Ate Pairing on Hyperelliptic Curves

Transcription

1 Ate Pairing on Hyperelliptic Curves R. Granger, F. Hess, R. Oyono, N. Thériault F. Vercauteren EUROCRYPT Barcelona

2 Pairings

3 Pairings Let G 1, G 2, G T be groups of prime order l. A pairing is a non-degenerate bilinear map e : G 1 G 2 G T. Bilinearity: e(g1 + g 2, h) = e(g 1, h)e(g 2, h), e(g, h1 + h 2 ) = e(g, h 1 )e(g, h 2 ). Non-degenerate: for all g 1: x G2 such that e(g, x) 1 for all h 1: x G1 such that e(x, h) 1 Examples: Scalar product on euclidean space, : R n R n R. Weil- and s on elliptic curves and abelian varieties.

4 Pairings in cryptography Exploit bilinearity: original schemes G 1 = G 2 MOV: DLP reduction from G1 to G T DLP ing 1 : (g, xg) DLP in G T : (e(g, g), e(g, g) x ) Decision DH easy in G1 DDH : (g, ag, bg, cg) test if e(g, cg) = e(ag, bg) Identity based crypto, short signatures,... (Too?) many new hardness assumptions and applications

5 This paper New pairing on hyperelliptic curves called ate pairing Generalises and unifies previous work by: BGOS05: eta pairing on supersingular curves HSV06: ate pairing on elliptic curves What s in a name? ate = Tate - T ate = reverse(eta) Spelling: ate and not Ate (please manually correct)

6 Let E be an elliptic curve over a finite field F q, i.e. E : y 2 = x 3 + ax + b for p > 5 Point sets E(F q k ) define an abelian group by Chord-tangent method Point at infinity E(Fq ) is neutral element. Hasse-Weil: number of points in E(F q ) is q + 1 t with t 2 q

7 Torsion subgroups E[l] subgroup of points of order dividing l, i.e. E[l] = {P E(F q ) lp = } Structure of E[l] for gcd(l, q) = 1 is Z/lZ Z/lZ. Let l #E(F q ), then E(F q )[l] gives at least one component. Embedding degree: k minimal with l (q k 1). Note l-roots of unity µ l F. q k If k > 1 then E(F q k )[l] = E[l].

8 Frobenius endomorphism Frobenius: ϕ : E E : (x, y) (x q, y q ) Characteristic polynomial: ϕ 2 [t] ϕ + [q] = 0 Eigenvalues on E[l]: 1 and q since l #E(F q ) For k > 1 have q 1 mod l, thus decomposition of E[l] into Frobenius eigenspaces: E[l] = E(F q k )[l] = P Q with ϕ(p) = P and ϕ(q) = qq Notation used before: G 1 = P and G 2 = Q

9 Functions and divisors Consider the function f = (x 1)2 (x+2) x on P Divisor of f : (f ) = 2(P 1 ) + (P 2 ) (P 0 ) 2(P ) Support of (f ): Supp((f )) = {P 1, P 2, P 0, P } Given divisor (f ), function is determined up to constant.

10 Miller functions Let P E(F q ) and n N. A Miller function f n,p is any function in F q (E) with divisor (f n,p ) = n(p) ([n]p) (n 1)( ) f n,p is determined up to a constant c F q. f n,p has a zero at P of order n. f n,p has a pole at [n]p of order 1. f n,p has a pole at of order (n 1). For every point Q P, [n]p,, we have f n,p (Q) F q.

11 Let P E(F q k )[l] and f l,p F q k (E) with (f l,p ) = l(p) l( ) Note: f l,p has zero of order l at P and pole of order l at. is defined as (assuming normalisation) P, Q l = f l,p (Q) Technical stuff: need to adjust domain and image, l : E(F q k )[l] E(F q k )/le(f q k ) F q k /(F q k ) l Reduced : e(p, Q) = P, Q (qk 1)/l l

12 Computing Miller s algorithm: double-add algorithm using bits of l Loop length for Tate is log 2 (l) Many optimisations when restricting domain to G 1 G 2 BUT: still defined on the whole of E[l] E/lE GOAL: construct efficient pairing only defined on G 1 G 2?

13 Like Tate, but evaluating smaller Miller function f s,p Recall E/F q with #E(F q ) = q + 1 t and l #E(F q ) Define T = t 1, then T q mod l Pairing Zoo Pairing Domain Where Who s Red Tate E[l] E/lE All HECs Miller l No eta G 1 G 2 SuSi BGOS T No ate EC G 2 G 1 All ECs HSV T No ate HEC G 2 G 1 All HECs GHOTV q Yes

14 Elliptic ate pairing Theorem: Let T = t 1 and T k 1. Then a(, ) : G 2 G 1 F q k /(F q k ) l : (Q, P) f T,Q (P) is a pairing, called the elliptic ate pairing Loop length is now log 2 (T ), but first argument over F q k Need final powering by (q k 1)/l to map into µ l, i.e. reduced ate pairing In general T q, but could be as small as l 1/ϕ(k) Need to use twists to make ate faster than Tate

15 Extreme elliptic ate Smallest non-degenerate ate pairing for T = 2, i.e. t = 3. Pairing now becomes extremely simple: ( y(p) λ(q)x(p) µ(q) (Q, P) x(p) x(2q) with y = λ(q)x + µ(q) tangent line at Q ) (q k 1)/l Recall t can only be as small as l 1/ϕ(k) so k has to be large Example: k = 197, p 374-bit, l 185-bit, D = 59 r = p =

16 Hyperelliptic ate pairing Take C/F q hyperelliptic curve and l #J C (F q ) Let G 1 = J C [l] Ker(ϕ [1]) and G 2 = J C [l] Ker(ϕ [q]) then a(, ) : G 2 G 1 µ l : (D 2, D 1 ) f q,d2 (D 1 ) defines a non-degenerate, bilinear pairing called the hyperelliptic ate pairing No need for final powering, maps directly into µ l

17 Pairing inversion in polynomial time R.I.P.> 1000 papers

18 Pairing inversion in polynomial time?

19 Pairing inversion (see GHV) Most pairings can be written as (P, Q) f s,p (Q) d with d is the final exponentiation (FE) E.g. Tate : s = l and d = (q k 1)/l Miller inversion (MI): invert f s,p ( ) Tate: security in MI, FE does not add security! Ate: families where MI is polynomial time only security totally in FE! BUT: does not imply weakness if used correctly...

20 Conclusion New pairing with domain two eigenspaces of Frobenius Pairing reduced by itself, so no final exponentiation Efficiency not so good, except if twists are available Elliptic ate with D = 3 remains best pairing to use Applications to pairing inversion (see GHV)