Faster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves

Transcription

1 Faster F p -arithmetic for Cryptographic Pairings on Barreto-Naehrig Curves Junfeng Fan, Frederik Vercauteren and Ingrid Verbauwhede Katholieke Universiteit Leuven, COSIC May 18,

2 Outline What is pairing? Why pairing? Fast computation of pairing Barreto-Naehrig (BN) curves Fast multiplication in F p Hardware implementation Conclusion 2

3 Outline What is pairing? Why pairing? Fast computation of pairing Barreto-Naehrig (BN) curves Fast multiplication in Fp Hardware implementation Conclusion 3

4 Diffie-Hellman key exchange [DH78] a, p a, p Random x a x mod p Alice key = (a y ) x a y mod p Random y key = (ax ) y Bob Computational Diffie-Hellman Problem (CDHP) : Consider a cyclic group G and generator a, {a,, a x, a y } a xy Discrete Logarithm Problem (DLP) : Consider a cyclic group G and generator a, {a, a x } x 4

5 Elliptic Curve Cryptography [Mil85,Kob87] Q R Z= kp = P P k y 2 =x 3-13x-3 Q+R Elliptic Curve Diffie-Hellman (ECDH): Elliptic curve E : Consider an elliptic E: y 2 + curve a 1 xy + E aand 3 y = a xpoint 3 + a 2 P, x 2 + a 4 x + a 6 {P, xp, yp} (xy)p Elliptic Curve Discrete Logarithm Problem (DLP) : Consider an elliptic curve E and a point P, {P, kp} k 5

6 DH v.s. ECDH q = a x mod p Q = kr G 1024-bit prime p security Elliptic Curve E on F p 163-bit prime p Performance Payload Power 6

7 Bilinear Pairing Additive group G 1 Additive group G 2 φ: G 1 G 2 G T Multiplicative group G T Bilinear P G 1, Q G 2, then φ(ap,bq)= φ(p,q) ab. Non-degenerate P G 1 \0, Q G 2, such that φ(p,q) 1. Computable 7

8 Application One round Triparitite Diffie-Hellman [Joux00] Alice a φ(bp,cp) a ap bp Bob b φ(ap,cp) b cp Shared key: φ(p,p) abc Charlie c φ(ap,bp) c Bilinear Diffie-Hellman Problem (BDHP) : Given P, ap, bp and cp in group G, compute φ(p,p) abc {P, ap, bp, cp} φ(p,p) abc 8

9 Application Identity-based encryption [BF01] Identity-based signature [Lynn02] MOV attack on ECC [MOV93] 9

10 Outline What is pairing? Why pairing? Fast computation of pairing Barreto-Naehrig (BN) curves Fast multiplication in F p Hardware implementation Conclusion 10

11 Tate pairing Definition Finite field F p, Elliptic curve E(F p ). Let r #E(F k p ), let k be the embedding degree, namely r p -1. Let E(F p )[r] denote the r-torsion group. Define G 1 = E(F p )[r], G 2 = E(F p k)[r]/re(f p k) and G T =μμ r F p k. Tate pairing: e(p,q)=(f r, P (Q)) (pk -1)/r, P G 1 and Q G 2 G 1 = E(F p )[r] G 2 = E(F p k)[r]/re(f p k) DLP should be intractable φ: G 1 G in 2 G G 1, G T 2, G T G T = μ r F p k 11

12 Pairing-Friendly Curves [FST07] G 1 = E(F p )[r] G 2 = E(F p k)[r]/re(f p k) φ: G 1 G 2 G T G T = μ r F p k E(F p ) has large prime-order subgroup, namely, ρ= logp/logr is small. Embedding degree k is small. Security level (in bits) Subgroup size r (in bits) Extension field size q k (in bits) Embedding Degree k ρ 1 ρ ,

13 Barreto-Naehrig Curves E:y y 2 = x 3 + b over F p,where p(z) = 36z z z 2 + 6z + 1, r(z) = 36z z z 2 +6z+1 + 1, t(z) = 6z Some nice features: r = #E(F( p ) k = 12 13

14 Pairing computation Pairing ate pairing R-ate pairing Optimal pairing Miller s operation o [BMX04] F p 12 F p 6 F p 2 [Scott08] F p -arithmetic p [This talk] 14

15 Outline What is pairing? Why pairing? Fast computation of pairing Barreto-Naehrig (BN) curves Fast multiplication in F p Hardware implementation Conclusion 15

16 Modular multiplication Target: Compute ab mod p Existing methods Schoolbook Montgomery [Mon85] Barrett [Bar86] Chung-Hasan [CH07] 16

17 Schoolbook method Target: Compute ab mod p Step 1: c = ab Step 2: q = c/p Step 3: r = c - qp 17

18 Schoolbook method improved Choose p = 2 m Step 1: c = ab Step 2: r = c mod p = c mod 2 m Choose p = 2 m -1 Step 1: c = ab Step 2: q = c/p = c/2 m ± δ, δ 1 when m>1. Step 3: r = c - qp Choose p = 2 m -s, where s is small. Step 1: c = ab Step 2: q = c/p = c/2 m ± δ,, δ is small. Step 3: r = c - qp 18

19 Montgomery method The essential idea: c/p c/2 Given p < 2 m and a,b< p, output ab2 - m mod p. Precompute p = p = -p - 1 mod mod 2 m /2 m Step 1: c = ab c c μ Step 2: μ = c mod 2 m Step 3: q = μp mod 2 m Step 4: r = ( c+qp ) / 2 m Step 5: r = r-p if r>p + qp c+qp / 2 m = ab2 -m mod p μ- μ qp mod 2 m = ( μp mod 2 m ) p mod 2 m = μp p mod 2 m = - μ 19 0

20 Montgomery method The essential idea: c/p c/2 Given p < 2 m and a,b< p, output ab2 - m mod p. Precompute p = Step 1: c = ab p = -p - 1 mod Step 2: μ = c mod 2 m Step 3: q = μp mod 2 m Step 4: r = ( c+qp ) / 2 m Step 5: r = r-p if r>p mod 2 m /2 m m-bit multiplication m-bit multiplication m-bit multiplication 20

21 What special for BN Curves E:y y 2 = x 3 + b over F p,where p(z) = 36z z z 2 + 6z + 1, When choose z= 0x f2d, we generate a 256-bit prime p(z)= 0xB ECBF9E F C206F BF. Some observations on p: Not 2 m Not 2 m -s for small s However, p(z) has small coefficients p - 1 (z) = 324z 4-36z 3-12z 2 +6z-1 mod z 5 p - 1 (z) = 1 mod z 21

22 Montgomery multiplication In integer ring Given p, a and b,, output In polynomial ring Given p(z) = 36z z 3 + ab2 - m mod p. 24z 2 + 6z + 1, a(z) ) and b(z), Precompute p = -p - 1 mod 2 m Step 1: c = ab Step 2: μ = c mod 2 m Step 3: q = μp mod 2 m Step 4: r = ( c+qp ) / 2 m Step 5: r = r-p if r>p output a(z)b(z)z - 5 mod mod p(z). p (z) ( ) = 324z 4-36z 3-12z 2 +6z-1 Step 1: c(z) = a(z)b(z) Step 2: μ(z) = c(z) mod z 5 Step 3: q(z) = -p p (z)μ(z) mod z 5 Step 4: r(z) = (c(z)+ q(z)p(z)/ z 5 22

23 There is one problem Given p(z) = 36z z z 2 + 6z + 1, a(z) and b(z), Given output a(z)b(z)z - 5 mod mod p(z). p (z) = 324z 4-36z 3-12z 2 +6z-1 Step 1: c(z) = a(z)b(z) Step 2: μ(z) = c(z) mod z 5 Step 3: q(z) = -p p (z)μ(z) mod z 5 Step 4: r(z) = (c(z)+ μ(z)p(z)/ z 5 Choose z= z=137, Input a(z) = 35z z 3 + 7z 2 + 6z b(z) = 5z z z 2 + 9z + 5 Step 1: c(z) = 175z 175z z z z z z z z Step 2: μ(z) = 2068z 2068z z z z Step 3: Step 4: r(z) ( ) = 2243z z z z z 3 23

24 Coefficient reduction The result we got: r(z) = 2243z z z z , But we need r i <z r(z) = -28z z z z z + 12 Thus, division i i by z is needed. d 24

25 New parameters for BN Curves E:y y 2 = x 3 + b over F p,where p(z) = 36z z z 2 + 6z + 1, r(z) = 36z z z 2 +6z+1 + 1, t(z) = 6t We can choose z= 2 m +s s, where s is small and p(z) is prime r(z) is prime (sufficiently large) and for high performance t(z) is has low Hamming-Weight (ate pairing) r(z) is has low Hamming-Weight (Tate pairing) 25

26 An example (128-bit security) E:y y 2 = x 3 + b over F p,where p(z) = 36z z z 2 + 6z + 1, r(z) = 36z z z 2 +6z+1 + 1, t(z) = 6t When choose z= s s, where s= and p(z) is 258-bit prime r(z) is 258-bit prime HW(t(z)) = 20 HW(r(z)) = 71 26

27 Outline What is pairing? Why pairing? Fast computation of pairing Barreto-Naehrig (BN) curves Fast multiplication in F p Hardware implementation Conclusion 27

28 Multiplier c(z) = a(z)b i No carry Propagation! c(z) + q(z)p(z) Coefficient Reduction 28

29 Hardware implementation 29

30 Results & Comparison 30

31 Other F p? For any irreducible p(z) defined as p(z) = p n z n + p n-1 z n p 1 z+1, When p i, is integer, we have p - 1 (z) mod z n has integer coefficients, and p - 1 (z) = 1 mod z. 31

32 Conclusion A new method to perform in F p multiplication for BN-curves Montgomery multiplication in polynomial ring z=2 n +s, where s is small This algorithm works for all irreducible ibl p(z) ( ) if p(z) = p n z n + p n-1 z n p 1 z+1 32

33 Thanks! 33