An Algorithm for the T Pairing Calculation in Characteristic Three - - PowerPoint PPT Presentation

▶

an algorithm for the t pairing calculation in

An Algorithm for the T Pairing Calculation in Characteristic Three - - PowerPoint PPT Presentation

Apr 06, 2024 155 likes •582 views

An Algorithm for the T Pairing Calculation in Characteristic Three and its Hardware Implementation Jean-Luc Beuchat 1 Masaaki Shirase 2 Tsuyoshi Takagi 2 Eiji Okamoto 1 1 Graduate School of Systems and Information Engineering University of

slide-1

SLIDE 1

An Algorithm for the ηT Pairing Calculation in Characteristic Three and its Hardware Implementation

Jean-Luc Beuchat1 Masaaki Shirase2 Tsuyoshi Takagi2 Eiji Okamoto1

1Graduate School of Systems and Information Engineering

University of Tsukuba, Japan

2Future University-Hakodate, Japan Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 1 / 25

slide-2

SLIDE 2

Outline of the Talk

1

Example: Three-Party Key Agreement

2

Computation of the ηT Pairing

3

Hardware Architecture

4

Conclusion

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 2 / 25

slide-3

SLIDE 3

Example: Three-Party Key Agreement

Key agreement

How can Alice, Bob, and Chris agree upon a shared secret key?

Bob Chris Alice

?

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 3 / 25

slide-4

SLIDE 4

Example: Three-Party Key Agreement

Discrete logarithm problem (DLP)

G = P: additively-written group of order n DLP: given P, Q, find the integer x ∈ {0, . . . , n − 1} such that Q = xP

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 4 / 25

slide-5

SLIDE 5

Example: Three-Party Key Agreement

Discrete logarithm problem (DLP)

G = P: additively-written group of order n DLP: given P, Q, find the integer x ∈ {0, . . . , n − 1} such that Q = xP

Diffie-Hellman problem (DHP)

Given P, aP, and bP, find abP.

Alice Bob

a b aP bP

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 4 / 25

slide-6

SLIDE 6

Example: Three-Party Key Agreement

Discrete logarithm problem (DLP)

G = P: additively-written group of order n DLP: given P, Q, find the integer x ∈ {0, . . . , n − 1} such that Q = xP

Diffie-Hellman problem (DHP)

Given P, aP, and bP, find abP.

Alice Bob

a b aP bP bP aP

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 4 / 25

slide-7

SLIDE 7

Example: Three-Party Key Agreement

Discrete logarithm problem (DLP)

G = P: additively-written group of order n DLP: given P, Q, find the integer x ∈ {0, . . . , n − 1} such that Q = xP

Diffie-Hellman problem (DHP)

Given P, aP, and bP, find abP.

Alice Bob

a b abP abP

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 4 / 25

slide-8

SLIDE 8

Example: Three-Party Key Agreement

Alice Chris Bob

aP bP cP a b c

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 5 / 25

slide-9

SLIDE 9

Example: Three-Party Key Agreement

First round

Alice Chris Bob

aP aP bP bP cP cP a b c

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 5 / 25

slide-10

SLIDE 10

Example: Three-Party Key Agreement

a

Alice Chris Bob

abP bcP acP b c

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 5 / 25

slide-11

SLIDE 11

Example: Three-Party Key Agreement

Second round

Alice Chris Bob

abP bcP acP abP acP bcP b c a

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 5 / 25

slide-12

SLIDE 12

Example: Three-Party Key Agreement

c abcP

Alice Bob Chris

abcP abcP a b

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 5 / 25

slide-13

SLIDE 13

Example: Three-Party Key Agreement

Three-party two-round key agreement protocol

Does a three-party one-round key agreement protocol exist?

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 6 / 25

slide-14

SLIDE 14

Example: Three-Party Key Agreement

Bilinear pairing

G1 = P: additively-written group G2: multiplicatively-written group with identity 1 A bilinear pairing on (G1, G2) is a map ˆ e : G1 × G1 → G2 that satisfies the following conditions:

1

Bilinearity. For all Q, R, S ∈ G1,

ˆ e(Q + R, S) = ˆ e(Q, S)ˆ e(R, S) and ˆ e(Q, R + S) = ˆ e(Q, R)ˆ e(Q, S).

2

Non-degeneracy. ˆ e(P, P) = 1.

3

Computability. ˆ

e can be efficiently computed.

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 7 / 25

slide-15

SLIDE 15

Example: Three-Party Key Agreement

Bilinear Diffie-Hellman problem (BDHP)

Given P, aP, bP, and cP, compute ˆ e(P, P)abc Assumption: the BDHP is difficult

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 8 / 25

slide-16

SLIDE 16

Example: Three-Party Key Agreement

Alice Chris Bob

aP bP cP a b c

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 9 / 25

slide-17

SLIDE 17

Example: Three-Party Key Agreement

Bob

aP bP cP bP aP cP aP cP bP a b c

Alice Chris

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 9 / 25

slide-18

SLIDE 18

Example: Three-Party Key Agreement

ˆ e(aP, bP)c a c b ˆ e(bP, cP)a ˆ e(aP, cP)b ˆ e(bP, cP)a = ˆ e(aP, cP)b = ˆ e(aP, bP)c = ˆ e(P, P)abc

Alice Chris Bob

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 9 / 25

slide-19

SLIDE 19

Example: Three-Party Key Agreement

Examples of cryptographic bilinear maps

Weil pairing Tate pairing ηT pairing (Barreto et al.) Ate pairing (Hess et al.)

Applications

Identity based encryption Short signature

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 10 / 25

slide-20

SLIDE 20

Computation of the ηT Pairing

Q Elliptic curve over F3m P = (xp, yp) Q = (xq, yq) (F36m) P Exponentiation ηT pairing calculation ηT(P, Q) ηT(P, Q)W ∈ F36m

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 11 / 25

slide-21

SLIDE 21

Computation of the ηT Pairing – Tower Field

F32m = F3m[σ]/(σ2 + 1)

1 x x2 xm−1 xm−2 xm−3

F36m = F32m[ρ]/(ρ3 − ρ − 1)

1 σ ρ2 1

F3 = Z/3Z = {0, 1, 2} F3m = F3[x]/(f (x))

ρ

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 12 / 25

slide-22

SLIDE 22

Computation of the ηT Pairing – Tower Field

xm−3 xm−2 xm−1 x2 x 1

F3m

ρ σρ 1 σ σρ2 ρ2

F32m F32m F32m 2 bits 2m bits 12m bits F3 F36m

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 13 / 25

slide-23

SLIDE 23

Computation of the ηT Pairing

ηT(P, Q)

Addition Multiplication Cubing Cube root

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 14 / 25

slide-24

SLIDE 24

Computation of the ηT Pairing

ηT(P, Q)

Addition Multiplication Cubing Cube root

ηT(P, Q)3

m+1 2

Addition Multiplication Cubing

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 14 / 25

slide-25

SLIDE 25

Computation of the ηT Pairing

ηT(P, Q)

Addition Multiplication Cubing Cube root

ηT(P, Q)3

m+1 2

Addition Multiplication Cubing

Bilinearity of ηT(P, Q)W

ηT (P, Q)W =

3m

ηT
3

m−1 2

P, Q

3

m+1 2 W Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 14 / 25

slide-26

SLIDE 26

Computation of the ηT Pairing

Multiplication over F36m – Exponentiation

Only one multiplication Operands: A and B ∈ F36m Cost: 18 multiplications and 58 additions over F3m

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 15 / 25

slide-27

SLIDE 27

Computation of the ηT Pairing

Multiplication over F36m – Exponentiation

Only one multiplication Operands: A and B ∈ F36m Cost: 18 multiplications and 58 additions over F3m

Multiplication over F36m – ηT(P, Q)

m+1 2

multiplications Operands: A and B ∈ F36m with

σ ρ σρ ρ2 σρ2 A = a0, a1, and a2 ∈ F3m 1 a0 a1 a2 −1

Cost: 13 multiplications and 46 additions over F3m

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 15 / 25

slide-28

SLIDE 28

Hardware Architecture

ηT(P, Q)W calculation ηT pairing ηT(P, Q) P = (xp, yp) Q = (xq, yq) Exponentiation

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 16 / 25

slide-29

SLIDE 29

Hardware Architecture

ηT(P, Q)W calculation ηT pairing ηT(P, Q) P = (xp, yp) Q = (xq, yq) Exponentiation

Multiplication over F36m

New algorithm

◮ 15 multiplications and 29 additions over F3m ◮ Allows one to share operands between multipliers (less registers)

Architecture

◮ 9 multipliers ◮ Most significant coefficient first (Horner’s rule) Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 16 / 25

slide-30

SLIDE 30

Hardware Architecture

Prototype

Field: F397 = F3[x]/(x97 + x12 + 2) FPGA: Cyclone II EP2C35 (Altera)

ηT(P, Q)

Arithmetic over F397

◮ 9 multipliers ◮ 2 adders ◮ 1 cubing unit

Area: 14895 LEs Frequency: 149 MHz Computation time: 33 µs

Exponentiation (Waifi 2007)

Unified operator Area: 2787 LEs Frequency: 159 MHz Computation time: 26 µs

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 17 / 25

slide-31

SLIDE 31

Hardware Architecture

Comparisons

Architecture Area Calculation FPGA time Our solution 18000 LEs 33 µs Cyclone II Grabher and Page (CHES 2005) 4481 slices 432 µs Virtex-II Pro Kerins et al. (CHES 2005) 55616 slices 850 µs Virtex-II Pro Ronan et al. (ITNG 2007) 10000 slices 178 µs Virtex-II Pro Beuchat et al. (CHES 2007) 1888 slices 222 µs Virtex-II Pro

(1 slice ≈ 2 LEs)

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 18 / 25

slide-32

SLIDE 32

Conclusion

Future work

Automatic generation of the control unit Application (e.g. short signature) Genus 2 Side-channel

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 19 / 25

slide-33

SLIDE 33

Appendix

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 20 / 25

slide-34

SLIDE 34

Multiplication over F36m – ηT(P, Q)

A · (−r2

0 + ypyqσ − r0ρ − ρ2) = c0 + c1σ + c2ρ + c3σρ + c4ρ2 + c5σρ2

c0 c1σ c2ρ c3σρ c4ρ2 c5σρ2 −a4r0 −a5r0 −a0r0 −a1r0 −a2r0 −a3r0 −a2 −a3 −a4 −a5 −a0 −a1 −a2 −a3 −a4 −a5 −a4r0 −a5r0 −a0r 2 a0ypyq −a2r 2 a2ypyq −a4r 2 a4ypyq −a1ypyq −a1r 2 −a3ypyq −a3r 2 −a5ypyq −a5r 2

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 21 / 25

slide-35

SLIDE 35

Multiplication over F36m – ηT(P, Q)

A · (−r2

0 + ypyqσ − r0ρ − ρ2) = c0 + c1σ + c2ρ + c3σρ + c4ρ2 + c5σρ2

c0 c1σ c2ρ c3σρ c4ρ2 c5σρ2 −a4r0 −a5r0 −a0r0 −a1r0 −a2r0 −a3r0 −a2 −a3 −a4 −a5 −a0 −a1 −a2 −a3 −a4 −a5 −a4r0 −a5r0 −a0r 2 a0ypyq −a2r 2 a2ypyq −a4r 2 a4ypyq −a1ypyq −a1r 2 −a3ypyq −a3r 2 −a5ypyq −a5r 2

1 Compute in parallel r2

0 , ypyq, a0r0, a1r0, a2r0, a3r0, a4r0, and a5r0 (8

multiplications)

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 21 / 25

slide-36

SLIDE 36

Multiplication over F36m – ηT(P, Q)

A · (−r2

0 + ypyqσ − r0ρ − ρ2) = c0 + c1σ + c2ρ + c3σρ + c4ρ2 + c5σρ2

c0 c1σ c2ρ c3σρ c4ρ2 c5σρ2 −a4r0 −a5r0 −a0r0 −a1r0 −a2r0 −a3r0 −a2 −a3 −a4 −a5 −a0 −a1 −a2 −a3 −a4 −a5 −a4r0 −a5r0 −a0r 2 a0ypyq −a2r 2 a2ypyq −a4r 2 a4ypyq −a1ypyq −a1r 2 −a3ypyq −a3r 2 −a5ypyq −a5r 2

1 Compute in parallel r2

0 , ypyq, a0r0, a1r0, a2r0, a3r0, a4r0, and a5r0 (8

multiplications)

2 Apply Karatsuba’s algorithm to compute the remaining products by

means of 9 multipliers

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 21 / 25

slide-37

SLIDE 37

Multiplication over F36m – ηT(P, Q)

A · (−r2

0 + ypyqσ − r0ρ − ρ2) = c0 + c1σ + c2ρ + c3σρ + c4ρ2 + c5σρ2

−a0r2 a0ypyq −a2r2 a2ypyq −a4r2 a4ypyq −a1ypyq −a1r2 −a3ypyq −a3r2 −a5ypyq −a5r2 Karatsuba’s algorithm (9 multiplications performed in parallel): a0ypyq − a1r2

0 = (a0 + a1)×(ypyq − r2 0 ) + a0×r2 0 − a1×ypyq

a2ypyq − a3r2

0 = (a2 + a3)×(ypyq − r2 0 ) + a2×r2 0 − a3×ypyq

a4ypyq − a5r2

0 = (a4 + a5)×(ypyq − r2 0 ) + a4×r2 0 − a5×ypyq

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 22 / 25

slide-38

SLIDE 38

Multiplication over F36m – ηT(P, Q)

M0 M1 M2 a0r0 a2r0 a4r0 a0r2 a2r2 a4r2 Three multipliers Common operand: r0 or r2

Synchronous reset D0 c2 c10 c1 00 c0 01 c4 10 c3 11 D1 Load Load Load Load c8 Shift c6 c7 c5 Clear Load Load Clear Select P c9

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 23 / 25

slide-39

SLIDE 39

Multiplication over F36m – ηT(P, Q)

M3 M4 M5 a1r0 a3r0 a5r0 a1ypyq a3ypyq a5ypyq Three multipliers Common operand: r0 or ypyq

Synchronous reset D0 c2 c10 c1 00 c0 01 c4 10 c3 11 D1 Load Load Load Load c8 Shift c6 c7 c5 Clear Load Load Clear Select P c9

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 23 / 25

slide-40

SLIDE 40

Multiplication over F36m – ηT(P, Q)

M6 M7 M8 r 2 ypyq – (a0 + a1)× (a2 + a3)× (a4 + a5)× (ypyq − r 2

0 )

(ypyq − r 2

0 )

(ypyq − r 2

0 )

1 1 c5 Load c7 Load c6 01 c9 Shift c12 c11 Select c10 Load Load Clear c3 c4 c2 c1 00 Select c0 11 Load Clear 10 Synchronous reset P D0 D1 Load Load c8

Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 24 / 25

slide-41

SLIDE 41

A Coprocessor for the ηT Pairing Computation

1 Mux0 d1 Ctrl Ctrl 1 D0 Ctrl D1

pe_mult_block_t1_generic

Ctrl D1 Q D0 Q

pe_mult_block_t1_generic pe_mult_block_t2_generic

D0 Ctrl D1 Q D0 D2 D1

pe_add

S Mux1 1 D C

pe_cubing

Mux2 Ctrl RAM Qa Qb d0 Jean-Luc Beuchat (University of Tsukuba) ηT Pairing in Characteristic Three Arith 18 25 / 25