Arithmetic Operators for Pairing-Based Cryptography Jean-Luc Beuchat - PowerPoint PPT Presentation

Arithmetic Operators for Pairing-Based Cryptography Jean-Luc Beuchat Laboratory of Cryptography and Information Security Graduate School of Systems and Information Engineering University of Tsukuba 1-1-1 Tennodai, Tsukuba Ibaraki, 305-8573, Japan mailto:beuchat@risk.tsukuba.ac.jp e J. Monnet, Saint-´ Joint work with Nicolas Brisebarre (Universit´ Etienne, France), J´ er´ emie Detrey (ENS Lyon, France), Eiji Okamoto (University of Tsukuba, Japan), Masaaki Shirase (Future University, Hakodate, Japan), and Tsuyoshi Takagi (Future University, Hakodate, Japan) Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 1 / 38

Outline of the Talk Example: Three-Party Key Agreement 1 Computation of the η T Pairing 2 A Coprocessor for the η T Pairing Computation 3 A Coprocessor for the Final Exponentiation 4 A Coprocessor for the Full Pairing Computation 5 Conclusion 6 Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 2 / 38

Example: Three-Party Key Agreement Key agreement How can Alice, Bob, and Chris agree upon a shared secret key? Alice Bob ? Chris Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 3 / 38

Example: Three-Party Key Agreement Discrete logarithm problem (DLP) G = � P � : additively-written group of order n DLP: given P , Q , find the integer x ∈ { 0 , . . . , n − 1 } such that Q = xP Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 4 / 38

Example: Three-Party Key Agreement Discrete logarithm problem (DLP) G = � P � : additively-written group of order n DLP: given P , Q , find the integer x ∈ { 0 , . . . , n − 1 } such that Q = xP Diffie-Hellman problem (DHP) Given P , aP , and bP , find abP . Alice Bob a b aP bP Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 4 / 38

Example: Three-Party Key Agreement Discrete logarithm problem (DLP) G = � P � : additively-written group of order n DLP: given P , Q , find the integer x ∈ { 0 , . . . , n − 1 } such that Q = xP Diffie-Hellman problem (DHP) Given P , aP , and bP , find abP . Alice aP Bob a b aP bP bP Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 4 / 38

Example: Three-Party Key Agreement Discrete logarithm problem (DLP) G = � P � : additively-written group of order n DLP: given P , Q , find the integer x ∈ { 0 , . . . , n − 1 } such that Q = xP Diffie-Hellman problem (DHP) Given P , aP , and bP , find abP . Alice Bob a b abP abP Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 4 / 38

Example: Three-Party Key Agreement Alice Bob a b aP bP Chris c cP Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 5 / 38

Example: Three-Party Key Agreement Alice Bob a b aP bP bP First round aP cP Chris c cP Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 5 / 38

Example: Three-Party Key Agreement Alice Bob a b abP acP Chris c bcP Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 5 / 38

Example: Three-Party Key Agreement Alice Bob a b abP acP acP Second round abP bcP Chris c bcP Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 5 / 38

Example: Three-Party Key Agreement Alice Bob a b abcP abcP Chris c abcP Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 5 / 38

Example: Three-Party Key Agreement Three-party two-round key agreement protocol Does a three-party one-round key agreement protocol exist? Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 6 / 38

Example: Three-Party Key Agreement Bilinear pairing G 1 = � P � : additively-written group G 2 : multiplicatively-written group with identity 1 A bilinear pairing on ( G 1 , G 2 ) is a map ˆ e : G 1 × G 1 → G 2 that satisfies the following conditions: Bilinearity. For all Q , R , S ∈ G 1 , 1 ˆ e ( Q + R , S ) = ˆ e ( Q , S )ˆ e ( R , S ) and ˆ e ( Q , R + S ) = ˆ e ( Q , R )ˆ e ( Q , S ). Non-degeneracy. ˆ e ( P , P ) � = 1. 2 Computability. ˆ e can be efficiently computed. 3 Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 7 / 38

Example: Three-Party Key Agreement Bilinear Diffie-Hellman problem (BDHP) e ( P , P ) abc Given P , aP , bP , and cP , compute ˆ Assumption: the BDHP is difficult Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 8 / 38

Example: Three-Party Key Agreement Alice Bob a b aP bP Chris c cP Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 9 / 38

Example: Three-Party Key Agreement bP Alice Bob a b aP bP aP aP cP bP cP Chris c cP Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 9 / 38

Example: Three-Party Key Agreement Alice Bob a b ˆ e ( bP , cP ) a e ( aP , cP ) b ˆ e ( bP , cP ) a = ˆ e ( aP , cP ) b = ˆ e ( aP , bP ) c = ˆ e ( P , P ) abc ˆ Chris c e ( aP , bP ) c ˆ Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 9 / 38

Example: Three-Party Key Agreement Examples of cryptographic bilinear maps Weil pairing Tate pairing η T pairing (Barreto et al. ) Ate pairing (Hess et al. ) Applications Identity based encryption Short signature Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 10 / 38

Computation of the η T Pairing Elliptic curve over F 3 m Q = ( x q , y q ) P = ( x p , y p ) P η T pairing η T ( P , Q ) η T ( P , Q ) W ∈ F 3 6 m Exponentiation calculation ( F 3 6 m ) Q Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 11 / 38

Computation of the η T Pairing – Tower Field ρ 2 1 ρ F 3 6 m = F 3 2 m [ ρ ] / ( ρ 3 − ρ − 1) 1 σ F 3 2 m = F 3 m [ σ ] / ( σ 2 + 1) x 2 x m − 3 x m − 2 x m − 1 1 x F 3 m = F 3 [ x ] / ( f ( x )) F 3 = Z / 3 Z = { 0, 1, 2 } Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 12 / 38

Computation of the η T Pairing – Tower Field F 3 2 m F 3 2 m F 3 2 m ρ 2 σρ 2 1 σ ρ σρ 12 m bits F 3 6 m x m − 3 x m − 2 x m − 1 x 2 1 x 2 m bits F 3 m 2 bits F 3 Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 13 / 38

Computation of the η T Pairing m +1 η T ( P , Q ) 3 2 η T ( P , Q ) (Arith 18) Addition Addition Multiplication Multiplication Cubing Cubing Cube root Bilinearity of η T ( P , Q ) W � 2 � W m +1 � � � 3 η T ( P , Q ) W = 3 m � �� m − 1 � η T 3 P , Q � 2 Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 14 / 38

Computation of the η T Pairing Multiplication over F 3 6 m – η T ( P , Q ) m +1 multiplications 2 Operands: A and B ∈ F 3 6 m with ρ 2 σρ 2 1 σ ρ σρ − r 2 B = y p y q − r 0 0 − 1 0 0 r 0 , y p , and y q ∈ F 3 m Cost: 13 multiplications and 46 additions over F 3 m Multiplication over F 3 6 m – Exponentiation Only one multiplication Operands: A and B ∈ F 3 6 m Cost: 18 multiplications and 58 additions over F 3 m Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 15 / 38

A Coprocessor for the η T Pairing Computation P = ( x p , y p ) η T ( P , Q ) Exponentiation η T ( P , Q ) W η T pairing Q = ( x q , y q ) (Waifi 2007) calculation (Arith 18) Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 16 / 38

A Coprocessor for the η T Pairing Computation P = ( x p , y p ) η T ( P , Q ) Exponentiation η T ( P , Q ) W η T pairing Q = ( x q , y q ) (Waifi 2007) calculation (Arith 18) Computation of η T ( P , Q ): multiplication over F 3 6 m New algorithm ◮ 15 multiplications and 29 additions over F 3 m ◮ Allows one to share operands between multipliers (less registers) Architecture ◮ 9 multipliers ◮ Most significant coefficient first (Horner’s rule) Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 16 / 38

A Coprocessor for the η T Pairing Computation Prototype Field: F 3 97 = F 3 [ x ] / ( x 97 + x 12 + 2) FPGA: Cyclone II EP2C35 (Altera) Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 17 / 38

A Coprocessor for the η T Pairing Computation Prototype Field: F 3 97 = F 3 [ x ] / ( x 97 + x 12 + 2) FPGA: Cyclone II EP2C35 (Altera) η T ( P , Q ) (Arith 18) Arithmetic over F 3 97 ◮ 9 multipliers ◮ 2 adders ◮ 1 cubing unit Area: 14895 LEs Frequency: 149 MHz Computation time: 33 µ s Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 17 / 38

A Coprocessor for the η T Pairing Computation Prototype Field: F 3 97 = F 3 [ x ] / ( x 97 + x 12 + 2) FPGA: Cyclone II EP2C35 (Altera) η T ( P , Q ) (Arith 18) Exponentiation (Waifi 2007) Arithmetic over F 3 97 Challenge ◮ 9 multipliers Raise η T ( P , Q ) to the W power ◮ 2 adders in 33 µ s (or less) ◮ 1 cubing unit with the smallest amount of Area: 14895 LEs hardware Frequency: 149 MHz Computation time: 33 µ s Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 17 / 38

A Coprocessor for the η T Pairing Computation Why FPGAs? Prototyping Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 18 / 38

A Coprocessor for the η T Pairing Computation Why FPGAs? Prototyping Short time to market Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 18 / 38

A Coprocessor for the η T Pairing Computation Why FPGAs? Prototyping Short time to market Small series Jean-Luc Beuchat (LCIS) η T Pairing in Characteristic Three 18 / 38