researchmap

researchmap

researchmap

researchmap

researchmap

記述言語：英語   出版者・発行元：Institute of Electronics, Information and Communication, Engineers, IEICE  

A pseudorandom number generator is widely used in cryptography. A cryptographic pseudorandom number generator is required to generate pseudorandom numbers which have good statistical properties as well as unpredictability. An m-sequence is a linear feedback shift register sequence with maximal period over a finite field. M-sequences have good statistical properties, however we must nonlinearize m-sequences for cryptographic purposes. A geometric sequence is a binary sequence given by applying a nonlinear feedforward function to an m-sequence. Nogami, Tada and Uehara proposed a geometric sequence whose nonlinear feedforward function is given by the Legendre symbol. They showed the geometric sequences have good properties for the period, periodic autocorrelation and linear complexity. However, the geometric sequences do not have the balance property. In this paper, we introduce geometric sequences of two types and show some properties of interleaved sequences of the geometric sequences of two types. These interleaved sequences have the balance property and double the period of the geometric sequences by the interleaved structure. Moreover, we show correlation properties and linear complexity of the interleaved sequences. A key of our observation is that the second type geometric sequence is the complement of the left shift of the first type geometric sequence by half-period positions.

DOI： 10.1587/transfun.E100.A.2720

Scopus

researchmap

記述言語：英語   出版者・発行元：Institute of Electronics, Information and Communication, Engineers, IEICE  

Pseudorandom number generators have been widely used in Monte Carlo methods, communication systems, cryptography and so on. For cryptographic applications, pseudorandom number generators are required to generate sequences which have good statistical properties, long period and unpredictability. ADickson generator is a nonlinear congruential generator whose recurrence function is the Dickson polynomial. Aly and Winterhof obtained a lower bound on the linear complexity profile of a Dickson generator. Moreover Vasiga and Shallit studied the state diagram given by the Dickson polynomial of degree two. However, they do not specify sets of initial values which generate a long period sequence. In this paper, we show conditions for parameters and initial values to generate long period sequences, and asymptotic properties for periods by numerical experiments. We specify sets of initial values which generate a long period sequence. For suitable parameters, every element of this set occurs exactly once as a component of generating sequence in one period. In order to obtain sets of initial values, we consider a logistic generator proposed by Miyazaki, Araki, Uehara and Nogami, which is obtained from a Dickson generator of degree two with a linear transformation. Moreover, we remark on the linear complexity profile of the logistic generator. The sets of initial values are described by values of the Legendre symbol. The main idea is to introduce a structure of a hyperbola to the sets of initial values. Our results ensure that generating sequences of Dickson generator of degree two have long period. As a consequence, the Dickson generator of degree two has some good properties for cryptographic applications.

DOI： 10.1587/transfun.E100.A.1816

Scopus

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

This paper proposes a new approach for generating pseudo random multi-valued (including binary-valued) sequences. The approach uses a primitive polynomial over an odd characteristic prime field F-p, where p is an odd prime number. Then, for the maximum length sequence of vectors generated by the primitive polynomial, the trace function is used for mapping these vectors to scalars as elements in the prime field. Power residue symbol (Legendre symbol in binary case) is applied to translate the scalars to k-value scalars, where k is a prime factor of p-1. Finally, a pseudo random k-value sequence is obtained. Some important properties of the resulting multi-valued sequences are shown, such as their period, autocorrelation, and linear complexity together with their proofs and small examples.

DOI： 10.1587/transfun.E100.A.922

Web of Science

researchmap

DOI： 10.1587/transfun.E100.A.1838

researchmap

DOI： 10.6109/jicce.2017.15.2.97

researchmap

記述言語：英語   出版者・発行元：WILEY-HINDAWI  

In this paper, we show efficient implementations of binary field multiplication over ARMv8. We exploit an advanced 64-bit polynomial multiplication (PMULL) supported by ARMv8 and conduct multiple levels of asymptotically faster Karatsuba multiplication for polynomial multiplication. Finally, our method completed binary field multiplication within 57 and 153 clock cycles for B-251 and B-571 cases, respectively. Proposed method improves the speed-performance by a factor of 4.5 times than previous techniques on same target platform. Copyright (c) 2016 John Wiley & Sons, Ltd.

DOI： 10.1002/sec.1462

Web of Science

researchmap

記述言語：英語   出版者・発行元：ASSOC COMPUTING MACHINERY  

In this article, we present a hybrid method to improve the performance of the Montgomery reduction by taking advantage of the Karatsuba technique. We divide the Montgomery reduction into two sub-parts, including one for the conventional Montgomery reduction and the other one for Karatsuba-aided multiplication. This approach reduces the multiplication complexity of n-limb Montgomery reduction from theta(n(2) + n) to asymptotic complexity theta(7n(2)/8 + n). Our practical implementation results over an 8-bit microcontroller also show performance enhancements by 11%.

DOI： 10.1145/2890502

Web of Science

researchmap

記述言語：英語   出版者・発行元：ASSOC COMPUTING MACHINERY  

In this article, we present a hybrid method to improve the performance of the Montgomery reduction by taking advantage of the Karatsuba technique. We divide the Montgomery reduction into two sub-parts, including one for the conventional Montgomery reduction and the other one for Karatsuba-aided multiplication. This approach reduces the multiplication complexity of n-limb Montgomery reduction from theta(n(2) + n) to asymptotic complexity theta(7n(2)/8 + n). Our practical implementation results over an 8-bit microcontroller also show performance enhancements by 11%.

DOI： 10.1145/2890502

Web of Science

researchmap

記述言語：英語   出版者・発行元：ASSOC COMPUTING MACHINERY  

In this article, we present a hybrid method to improve the performance of the Montgomery reduction by taking advantage of the Karatsuba technique. We divide the Montgomery reduction into two sub-parts, including one for the conventional Montgomery reduction and the other one for Karatsuba-aided multiplication. This approach reduces the multiplication complexity of n-limb Montgomery reduction from theta(n(2) + n) to asymptotic complexity theta(7n(2)/8 + n). Our practical implementation results over an 8-bit microcontroller also show performance enhancements by 11%.

DOI： 10.1145/2890502

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

Pairing-based cryptography has realized a lot of innovative cryptographic applications such as attribute-based cryptography and semi homomorphic encryption. Pairing is a bilinear map constructed on a torsion group structure that is defined on a special class of elliptic curves, namely pairing-friendly curve. Pairing-friendly curves are roughly classified into supersingular and non supersingular curves. In these years, non supersingular pairing-friendly curves have been focused on from a security reason. Although non supersingular pairing-friendly curves have an ability to bridge various security levels with various parameter settings, most of software and hardware implementations tightly restrict them to achieve calculation efficiencies and avoid implementation difficulties. This paper shows an FPGA implementation that supports various parameter settings of pairings on non supersingular pairing-friendly curves for which Montgomery reduction, cyclic vector multiplication algorithm, projective coordinates, and Tate pairing have been combinatorially applied. Then, some experimental results with resource usages are shown.

DOI： 10.1587/transinf.2015ICP0018

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

This paper addresses the problem of job scheduling in volunteer computing (VC) systems where each computation job is replicated and allocated to multiple participants (workers) to remove incorrect results by a votingmechanism. In the job scheduling of VC, the number of workers to complete a job is an important factor for the system performance; however, it cannot be fixed because some of the workers may secede in real VC. This is the problem that existing methods have not considered in the job scheduling. We propose a dynamic job scheduling method which considers the expected probability of completion (EPC) for each job based on the probability of worker's secession. The key idea of the proposed method is to allocate jobs so that EPC is always greater than a specified value (SPC). By setting SPC as a reasonable value, the proposed method enables to complete jobs without excess allocation, which leads to the higher performance of VC systems. We assume in this paper that worker's secession probability follows Weibull-distribution which is known to reflect more practical situation. We derive parameters for the distribution using actual trace data and compare the performance of the proposed and the previous method under the Weibull-distribution model, as well as the previous constant probability model. Simulation results show that the performance of the proposed method is up to 5 times higher than that of the existing method especially when the time for completing jobs is restricted, while keeping the error rate lower than a required value.

DOI： 10.1587/transinf.2015PAP0027

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

This paper addresses the problem of job scheduling in volunteer computing (VC) systems where each computation job is replicated and allocated to multiple participants (workers) to remove incorrect results by a votingmechanism. In the job scheduling of VC, the number of workers to complete a job is an important factor for the system performance; however, it cannot be fixed because some of the workers may secede in real VC. This is the problem that existing methods have not considered in the job scheduling. We propose a dynamic job scheduling method which considers the expected probability of completion (EPC) for each job based on the probability of worker's secession. The key idea of the proposed method is to allocate jobs so that EPC is always greater than a specified value (SPC). By setting SPC as a reasonable value, the proposed method enables to complete jobs without excess allocation, which leads to the higher performance of VC systems. We assume in this paper that worker's secession probability follows Weibull-distribution which is known to reflect more practical situation. We derive parameters for the distribution using actual trace data and compare the performance of the proposed and the previous method under the Weibull-distribution model, as well as the previous constant probability model. Simulation results show that the performance of the proposed method is up to 5 times higher than that of the existing method especially when the time for completing jobs is restricted, while keeping the error rate lower than a required value.

DOI： 10.1587/transinf.2015PAP0027

Web of Science

researchmap

記述言語：英語   出版者・発行元：ELSEVIER ADVANCED TECHNOLOGY  

Optimal Prime Fields (OPFs) are considered to be one of the best choices for lightweight elliptic curve cryptography implementations on resource-constraint embedded processors. In this paper, we revisit the efficient modular arithmetic over the special prime fields, and present improved implementations of modular multiplication and squaring for OPFs, called Optimal Prime Field Coarsely Integrated Operand Caching (OPF-CIOC) and Coarsely Integrated Sliding Block Doubling (OPF-CISBD) methods. The OPF-CIOC and OPF-CISBD methods follow the general ideas of (consecutive) operand caching and sliding block doubling techniques, respectively. The methods have been carefully optimized and redesigned for Montgomery multiplication and squaring in an integrated fashion. We then evaluate the practical performance of proposed methods on representative 8-bit AVR processor. Experimental results show that the proposed OPF-CIOC and OPF-CISBD methods outperform the previous best known results in ACNS'14 by a factor of 8% and 32%. Furthermore, our methods are implemented in a regular way which helps to reduce the leakage of side-channel information. (C) 2015 Elsevier Ltd. All rights reserved.

DOI： 10.1016/j.cose.2015.03.005

Web of Science

researchmap

記述言語：英語   出版者・発行元：ELSEVIER ADVANCED TECHNOLOGY  

Optimal Prime Fields (OPFs) are considered to be one of the best choices for lightweight elliptic curve cryptography implementations on resource-constraint embedded processors. In this paper, we revisit the efficient modular arithmetic over the special prime fields, and present improved implementations of modular multiplication and squaring for OPFs, called Optimal Prime Field Coarsely Integrated Operand Caching (OPF-CIOC) and Coarsely Integrated Sliding Block Doubling (OPF-CISBD) methods. The OPF-CIOC and OPF-CISBD methods follow the general ideas of (consecutive) operand caching and sliding block doubling techniques, respectively. The methods have been carefully optimized and redesigned for Montgomery multiplication and squaring in an integrated fashion. We then evaluate the practical performance of proposed methods on representative 8-bit AVR processor. Experimental results show that the proposed OPF-CIOC and OPF-CISBD methods outperform the previous best known results in ACNS'14 by a factor of 8% and 32%. Furthermore, our methods are implemented in a regular way which helps to reduce the leakage of side-channel information. (C) 2015 Elsevier Ltd. All rights reserved.

DOI： 10.1016/j.cose.2015.03.005

Web of Science

researchmap

researchmap

researchmap

記述言語：英語  

To evaluate the security of pairing-based cryptography, it is also required to consider the pairing inversion problem. According to some previous works, the pairing inversion problem is solvable if exponentiation inversion (EI) problem is solved. This paper introduces an algorithm of power root calculation and the algorithm applies to EI problem.

DOI： 10.4156/jnit.vol4.issue3.13

Scopus

researchmap

記述言語：英語  

Pollard's rho method is well-known as an efficient method for solving discrete logarithm problem (DLP). This paper adopts the DLP on the so-denoted G3 over Barreto-Naehrig curve, together with XTR group. Then, this paper shows this idea with the proposed algorithm, and the experimental computation time of solving the DLP is reduced by about 15%.

DOI： 10.4156/jnit.vol4.issue3.14

Scopus

researchmap

DOI： 10.1007/978-3-319-04873-4_11

researchmap

DOI： 10.1109/IWSDA.2013.6849054

researchmap

記述言語：英語   出版者・発行元：IEEE  

This paper shows an approach for reducing the size of the exponent of final exponentiation with multiplying some extra terms. In the case of Tate and Ate pairings with Barreto-Naehrig curve whose embedding degree is 12, the exponent is reduced to (p(4) - p(2) + 1)/r, where p is the characteristic of the base field and r is the order of pairing.

DOI： 10.1109/NBiS.2013.86

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC  

Several methods for finding a basis conversion matrix between two different bases in an extension field F-p(m) have been proposed. Among them, the one based on Gauss period normal basis (GNB) is on average the most efficient. However, since it needs to construct a certain tower field F-(pm)n, some inefficient cases in which the towering degree n becomes large have been reported. This paper first determines that such inefficient cases are caused by the GNB condition. In order to overcome this inefficiency, we propose a method that does not use any GNB in the target extension field F-p(m), but instead uses a certain polynomial basis in F-p(m) derived by a certain small cyclic group in F-(pm)n. This causes relaxation of the condition for the towering degree n. In addition, our experimental results show that the proposed method substantially accelerates the computation time for finding a basis conversion matrix.

DOI： 10.1109/TIT.2012.2191477

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC  

Several methods for finding a basis conversion matrix between two different bases in an extension field F-p(m) have been proposed. Among them, the one based on Gauss period normal basis (GNB) is on average the most efficient. However, since it needs to construct a certain tower field F-(pm)n, some inefficient cases in which the towering degree n becomes large have been reported. This paper first determines that such inefficient cases are caused by the GNB condition. In order to overcome this inefficiency, we propose a method that does not use any GNB in the target extension field F-p(m), but instead uses a certain polynomial basis in F-p(m) derived by a certain small cyclic group in F-(pm)n. This causes relaxation of the condition for the towering degree n. In addition, our experimental results show that the proposed method substantially accelerates the computation time for finding a basis conversion matrix.

DOI： 10.1109/TIT.2012.2191477

Web of Science

researchmap

記述言語：英語   出版者・発行元：SPRINGER-VERLAG BERLIN  

A lot of improvements and optimizations for the hardware implementation of Sub Bytes of Rijndael, in detail inversion in F(28) have been reported. Instead of the Rijndael original F(28) it is known that its isomorphic tower field F(((22)2)2) has a more efficient inversion. For the towerings, several kinds of bases such as polynomial and normal bases can be used in mixture. Different from the meaning of this mixture of bases, this paper proposes another mixture that contributes to the reduction of the critical path delay of SubBytes. To the F((22)2)-inversion architecture, for example, the proposed mixture inputs and outputs elements represented with normal and polynomial bases, respectively.

DOI： 10.1007/978-3-642-15031-9_16

Web of Science

researchmap

researchmap

記述言語：英語   出版者・発行元：SPRINGER-VERLAG BERLIN  

A lot of improvements and optimizations for the hardware implementation of Sub Bytes of Rijndael, in detail inversion in F(28) have been reported. Instead of the Rijndael original F(28) it is known that its isomorphic tower field F(((22)2)2) has a more efficient inversion. For the towerings, several kinds of bases such as polynomial and normal bases can be used in mixture. Different from the meaning of this mixture of bases, this paper proposes another mixture that contributes to the reduction of the critical path delay of SubBytes. To the F((22)2)-inversion architecture, for example, the proposed mixture inputs and outputs elements represented with normal and polynomial bases, respectively.

DOI： 10.1007/978-3-642-15031-9_16

Web of Science

researchmap

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

It is said that the lower bound of the number of iterations of Miller's algorithm for pairing calculation is log(2) r/phi(k), where phi(.) is the Euler's function, r is the group order, and k is the embedding degree. Ate pairing reduced the number of the loops of Miller's algorithm of Tate pairing from left perpendicularlog(2) right perpendicular to left perpendicularlog(2)(t-1)right perpendicular, where t is the Frobenius trace. Recently, it is known to systematically prepare a pairing-friendly elliptic curve whose parameters are given by a polynomial of integer variable "chi." For such a curve, this paper gives integer variable chi-based Ate (Xate) pairing that achieves the lower bound. In the case of the well-known Barreto-Naehrig pairing-friendly curve. it reduces the number of loops to left perpendicularlog(2)chi right perpendicular. Then, this paper optimizes Xate pairing for Barreto-Naehrig curve and shows its efficiency based on some simulation results.

DOI： 10.1587/transfun.E92.A.1859

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

It is said that the lower bound of the number of iterations of Miller's algorithm for pairing calculation is log(2) r/phi(k), where phi(.) is the Euler's function, r is the group order, and k is the embedding degree. Ate pairing reduced the number of the loops of Miller's algorithm of Tate pairing from left perpendicularlog(2) right perpendicular to left perpendicularlog(2)(t-1)right perpendicular, where t is the Frobenius trace. Recently, it is known to systematically prepare a pairing-friendly elliptic curve whose parameters are given by a polynomial of integer variable "chi." For such a curve, this paper gives integer variable chi-based Ate (Xate) pairing that achieves the lower bound. In the case of the well-known Barreto-Naehrig pairing-friendly curve. it reduces the number of loops to left perpendicularlog(2)chi right perpendicular. Then, this paper optimizes Xate pairing for Barreto-Naehrig curve and shows its efficiency based on some simulation results.

DOI： 10.1587/transfun.E92.A.1859

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

This paper proposes a method to construct a basis conversion matrix between two given bases in F-pm. In the proposed method, Gauss period normal basis (GNB) works as a bridge between the two bases. The proposed method exploits this property and construct a basis conversion matrix mostly faster than EDF-based algorithm on average in polynomial time. Finally, simulation results are reported in which the proposed method compute a basis conversion matrix within 30 msec on average with Celeron (2.00 GHz) when m log p approximate to 160.

DOI： 10.1587/transfun.E92.A.1500

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

This paper presents implementation techniques of fast Ate pairing of embedding degree 12. In this case, we have no trouble in finding a prime order pairing friendly curve E such as the Barreto-Naehrig curve y(2) = x(3) + a, a is an element of F-p. For the curve, an isomorphic substitution from G(2) is an element of E(F-p(12)) into G(2)'in subfield-twisted elliptic curve E'(F-p(2)) speeds up scalar multiplications over G(2) and wipes out denominator calculations in Miller's algorithm. This paper mainly provides about 30% improvement of the Miller's algorithm calculation using proper subfield arithmetic operations. Moreover, we also provide the efficient parameter settings of the BN curves. When p is a 254-bit prime, the embedding degree is 12, and the processor is Pentium4 (3.6 GHz), it is shown that the proposed algorithm computes Ate pairing in 13.3 milli-seconds including final exponentiation.

DOI： 10.1587/transfun.E92.A.508

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

This paper presents implementation techniques of fast Ate pairing of embedding degree 12. In this case, we have no trouble in finding a prime order pairing friendly curve E such as the Barreto-Naehrig curve y(2) = x(3) + a, a is an element of F-p. For the curve, an isomorphic substitution from G(2) is an element of E(F-p(12)) into G(2)'in subfield-twisted elliptic curve E'(F-p(2)) speeds up scalar multiplications over G(2) and wipes out denominator calculations in Miller's algorithm. This paper mainly provides about 30% improvement of the Miller's algorithm calculation using proper subfield arithmetic operations. Moreover, we also provide the efficient parameter settings of the BN curves. When p is a 254-bit prime, the embedding degree is 12, and the processor is Pentium4 (3.6 GHz), it is shown that the proposed algorithm computes Ate pairing in 13.3 milli-seconds including final exponentiation.

DOI： 10.1587/transfun.E92.A.508

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

In this paper, a multiplication algorithm in extension field F-pm is proposed. Different from the previous works, the proposed algorithm can be applied for an arbitrary pair of characteristic 1) and extension degree in only except for the case when 4p divides m(p-1) and m is an even number. As written in the title, when p > m, 4p does not divice m(p - 1). The proposed algorithm is derived by modifying cyclic vector multiplication algorithm (CVMA). We adopt a special class of Gauss period normal bases. At first in this paper, it is formulated as an algorithm and the calculation cost of the modified algorithm is evaluated. Then, compared to those of the previous works, some experimental results are shown. Finally, it is shown that the proposed algorithm is sufficient practical when extension degree in is small.

DOI： 10.1587/transfun.E92.A.173

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

For ID-based cryptography, not only pairing but also scalar multiplication must be efficiently computable. In this paper, we propose a scalar multiplication method on the circumstances that we work at Ate pairing with Barreto-Naehrig (BN) curve. Note that the parameters of BN curve are given by a certain integer, namely mother parameter. Adhering the authors' previous policy that we execute scalar multiplication on subfield-twisted curve (E) over tilde (F-p2) instead of doing on the original curve E(F-p12), we at first show sextic twisted subfield Frobenius mapping (ST-SFM) in E(Fp2). On BN curves, note (phi) over tilde is identified with the scalar multiplication by p. However a scalar is always smaller than the order r of BN curve for Ate pairing, so ST-SFM does not directly applicable to the above circumstances. We then exploit the expressions of the curve order r and the characteristic p by the mother parameter to derive some radices such that they are expressed as a polynomial of p. Thus, a scalar multiplication [s] can be written by the series of ST-SFMs (phi) over tilde. In combination with the binary method or multi-exponentiation technique, this paper shows that the proposed method runs about twice or more faster than plain binary method.

DOI： 10.1587/transfun.E92.A.182

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

For ID-based cryptography, not only pairing but also scalar multiplication must be efficiently computable. In this paper, we propose a scalar multiplication method on the circumstances that we work at Ate pairing with Barreto-Naehrig (BN) curve. Note that the parameters of BN curve are given by a certain integer, namely mother parameter. Adhering the authors' previous policy that we execute scalar multiplication on subfield-twisted curve (E) over tilde (F-p2) instead of doing on the original curve E(F-p12), we at first show sextic twisted subfield Frobenius mapping (ST-SFM) in E(Fp2). On BN curves, note (phi) over tilde is identified with the scalar multiplication by p. However a scalar is always smaller than the order r of BN curve for Ate pairing, so ST-SFM does not directly applicable to the above circumstances. We then exploit the expressions of the curve order r and the characteristic p by the mother parameter to derive some radices such that they are expressed as a polynomial of p. Thus, a scalar multiplication [s] can be written by the series of ST-SFMs (phi) over tilde. In combination with the binary method or multi-exponentiation technique, this paper shows that the proposed method runs about twice or more faster than plain binary method.

DOI： 10.1587/transfun.E92.A.182

Web of Science

researchmap

researchmap

researchmap

DOI： 10.1109/ISIT.2009.5205994

researchmap

DOI： 10.1109/ISCE.2009.5156956

researchmap

researchmap

researchmap

researchmap

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

A class of zero-correlation zone (ZCZ) sequences constructed by the recursive procedure from a perfect sequence and a unitary matrix was proposed by T, Nakamura, and Suehiro [1]. In the reference [1], three parameters, s.t., the Sequence length, the family size and the length of the ZCZ, were evaluated for a general estimate of the performance of the ZCZ sequences. In this letter, we give more detailed distributions of that correlation values are zero on their ZCZ sequence sets.

DOI： 10.1093/ietfec/e91-a.12.3745

Web of Science

researchmap

記述言語：英語   出版者・発行元：ELECTRONICS TELECOMMUNICATIONS RESEARCH INST  

This paper proposes an exponentiation method with Frobenius mappings. The main target is an exponentiation in an extension field. This idea can be applied for scalar multiplication of a rational point of an elliptic curve defined over an extension field. The proposed method is closely related to so-called interleaving exponentiation. Unlike interleaving exponentiation methods, it can carry out several exponentiations of the same base at once. This happens in some pairing-based applications. The efficiency of using Frobenius mappings for exponentiation in an extension field was well demonstrated by Avanzi and Mihailescu. Their exponentiation method efficiently decreases the number of multiplications by inversely using many Frobenius mappings. Compared to their method, although the number of multiplications needed for the proposed method increases about 20%, the number of Frobenius mappings becomes small. The proposed method is efficient for cases in which Frobenius mapping cannot be carried out quickly.

DOI： 10.4218/etrij.08.0108.0178

Web of Science

researchmap

記述言語：英語   出版者・発行元：ACADEMIC PRESS INC ELSEVIER SCIENCE  

This paper proposes a useful method for constructing a self-dual normal basis in an arbitrary extension field F-p(m) such that 4p does not divide m(p - 1) and m is odd. In detail, when the characteristic p and extension degree in satisfies the following conditions (1) and either (2a) or (2b); (1) 2km + 1 is a prime number, (2a) the order of p in F2km+ 1 is 2km, (2b) 2 dagger km and the order of p in F2km + 1 is km, we can consider a class of Gauss period normal bases. Using this Gauss period normal basis, this paper shows a method to construct a self-dual normal basis in the extension field F-p(m). (C) 2008 Elsevier Inc. All rights reserved.

DOI： 10.1016/j.ffa.2008.04.001

Web of Science

researchmap

記述言語：英語   出版者・発行元：ACADEMIC PRESS INC ELSEVIER SCIENCE  

This paper proposes a useful method for constructing a self-dual normal basis in an arbitrary extension field F-p(m) such that 4p does not divide m(p - 1) and m is odd. In detail, when the characteristic p and extension degree in satisfies the following conditions (1) and either (2a) or (2b); (1) 2km + 1 is a prime number, (2a) the order of p in F2km+ 1 is 2km, (2b) 2 dagger km and the order of p in F2km + 1 is km, we can consider a class of Gauss period normal bases. Using this Gauss period normal basis, this paper shows a method to construct a self-dual normal basis in the extension field F-p(m). (C) 2008 Elsevier Inc. All rights reserved.

DOI： 10.1016/j.ffa.2008.04.001

Web of Science

researchmap

記述言語：英語   出版者・発行元：ELECTRONICS TELECOMMUNICATIONS RESEARCH INST  

This paper proposes a method for generating a basis translation matrix between isomorphic extension fields. To generate a basis translation matrix, we need the equality correspondence of a basis between the isomorphic extension fields. Consider an extension field F-p(m) where p is characteristic. As a brute force method, when p(m) is small, we can check the equality correspondence by using the minimal polynomial of a basis element; however, when P, is large, it becomes too difficult. The proposed methods are based on the fact that Type I and Type H optimal normal bases (ONBs) can be easily identified in each isomorphic extension field. The proposed methods efficiently use Type I and Type II ONBs and can generate a pair of basis translation matrices within 15 ms on Pentium 4 (3.6 GHz) when mlog(2)p = 160.

DOI： 10.4218/etrij.08.0107.0182

Web of Science

researchmap

researchmap

researchmap

researchmap

researchmap

記述言語：英語   出版者・発行元：IEEE COMPUTER SOC  

This paper proposes a method for generating an irreducible polynomial of an arbitrary degree m over an arbitrary prime field F, such that p > m. The proposed method is closely related to the minimal polynomial determination and therefore it has the following features: its complexity has little dependency on the size of characteristic p, its calculation cost is explicitly given with degree m, and it can generate primitive polynomials when p(m) - 1 is factorized as the product of prime numbers. The restriction p > m comes from using Newton's formula.

DOI： 10.1109/ICCIT.2008.171

Web of Science

researchmap

researchmap

DOI： 10.1007/978-3-540-89641-8_16

researchmap

記述言語：英語   出版者・発行元：IEEE COMPUTER SOC  

This paper proposes an improvement of twisted-Ate pairing with Barreto-Naehrig curve so as to efficiently use Frobenius mapping with respect to prime field. Then, this paper shows some simulation results by which it is shown that the improvement accelerates twisted-Ate pairing.

DOI： 10.1109/ICCIT.2008.193

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEEE COMPUTER SOC  

This paper proposes an efficient implementation of Ate pairing on twisted elliptic curve. Suppose that a pairing-friendly elliptic curve E has a twisted elliptic curve E' of degree d, and let psi(d) be an isomorphic map from E'(F-p(e)) to the corresponding subgroup of E(F-p(k)). Then, consider G' = psi(-1)(d) (G1) and G(2)' = psi(-1)(d) (G(2)) for G(1), G(2) at Ate pairing alpha. Let P is an element of G(1), Q is an element of G(2), P' is an element of G'(1) and Q' is an element of G'(2), the authors have shown alpha(Q,P) = F-t-q,F-Q (P)((pk-1)/r) = f(t-1,Q')(P')((pk-1)/r). This paper shows that this new Ate pairing, namely cross twisted (Xt) Ate pairing, provides an quite efficient implementation.

DOI： 10.1109/ICCIT.2008.172

Web of Science

researchmap

記述言語：英語   出版者・発行元：IEEE COMPUTER SOC  

This paper first introduces cyclic vector multiplication algorithm (CVMA) that is a multiplication algorithm in extension field. Then, it is also introduced that CVMA is useful under the tight restrictions of pairing-based cryptographies. Then, this paper points out a problem about the calculation cost of CVMA. For this problem, this paper proposes an improvement. According to some simulation results, it is shown that the improvement makes CVMA much more efficient.

DOI： 10.1109/ICCIT.2008.166

Web of Science

researchmap

記述言語：英語   出版者・発行元：TAYLOR & FRANCIS INC  

Self-dual normal basis is efficient for the arithmetic operations in extension field and especially trace calculation. However, self-dual normal bases do not exist in [image omitted] when characteristic p is odd and degree m is even. This paper proposes a method to construct an efficient normal basis for trace calculation when extension degree is even. In this paper, we call it pseudo self-dual normal basis.

DOI： 10.1080/01969720802188201

Web of Science

researchmap

researchmap

researchmap

researchmap

DOI： 10.1007/978-3-540-85538-5_13

researchmap

記述言語：英語   出版者・発行元：ELECTRONICS TELECOMMUNICATIONS RESEARCH INST  

This paper proposes a multiplication algorithm for F-pm, which can be efficiently applied to many pairs of characteristic p and extension degree m except for the case that 8p divides m(p-1). It uses a special class of type-< k, m > Gauss period normal bases. This algorithm has several advantages: it is easily parallelized; Frobenius mapping is easily carried out since its basis is a normal basis; its calculation cost is clearly given; and it is sufficiently practical and useful when parameters k and m are small.

DOI： 10.4218/etrij.07.0107.0040

Web of Science

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

記述言語：英語  

Self-dual normal basis is efficient for the arithmetic operations in extension field and especially trace calculation. However, self-dual normal bases do not exist in Fpm when characteristic p is odd and degree m is even. This paper proposes a method to construct a normal basis of even degree that is efficient for trace calculation. © 2007 IEEE.

DOI： 10.1109/ICCIT.2007.4420265

Scopus

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

記述言語：英語   出版者・発行元：IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG  

This paper proposes an extension field named TypeII AOPF. This extension field adopts TypeII optimal normal basis, cyclic vector multiplication algorithm, and Itoh-Tsujii inversion algorithm. The calculation costs for a multiplication and inversion in this field is clearly given with the extension degree. For example, the arithmetic operations in TypeII AOPF F-p5 is about 20% faster than those in OEF F-p5. Then, since CVMA is suitable for parallel processing, we show that TypeII AOPF is superior to AOPF as to parallel processing and then show that a multiplication in TypeII AOPF becomes about twice faster by parallelizing the CVMA computation in TypeII AOPF.

DOI： 10.1093/ietfec/e88-a.5.1200

Web of Science

researchmap

researchmap

記述言語：英語   出版者・発行元：SCRIPTA TECHNICA-JOHN WILEY & SONS  

In most of the methods of public key cryptography devised in recent years, a finite field of a large order is used as the field of definition. In contrast, there are many studies in which a higher-degree extension field of characteristic 2 is fast implemented for easier hardware realization. There are also many reports of the generation of the required higher-degree irreducible polynomial, and of the construction of a basis suited to fast implementation, such as an optimal normal basis (ONB). For generating higher-degree irreducible polynomials, there is a method in which it 2m-th degree self-reciprocal irreducible polynomial is generated from an m-th degree irreducible polynomial by a simple polynomial transformation (called the self-reciprocal transformation). This paper considers this transformation and shows that When the set of zeros of the m-th degree irreducible polynomial forms a normal basis, the set of zeros of the generated 2m-th order self-reciprocal irreducible polynomial also forms a normal base. Then it is clearly shown that there is a one-to-one correspondence between the transformed irreducible polynomial and the generated self-reciprocal irreducible polynomial. Consequently, the inverse transformation of the self-reciprocal transformation (self-reciprocal inverse transformation) can be applied to a self-reciprocal irreducible polynomial. It is shown that an m-th degree irreducible polynomial can always be generated from a 2m-th degree self-reciprocal irreducible polynomial by the self-reciprocal inverse transformation. We can use this fact for generating 1/2-degree irreducible polynomials. As an application of 1/2-degree irreducible polynomial generation, this paper proposes a method which generates a prime degree irreducible polynomial with a Type II ONB as its zeros. (c) 2005 Wiley Periodicals, Inc.

DOI： 10.1002/ecjc.20151

Web of Science

researchmap

記述言語：英語   出版者・発行元：SCRIPTA TECHNICA-JOHN WILEY & SONS  

In most of the methods of public key cryptography devised in recent years, a finite field of a large order is used as the field of definition. In contrast, there are many studies in which a higher-degree extension field of characteristic 2 is fast implemented for easier hardware realization. There are also many reports of the generation of the required higher-degree irreducible polynomial, and of the construction of a basis suited to fast implementation, such as an optimal normal basis (ONB). For generating higher-degree irreducible polynomials, there is a method in which it 2m-th degree self-reciprocal irreducible polynomial is generated from an m-th degree irreducible polynomial by a simple polynomial transformation (called the self-reciprocal transformation). This paper considers this transformation and shows that When the set of zeros of the m-th degree irreducible polynomial forms a normal basis, the set of zeros of the generated 2m-th order self-reciprocal irreducible polynomial also forms a normal base. Then it is clearly shown that there is a one-to-one correspondence between the transformed irreducible polynomial and the generated self-reciprocal irreducible polynomial. Consequently, the inverse transformation of the self-reciprocal transformation (self-reciprocal inverse transformation) can be applied to a self-reciprocal irreducible polynomial. It is shown that an m-th degree irreducible polynomial can always be generated from a 2m-th degree self-reciprocal irreducible polynomial by the self-reciprocal inverse transformation. We can use this fact for generating 1/2-degree irreducible polynomials. As an application of 1/2-degree irreducible polynomial generation, this paper proposes a method which generates a prime degree irreducible polynomial with a Type II ONB as its zeros. (c) 2005 Wiley Periodicals, Inc.

DOI： 10.1002/ecjc.20151

Web of Science

researchmap

researchmap

researchmap

DOI： 10.1093/ietfec/e88-a.10.2792

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap

researchmap