Speaker Deck
Speaker Deck Pro
Sign in
Sign up
for free
高速な楕円曲線の実装
ykm11
March 30, 2020
Technology
0
900
高速な楕円曲線の実装
ラボユース第9期
ykm11
March 30, 2020
Tweet
Share
Other Decks in Technology
See All in Technology
ishiayaya
PRO
0
320
kyonmm
1
1.9k
zaki134rp
1
180
hsano
0
120
comucal
PRO
0
410
shirayanagiryuji
1
400
jakalada
1
270
minamizaki
0
510
kanaugust
PRO
0
210
tsuyo
0
180
sakon310
4
4.2k
ama_ch
0
3.3k
Featured
See All Featured
chriscoyier
145
19k
smashingmag
229
18k
smashingmag
283
47k
cherdarchuk
71
260k
productmarketing
5
640
shpigford
165
19k
iamctodd
17
1.8k
carmenhchung
26
1.3k
mthomps
39
2.3k
sachag
446
36k
afnizarnur
176
14k
matthewcrist
73
7.5k
Transcript
ߴͳପԁۂઢͷ࣮ ฏా ྒྷ 2020.03.30 αΠϘζɾϥϘϢʔεୈ 9 ظ Ռใࠂձ 1
ࣗݾհ • ฏా ྒྷ • ϥϘϢʔεୈ 9 ظੜ • ిؾ௨৴େֶ
3 • GitHub: ykm11 • Twitter: @ykm kn • झຯιϩπʔϦϯά 2
αΠϘζɾϥϘϢʔε ୈ 9 ظ • ༰ • ։ൃςʔϚ: C/C++ʹΑΔιϑτΣΞ։ൃ •
ϝϯλʔ: ޫ࣎ੜ͞Μ • ߴͳପԁۂઢΛ࣮ʢ& C++ͷษڧʣ • ಛఆͷପԁۂઢʹݶΒΕΔ͕͔ͳΓͷΛୡ • ҙਫ਼ʹରԠʢগ͠མͪΔʣ Ռ - https://github.com/ykm11/lab-youth/tree/master/ellipticCurve 3
࣍ • ପԁۂઢͱ • ߴԽ࣮ͷಓ • ΞϑΟϯ࠲ඪ͔ΒࣹӨ࠲ඪ • Πϯελϯεੜ, ԋࢉճͷݮ
• ಈతϝϞϦ֬อͷఫഇ • εΧϥʔഒࢉΞϧΰϦζϜ • ͞ΒͳΔߴԽ • ͲΕ͚ͩ͘ͳ͔ͬͨ 4
ପԁۂઢͱ ମ K ্Ͱఆٛ͞ΕΔପԁۂઢ E/K , E/K := {(x, y)
∈ K2 | y2 = x3 + ax + b} ∪ {O} a, b ∈ K P, Q ∈ E/K ʹ͠ࢉ + Λఆٛ͢Δͱ (E/K, +) Ճ๏܈ʹͳΔ P = (x1, y1), Q = (x2, y2) ∈ E/K ͷ͠ࢉ P + Q (x1, y1) + (x2, y2) =: (x3, y3) x3 = m2 − x1 − x2 y3 = m(x1 − x3) − y1 m = y2−y1 x2−x1 (P ̸= Q) 3x2 1 +a 2y1 (P = Q) ҉߸Ͱɺఆٛମ K ඪ͕ 2,3 Ͱͳ͍༗ݶମ͕Α͘ΘΕΔ 5
ߴԽ࣮ͷಓ Πϯτϩ ඪ • P ͷεΧϥʔഒ [k]P = P
+ P + .. + P Λ͍ͨ͘͠ • Α͍ΞϧΰϦζϜΛ͏ • ͠ࢉ, 2 ഒࢉΛ͘͢Δ • ֤छΞϧΰϦζϜ͠ࢉ, 2 ഒࢉͷΈ߹ΘͤͳͷͰɺ ͪ͜ΒΛ͘͢ΕεΧϥʔഒ͘ͳΔ 6
ߴԽ࣮ͷಓ ΞϑΟϯ࠲ඪ͔ΒࣹӨ࠲ඪ ΞϑΟϯ࠲ඪͰ࣮͢Δͱ͖ʹࠔΔ͜ͱ • ୯Ґݩʢແݶԕʣͷѻ͍ Ϋϥεͷϝϯόมʹ bool isInf ΛͨͤΔʁ •
͖ΛٻΊΔͱ͖ʹআࢉ͕ൃੜ • ֦ுϢʔΫϦουͷΞϧΰϦζϜΛ͏͔ɺ • p-2 ͢Δ͜ͱʹΑͬͯٯݩΛಘΔʢFermat ͷখఆཧΑΓ ܭࢉͷίετʁ ࣹӨ࠲ඪͰ࣮͢Δ͜ͱʹΑΓɺ্ͷΛղܾ 7
ߴԽ࣮ͷಓ ΞϑΟϯ࠲ඪ͔ΒࣹӨ࠲ඪ ࣹӨ࠲ඪͷݫີͳఆٛͳͲޫ͞Μͷஶॻ 1 K2 ϕ −→ P ∈
∈ (x, y) −→ (x : y : 1) (X/Z, Y /Z) ϕ−1 −→ (X : Y : Z) • ఆٛํఔࣜ y2 = x3 + ax + b ͔Β Y 2Z = X3 + aXZ2 + bZ3 ʹ • ୯Ґݩ (0 : 1 : 0) 1https://herumi.github.io/ango/ 8
ߴԽ࣮ͷಓ ΞϑΟϯ࠲ඪ͔ΒࣹӨ࠲ඪ (X1 : Y1 : Z1) + (X2 :
Y2 : Z2) =: (X3 : Y3 : Z3) ͷެࣜ ಋग़লུ͠·͢ • (X1 : Y1 : Z1) ̸= (X2 : Y2 : Z2) u := Y2Z1 − Y1Z2, v := X2Z1 − X1Z2, w := u2Z1Z2 − v3 − 2v2X1Z2, X3 := vw, Y3 := u(v2X1Z2 − w) − v3Y1Z2, Z3 := v3Z1Z2 • (X : Y : Z) ͷ̎ഒެࣜ u := 3X2 + aZ2, v := YZ, w := u2 − 8XYv, X3 := 2vw, Y3 := u(4XYv − w) − 8(Yv)2, Z3 := 8v3 9
ߴԽ࣮ͷಓ ΞϑΟϯ࠲ඪ͔ΒࣹӨ࠲ඪ ࣹӨ࠲ඪͷ࠾༻ʹΑΓ • Z ͷͰ୯Ґݩ͔Ͳ͏͔ΛผͰ͖Δ • আࢉ͕ແ͘ͳͬͨ • ࢉ͕૿͑Δ͕ɺআࢉʹൺΔͱ͔ͳΓ҆Ձ
Table 1: ίετൺֱ Ճࢉ P + Q 2 ഒࢉ (2P) ΞϑΟϯ࠲ඪ 3M + I 4M + I ࣹӨ࠲ඪ 14M 12M M ༗ݶମͷࢉ, I ٯݩͷܭࢉ 10
Πϯελϯεੜ, ԋࢉճͷݮ • ՃࢉͰ 14 ճͷ༗ݶମͷࢉ u := Y2Z1 −
Y1Z2, v := X2Z1 − X1Z2, w := u2Z1Z2 − v3 − 2v2X1Z2, X3 := vw, Y3 := u(v2X1Z2 − w) − v3Y1Z2, Z3 := v3Z1Z2 • ͬͱ͋Γͦ͏ʢʹݟ͑Δʣ • ಉ͡ܭࢉΛ͠ͳ͍ • ͔ͭɺ༗ݶମΠϯελϯεͷੜΛ࠷খݶʹ 11
Πϯελϯεੜ, ԋࢉճͷݮ • ՃࢉͰ 14 ճͷ༗ݶମͷࢉ u := Y2Z1 −
Y1Z2, v := X2Z1 − X1Z2, w := u2Z1Z2 − v3 − 2v2X1Z2, X3 := vw, Y3 := u(v2X1Z2 − w) − v3Y1Z2, Z3 := v3Z1Z2 • ͬͱ͋Γͦ͏ʢʹݟ͑Δʣ • ಉ͡ܭࢉΛ͠ͳ͍ • ͔ͭɺ༗ݶମΠϯελϯεͷੜΛ࠷খݶʹ 12
Πϯελϯεੜ, ԋࢉճͷݮ • Ұ࣌มΛੜ͠ͳ͍ʢมͯ͢ Fp ͷΠϯελϯεʣ x = y *
z - v * w; • վྑ mul(x, y, z); // x = y * z; mul(t, v, w); // t = v * w; sub(x, x, t); // x = x - t; • “% modulus” Λଟ༻͠ͳ͍ • Fp ͷݩͷՃࢉͷ࠷େ 2p − 2 • ݮࢉͷ࠷খ −p + 1 • Ճݮࢉͷ߹ɺԋࢉ݁Ռʹରͯ͠దٓ modulus Λ ͔͢Ҿ͔͘ͰΑ͍ 13
ಈతϝϞϦ֬อͷఫഇ • GMP mpz class malloc ͰಈతʹϝϞϦΛ֬อ͢Δ -
ಈతϝϞϦ֬อ͕ϘτϧωοΫ ରࡦ • ಈతϝϞϦ֬อΛ͠ͳ͍ - ϝϞϦཧΛࣗͰߦ͏ - mpz class Λྻʹஔ͖͍͑ͯ͘ - mpn ͕ؔ͋ΔͷͰଟഒͷ࢛ଇԋࢉΘΓͱ͔Μͨ Μʹॻ͚Δ 14
ߴԽ࣮ͷಓ Πϯτϩʢ࠶ܝʣ ඪ • P ͷεΧϥʔഒ [k]P = P
+ P + .. + P Λ͍ͨ͘͠ • Α͍ΞϧΰϦζϜΛ͏ • ͠ࢉ, 2 ഒࢉΛ͘͢Δ • ֤छΞϧΰϦζϜ͠ࢉ, 2 ഒࢉͷΈ߹ΘͤͳͷͰɺ ͪ͜ΒΛ͘͢ΕεΧϥʔഒ͘ͳΔ 15
εΧϥʔഒࢉΞϧΰϦζϜ ࣮ͨ͠ͷ • ӈ͖, ࠨ͖όΠφϦ๏ • sliding window method •
window NAF method ͋ΔପԁۂઢʹͷΈదԠͰ͖ΔΞϧΰϦζϜ͋Δ • GLV for secp256k1 ௨ৗͷεΧϥʔഒࢉΑΓ͓͓Αͦ 1.5 ഒఔߴ 16
͞ΒͳΔߴԽ • ϠίϏ࠲ඪΛར༻ • ࣹӨ࠲ඪΑΓ 2 ഒࢉͷίετ͕খ͍͞ • 2 ഒࢉΛΑ͘͏ͱ͖ʹ༗ޮ
• ߴͳଟഒԋࢉΛ࣮͢Δ • GMP mpn ͱ͍ͯ • ΞηϯϒϦϨϕϧͰ࠷దԽΛؤுΔ 17
ͲΕ͚ͩ͘ͳ͔ͬͨ • Golang ͷପԁۂઢ࣮ 2, sage-8.83 ͱΛൺֱ • ࣮ߦڥ OS:
Ubuntu 18.04 (on Mac) CPU: i7-8850H 2.60GHz compiler: gcc-9.2.1 -O3 (for C++) 2https://github.com/ykm11/goCurve 3Python Ͱ࣮ߦͰ͖ΔΦʔϓϯιʔεͳֶιϑτΣΞ 18
ͲΕ͚ͩ͘ͳ͔ͬͨ secp256k1 ͷύϥϝʔλΛͬͯܭଌ Table 2: ൺֱʢ୯Ґ usecʣ add dbl sage
19.88 24.68 GolangʢΞϑΟϯ࠲ඪʣ 5.670 6.374 C++ʢࣹӨ࠲ඪʣ 1.432 1.421 C++ʢϠίϏ࠲ඪʣ 1.440 1.002 19
ͲΕ͚ͩ͘ͳ͔ͬͨ εΧϥʔഒʹ͍ͭͯܭଌͯ͠ΈΔ ύϥϝʔλ secp256k1 Table 3: ΞϧΰϦζϜͷൺֱʢ୯Ґ usecʣ ࣹӨ࠲ඪ ϠίϏ࠲ඪ
ࠨ͖όΠφϦ๏ 527.17 421.00 ӈ͖όΠφϦ๏ 519.92 409.11 Sliding Window Method (size 2) 498.19 403.97 NAF (size 4) 484.88 360.63 GLV (NAF) 320.94 N/A 20
·ͱΊ • ߴʹಈ࡞͢ΔପԁۂઢΛ C++Ͱ࣮ͨ͠ • ͷ͠ࢉΛ͘͢ΔͱεΧϥʔഒ͕͘ͳΔ • ༗ݶମͷ࢛ଇԋࢉΛ͘͢Δͱͷ͠ࢉ͕͘ͳΔ • ར༻ՄೳͳପԁۂઢΛ૿͠ɺҙਫ਼Ͱ͕ग़ΔΑ͏
ʹ͍ͨ͠ 21