mixed bases for efficient inversion in f and conversion ... · pdf filemixed bases for...
TRANSCRIPT
Mixed Bases for Efficient Inversion in
F((22)2)2 and Conversion Matrices of
SubBytes of AES
Information Transfer Laboratory
Okayama University, Japan
Yasuyuki Nogami, Kenta Nekado, Tetsumi Toyota,
Naoto Hongo, and Yoshitaka Morikawa
Okayama University
Research background (1)
Odd characteristic extension field
– Cryptographic applications
Pairing-based cryptography with elliptic curves
Efficient arithmetic operations
Using several kinds of bases in mixture
– Modular polynomials
Irreducible binomials, irreducible trinomials
Cyclotomic polynomials
– Bases
Polynomial basis : multiplication
Normal basis : Frobenius mapping
– Gauss period normal basis (GNB)
CHES2010 @ University of California Santa Barbara
characteristic
extension degree
1/19
they respectively have efficient calculations
Okayama University
Research background (2)
Itoh-Tsujii inversion algorithm (ITA)
– Multiplications by conjugates
– Frobenius mappings
– In the case of characteristic two
Frobenius mapping is equivalent to squaring.
CHES2010 @ University of California Santa Barbara 2/19
subfield inversion
Normal bases efficiently work for ITA.
Okayama University
Research background (3)
In the case of pairing-based cryptographies…
– Binary extension fields
– Ternary extension fields
– Other odd characteristic extension fields
Parameters
– : 160 bits - 256 bits
– : 2,3,4, …, 20
Research targets
– Vector multiplication algorithm
– Exponentiation and scalar multiplication for rational points
– For using several kinds of bases in mixture
• Bases conversion matrices are required.
CHES2010 @ University of California Santa Barbara 3/19
our previous work : GNB-based derivation
motivation
Okayama University
Then, as an application …
inversion for SubBytes of AES
CHES2010 @ University of California Santa Barbara 4/19
Original Tower field with various bases
Bases conversion matrices
and modular polynomials
Okayama University
Then, as an application …
inversion for SubBytes of AES
CHES2010 @ University of California Santa Barbara 5/19
Original Tower field with various bases
Bases conversion matricesIs the GNB-based derivation available ?
and modular polynomials
Okayama University
However, …
– When for AES, it is not satisfied…
– Once I had lost the motivation, with respect to the conjugates,
8 variants existed for the pair of conversion matrices
CHES2010 @ University of California Santa Barbara 6/19
No problem. Full search !
the order is very small !
Condition for the existence of GNBs
``Finding a Basis Conversion Matrix via Prime Gauss Period Normal Basis,"
Y. Nogami, R. Namba, and Y. Morikawa, IEICE Trans., E92-A, no. 6, pp. 1500 - 1507, 2009.
GNB-based derivation :
Okayama University
The detail of AES
AES also needs affine / inverse affine transforms
8 variants of
there are 8 variants of and .
CHES2010 @ University of California Santa Barbara 7/19
Matrices for the affine / inverse affine transform
In the encryption phase,
Okayama University
Previous works
According to some previous works, there are
– For each, there are 8 variants of .
CHES2010 @ University of California Santa Barbara 8/19
towering constructions of .
efficient / inefficient !?
For example,
Okayama University
Conversion matrices
Binary vectors are multiplied by the matrices.
CHES2010 @ University of California Santa Barbara 9/19
The Hamming weights of row vectors are
Example : row vectors
two inputs logic
preferred to be smaller than 5.
ex-or
Okayama University
Hamming weights of row vectors
Efficient conversion matrices
CHES2010 @ University of California Santa Barbara 10/19
good or bad !?
smaller than 5 larger than or equal to 5
The maximum Hamming weight of row vectors is …
The constructions rarely had good – good conversion matrices.
Okayama University
Notations for the efficiency
Notations with good and bad
CHES2010 @ University of California Santa Barbara 11/19
good / bad
good / bad
good / bad
Unfortunately,
the rare constructions of good – – good conversion matrices
were all good – bad – good constructions …
The rare constructions did not have efficient inversions in F((22)2)2.
Okayama University
good – good – bad construction
Sec. 2.4 construction
Based on this good – good – bad construction,
the idea of mixed bases is applied.
CHES2010 @ University of California Santa Barbara 12/19
good
good
bad
In general, I/O bases are the same.
Okayama University
Main idea – the first mix –
If the output uses other type of basis …
CHES2010 @ University of California Santa Barbara 13/19
without loss of efficiency
bad
good
squaring in
multiplication
inversion times const.
Okayama University
If the output uses other type of basis …
Main idea – the first mix –
CHES2010 @ University of California Santa Barbara 14/19
Polynomial outputthe first mix !
Normal input
the first mix !
without loss of efficiency
good / bad
good
Okayama University
If the output uses other type of basis …
Main idea – the first mix –
CHES2010 @ University of California Santa Barbara 15/19
the first mix !
without loss of efficiencyThe maximum Hamming weight of row vectors
is smaller than 5.
Another good conversion matrix could follow.
good !
Okayama University
good
Extension of the idea – the second mix –
If normal bases can be partially applied …
CHES2010 @ University of California Santa Barbara 16/19
good
Normal basis is efficient for inversion…
z
good
squaring in
multiplication
inversion times const.
Okayama University
Extension of the idea – the second mix –
If normal bases can be partially applied …
CHES2010 @ University of California Santa Barbara 17/19
good
Normal basis is partially used in mixture.the second mix !
good / bad
Okayama University
Normal basis is partially used in mixture.
Extension of the idea – the second mix –
If normal bases can be partially applied …
CHES2010 @ University of California Santa Barbara 18/19
good
better !
Normal input
Polynomial output
Polynomial input – Polynomial output
the second mix !
Okayama University
Conclusion and future works
Mixed bases technique
good – good – bad construction
good – better – good construction
I would like to thank to the anonymous reviewers.
– Security issue for such special conversion matrices
– Total approach together with the decryption phase
Other towering fields
– For example,
CHES2010 @ University of California Santa Barbara 19/19
Okayama University
Thank you for your attention !
CHES2010 @ University of California Santa Barbara