PSEC 34567>9;<@Ul§¶Óí7¦Fñ¢,T!!Ë[°!!b[®x±²PSEC !!³RIvh¢¨²PSEC !!³§²PSEC-1 !!³§²PSEC-2 !!³§²PSEC3 !!³vwp®a|¦W¨ ££{§åÖ!!b[®xNJ|¢¨ ££p®a|§  0E.î Ý{'¢§NJ4C
¡òp®a|¦¢¦ û¢¨
²PSEC !!³§) ElGamal !!5 °8@!!v~wjVu±¦`oÇ3
Ì°FO-1 Ì, FO-2 Ì, OP Ì± [7, 8, 12] ¦Jv§ v  ¦!!b[®xÇ3u¢¨y§£ Ç3Ì§Êú5 oh`{5 ¦NJ¢{§£ oh`{5 §gn_Wc6P"éÚ&ÿ×#Ø(Ë oh`{5 ¦Jv¢{|¢§Õîoh`{5 î¢¸Kv¨@Ul§ (^p§ SHA-1 8}Ë[ [3] ¦pY¢°10þPý±¨y§ÒXðg¢
jblk®e§_vv]}xpYoh`{5 ¦Jv) £v¢¨
FO-1 Ì¦Jv) ElGamal !!5 ¦Ç3!!b[®x{ PSEC-1 !!u¡§ FO-2 Ì¦Jv) ElGamal !!5 ¦Ç3!!b[®x{ PSEC-2 !!
u¡§ OP Ì¦Jv) ElGamal !!5 ¦Ç3!!b[®x{ PSEC-3 !!
u¢¨
ÊúU^~cx§2hoh`{5 #-§)Fq}y®eU^~cx¦¸K¢{§ £v§ refhojo þ¦Pý£v¨
§ PSEC-2, PSEC-3 §Ú&BíT!!ÄJ¢{|¢¨ÒXðg¢jblk®e§_vv]}x§BíT!!p®mx°one-time-pad)!!{Jv £v¢¨
12 ¡¦©®£^Jñ!!yv°¤^Jñu£u¢±I­^JñNJ4C
 ¦isñÉ0¢fKu¢¨px§ 1998 Ü= SSL  PKCS#1°We®nhl&}S¥£v¢!!i®±¢!!M  [4] ¡§#,wEH{}Û\£¢w¨°±^JñNJ4CyvÝÑñM°ò+ñ!!ÃM±{dÂ1Ýu¢§y°± PKCS#1 wr{®~bjVh\L{7u¢¨ wEH¦í§(ç £v¢!!MÂo&D&B  ¦W°¡§ò+ñ!!ÃM
D¶Óu¢± [1] {°òÍ.î±0E|¢w^Jñ!!{A£¢w¨
PSEC !! wKA6PÏx¢) £¶ÓFñ,T!!Ë[u¢¨ w&D&B  ¦W^Jñ!!¦L¢*­{1Ë9§8@ñ  ^Jñ Ý¦W8@!!°!!v~wjVu±¦ ^J ¦ÉWoh`{5 ¦Jv&D&B  ¦Ww!!Ç3
¢u¢¨wUv®g§ 1994 Ü Bellare, Rogaway  OAEP ð"#L§¹öñUv®g£v¢u¢¨
PSEC !!8@!!°!!v~wjVu±§)F2 £ ElGamal !!5 °) ElGamal !!5 ±¦Jv¢¨§oh`{5 ¦JvÇ3Ë[§`oËÌ°FO-1 Ì, FO-2 Ì, OP Ì± [7, 8, 12] ¦Jv¢¨ ££Ç
3Ë[+ 3 !!Ë[°!!b[®x±{ |§ £ ¦ ££ PSEC-1,
PSEC-2, PSEC-3 ¨wÇ3£!!Ë[§ Jv £oh`{5 {iñ}fx
5 .î°}fxY}\zk±§z) ElGamal !!5 8@ñ ¦.î£§&D&B  °ò+ñ!!ÃMD¶Óu¢
±{0E|¢¨^Jñoh`{5 {iñ}fx5 vw.îDv.îu¢{§w.î,  0EvË[/ zM{u£§ £oh`{5 }fx5 Dv ]°·}fx ±({Sz¦&B¢¨ SHA wë&8}) £oh`{5 4"§&8@ñ·}fxu¢ÿ×  S~¢{#Øu¢7 £v¢¨e§}fxY}\zk,  0EvË[¦Þ¢·5#Øu¢7 £v¢¨£{§}fxY}\zky~¢  q}fWxu¢1 ¨óJñq}y®eî°jqj = 160±yv§ PSEC !!#,wÕì¦W
°1}§²PSEC !!Z»0ù³¦Pý£v±¨
91. PSEC-1 ò+ «BíT! !T° ­ 128 shl±àòv¢¨
2. PSEC-2 ò+ «Ú&ìBíT!!Tà§yìvÅÃ¶Óí7§ÕZvdñNJËÌ°¡§Tàk®eà{Ò:v¢±òv¢¨
3. PSEC-3 ò+ «Ú&ìBíT!!Tà§yìvÅÃ¶Óí7§ÕZvdñNJËÌ°¡§Tàk®eà{2Ò:± dh`|ñNJËÌ°¡§dh`|,Xy~¢Tà £#.dh`|,êBíT!!¢k®e!!-±òv¢°8.4 Pý±¨
7
1. PSEC-1 §)F2¿ÂNî Die-Hellman (EC-PDDH) .î}fxY}\zk,§ò+ñ!!ÃMD¶Óu¢
{0E|¢¨ÎÊÔãæÚàÖã×äáÜäÅçì¹ÅºÄÌÆÉÍ·Çîñ÷ú³ùÉ²ÅÌÀÉáÜäÓöû
¿ÐÞÛÙâ0é¹ýêÅºÇ¶Í·Ç°þßåÝØäÓó¾Ä¶Ð [5] Õ¾¸¾Ô¼ÉøÊíËÄèüúÈÿÎ
ÑÁÌÉÅµÏÔô2Èýê½ÑÁ4õÈ3¾ÄÊÔ Canetti ÁÂÉï´È1Ã»ð6Ê5È±ë¹Ç¶Í·ÈòÒÑÐÕ
1 Canetti

2

°BíT!!p®mx!!¦Jv±§)F2 DieHellman (EC-DH) .î}fxY}\zk,§ò+ñ!!Ã
MD¶Óu¢{0E|¢¨
3. PSEC-2 °(ãBíT!!¦Jv±§Jv¢BíT!!{aÑñM u¢4"§)F2 Die-Hellman (EC-DH) .
î}fxY}\zk,§ò+ñ!!ÃMD¶Óu¢{0E|¢¨
4. PSEC-3 °BíT!!p®mx!!¦Jv±§)F2 GapDie-Hellman (EC-GDH) .î }fxY}\zk,§ò+ñ 
!!ÃMD¶Óu¢{0E|¢¨
5. PSEC-3 °p®mx!!#-BíT!!¦Jv±§Jv¢B
íT!!{aÑñM u¢4"§)F2 Gap-Die-Hellman(EC-GDH) .î}fxY}\zk,§ò+ñ!!ÃM
D¶Óu¢{0E|¢¨ §dh`|ñNJËÌ¦4"§2Ò.î,§dh`|y~¢!!&D&B  °ò+ñ!!ÃMD¶Ó¯6Q±{0E£¢¨ óJñq}y®eîyv§ PSEC °PSEC-1, PSEC-2, PSEC-3±§óJñ)F!!°) ElGamal !!±ÒÎ Ý¦Hv¢¨Õ§PSEC-1, PSEC-2 §!!-÷iõ{) ElGamal !!Ò§À!÷iõ{) ElGamal !!G 1/2 u¢¨(Ë§ PSEC-3 §!!-§À!
-v£) ElGamal !!Òu¢¨°y§) ElGamal !!
§ PSEC w  0EDvë&¨±
2. PSEC-2

3 £:?=¯¢!!§O (G ; E ; D) ;î£¢¨§ G T *Qu¡§ E !!-*Q§ D À!-*Qu¢¨
PSEC-1 ) ElGamal !!5 oh`{5 ¦Jv!!Ë[u¡§ PSEC-2
y PSEC-3 ) ElGamal !!5 oh`{5 §BíT!!¦Jv!!Ë[u¢¨@RIù§#,wº<¦Jv¢¨
 a := b: b æ¦ a Ù¢¨}§ a ¦ b î?¢¨
 Z:  c"¨
 Z=nZ := f0; 1; : : : ; n 0 1g¨ A, B ¦c"¢|§ AnB := fx j x 2 A ^ x 62 B g¨
 (Z=nZ)3 := f1; 2; : : : ; n 0 1gnfx j gcd(x; n) 6= 1g¨PSEC3 Fq : $ { q H¨ q = pn °p:  ±|§ Z=pZ 2&ü[ f (x) =f0 + f1 x + 1fn xn y8ï°;8ï}[8ï±¦î¢§ Fq K a § a = (an01 ; an02 ; : : : ; a0 ) °ai 2 Z=pZ±º£¢¨
 f0; 1g3 §Hìshlqc"¨ f0; 1g3 ¦ B <u¢¨ f0; 1gi § i shlìshlqc"¨ f0; 1gi ¦ Bi <u¢¨
 a 2 Z |§ Bi [a] §
a = a0 + 2a1 + 22a2 + 1 1 1 2i01 ai01

¢wshlq (ai01; ai02; : : : ; a0 ) 2 Bi ¦&B¢¨
 a 2 Fq § q = pn °p:  ±|§ a = (an01 ; an02 ; : : : ; a0) °ai 2 Z=pZ±º£v¢¢¨§ 2k01  p  2k 0 1 ¢¨|§ Bn1k [a]§shlq (Bk [an01]jjBk [an02]
1 1 1 Bk [a0 ]) 2 Bn1k ¦&B¢¨§ jFq j := n 1 k ¢¨
 P ¦ Fq 2)Fô¢¨ B8+21qLen [P ] §shlq (00000UCY jj BqLen[xP ]jjBqLen[yP ]) 2 B8+21qLen ¦&B¢°qLen := jFq j±¨§ xP y yP§ P  x- %¹§ y- %¹¦&B§ (UCY ) § IEEE P1363 E.2.3.2 î£¦Jv¢ [9]¨ a := (ai01; ai02; : : : ; a0 ) 2 Bi |§ I[a] §
b = a0 + 2a1 + 22a2 + 1 1 1 2i01 ai01

¢w b 2 Z ¦&B¢¨
 a 2 Bi |§ jaj := i.
 a  b (mod n) § a 0 b { p 1¡ £¢¦&B¢¨ a := b mod n §
a 2 Z=nZ z a  b (mod n) ¦&B¢¨
 a 2 B z b 2 B |§ ajjb  a  b O"¦&B¢¨px§ (0; 1; 0; 0)jj(1; 1; 0) =(0; 1; 0; 0; 1; 1; 0) ¢¨
 X 2 B |§ [X ]k § X &2$ k shl¦&B¢¨
 X 2 B |§ [X ]k § X &,$ k shl¦&B¢¨
 a 2 Bi z b 2 Bi |§ a 8 b shlAßñsit¦&B¢¨°¡§ a 8 b 2 Bi ¢¨±
 a 2 Bi z b 2 Bj |°i < j ±§ a 8 b ¦LQ¢4"§ a 2$ 0 ¦q
kV]§ j shl*Q¦w¨px§ (101) 8 (10100) := (00101) 8(10100) = (10001)¨ item ô Q ¦)F2ô|§ xQ   x- %¹¦&B¢¢¨4

4 ®8­¨«8%!¬!!§8@!!5 °!!v~wjVu±§) ElGamal !!5 ¦Jvv¢¨#,§) ElGamal !!5 °T G§!! E §À! D±¦Y¨
PSEC

4.1

&: GG Ùngn#,í¡u¢¨[[' ]  u¢d[{~jVq}y®e k 2 Z.

)' ] ,T (Fq ; a; b; p; P; W; pLen; qLen) 2 Zn+4 2 Z7 ¶CT s 2 Z ¨k ¦Ùn¢T

*Q G #,í¡u¢¨ #,)F (EC) q}y®e¦ °IEEE P1363 A.12.4 { 12.7, [9]±©HFq q}y®e§)F E ¦î¢q}y®e a  b °v£ Fq K±§E ô G u¢ p§$ { p u¢ E 2ô P ¨y§)Fq}y®e (a; b) § Weierstrass ¹öK8}¨§ 2k01  p  2k 0 1
¢¨§ô P § Fq 2UtV%¹º£¢°¡ P 2 (Fq )2 ±¨y§ q = pn °p:  ±|§ Fq §#,wº£v¢¢¨ ((p; n); (fn ; 1 11 ; f1 ; f0); b) 2 Zn+4 ¨§ (fn; 1 1 1 ; f1 ; f0 ) § Z=pZ 2&ü[ f (x) = f0 + f1 x + 1fn xn ¦î§ b §8ï°b = 1: ;8ï¬ b = 2:[8ï±¦î¢¨
H Fq  IEEE P1363 [9] î £v¢¨ q { § 2 |3
v£¦Smv¨§ OEF[14] ¦SwgL¢¨°OEF v½rh¢¨±
 s 2 (Z=pZ)3 ¦}fxî§ E 2ô W = sP ¦LQ¢¨
 pLen := k § qLen := jFq j ¢¨*)F (EC) q}y®e`bjxî§}NJ_BHmv¨

4.2

8,: E

E Ùn§gn#,í¡¨[' ] ÅÃ m 2 f0; 1gqLen @,T (Fq ; a; b; p; P; W; pLen; qLen) 2 Zn+4 2 Z9 .
[)' ] !!Ã c = (C1 ; c2 ) 2 Z2 2 f0; 1gqLen .
m  (q; a; b; p; P; W; pLen; qLen), ¦Ùn¢ !!*Q E #,í¡¨
 r 2 (Z=pZ)3 ¦}fx¨
 E 2ô Q  C1 ¦#,wLQ¢¨
Q := rW;C1 := rP: c2 ¦#,wLQ¢¨
c2 := m 8 BqLen [xQ ]:
5

4.3

-,: D

D Ùn§gn#,í¡¨[' ] !!Ã c = (C1 ; c2 ) 2 Z2 2 f0; 1gqLen ,T (Fq ; a; b; p; P; W; pLen; qLen) 2
Zn+4 2 Z9 y¶CT s 2 Z¨[)' ] ÅÃ m 2 f0; 1gqLen¨c  (q; a; b; p; P; W; pLen; qLen), s, ¦Ùn§À!*Q D #,í¡¨

 E 2ô Q0 := sC1 y m0 := c2 8 BqLen [xQ ] ¦LQ¢¨0

 m0 ¦À!O2°ÅÃ m±gn¢¨5¤­¨#,§@RIyvSJ£¢Êú5 ¦Y¨
 (k shl±M  U^~cx}°Ùn£ k ± k shl
>VM ¦ gn¢U^~cx«@RIyv§T  !!-÷iyv§u¢ä%z }fxæ¦¢¸K{u¡§ |M }>VM ¦NJ¢¨Áiñá£M ¦Jv¢4"§ Êúè{¸K¢¨ wÊúè¦Jvv4"§>VM ¦NJ¢¨>VM  U^~cxp§IEEE P1363 [9]  Annex D.6 }§ [11]  6 þY£v¢wU^~cx¦NJ¢{|¢¨
 (k shl±  U^~cx«°Ùn£ k ± k shl ¦gn¢U^~cx¨p§°k shl±M ¦2<§M  U^~cx¡ § Miller-Rabin  âîjbl¦ t +G¡Èqb¢§M  ¦G¡È¨Ùn£
M { Miller-Rabin jbl¦ t +G¡Èqb4"§ M ¦ âîgn¢U^~cx¨§ Miller-Rabin  âîjbl§ IEEE P1363[9] Annex A.15.1  Miller-Rabin  âîjblRIew¢¨
y§ k( 88) shl {§2< Miller-Rabin  âîjbl¦ t(> 1) +qbzz¥ §" u¢0j§ ­prk

pk;t = 2t+4k (20 tk )tu¢{ç £v¢ [6]¨ oh`{5 «óJñ p¦ 10 þY¨ Y£¢oh`{5  pyv
§ SHA-1 ¦Jv¢¨£§ NIST ð"£§ Secure Hash Algorithm (SHA-1) ¦T¨ SHA-1 RI§ FIPS 180-1 standard [15] ew¢¨6 BíT!! SymE :§BíT!! SymE ¦Jv¢¨ SymE ¦^¢(óJñËÌ§p®mx!!u¢¨¡§ SymEnc(key; ptext) := key 8 ptext,
SymDec(key; ctext) := key 8 ctext¨§ 8 shlAßñsit¦&B¢¨
SymE T key ì¡|v_WcÅÃ¦!!-¢4"§ SymE
Ú&uh\!!}bl~®x!!¦NJ¢{|¢¨ )Fq}y®e U^~cx«
2°p > 3±)Fq}y®e U^~cxv§ IEEE P1363[9]  Annex A.12.4, 12.5 ew¢¨ F2 2)Fq}y®eU^~cxv§ IEEE P1363 [9]  Annex A.12.6, 12.7 ew¢¨ )F2I*QU^~cx«
2°p > 3±)FI*QU^~cxv§ IEEE P1363 [9] Annex A.10.1 ew¢¨ F2 2)FI*QU^~cxv
§ IEEE P1363 [9]  Annex A.10.2 ew¢¨
 8@ñ *QU^~cx«
IEEE P1363 [9]  Annex A.1 { A.3 Y£v¢U^~cxew¢¨
PSEC-2, PSEC-3mm

6 PSEC-1 82
6.1

&: GG Ùngn#,í¡u¢¨[[' ]  u¢d[{~jVq}y®e k 2 Z.

)' ] ,T (Fq ; a; b; p; P; W; hID; pLen; mLen; hLen; rLen; qLen) 2 Zn+4 2 Z13 ¶CT s 2 Z ¨k ¦Ùn¢T *Q G #,í¡u¢¨ #,)F (EC) q}y®e¦ °IEEE P1363 A.12.4 { 12.7, [9]±©HFq q}y®e§)F E ¦î¢q}y®e a  b °v£ Fq K±§E ô G u¢ p§$ { p u¢ E 2ô P ¨y§)Fq}y®e (a; b) § Weierstrass ¹öK8}¨§ 2k01  p  2k 0 1
¢¨§ô P § Fq 2UtV%¹º£¢°¡ P 2 (Fq )2 ±¨y§ q = pn °p:  ±|§ Fq §#,wº£v¢¢¨ ((p; n); (fn ; 1 11 ; f1 ; f0); b) 2 Zn+4 ¨§ (fn; 1 1 1 ; f1 ; f0 ) § Z=pZ 2
7&ü[ f (x) = f0 + f1 x + 1fn xn ¦î§ b §8ï°b = 1: ;8ï¬ b = 2:[8ï±¦î¢¨
H Fq  IEEE P1363 [9] î £v¢¨ q { § 2 |3

v£¦Smv¨§ OEF[14] ¦SwgL¢¨°OEF v½rh¢¨±
 s 2 (Z=pZ)3 ¦}fxî§ E 2ô W = sP ¦LQ¢¨
 pLen := k, qLen := jFq j î¢¨ mLen  rLen ¦ mLen + rLen  qLen ¢wî§ hLen  pLen ¢¨
 #,woh`{5 h: f0; 1gmLen+rLen 0! f0; 1ghLen ¦î§ \Æ´!¦ hID ¢¨ hID = 1 §@RIù 10 þpY¢oh`{5 ¢¨*)F (EC) q}y®e h `bjxî§}NJ_BHmv¨
8,: E

6.2

E Ùn§gn#,í¡¨[[' ] ÅÃ m 2 f0; 1gmLen @,T (Fq ; a; b; p; P; W; hID; pLen; mLen; hLen,
rLen; qLen) 2 Zn+4 2 Z13 .

)' ] !!Ã c = (C1; c2) 2 Z2 2 f0; 1gqLen.

m  (Fq ; a; b; p; P; W; h; pLen; mLen; rLen; qLen), ¦Ùn¢ !!*Q E #,í¡¨ r 2 f0; 1grLen ¦}fx§ t := h(mjjr) ¦LQ¢¨:= I[t]§ E 2ô Q  C1 ¦#,wLQ¢¨
Q := W;

C1 := P: c2 ¦#,wLQ¢¨
c2 := (mjjr) 8 BqLen [xQ ]:
6.3

-,: D

D Ùn§gn#,í¡¨[[' ] !!Ã c = (C1; c2) 2 Z2 2f0; 1gqLen ,T (Fq ; a; b; p; P; W; hID; pLen; mLen; hLen; rLen;
qLen) 2 Zn+4 2 Z13 y¶CT s 2 Z¨)' ] ÅÃ m 2 f0; 1gqLen }gn¨c  (Fq ; a; b; p; P; W; hID; pLen; mLen; hLen; rLen, qLen), s, ¦Ùn§À!*Q D #,í¡¨

8 E 2ô Q0 := sC1 y u := c2 8BqLen[xQ ] ¦LQ§  u0 = [u]mLen+rLen0¢¨ 0 := I[h(u0)] §#,[{ k¢zwz¦R0¢¨
C1 = 0 P:  k£§ [u0 ]mLen ¦ÅÃgn¢¨ kv4"§/gnv¨*R$¼"/4"§²¼"/³¦&B¢ÕÆgn¦v¨
7 PSEC-2 82
7.1

&: GG Ùngn#,í¡u¢¨[[' ]  u¢d[{~jVq}y®e k 2 Z¨)' ] ,T (Fq ; a; b; p; P; W; hID; gID; SEID; pLen; hLen; gLen; rLen; qLen) 2 Zn+42
¶CT s 2 Z ¨k ¦Ùn¢T *Q G #,í¡u¢¨ #,)F (EC) q}y®e¦ °IEEE P1363 A.12.4 { 12.7, [9]±©HFq q}y®e§)F E ¦î¢q}y®e a  b °v£ Fq K±§E ô G u¢ p§$ { p u¢ E 2ô P ¨y§)Fq}y®e (a; b) § Weierstrass ¹öK8}¨§ 2k01  p  2k 0 1
¢¨§ô P § Fq 2UtV%¹º£¢°¡ P 2 (Fq )2 ±¨y§ q = pn °p:  ±|§ Fq §#,wº£v¢¢¨ ((p; n); (fn ; 1 11 ; f1 ; f0); b) 2 Zn+4 ¨§ (fn; 1 1 1 ; f1 ; f0 ) § Z=pZ 2&ü[ f (x) = f0 + f1 x + 1fn xn ¦î§ b §8ï°b = 1: ;8ï¬ b = 2:[8ï±¦î¢¨
H Fq  IEEE P1363 [9] î £v¢¨ q { § 2 |3
v£¦Smv¨§ OEF[14] ¦SwgL¢¨°OEF v½rh¢¨±
 s 2 (Z=pZ)3 ¦}fxî§ E 2ô W = sP ¦LQ¢¨ pLen := k,qLen := jFq j î¢¨ rLen  qLen ¢w rLen ¦î¢¨
 #,w 2 oh`{5 h: f0; 1gmLen+rLen 0! f0; 1ghLen , g: f0; 1grLen 0!
f0; 1ggLen ¦î§ ££\Æ´!¦ HID y GID ¢¨ HID = 1 y
 GID =1 §@RIù 10 þpY¢oh`{5 ¢¨ BíT!! SymE ¦î§ \Æ´!¦ SEID ¢¨ SEID = 1 §p®m
x!!°one-time-pad±¢¨§ SymE = (SymEnc; SymDec) Bí
Z15 ,

9

T K ¦BíT!!ªÀ!U^~cxu¢¨ K ì gLen shl
u¢¨!!U^~cx SymEnc §T K ÅÃ X 2 BmLen ¦Ùn!
!Ã SymEnc(K; X )BmLen ¦gn¢¨À!U^~cx SymDec §T K !!Ã Y BmLen ¦ÙnÅÃ SymDec(K; Y )BmLen ¦gn¢¨§Ú&
T K § SymEnc(K; 1) § 1  1 5 ¢¨*)F (EC) q}y®e h; g `bjxî§}NJ_BHmv¨
7.2 8,: EE Ùn§gn#,í¡¨[[' ] ÅÃ m 2 f0; 1gmLen §y,T (Fq ; a; b; p; P; W;hID; gID; SEID; pLen;
hLen; gLen; rLen; qLen) 2 Zn+4 2 Z15 ¨)' ] !!Ã c = (C1; c2; c3) 2 Z2 2 f0; 1gqLen+mLen¨

m  (Fq ; a; b; p; P; W;hID; gID; SEID; pLen; hLen; gLen; rLen; qLen) ¦Ùn¢!!*Q E #,í¡¨
 r 2 f0; 1grLen ¦}fx§ g(r ) y t := h(mjjr) ¦LQ¢¨ := I[t] § E 2ô Q y C1 ¦#,wLQ¢¨
Q := W;

C1 := P: c2 ; c3 ¦#,wLQ¢¨
c2 := r 8 BqLen [xQ ];c3 := SymEnc(g (r); m):.: SymE ¦^¢(óJñËÌ§p®mx!!u¢¨¡§
SymEnc(key; ptext) := key 8 ptext;
SymDec(key; ctext) := key 8 ctext:

SymE T g (r) ì gLen µ|_Wc mLen ÅÃ M ¦!!-¢4"§ SymE òÍBíT!!°uh\!!}bl~®x!!±¦NJ

¢¨
7.3

-,: D

D Ùn§gn#,í¡¨[[' ] !!Ã c = (C1; c2; c3) ,T (Fq ; a; b; p; P; W; hID; gID; SEID; pLen; hLen;
gLen; rLen; qLen) 2 Zn+4 2 Z15 y¶CT s 2 Z¨)' ] ÅÃ m 2 f0; 1gmLen }gn¨
10c  (Fq ; a; b; p; P; W; hID; gID; SEID; pLen; hLen; gLen; rLen; qLen), s ¦Ùn§À!*Q D #,í¡¨
 E 2ô Q0 := sC1 y u := c2 8 BqLen[xQ ] ¦LQ§  r0 := [u]rLen¢¨ m0 := SymDec(g (r0 ); c3) ¦LQ¢¨
 0 := I[h(m0 jjr0 )] §#,[{ k¢zwz¦R0¢¨
0C1 = 0 P:  k£§ m0 ¦ÅÃgn¢¨ kv4"§/gnv¨*R$¼"/4"§²¼"/³¦&B¢ÕÆgn¦v¨
8 PSEC-3 82
8.1

&: GG Ùngn#,í¡u¢¨[[' ]  u¢d[{~jVq}y®e k 2 Z¨)' ] ,T (Fq ; a; b; p; P; W; hID; gID; SEID; pLen; hLen; gLen; rLen; qLen) 2 Zn+42
¶CT s 2 Z ¨k ¦Ùn¢T *Q G #,í¡u¢¨ #,)F (EC) q}y®e¦ °IEEE P1363 A.12.4 { 12.7, [9]±©HFq q}y®e§)F E ¦î¢q}y®e a  b °v£ Fq K±§E ô G u¢ p§$ { p u¢ E 2ô P ¨y§)Fq}y®e (a; b) § Weierstrass ¹öK8}¨§ 2k01  p  2k 0 1
¢¨§ô P § Fq 2UtV%¹º£¢°¡ P 2 (Fq )2 ±¨y§ q = pn °p:  ±|§ Fq §#,wº£v¢¢¨ ((p; n); (fn ; 1 11 ; f1 ; f0); b) 2 Zn+4 ¨§ (fn; 1 1 1 ; f1 ; f0 ) § Z=pZ 2&ü[ f (x) = f0 + f1 x + 1fn xn ¦î§ b §8ï°b = 1: ;8ï¬ b = 2:[8ï±¦î¢¨
H Fq  IEEE P1363 [9] î £v¢¨ q { § 2 |3
v£¦Smv¨§ OEF[14] ¦SwgL¢¨°OEF v½rh¢¨±
 s 2 (Z=pZ)3 ¦}fxî§ E 2ô W = sP ¦LQ¢¨ pLen := k,qLen := jFq j î¢¨ rLen  qLen ¢w rLen ¦î¢¨
 #,woh`{5 h: f0; 1g8+41qLen+21mLen 0! f0; 1ghLen , g: f0; 1gqLen 0!
f0; 1ggLen ¦î§ ££\Æ´!¦ HID y GID ¢¨ HID = 1 y
 GID =1 §@RIù 10 þpY¢oh`{5 ¢¨
Z15 ,

11

 BíT!! SymE ¦î§ \Æ´!¦ SEID ¢¨ SEID = 1 §p®m

x!!°one-time-pad±¢¨§ SymE = (SymEnc; SymDec) BíT K ¦BíT!!ªÀ!U^~cxu¢¨ K ì gLen shl
u¢¨!!U^~cx SymEnc §T K ÅÃ X 2 BmLen ¦Ùn!
!Ã SymEnc(K; X )BmLen ¦gn¢¨À!U^~cx SymDec §T K !!Ã Y BmLen ¦ÙnÅÃ SymDec(K; Y )BmLen ¦gn¢¨§Ú&
T K § SymEnc(K; 1) § 1  1 5 ¢¨*)F (EC) q}y®e h; g `bjxî§}NJ_BHmv¨
8.2 8,: EE Ùn§gn#,í¡¨[[' ] ÅÃ m 2 f0; 1gmLen §y,T (Fq ; a; b; p; P; W;hID; gID; SEID; pLen;
hLen; gLen; rLen; qLen) 2 Zn+4 2 Z15 ¨)' ] !!Ã c = (C1; c2; c3; c4) 2 Z2 2 f0; 1gqLen+mLen+hLen¨m  (Fq ; a; b; p; P; W;hID; gID; SEID; pLen; hLen; gLen; rLen; qLen) ¦Ùn¢!!*Q E #,í¡¨
 u 2 f0; 1gqLen y r 2 (Z=pZ)3 ¦(I}fx¨
 E 2ô C1 y T ¦#,wLQ¢¨
C1 := rP;

T := rW:¦LQ¢¨c2 := u 8 BqLen [xT ]y g(u) ¦LQ¢¨ c3 ; c4 ¦#,wLQ¢¨

c3 := SymEnc(g (u); m);c4 := h(B8+21qLen [C1]jjc2 jjc3jjujjm):.: SymE ¦^¢(óJñËÌ§p®mx!!u¢¨¡§
SymEnc(key; ptext) := key 8 ptext;
SymDec(key; ctext) := key 8 ctext:§ 8 shlAßñsit¦&B¢¨
SymE T g (u) ì gLen µ|_Wc mLen ÅÃ M ¦!!-¢4"§ SymE òÍBíT!!°uh\!!}bl~®x!!±¦NJ
¢¨
12

8.3

-,: D

D Ùn§gn#,í¡¨[[' ] !!Ã c = (C1 ; c2 ; c3 ; c4 ) 2 Z2 2 f0; 1gqLen+mLen+hLen ,T (Fq ; a; b; p; P;

W; hID; gID; SEID; pLen; hLen; gLen; rLen; qLen) 2 Zn+4 2 Z15 ¨y¶CT s 2 Z¨)' ] ÅÃ m 2 f0; 1gmLen }gn¨c  (Fq ; a; b; p; P; W; hID; gID; SEID; pLen; hLen; gLen; rLen; qLen), s ¦Ùn§À!*Q D #,í¡¨
 E 2ô T 0 := sC1 y u0 := c2 8 BqLen[xT ] ¦LQ¢¨
 m0 := SymDec(g (u0 ); c3 ) ¦LQ¢¨
 #,[{ k¢zwz¦R0¢¨
0c4 = h(B8+21qLen [C1 ]jjc2jjc3 jju0jjm0):  k£§ m0 ¦ÅÃgn¢¨ kv4"§/gnv¨*R$¼"/4"§²¼"/³¦&B¢ÕÆgn¦v¨
8.4 (+* PSEC-3 8,356478 :9/0!!§#,wdh`|ñNJËÌ{1Ý¢¨ 7_§ u 2 f0; 1gqLen y r 2 (Z=pZ)3 ¦(I}fx¨ 7_§ C1 := rP , T := rW , c2 := u 8 BqLen [xT ] y K := g (u) ¦LQ§ (C1 ; c2 ) ¦7¢¨ °¶CT¦ÉW¢±a7_§ (C1; c2) z u ¦À!-§ K := g (u) ¦LQ¢¨ [TàtX®cb]
 #§ÅÃ mi °i = 1; 2; : : : ;±§7_§ c3;i := SymEnc(K; mi ) y c4;i := H (B8+21qLen[C1]jjc2jjc3;i jjujjmi) ¦LQ§ (c3;i; c4;i) ¦7¢¨
 a7_§ K ¦Jv mi ¦À!¢ÒX c4;i = H (B8+21qLen[C1]jjc2jjc3;ijjujjmi )Í R0¦w¨ [!!í7tX®cb]

PSEC-39 §¥$"ª#,§ PSEC-1, PSEC-2, PSEC-3 Bí¢q}y®e ûæ¦Y¨
 k : 160 #2°p _Wc¦ 160 shl#2±
 hLen: 128 #2
13

#,§²PSEC !!Z»0ù³Y² Ý»0³ºñq}y®eæ¦Y¨
PSEC-1, PSEC-2, PSEC-3 yvBíq}y®e§ p y q _Wc¦
160 bits ¢¨ § PSEC-1 4"§ mLen = 128, rLen = 32, hLen = 160§
PSEC-2 °p®mx!!NJ±4"§ rLen = 160, gLen = 128, hLen = 160§ PSEC-3 °p®mx!!NJ±4"§ qLen = 160, gLen = 128, pLen = 160,
hLen = 128§¢¨
10 #­¨
9hw§ h °y g±{iñ}fx5 u¢| PSEC  ¦0E¢{|¢¨(Ë§^'!!U^~cx¦^¢'iñ}fx5 ¥¡^Jñ(Ë 5 °px SHA ±¦Jv¢¨§SHA ¦JvÚ&_Wc°hLen shl±¦gn¢5 H ( p¦Y¨ËÌ§ Bellare  Rogaway ¡Y£ËÌu¢ [3]¨
SHA (x)  x  SHA ¦òJÔ £ 160 shlgnæ¦&B¢¨§ 160shl \ø:æ" ¦ ABCDE =  ¢¨ SHAl (x) ¦ SHA (x) Ð l shl¢¨§ i ¦ 32 shl¾!-æ¦ < i > ¢¨5 H ¦#,wî¢¨
80LH (x) := SHA80
 (< 0 > jjx)jjSHA (< 1 > jjx)jj 11 1 jjSHA (< l > jjx);l l = b 380k c, z Ll = hLen 0 80l.

1[1] Bellare, M., Desai, A., Pointcheval, D., and Rogaway, P.: Relations Among Notions of Security for Public-Key Encryption Schemes, Proc. of Crypto'98, LNCS
1462, Springer-Verlag, pp. 26{45 (1998).
[2] Bellare, M. and Rogaway, P.: Random Oracles are Practical: A Paradigm for
Designing Ecient Protocols, Proc. of the First ACM Conference on Computerand Communications Security, pp.62{73 (1993).
[3] Bellare, M. and Rogaway, P. : Optimal Asymmetric Encryption, Proc. of Eurocrypt'94, LNCS 950, Springer-Verlag pp.92-111 (1995).
[4] Bleichenbacher, D.: Chosen Ciphertext Attacks Against Protocols Based on the
RSA Encryption Standard PKCS #1, Proc. of Crypto'98, LNCS 1462, SpringerVerlag, pp. 1{12 (1998).
[5] Canetti, R., Goldreich, O. and Halevi, S.: The Random Oracle Methodology,
Revisited, Proc. of STOC, ACM Press, pp.209{218 (1998).

14

[6] Damgard, I., Landrock, P., and Pomerance, C., \Average Case Error Estimates for
the Strong Probable Prime Test", Matematics of Computation 61(1993), pp.177{
194.
[7] Fujisaki, E., and Okamoto, T., \How to Enhance the Security of Public-Key
Encryption at Minimum Cost", IEICE Trans. Fundamentals, Vol.E83-A, NO.1
January, pp.24{32, 2000.
[8] Fujisaki, E. and Okamoto, T.: Secure Integration of Asymmetric and Symmetric
Encryption Schemes, Proc. of Crypto'99, Springer-Verlag, LNCS 1666, pp. 535{
554 (1999).
[9] IEEE P1363 Draft (D9), http://grouper.ieee.org/groups/1363/P1363/draft.html(1999).
[10] Joye, M., Quisquater, J.J., and Yung, M.: On the Power of Misbehaving Adversaries and Security Analysis of EPOC, Manuscript (February 2000).
[11] Menezes, A., van Oorschot, P., and Vanstone, S., \Handbook of Applied Cryptography", CRC Press, Boca Raton, Florida 1996.
[12] Okamoto, T. and Pointcheval, D.: OCAC: an Optimal Conversion for Asymmetric
Cryptosystems, manuscript (2000).
[13] Okamoto, T. and Pointcheval, D.: PSEC{3: Provably Secure Elliptic Curve Encryption Scheme { V3, submission to P1363a (2000).
[14] Bailey, D. V. and Paar, C.: Optimal Extension Fields for Fast Arithmetic in
Public-Key Algorithms, Proc. of Crypto'98, LNCS 1462, Springer-Verlag, pp.472485 (1998).
[15] FIPS 180-1 \Secure Hash Standard", Federal Information Processing Standards
Publication 180-1, U.S. Department of Commerce/N.I.S.T., National Technical
Information Service, Spring eld, Virginia, April 17 1995.

15

Appendix
A De nition of Optimal Extension Field(OEF)
binomial : a polynomial of the form tm

0 !.

pseudo-Mersenne prime: a positive rational integer of the form 2nbn=2c.

Optimal Extension Field(OEF): a

6 c; log2 nite eld Fpm with p a pseudo-Mersenne

prime and an irreducible binomial as the eld polynomial.

B Finite Field Arithmetic
An odd characteristic extension eld is a nite eld whose number of elements is a

power of an odd prime. If m  1, then there is a unique eld Fpm with pm elements.
For purposes of conversion, the elements of Fpm shall be represented in polynomial
basis.
This representation is determined by choosing an irreducible polynomial p(t) overFp . Then Fpm is isomorphic to Fp [t]=p(t). This interpretation shall be the bit string
formed by concatenating the values of the coecients represented as integers. Thus
the polynomial

am01 tm01 + : : : + a2 t2 + a1t + a0

is represented by the bit string(am01 ; : : : ; a2 ; a1 ; a0 )where each of the ai are positive integers less than p, padded with leading 0 bits sothat each ai is represented with dlog2 pe bits.

16