text:
An elliptic curve encryption system represents coordinates of a point on the curve as a vector of binary digits in a normal basis representation in F2.spsb.m. A key is generated from multiple additions of one or more points in a finite field. Inverses of values are computed using a finite field multiplier and successive exponentiations. A key is represented as the coordinates of a point on the curve and key transfer may be accomplished with the transmission of only one coordinate and identifying information of the second. An encryption protocol using one of the coordinates and a further function of that coordinate is also described.
1. In a data encryption system in which the data is combined with an encryption key to produce ciphertext, a method of generating a key comprising the steps of
a) selecting an elliptic curve of the form y2 +xy=x3 +ax2 +b lying in the finite field GF2m, said field being selected to have elements A2.spsp.i (o≦i≦m) that constitute a normal basis,
b) representing the coordinates of a point on said curve as a set of vectors, each vector representing a coordinate of said point and having m binary digits, each of which represents the coefficient of A2.spsp.i in the normal basis representation of said vector,
c) computing from addition of at least two sets of vectors an additional set of vectors to represent the coordinates of further point on said curve, and
d) utilising said additional set of vectors to derive a key for encrypting data.
2. A method according to claim 1 wherein addition of sets of vectors involves at lest one squaring operation.
3. A method according to claim 2 wherein said squaring operation is performed on at least one of said vectors of one of said sets representing a point.
4. A method according to claim 3 wherein said squaring operation is performed on combinations of vectors from a plurality of said sets representing respective points.
5. A method according to claim 3 wherein each of said vectors is represented as m binary digits and squaring thereof is performed by a cyclic shift of said m binary digits.
6. A method according to claim 5 wherein said m binary digits are stored in respective cells of a shift register and squaring thereof is performed by a cyclic shift of said m bits in said register.
7. A method according to claim 1 wherein addition of sets of vectors involves the computation of at least one inverse of a vector.
8. A method according to claim 7 wherein said inversion utilises multiple squaring operations.
9. A method according to claim 8 wherein squaring operations are performed by a cyclic shift of binary digits.
10. A method according to claim 7 wherein computation of said inverse includes an exponentiation of the square of the vector to provide a value γ of the form
γ=β1+2+2.spsp.2 .sup.. . . 2.spsp.g-1
where β is the square of the vector and g is a factor of m-1.
11. A method according to claim 10 wherein successive terms of said exponentiation are obtained by successive cyclic shifts of the vector.
12. A method according to claim 11 wherein the value of the γ is accumulated after each cyclic shift by multiplication of the shifted term with the previously accumulated value of γ.
13. A method according to claim 10 wherein m binary digits representing β are stored in each of a pair of shift registers, one of said pair of registers being cyclically shifted and said pair of registers being multiplied to provide an intermediate value of γ.
14. A method according to claim 13 wherein said one of said pair of registers is further cyclically shifted to provide a further successive term of said expansion and said further successive term multiplied with said intermediate value to provide a further intermediate value of γ.
15. A method according to claim 14 wherein said cyclic shifting and multiplication is performed g-2 times to complete said exponentiation of β and provide a value of γ.
16. A method according to claim 10 where computation of said inverse includes a further exponentiation of γ of the form
γ1+2.spsp.g+2.spsp.2g .sup.. . . 2.spsp.(h-i)g
where h is a factor of m-1 such that gh=m-1.
17. A method according to claim 16 wherein successive terms said further exponentiation are obtained by successive cyclic shifts of the m binary digits representing γ.
18. A method according to claim 17 wherein the value of said inverse is accumulated after each cyclic shift by multiplication of the shifted term with the previously accumulated value of γ.
19. A method according to claim 16 wherein m binary digits representing γ are stored in each of a pair of shift registers, one of said pair of registers being cyclically shifted and said pair of registers being multiplied together to provide an intermediate value of said inverse.
20. A method according to claim 19 wherein said one of said pair of registers is further cyclically shifted to provide a further successive term of said expansion which is then multiplied with said intermediate value of said inverse to provide a further intermediate value thereof.
21. A method according to claim 20 wherein said cyclic shifting and multiplication is performed (h-1)g-1 times to complete exponentiation of γ.
22. A method according to claim 11 wherein said further point on said curve is an integer multiple d of said point P and said value dP is computed by successively doubling multiples of P to provide terms 2i P from t=o to t=m, and computing ##EQU16## where λ is the coefficient of the binary representation of d.
23. A method according to claim 22 wherein doubling of multiples of p is obtained by computing ##EQU17## and ##EQU18## where x1 y1 are the coordinates of the point 2i-1 and x3 y3 are the coordinates of the point 2i p.
24. A method according to claim 23 wherein computation of the term x1 2 is obtained by a cyclic shift of binary digits representing x1 in a normal basis.
25. A method according to claim 24 wherein computation of the inverse of x1 2 is computed by an exponentiation of x1 2 to provide a value γ of the form
β1+2+2 2 . . . 2g-1
where β=x1 2 and g is a factor of m-1.
26. A method according to claim 25 wherein successive terms of said exponentiation are obtained by successive cyclic shifts of the binary digits representing x1 2 in a normal basis.
27. A method according to claim 26 wherein computation of the inverse of x1 2 includes a further exponentiation of γ of the form
γΣ1+2g +22g . . . 2.sup.(h-i)g
where h is a factor of m-1 such that gh=m-1.
28. A method according to claim 27 wherein successive terms said further exponentiation are obtained by successive cyclic shifts of the m binary digits representing γ.
29. A method of transferring the coordinates of a point on an algebraic curve defined by a function of two variables between a pair of correspondents connected by a data communications link comprising the steps of forwarding from one correspondent to another a coordinate of said point, providing at said other correspondent parameters of said algebraic curve, and computing at said other correspondent said other coordinate from said one coordinate and said algebraic curve.
30. A method according to claim 29 including the step of forwarding with said one coordinate identifying information of said other coordinate and utilising said identifying information and a discriminating function to determine the appropriate value of said other coordinate.
31. A method according to claim 30 wherein said identifying information is a digital bit of said other coordinate that identifies the appropriate value of said other coordinate.
32. A method according to claim 30 wherein said algebraic curve is an elliptic curve of the form y2 +xy=x3 +ax2 +b and said other coordinate is determined by solving a quadratic equation to provide two possible values of said other coordinate, said identifying information indicating the appropriate one of said values.
33. A method according to claim 32 wherein said identifying information is a digital bit of said other coordinate that identifies the appropriate value of said other coordinate.
34. A method according to claim 30 wherein said algebraic curve is defined over the field Zp and said identifying information indicates the Legendre symbol of the appropriate value.
35. A method according to claim 30 wherein said curve is defined over the field zp and the elements thereof subdivided into a pair of subsets, one of which contains one possible value and the other of which contains the other possible value, said indicating information identifying the subset containing the appropriate value.
36. A method according to claim 29 wherein said algebraic curve is an elliptic curve of the form y2 +xy=x3 +ax+b defined over a finite field F2 m.
37. A method according to claim 36 including the step of forwarding with said one coordinate identifying information of said other coordinate and utilising said identifying information and a discriminating function to determine the appropriate value of said other coordinate.
38. A method according to claim 37 wherein said field GF2m has field elements A2.spsp.i that constitute a normal basis.
39. A method according to claim 38 wherein said other coordinate is determined by solving a quadratic equation to provide two possible values of said other coordinate, said identifying information indicating the appropriate one of said values.
40. A method according to claim 38 wherein said quadratic equation is solved by summing terms of the form c from g=0 to g=m-1 where ##EQU19## and x0 is said one coordinate.
41. A method according to claim 40 wherein terms of the form c are obtained by g fold cyclic shifts of the normal basis representation of c.
42. A method of encrypting a message m using a public key cryptographic system and having a private key formed from a bit string representative of a coordinate (x, y) of a point p on an elliptic curve, said method comprising the steps of representing said message m as a pair of message bit strings m1 m2 of length corresponding to the bit strings representing the coordinates x,y, and combining said message bit strings with an enciphering bit string derived from at least one of said coordinates to generate a ciphertext c of said message.
43. A method according to claim 42 wherein said enciphering bit strings are derived from each of said coordinates to produce ciphertext c.
44. A method according to claim 42 wherein said message bit strings are combined with enciphering bit strings derived from one of said coordinates and a function thereof to produce said ciphertext.
45. A method according to claim 43 wherein said enciphering bit string is derived from said coordinate x and the cube x3 thereof.
46. A method according to claim 42 wherein field elements z are derived from at least one of said coordinates and modify the combination of said message bit strings and said enciphering bit string.
47. A method according to claim 46 wherein said ciphertext c is of the form (c1 c2) where
c1 =z1 (m1 ⊕f1 (x0)) and
c2 +z2 (m1 ⊕f2 (x0));
f1 (x0)f2 (x) are respective first and second values derived from the coordinate x and z1 and z2 are respective field elements derived from the coordinate x.
48. A method according to claim 47 wherein f2 (x) is said second coordinate y.
49. A method according to claim 47 wherein f2 (x) is the cube of the value of the coordinate x.
50. A method according to claim 47 wherein said field elements z are formed by concatenating part of each of said values f1 (x), f2 (x).
51. A method according to claim 50 wherein f2 (x) is derived from the cube of the value of the coordinate x.
52. A method according to claim 47 wherein
c1 =z1 (m1 ⊕x0)
c2 =z2 (m2 ⊕x0 3)
z1 =x01 ∥x2 3
z2 =x2 ∥x1 3
where x1 ∥x2 3 is the counterclaim of the first half of the representation of the coordinate x and the second half of the cancellation of the representation of x3 and x2 ∥x1 3 is the concatenation of the second half of the representation of the coordinate x with the first half of the representation of the X3.
This is a continuation of PCT/CA95/00452, filed on Jul. 31, 1995, which is a continuation-in-part of Ser. No. 08/282,263, filed on Jul. 29, 1994, now abandoned.
The present invention relates to public key cryptography.
The increasing use and sophistication of data transmission in such fields as telecommunications, networking, cellular communication, wireless communications, "smart card" applications, audio-visual and video communications has led to an increasing need for systems that permit data encryption, authentication and verification.
It is well known that data can be encrypted by utilizing a pair of keys, one of which is public and one of which is private. The keys are mathematically related such that data encrypted with the public key may only be decrypted with the private key and conversely, data encrypted with the private key can only be decrypted with the public key. In this way, the public key of a recipient may be made available so that data intended for that recipient may be encrypted with the public key and only decrypted by the recipient's private key, or conversely, encrypted data sent can be verified as authentic when decrypted with the sender's public key.
The most well known and accepted public key cryptosystems are those based on integer factorization and discrete logarithms in finite groups. In particular, the RSA system for modulus n=p�q where p and q are primes, the Diffie-Hellman key exchange and the ElGamal protocol in Zp, (p a prime) have been implemented worldwide.
The RSA encryption scheme, where two primes p and q are multiplied to provide a modulus n, is based on the integer factorization problem. The public key e and private key d are related such that their product e�d equals 1(mod φ) where φ=(p-1) (q-1). A message M is encrypted by exponentiating it with the private key e to the modulus n, [C=Me (mod - n)] and decrypted by exponentiating with the public key mod n [M=Cd (mod n)]. This technique requires the transmission of the modulus n and the public key and the security of the system is based on the difficulty of factoring a large number that has no relatively small factors. Accordingly both p and q must be relatively large primes.
One disadvantage of this system is that p and g must be relatively large (at least 512 bits) to attain an adequate level of security. With the RSA protocol this results in a 1024 bit modulus and a 512 bit public key which require significant bandwidth and storage capabilities. For this reason researchers have looked for public key schemes which reduce the size of the public key. Moreover, recent advances in analytical techniques and associated algorithms have rendered the RSA encryption scheme potentially vulnerable and accordingly raised concerns about the security of such schemes. This implies that larger primes, and therefore a larger modulus, need to be employed in order to maintain an acceptable level of security. This in turn increases the bandwidth and storage requirements for the implementation of such a scheme.
Since the introduction of the concept of public key cryptography by Diffie and Hellman in 1976, the potential for the use of the discrete logarithm problem in public key cryptosystems has been recognized. In 1985, ElGamal described an explicit methodology for using this problem to implement a fully functional public key cryptosystem, including digital signatures. This methodology has been refined and incorporated with various protocols to meet a variety of applications, and one of its extensions forms the basis for a proposed U.S. digital signature standard (DSS). Although the discrete logarithm problem, as first employed by Diffie and Hellman in their public key exchange algorithm, referred explicitly to the problem of finding logarithms with respect to a primitive element in the multiplicative group of the field of integers modulo a prime p, this idea can be extended to arbitrary groups (with the difficulty of the problem apparently varying with the representation of the group).
The discrete logarithm problem assumes that G is a finite group, and a and b are elements of C. Then the discrete logarithm problem for G is to determine a value x (when it exists) such that ax =b. The value for x is called a logarithm of b to the base of a, and is denoted by loga b.
The difficulty of determining this quantity depends on the representation of G. For example, if the abstract cyclic group of order m is represented in the form of the integers modulo m, then the solution to the discrete logarithm problem reduces to the extended Euclidean algorithm, which is relatively easy to solve. However, the problem is made much more difficult if m+1 is a prime, and the group is represented in the form of the multiplicative group of the finite field Fm+1. This is because the computations must be performed according to the special calculations required for operating in finite fields.
It is also known that by using computations in a finite field whose members lie on an elliptic curve, that is by defining a group structure G on the solutions of y2 +xy=x3 +ax2 +b over a finite field, the problem is again made much more difficult because of the attributes of elliptic curves. Therefore, it is possible to attain an increased level of security for a given size of key. Alternatively a reduced key may be used to maintain a required degree of security.
The inherent security provided by the use of elliptic curves is derived from the characteristic that an addition of two points on the curve can be defined as a further point that itself lies on the curve. Likewise the result of the addition of a point to itself will result in another point on the curve. Therefore, by selecting a starting point on the curve and multiplying it by an integer, a new point is obtained that lies on the curve. This means that where P=(x,y) is a point on an elliptic curve over a finite field [E(Fq.spsb.a)], with x and y each represented by a vector of n elements then, for any other point Rε<P> (the subgroup generated by P), dP=R. To attack such a scheme, the task is to determine an efficient method to find an integer d, O≦d≦(order of P)-1 such that dP=R. To break such a scheme, the best algorithms known to date have running times no better than O(√p), where p is the largest prime dividing the order of the curve (the number of points on the curve).
Thus, in a cryptographic system where the integer d remains secret, the difficulty of determining d can be exploited.
An ElGamal protocol of key exchange based on elliptic curves takes advantage of this characteristic in its definition of private and public keys. Such an ElGamal protocol operates as follows:
1. In order to set up the protocol, where a message is to be sent from A to B, an elliptic curve must be selected and a point P=(x,y), known as the generating point, must be selected.
2. The receiver, B, then picks a random integer d as his private key. He then computes dP, which is another point on the curve, which becomes his public key that is made available to the sender and the public. Although the sender knows the value dP, due to the characteristic of elliptic curves noted above, he has great difficulty determining the private key d.
3. The sender A, chooses another random integer k, the session seed, and computes another point on the curve, kP which serves as a public session key. This also exploits the characteristic of elliptic curves mentioned above.
4. The sender, A, then retrieves the public key dP of receiver B and computes kdP, another point on the curve, which serves as the shared encryption key for that session.
5. The sender, A, then encrypts the message M with the encryption key to obtain the ciphertext C.
6. The sender then sends the public session key kP and the ciphertext C to the receiver B.
7. The receiver, B, determines the encryption key kdP by multiplying his private key d by kP.
8. The receiver, B, can then retrieve the message M by decrypting the ciphertext C with the encryption key kdP.
During the entire exchange, the private key d and the seed key k remain secret so that even if an interloper intercepts the session key kP he cannot derive the encryption key kdP from B's public key dP.
Elliptic curve cryptosystems can thus be implemented employing public and private keys and using the ElGamal protocol.
The elliptic curve cryptography method has a number of benefits. First, each person can define his own elliptic curve for encryption and decryption, which gives rise to increased security. If the private key security is compromised, the elliptic curve can be easily redefined and new public and private keys can be generated to return to a secure system. In addition, to decrypt data encoded with the method, only the parameters for the elliptic curve and the session key need be transmitted.
One of the drawbacks of other public key systems is the large bandwidth and storage requirements for the public keys. The implementation of a public key system using elliptic curves reduces the bandwidth and storage requirements of the public key system because the parameters can be stored in fewer bits. Until now, however, such a scheme was considered impractical due to the computational difficulties involved and the requirement for high speed calculations. The computation of kP, dP and kdP used in a key exchange protocol require complex calculations due to the mathematics involved in adding points in elliptic curve fields.
Computations on an elliptic curve are performed according to a well known set of relationships. If K defines any field, then an equation of the form y2 +a1 xy+a3 y=x3 +a2 x2 +a4 x+a6, where each of the coefficients ai lie in K, defines an elliptic curve over K. If E is the set of points on this curve, then an abelian group can be defined on the set E∪{O}, where O is a special element not occurring in E. O acts as the zero element of the group. If P=(x,y), then -P=(x,-y) in the case of an odd characteristic, and for two points P and Q on the curve where Q≠�P, the sum P+Q is the third point on the curve where the line joining P and Q again meets the curve. If P=Q, then the tangent line is used. As in any abelian group, we use the notation nP to denote P added to itself n times if n is positive, and -P added to itself |n| times if n is negative, and 0P=O.
If Fq is a finite field, then elliptic curves over Fq can be divided into two classes, namely supersingular and non-supersingular curves. If Fq is of characteristic 2, i.e. g=2M, then the classes are defined as follows.
i) The set of all solutions to the equation y2 +ay=x3 +bx+c where a,b,cεFq, a≠0, together with a special point called the point at infinity O is a supersingular curve over Fq.
ii) The set of all solutions to the equation y2 +xy=x3 +ax2 +b where a,bεFq, b≠0, together with a special point called the point at infinity O is a nonsupersingular curve over Fq.
By defining an appropriate addition on these points, we obtain an additive abelian group. The addition of two points P(x1,y1) and Q(x2,y2) for the supersingular elliptic curve E with y2 +ay=x3 +bx+c is given by the following:
If P=(x2,y2)εE; then define
-P=(x1,y1 +a), P+O=O+P=P for all PεE.
If Q=(x2,y2) εE and Q≠-P, then the point representing the sum of P+Q, is denoted (x3,y3), where ##EQU1##
The addition of two points P(x1,y1) and Q(x2,y2) for the nonsupersingular elliptic curve y2 +xy=x3 +ax2 +b is given by the following:
If P=(x1,y1) εE then define -P=(x1, y1 +x1). For all PεE, O+P=P+O=P. If Q=(x2,y2) εE and Q≠-P, then P+Q is a point (x3,y3) where ##EQU2##
Accordingly it can be seen that computing the sum of two points on E requires several multiplications, additions, and inverses in the underlying field Fq. In turn, each of these operations requires a sequence of elementary bit operations.
When implementing an ElGamal or Diffie-Hellman scheme with elliptic curves, one is required to compute kP=P+P+ . . . +P (P added k times) where k is a positive integer and PεE. This requires the computation of (x3,y3) to be computed k-1 times. Even if alternative techniques such as "double and add" are utilised, it is still necessary to compute the addition of two points several times, each of which requires multiplications, additions and inverses in the underlying finite field. For large values of k which are typically necessary in cryptographic applications, this has previously been considered impractical for data communication.
It is an object of the present invention to provide a method of encryption utilizing elliptic curves that facilitates the computation of additions of points while providing an adequate level of security in an efficient and effective manner.
The applicants have developed a method using a modified version of the Diffie-Hellman and ElGamal protocols defined in the group associated with the points on an elliptic curve over a finite field. The method involves formulating the elliptic curve calculations so as to make elliptic curve cryptography efficient, practical and viable, and preferably employs the use of finite field processor such as the Computational Method and Apparatus for Finite Field Multiplication as disclosed in U.S. Pat. No. 4,745,568. The preferred method exploits the strengths of such a processor with its computational abilities in finite fields. The inventive method structures the elliptic curve calculations as finite field multiplication and exponentiation over the field F2.spsb.m. In the preferred method, a normal basis representation of the finite field is selected and the calculations which can readily be performed on a finite field processor.
The inventors have recognized that the computations necessary to implement the elliptic curve calculations can be performed efficiently where a finite field of characteristic 2 is chosen.
When computing in a field of characteristic 2, i.e. F2.spsb.m, squaring is a linear operation, i.e. (A+B)2 is A2 +B2. By adapting appropriate representations, the computation of the squared terms required in the addition of two points is greatly simplified. In particular, if a normal basis representation is chosen, squaring can be achieved through a cyclic shift of the binary vector representing the field element to be squared.
Moreover, computing inverses in F2.spsb.m can be implemented with simple shift and XOR operations by selection of an appropriate representation. In some implementations, the computation of an inverse can be arranged to utilize multiple squaring operations and thereby improve the efficiency of the computation.
When such computations are performed using a normal basis representation of the finite field, the inventors have also recognized that the elliptic curve calculations are further simplified with the computations presented in this form, the applicants have realized that specialized semiconductor devices can be fabricated to perform the calculations. With the calculations presented in such a form, additions in the field F2.spsb.m can be efficiently performed in one clock cycle utilizing a simple XOR operation.
Multiplications can be performed very efficiently in only n clock cycles where n is the number of bits being multiplied. Furthermore, squaring can be efficiently performed in 1 clock cycle as a cyclic shift of the bit register. Finally, inverses can easily be computed, requiring approximately log2 n multiplications rather than the approximately 2n multiplications required in other arithmetic systems.
The inventors have also recognized that the bandwidth and storage requirements of a cryptographic system utilizing elliptic curves can be significantly reduced where for any point P(x,y) on the curve, only the x coordinate and one bit of the y coordinate need be stored and transmitted, since the one bit will indicate which of the two possible solutions is the second coordinate.
The inventors have also recognized when using the ElGamal protocol that messages need not be points on the curve if the protocol is modified such that the message M is considered as a pair of field elements M1 M2 and each is operated on by the coordinates (x1 y) of the session encryption key kdP in a predetermined manner to produce new field elements C1 C2 that represent the ciphertext C. The receiver can then extract the message M=(m1,m2) by applying the inverse transformation of the predetermined manner. Although this may require an inverse operation in the field, they may be performed efficiently in the field F2.spsb.155, and in particular when operating with the processor noted above.
To assist in the appreciation of the implementation of the present invention , it is believed that a review of the underlying principles of finite field operations is appropriate. The finite field F2 is the number system in which the only elements are the binary numbers 0 and 1 and in which the rules of addition and multiplication are the following:
These rules are commonly called modulo-2 arithmetic. All additions specified in logic expressions or by adders in this application are performed modulo-2 as an XOR operation. Furthermore, multiplication is implemented with logical AND gates.
The finite field F2.spsb.m, where m is an integer greater than 1, is the number system in which there are 2m elements and in which the rules of addition and multiplication correspond to arithmetic modulo an irreducible polynomial of degree m with coefficients in F2. Although in an abstract sense there is for each m only one field F2.spsb.m, the complexity of the logic required to perform operations in F2.spsb.m depends strongly on the particular way in which the field elements are represented. These operations may be performed using processors implemented in either hardware or software with dedicated hardware processors generally considered faster.
The conventional approach to operations performed in F2.spsb.m is described in such papers as T. Bartee and D. Schneider, "Computation with Finite Fields", Information and Control, Vol. 6, pp. 79-98, 1963. In this conventional approach, one first chooses a polynomial P(X) of degree m which is irreducible over F2.spsb.m, that is, P(X) has binary coefficients but cannot be factored into a product of polynomials with binary coefficients each of whose degree is less than m. An element A in F2.spsb.m is then defined to be a root of P(X), that is, to satisfy P(A)=0. The fact that P(X) is irreducible guarantees that the m elements A0 =1, A, A2, . . . Am-1 of F2.spsb.m are linearly independent over F2.
For the purposes of illustration, the example of F2.spsb.3 will be used with the choice of P(X)=X3 +X+1 for the irreducible polynomial of degree 3. The next step is to define A as an element of F2.spsb.3 such that A3 +A+1=0. The following assignment of unit vectors is then made:
An arbitrary element B of F2, is now represented by the binary vector [b2, b1, b0 ] with the meaning that B=[b2, b1, b0 ]=b2 A2 +b1 A+b0.
If we represent a second element C=[c2, c1, c0 ], it follows that B+C=[b2 ⊕c2, b1 ⊕c1, b0 ⊕c0 ].
Thus, in the conventional approach, addition in F2.spsb.3 is easily performed by logic that merely forms the modulo-2 sum of the two vectors representing the elements to be summed component-by-component. Multiplication is, however, considerably more complex to implement.
Continuing the example, from the irreducible polynomial it can be seen that A3 =A+1 and A4 =A2 +A where use has been made of the fact that -1=+1 in F(2). In hardware, multiplication can be simplified by taking advantage of the special feature of a finite field F2.spsb.m that there always exists a so-called normal basis for the finite field. That is, one can always find a field element N such that N, N2, N4 . . . N2m-1 are a basis for F2.spsb.m. Every field element B can be uniquely written as B=bm-1 N2m-1 + . . . +b2 N4 +b1 N2 +b0 N=[bm-1, . . . , b2,b1,b0 ] where b0, b1,b2, . . . bm-1 are binary digits.
For example, in the finite field F2.spsb.3, if we let N=[1,1,0]
______________________________________ Normal basis Element Field Normal Basis Representation Vector______________________________________[0,0,0] -- [0,0,0] [1,0,0] N2 + N4 [1,1,1] [0,1,0] N + N2 + N4 [0,1,1] [0,0,1] N + N2 [1,0,1] [1,1,0] N [1,0,0] [1,0,1] N + N4 [0,1,0] [0,1,1] N [1,1,0] [1,1,1] N2 [0,0,1]______________________________________
Then, if B=[bm-1, . . . ,b2,b1,b0 ] and C=[cm-1, . . . ,c2, c1,c0 ] are any two elements of F2.spsb.m in normal basis representation, then the product D=B�C=[dm-1. . . , d2,d1,d0 ] has the property that the same logic circuitry which when applied to the components or binary digits of the vectors representing B and C produces dm-1 will sequentially produce the remaining components dm-2, . . . , d2,d1,d0 of the product when applied to the components of the successive shifts of the vectors representing B and C.
As illustrated in U.S. Pat. No. 4,745,568 for Computational Method and Apparatus for Finite Field Multiplication, multiplication may be implemented by storing bit vectors B and C in respective shift registers and establishing connections to respective accumulating cells such that a grouped term of each of the expressions di is generated in respective ones of m accumulating cells. By rotating the bit vectors B and C in the shift registers and by rotating the contents of the accumulating cells, each grouped term of a respective binary digit di is accumulated in successive cells. Thus all of the binary digits of the product vector are generated simultaneously in the accumulating cells after one complete rotation of the bit vectors B and C.
One attribute of operating such a processor is that in the field F2.spsb.m, is that squaring is a linear operation in the sense that for every pair of elements B and C in F2.spsb.m, (B+C)2 =B2 +C2. It is the case for every element B of F2.spsb.m that B2.spsp.M =B.
In particular in a normal basis representation, squaring an element involves a cyclic shift of the vectors representation of the element, i.e. if B=[bm-1, . . . ,b2,b1,b0 ] then B2 =[bm-2, . . . ,b2, b1,b0, bm-1 ].
Thus when using the processor exemplified above, squaring may be achieved in one cycle. Moreover, this general characteristic of F2.spsb.m, where squaring is a linear operation, may be exploited in other implementations, such as software, where a normal basis representation is not used.
As noted above, the inventors have taken advantage of the efficiency of the mathematical operations in F2.spsb.m in the implementation of an elliptic curve encryption scheme. The applicants have developed a method of formulating the elliptic curve calculations so as to make elliptic curve cryptography efficient, practical and viable. The preferred method employs the use of a finite field processor such as the Computational Method and Apparatus for Finite Field Multiplication as disclosed in U.S. Pat. No. 4,745,568. The method couples the attractive cryptographic characteristics of elliptic curves with the strengths of the field processor through its computational abilities in finite field F2.spsb.m. The inventive method structures the elliptic curve calculations as operations, such as multiplication and exponentiation, over the field where F2.spsb.m, which can readily be calculated on a finite field processor.
An embodiment of the invention will now be described by way of example only with reference to the accompanying drawings in which:
FIG. 1 is a diagram of the transmission of an encrypted message from one location to another,
FIG. 2 is a diagram of an encryption module used with the communication system of FIG. 1,
FIG. 3 is a diagram of a finite field processor used in the encryption and decryption module of FIG. 2.
FIG. 4 is a flow chart showing movement of the elements through the processor of FIG. 3 in computing an inverse function.
FIG. 5 is a flow chart showing movement of elements through the processor of FIG. 3 to compute the addition of two points.
An embodiment of the invention will first be described utilising an ElGamal key exchange protocol and a Galois field F2.spsb.155 to explain the underlying principles. Further refinements will then be described.
Referring therefore to FIG. 1, a message M is to be transferred from a transmitter 10 to a receiver 12 through a communication channel 14. Each of the transmitters 10 and receiver 12 has an encryption/decryption module 16 associated therewith to implement a key exchange protocol and an encryption/decryption algorithm.
The module 16 is shown schematically in FIG. 2 and includes an arithmetic unit 20 to perform the computations in the key exchange and generation. A private key register 22 contains a private key, d, generated as a 155 bit data string from a random number generator 24, and used to generate a public key stored in a public key register 26. A base point register 28 contains the coordinates of a base point P that lies in the elliptic curve selected with each coordinate (x, y), represented as a 155 bit data string. Each of the data strings is a vector of binary digits with each digit being the coefficient of an element of the finite field in the normal basis representation of the coordinate.
The elliptic curve selected will have the general form y2 +xy=x3 +ax2 +b and the parameters of that curve, namely the coefficients a and b are stored in a parameter register 30. The contents of registers 22, 24, 26, 28, 30 may be transferred to the arithmetic unit 20 under control of a C.P.U. 32 as required.
The contents of the public key register 26 are also available to the communication channel 14 upon a suitable request being received. In the simplest implementation, each encryption module 16 in a common security zone will operate with the same curve and base point so that the contents of registers 28 and 30 need not be accessible. If further sophistication is required, however, each module 16 may select its own curve and base point in which case the contents of registers 28, 30 have to be accessible to the channel 14.
The module 16 also contains an integer register 34 that receives an integer k, the session seed, from the generator 24 for use in encryption and key exchange. The module 16 has a random access memory (RAM) 36 that is used as a temporary store as required during computations.
The encryption of the message M with an encryption key kdP derived from the public key dP and session seed integer k is performed in an encryption unit 40 which implements a selected encryption algorithm. A simple yet effective algorithm is provided by an XOR function which XOR's the message m with the 310 bits of the encryption key kdP. Alternative implementations such as the DES encryption algorithm could of course be used.
An alternative encryption protocol treats the message m as pairs of coordinates m1,m2, each of 155 bit lengths in the case of F2.spsb.155, and XOR's the message m1,m2 with the coordinates of the session key kdP to provide a pair of bit strings (m1 ⊕x0) (m2 ⊕y0). For further security a pair of field elements z1 z2 are also formed from the coordinates (x0 y0) of kdP.
In one embodiment, the elements z1 z2 are formed from the concatenation of part of x0 with part of y0, for example, z1 =x01 ∥y02 and z2 =x02 ∥y01
where x01 is the first half of the bit string of x0
x02 is the second half of the bit string of x0
y01 is the first half of the bit string of y0
y02 is the second half of the bit string of y0
The first elements z1 and Z2 when treated as field elements are then multiplied with respective bit strings (m1 ⊕x0) and (m2 ⊕y0) to provide bit strings cl c2 of ciphertext c.
i.e. c1 =z1 (m1 ⊕x0)
C2 =z3 (m2 ⊕y0)
In a preferred implementation of the encryption protocol, a function of x0 is used in place of y0 in the above embodiment. For example the function x0 3 is used as the second 155 bit string so that
c1 =z1 (m1 ⊕x0)
c2 =z2 (m2 ⊕x0 3)
z1 =x01 ∥x02 2
z1 =x02 ∥x01 3
where x01 3 is the first half of X0 3
z02 3 is the second half of x0 3
This protocol is also applicable to implementation of elliptic curve encryption in a field other than F2.spsb.m, for example Zp or in general FP.spsb.m.
Where zP is used it may be necessary to adjust the values of x0 and y0 or x0 3 to avoid overfow in the multiplication with z1 and z2. Conventionally this may be done by setting the most significant bit x0 and FP.spsb.m or y0 to zero.
In order for the transmitter 10 to send the message M to the receiver 12, the receivers public key is retrieved by the transmitter 10. The public key is obtained by the receiver 12 computing the product of the secret key d and base point P in the arithmetic unit 20 as will be described more fully below. The product dP represents a point on the selected curve and serves as the public key. The public key dP is stored as two 155 bit data strings in the public key register 26.
Upon retrieval of the public key dP by the transmitter 10, it is stored in the RAM 36. It will be appreciated that even though the base point P is known and publicly available, the attributes of the elliptic curve inhibit the extraction of the secret key d.
The transmitter 10 uses the arithmetic unit 20 to compute the product of the session seed k and the public key dP and stores the result, kdP, in the RAM 36 for use in the encryption algorithm. The result kdP is a further point on the selected curve, again represented by two 155 bit data strings or vectors, and serves as an encryption key.
The transmitter 10 also computes the product of the session seed k with the base point P to provide a new point kP, the session public key, which is stored in the RAM 36.
The transmitter 10 has now the public key dP of the receiver 12, a session public key kP and an encryption key kdP and may use these to send an encrypted message. The transmitter 10 encrypts the message M with the encryption key kdP in the encryption unit 40 implementing the selected encryption protocols discussed above to provide an encrypted message C. The ciphertext C is transmitted together with the value kP to the encryption module 16 associated with receiver 12.
The receiver 12 utilises the session public key kP with its private key d to compute the encryption key kdP in the arithmetic unit 20 and then decrypt the ciphertext C in the encryption unit 40 to retrieve the message M.
During this exchange, the secret key d and the session seed k remain secret and secure. Although P, kP and dP are known, the encryption key kdP cannot be computed due to the difficulty in obtaining either d or k.
The efficacy of the encryption depends upon the efficient computation of the values kP, dP and kdP by the arithmetic unit 20. Each computation requires the repetitive addition of two points on the curve which in turn requires the computation of squares and inverses in F2.spsb.m.
The operation of the arithmetic unit 20 is shown schematically in FIG. 3. The unit 20 includes a multiplier 48 having a pair of cyclic shift registers 42, 44 and an accumulating register 46. Each of the registers 42, 44, 46 contain M cells 50a, 50b . . . 50m, in this example 155, to receive the m elements of a normal basis representation of one of the coordinates of e.g. x, of P. As fully explained in U.S. Pat. No. 4,745,568, the cells 50 of registers 42, 44 are connected to the corresponding cells 50 of accumulating register 46 such a way that a respective grouped term is generated in each cell of register 46. The registers 42,44,46 are also directly interconnected in a bit wise fashion to allow fast transfers of data between the registers.
The movement of data through the registers is controlled by a control register 52 that can execute the instruction set shown in the table below:
TABLE 1______________________________________INSTRUCTION SET Operation Size Clock Cycles______________________________________Field Multiplication 155 bit blocks 156 MULT Calculation of Inverse 24 multiplications approx. 3800 INVERSE I/O 5-32 bit transfers per 10 10 clock cycles WRITE(A,B or C) read/write to registers 2 clock cycles READ(A,B or C) per transfer Elementary Register 155 bit parallel operation (idle) NOP Rotate (A,B or C) Copy (A <- B) (A <- C) (A <- B) (B <- C) SWAP (A <-> B) CLEAR (A,B or C) SET (A,B or C) ADD (A B) ACCUMULATE______________________________________
The unit 20 includes an adder 54 to receive data from the registers 42,44,46 and RAM 36. The adder 54 is an XOR function and its output is a data stream that may be stored in RAM 36 or one of the registers 42, 44. Although shown as a serial device, it will be appreciated that it may be implemented as a parallel device to improve computing time. similarly the registers 42,44,46 may be parallel loaded. Each of the registers 42,44,46, is a 155 bit register and is addressed by a 32 bit data bus to allow 32 bit data transfer in 2 clock cycles and the entire loading in 5 operations.
The subroutines used in the computation will now be described.
a) Multiplication
The cyclic shift of the elements through the registers 42, 44 m times with a corresponding shift of the accumulating register 46 accumulates successive group terms in respective accumulating cells and a complete rotation of the elements in the registers 42, 44, produces the elements of the product in the accumulating register 46.
b) Squaring
By operating in F2.spsb.m and adopting a normal basis representation of the field elements, the multiplier 48 may also provide the square of a number by cyclically shifting the elements one cell along the registers 42. After a one cell shift, the elements in the register represent the square of the number. In general, a number may be raised to the power 2g by cyclically shifting g times through a register.
c) Inversion
Computation of the inverse of a number can be performed efficiently with the multiplier 48 by implementing an algorithm which utilises multiple squaring operations. The inverse X-1 is represented as X2.spsp.M-2 or X2(2.spsp.M-1-1).
If m-1 is considered as the product of two factors g,h then X-1 may be written as X2(2.spsp.m-1-1) or β2.spsp.gh-1 where β=X2.
The exponent 2gh -1 is equivalent to ##EQU3##
The term 2g -1 may be written as ##EQU4## so that ##EQU5## and is denoted γ
This term may be computed on multiplier 48 as shown in FIG. 4 by initially loading registers 42, with the value X. This is shifted 1 cell to represent β (i.e. X2) and the result loaded into both registers 42, 44.
Register 44 is then shifted to provide β2 and the registers 42, 44 multiplied to provide β2+1 in the accumulating register 46. The multiplication is obtained with one motion, i.e. a m bit cyclic shift, of each of the registers 42, 44, 46.
The accumulated term β1+2 is transferred to register 44 and register 42, which contains β2 is shifted one place to provide β4. The registers 42, 44 are multiplied to provide β1+2+4.
This procedure is repeated g-2 times to obtain γ. As will be described below, γ can be exponentiated in a similar manner to obtain ##EQU6##
This term can be expressed as γ1+2.spsp.g+2.spsp.2g+2.spsp.3g . . . 2.sup.(m-1)g.
As noted above, γ can be exponentiated to the 2g by shifting the normal basis representation g times in the register 42, or 44.
Accordingly, the registers 42, 44 are each loaded with the value γ and the register 42 shifted g times to provide γ2.spsp.g. The registers 42, 44 are multiplied to provide γ�γ2.spsp.g or γ1+2.spsp.g in the accumulating register 46. This value is transferred to the register 44 and the register 42 shifted g times to provide γ2.spsp.3g.
The multiplication will then provide γ1+2.spsp.g+2.spsp.3g. Repetition of this procedure (h-1)g-1 times produces the inverse of X in the accumulating register 46.
From the above it will be seen that squaring, multiplying, and inverting can be effectively performed utilising the finite field multiplier 48.
To compute the value of dP for generation of the public key, the arithmetic unit 20 associated with the receiver 12 initially computes the addition of P+P. As noted in the introduction, for a nonsupersingular curve the new point Q has coordinates (X3,Y3) where ##EQU7##
To compute X3, the following steps may be implemented as shown in FIG. 5.
The m bits representing X1 are loaded into register 42 from base point register 28 and shifted one cell to the right to provide X1 2. This value is stored in RAM 36 and the inverse of X1 2 computed as described above.
The value of X1 -2 is loaded into register 44 and the parameter b extracted from the parameter register 30 and loaded into register 42. The product bx1 -2 is computed in the accumulating register 46 by rotating the bit vectors and the resultant value XOR'd in adder 52 with value of X1 2 stored in RAM 36 to provide,the normal basis representation of X3. The result may be stored in RAM 36.
A similar procedure can be followed to generate Y3 by first inverting X1, multiplying the result by Y, and XORing with X1 in the adder 52. This is then multiplied by X3 stored in RAM 36 and the result XOR'd with the value of X3 and X1 2 to produce Y3.
The resultant value of (X3, Y3) represents the sum of P+P and is a new point Q on the curve. This could then be added to P to produce a new point Q'. This process could be repeated d-2 times to generate dP.
The addition of P+Q requires the computation of (X3, Y3) where ##EQU8##
This would be repeated d-2 times with a new value or Q at each iteration to compute dP.
Whilst in principal this is possible with the arithmetic unit 20, in practice the large numbers used make such a procedure infeasible. A more elegant approach is available using the binary representation of the integer d.
To avoid adding dissimilar points P and Q, the binary representation of d is used with a doubling method to reduce the number of additions and the complexity of the additions.
The integer d can be expressed as ##EQU9##
The values of λ are the binary representation of d.
Having computed 2P, the value obtained may be added to itself, as described above at FIG. 5 to obtain 22 P, which in turn can be added itself to provide 23 P etc. This is repeated until 2i P is obtained.
At each iteration, the value of 2i P is retained in RAM 36 for use in subsequent additions to obtain dp.
The arithmetic unit 20 performs a further set of additions for dissimilar points for those terms where λ is 1 to provide the resultant value of the point (x3,y3) representing dP.
If for example k=5, this can be computed as 22 P+P or 2P+2P+P or Q+Q+P. Therefore the result can be obtained in 3 additions; 2P=Q takes 1 addition, 2P+2P=Q+Q=R takes 1 and R+P takes 1 addition. At most t doublings and t subsequent additions are required depending on how many λ are 1.
For computations in a Galois field F2.spsb.155 it has been found that computing the inverse takes approximately 3800 clock cycles.
The doubling of a point, i.e. the addition of point to itself, takes in the order of 4500 clock cycles and for a practical implementation of a private key, the computation of the public key dP may be computed in the order of 1.5�105 clock cycles. With a clock rate typically in the order of 40 mHz, the computation of dP will take in the order of 3�10-2 seconds. This throughput can be enhanced by bounding the seed key k with a Hamming weight of, for example, 20 and thereby limit the number of additions of dissimilar points.
The session public key kP can similarly be computed with the arithmetic unit 20 of transmitter 10 using the base point P from register 28. Likewise, because the public key dP is represented as a point,(x3,y3), the encryption key kdP can be computed in similar fashion.
Each of these operations will take a similar time and can be completed prior to the transmission.
The recipient 12 is similarly required to compute dkP as he received the ciphertext c which again will take in the order of 3�10-2 seconds, well within the time expected for a practical implementation of an encryption unit.
The public key dP, and the session key kP are each represented as a 310 bit data string and as such require a significantly reduced bandwidth for transmission. At the same time, the attributes of elliptic curves provides a secure encryption strategy with a practical implementation due to the efficacy of the arithmetic unit 20.
a) The selection of the field Fq.spsb.m
The above example has utilised a field of 2155 and a non-supersingular curve. The value 155 was chosen in part because an optimal normal basis exists in F2.spsb.155 over F2. However, a main consideration is the security and efficiency of the encryption system. The value 155 is large enough to be secure but small enough for efficient operation. A consideration of conventional attacks that might be used to break the ciphertext suggests that with elliptic curves over F2.spsb.m, a value of m of about 130 provides a very secure system. Using one thousand devices in parallel, the time taken to find one logarithm is about 1.5�1011 seconds or at least 1500 years using the best known method and the field P2.spsb.155. Other techniques produce longer run times.
b) Supersingular v. Nonsupersingular Curves
A comparison of attacks on data encrypted using elliptic curves suggests that non-supersingular curves are more robust than supersingular curves. For a field Fq.spsb.k, an attack based on the method suggested by Menezes, Okamoto and Vanstone in an article entitled "Reducing elliptic curve logarithms to logarithms in finite field" published in the Proceeding 22 Annual ACM Symposium Theory Computing 1991, pp. 80-89, (The MOV attack) shows that for small values of k, the attack becomes subexponential. Most supersingular curves have small values of k associated with them. In general however, non-supersingular curves have large values of k and provided k>log2 q then the MOV attack becomes less efficient than more conventional general attacks.
The use of a supersingular curve is attractive since the doubling of a point (i.e. the case where P=Q) does not require any real time inversions in the underlying field. For a supersingular curve, the coordinates of 2P are ##EQU10##
Since a is a constant, a-1 and a-2 is fixed for a given curve and can be precomputed. The values of x1 2 and x1 4 can be computed with a single and double cyclic shift respectively on the multiplier 48. However, the subsequent addition of dissimilar points to provide the value of dP still requires the computation of an inverse as ##EQU11## and ##EQU12##
Accordingly, although supersingular curves lead to efficient implementations, there is a relatively small set of supersingular curves from which to choose, particularly if the encryption is to be robust. For a supersingular curve where m is odd, there are 3 classes of curve that can be considered further, namely
y2 +y=x3
y2 +y=x3 +x
y2 +y=x3 +x+1
However, a consideration of these curves for the case where m=155 shows that none provide the necessary robustness from attack.
Enhanced security for supersingular curves can be obtained by employing quadratic extensions of the underlying field. In fact, in Fq where q=2310, i.e. a quadratic extension of F2.spsb.155, amongst the supersingular curves, there are four which under the MOV attack require computation of discrete logs in F2.spsb.930. These curves provide the requisite high security and also exhibit a high throughput. Similarly, in other extensions of subfields of F.sub..spsb.155 (e.g. F2.spsb.31) other curves exist that exhibit the requisite robustness. However, their use increases the digits that define a point and hence the bandwidth when they are transmitted.
By contrast, the number of nonsupersingular curves of Fq,q=2155, is 2(2155 -1). By selecting q=2 i.e. a field F2.spsb.M, the value of a in the representation of the curve, y2 +xy=x3 +ax2 +b, can be chosen to be either 1 or 0 without loss of generality. This large choice of curves permits large numbers of curves over this field to be found for which the order of a curve is divisible by a large prime factor. In general, determining the order of an arbitrary nonsupersingular curve over Fq is not trivial and one approach is explained further in a paper entitled "Counting Points on Elliptic Curves" by Menezes, Vanstone and Zuccherato, Mathematics of Computation 1992.
In general however, the selection of suitable curves is well known in the art, as exemplified in "Application of Finite Fields", chapters 7 and 8, by Menezes, Blake et al, Kluwer Academic Publishers (ISBN 0-7923-9282-5). Because of the large numbers of such curves that meet the requirements, the use of nonsupersingular curves is preferred despite the added computations.
An alternative approach that reduces the number of inversions when using nonsupersingular curves is to employ homogeneous coordinates. A point P is defined by the coordinates (x,y,z,) and Q by the point (x2,y2,x2)
The point (0, 1, 0) represents the identity O in E.
To derive the addition formulas for the elliptic curve with this representation, we take points P=(x1,y1,z1) and Q=(x2,y2,z2), normalize each to (x1 /z1, y1 /z1, 1), (x1 /z1, y2 /z2, 1), and apply the previous addition formulas. If P=(x1,y1,z1), Q=(x2,y2,z2), P,Q≠O, and P≠-Q then P+Q=(x3,y3, z3) where if P≠Q, then
x3 =AD
y3 =CD+A2 (Bx1 +Ay1)
z3 =A3 z1 z2
where A=x2 z1 +x1 z2, B=y2 z1 +y1 z2, C=A 30 B and D=A2 (A+az1 z2)+z1 z2 BC.
In the case of P=Q, then
x3 =AB
y3 =x1 4 A+B(x1 2 +y1 z1 +A)
z3 =A3
where A=x1 z1 and B=bz1 4 +x1 4.
It will be noted that the computation of x3 y3 and z3 does not require any inversion. However, to derive the coordinates x3 m, y3 m in a nonhomogeneous representation, it is necessary to normalize the representation so that
x3 m =x3 /z3 y3 m =y3 /z3
This operation requires an inversion that utilizes the procedure noted above. However, only one inversion operation is required for the computation of dP.
Using homogeneous coordinates, it is still possible to compute dP using the version of the double and add method described above. The computing action of P+Q , P≠Q, requires 13 field multiplications, and 2P requires 7 multiplications.
In the example above, the coordinates of the keys kP kdP are each transferred as two 155 bit field elements for F2.spsb.155. To reduce the bandwidth further it is possible to transmit only one of the co-ordinates and compute the other coordinate at the receiver. An identifier, for example a single bit of the correct value of the other coordinate, may also be transmitted. This permits the possibilities for the second coordinate to be computed by the recipient and the correct one identified from the identifier.
Referring therefore to FIG. 1, the transmitter 10 initially retrieves as the public key dP of the receiver 12, a bit string representing the coordinate x0 and a single bit of the coordinate y0.
The transmitter 10 has the parameters of the curve in register 30 and therefore may use the coordinate x0 and the curve parameters to obtain possible values of the other coordinate y0 from the arithmetic unit 20.
For a curve of the form y2 +xy=x3 +ax2 +b and a coordinate x0, then the possible values y1,y2 for y0 are the roots of the quadratic y2 +x0 y=x0 3 +ax0 2 +b.
By solving for y, in the arithmetic unit 20 two possible roots will be obtained and comparison with the transmitted bit of information will indicate which of the values is the appropriate value of y.
The two possible values of the second coordinate (y0) differ by x0, i.e. y1 =y2 +x0.
Since the two values of y0 differ by x0, then y1 and y2 will always differ where a "1" occurs in the representation of x0. Accordingly the additional bit transmitted is selected from one of those positions and examination of the corresponding bit of values of y0, will indicate which of the two roots is the appropriate value.
The receiver 10 thus can generate the coordinates of the public key dP even though only 156 bits are retrieved.
Similar efficiencies may be realized in transmitting the session key kP to the receiver 12 as the transmitter 10s need only forward one coordinate, x0 and the selected identifying bit of y0. The receiver 12 may then reconstruct the possible values of y0 and select the appropriate one.
In the field F2.spsb.m. it is not possible to solve for y using the quadratic formula as 2 a=0. Accordingly, other techniques need to be utilised and the arithmetic unit 20 is particularly adapted to perform this efficiently.
In general provided X0 is not zero, if y=x0 z then x0 2 z2 +x0 2 z=x3 0 +ax0 2 +b.
This may be written as ##EQU13## i.e. z2 +z=c.
If m is odd then either ##EQU14## or z=1+c2.spsp.o + . . . +c2.spsp.m-1 to provide two possible values for y0.
A similar solution exists for the case where m is even that also utilises terms of the form c2.spsp.g.
This is particularly suitable for use with a normal basis representation in F2.spsb.m.
As noted above, raising a field element in F2.spsb.m to a power g can be achieved by a g fold cyclic shift where the field element is represented as a normal basis.
Accordingly, each value of z can be computed by shifting and adding and the values of y0 obtained. The correct one of the values is determined by the additional bit transmitted.
The use of a normal basis representation in F2.spsb.m therefore simplifies the protocol used to recover the coordinate y0.
If P=(x0 y0) is a point on the elliptic curve E:y2 +xy=x3 +ax2 +b defined over a field F2.spsb.m, then y0 is defined to be 0 if x0 =0; if x0 ≠0 then y0 is defined to be the least significant bit of the field element y0 �x0 -1.
The x-coordinate x0 of P and the bit y0 are transmitted between the transmitter 10 and receiver 12. Then the y coordinate y0 can be recovered as follows.
1. If x0 =0 then y0 is obtained by cyclically shifting the vector representation of the field element b that is stored in parameter register 30 one position to the left. That is, if
b=bm-1 bm-2 . . . b1 b0
then y0 =bm-2 . . . b1 b0 bm-1
2. If x0 ≠0 then do the following:
2.1 Compute the field element c=x0 +a+bx0 -2 in F2 m.
2.2 Let the vector representation of c be c=cm-1 cm-2 . . . c1 c0.
2.3 Construct a field element z=zm-1 zm-2 . . . z1 z0 by setting ##EQU15## 2.4 Finally, compute y0 =x0 �z.
It will be noted that the computation of x0 -: can be readily computed in the arithmetic unit 20 as described above and that the computation of y0 can be obtained from the multiplier 48.
In the above examples, the identification of the appropriate value of y0 has been obtained by transmission of a single bit and a comparison of the values of the roots obtained. However, other indicators may be used to identify the appropriate one of the values and the operation is not restricted to encryption with elliptic curves in the field GF(2m). For example, if the field is selected as Zp p=3(mod 4) then the Legendre symbol associated with the appropriate value could be transmitted to designate the appropriate value. Alternatively, the set of elements in Zp could be subdivided into a pair of subsets with the property that if y is in one subset, then -y is in the other, provided y≠0. An arbitrary value can then be assigned to respective subsets and transmitted with the coordinate x0 to indicate in which subset the appropriate value of y0 is located. Accordingly, the appropriate value of y0 can be determined. Conveniently, it is possible to take an appropriate representation in which the subsets are arranged as intervals to facilitate the identification of the appropriate value of y0.
These techniques are particularly suitable for encryption utilizing elliptic curves but may also be used with any algebraic curves and have applications in other fields such as error correcting coding where coordinates of points on curves have to be transferred.
It will be seen therefore that by utilising an elliptic curve lying in the finite field GF2 m and utilising a normal basis representation, the computations necessary for encryption with elliptic curves may be efficiently performed. Such operations may be implemented in either software or hardware and the structuring of the computations makes the use of a finite field multiplier implemented in hardware particularly efficient.
Patent Citations
Non-Patent Citations
Referenced by
Legal Events
Original Image

subset: commoncrawl


text:
If I've just lost a battle in PvP, the thinking is, "Just one more -- maybe the next one will be a winner! If you log off now, you'll miss it!" But if I've just won a battle, the voice says, "Just one more -- you just won a match, so chances are you'll win the next one too!" Whenever I review my progress with honor points, gold or experience, to see how I've done this session, the voice insists: "Just a few more, and your goal of <insert however many points you think you need here> will be complete!" Even if I've firmly decided that I'm fighting no more battles of any sort today, there's always the temptation to log in to "just one more" alt to check mail, auction items, or chat with a friend for a while longer. Just logging off for good can take a long time if I'm not firm with myself, and naturally, whatever I was going to do afterwards (often sleeping) may suffer for it.
By far the best weapon I have discovered for fighting off this insidious enemy inside my own head is to decide beforehand exactly how many battleground matches I am going to play or quests I'm going to do, no matter whether I'm ultimately successful or not. This works better for me than, "I'm only going to play for <insert amount of time here>", because it is based more on exact activities I have planned. With a time limit, the little voice will say, "But I just have a little bit left to finish!" but with the activity limit, once my number is up, this voice will assuredly say "just one more" again, but then I can reply, "NO! Three is the limit! End of story! Go to sleep!" I can then click on "exit game" with glee at my complete and total victory over... me.


text:
Ethanol RIN Values Jump to Record 53 Cents, Blue Ocean Says
Feb. 27 (Bloomberg) -- The value of Renewable Identification Numbers for corn-based ethanol rose to a record on concern that biofuel production and consumption won't meet U.S. targets.
Prices for RINs, the credits that help the Environmental Protection Agency track whether refiners are meeting federal biofuel-use mandates, jumped to 53 cents from about 45.5 cents yesterday, according to Blue Ocean Brokerage LLC in New York.
Ethanol production has dropped 16 percent to an annualized rate of 12.4 billion gallons last week from a record in December 2011, a government report showed today. That's short of the 13.8 billion refiners are required to use this year. Falling gasoline demand plus higher ethanol consumption targets is known as the "blend wall."
"There is some concern that the combination of low ethanol production this year with the potential to hit the blend wall next year could result" in a shortage of RINs, said Michael Breitenbach, an analyst and trader at Blue Ocean.
Refiners can use the credits in lieu of blending a physical gallon, according to Geoff Cooper, vice president of research and analysis at the Renewable Fuels Association, a Washington-based trade organization.
The government wants U.S. refiners to use escalating amounts of ethanol in gasoline, up to 15 billion gallons by 2015. That comes as consumption of the motor fuel shrinks.
Higher Levels
Ethanol industry advocates have pushed for higher concentrations of the biofuel in gasoline, to 15 percent, a level also called E-15, from 10 percent to help meet targets.
The EPA said in 2011 it would allow the higher blends at filling stations for cars made after 2001. Organizations including the American Petroleum Institute have called for more testing and last week said that they petitioned the U.S. Supreme Court to overturn the EPA's decision.
"Everyone is really worried that E-15 is not going to kick in and gasoline demand is going down," said Beatriz Pupo, an analyst at Kingsman SA, a Lausanne, Switzerland-based sugar and biofuels research firm. "Everybody's anticipating that they will need more RINs because they won't have enough physical production."
To contact the reporter on this story: Mario Parker in Chicago at firstname.lastname@example.com
To contact the editor responsible for this story: Dan Stets at email@example.com


text:
Have you ever had an idea for a painting? Just could not find the right art piece for a room? Wanted to make a thoughtful gift for someone special? I am here so that we can work together to create something special for you.
You have a wish, an idea or a vision, perhaps. You talk to me, explain your desire, maybe even present me with an image. We discuss the size, medium and agree on a price. I sketch it, send you a picture, we discuss the result and make an occasional change to what I created. After a security deposit, I begin my work on our project, while keeping you informed of the progress and will send you a picture of the finished product. After final payment has been received I will mail the piece to you via UPS. If there any questions feel free to contact me at any time.


text:
These Champion Mesh Shorts with Pockets are to be used for screen-printing.
Click here to view colors available
Use our stock designs to order existing
designs and save on an Art Fee. Order as a
group to save your house money and create your own design with our full time Art
One-Color Screenprinted Designs
click here for more
City Hook and Ladder Shirt
as low as $4.16
Fear The Mascot
as low as $4.16
Bike Style Shirt
as low as $4.16
Two-Colors Customized Designs
click here for more
Two Color Back Shirt
as low as $4.56
FD Rescue Shirt
as low as $4.96
Diamond Plate Back
as low as $3.96
Multi-Color Personalized Designs
click here for more
FlameZilla Shirt
as low as $7.36
Multi-Color Firefighter Shirt
as low as $5.76
Eagle Design Department Shirt
as low as $6.16
Shop Copyright © 1999-2007 Rocksalt International Pty Ltd. All rights reserved.
| ShopSiteMap
| Customer Service
Copyright © Fire Department Clothing.com All rights reserved. | Secured by
TeleSSL.com | Hosting & Design by TeleSites.net


text:
We know there are Liverpool fans in every corner of the world - and no matter where you live you can get free delivery on any item purchased in our online store this weekend.
This great offer comes just at the right time for Kopites who are doing their Christmas shopping - or for those who just want to treat themselves or their loved ones at this time of year.
What's more, we have just launched our Christmas range, and hundreds more products will be added over the coming weeks.
You'll also find some fantastic products in our autumn/winter and Warrior ranges.
The offer ends at 9am GMT on Monday.
Tagged: free delivery , online store , shop
Submit your views in the box below. Alternatively, you can debate these issues with fellow fans on our Message Boards or blog about them on The Kop
The views expressed here are not those of Liverpool Football Club (read more)


text:
This is the smallest snail I have ever seen.
I asked SiewPeng what the adjective which is "smaller than tiny" is, she said "microscopic". Yes! This snail is really microscopic and it is less than 2 mm.
I found it when I was removing some weeds in our garden and I put it gently on my finger. This snail was quite active and started crawling, it couldn't hold itself properly and fell off my finger. I managed to find it and took its photo quickly.
Less than half a minute later, it fell off again, and I could not find it anymore.
It might be a new born baby snail which was not afraid of human beings and was very active crawling everywhere.


text:
This undergraduate text spreads itself too thin — despite being 454 pages long, it covers so many topics that you don't really get an in-depth treatment of anything.
The book gets off to a good start looking at several traditional PDE problems, such as the vibrating string, the drumhead, and heat flow, and derives the PDE for each one. Then it gradually builds more and more complete solutions to each problem, gradually bringing in boundary conditions, initial conditions, and eigenvalues. This takes the first quarter of the book.
Then it veers off in a pure-math direction for the second quarter of the book, giving fairly complete accounts of the theory of Fourier series (including convergence theorems, completeness, and the Gibbs phenomenon), harmonic functions, and Green's functions. There are no applications, though, so students who were excited by the good discussion of applications in the first quarter may lose interest.
Now the book starts being spread too thin. The last half of the book deals again with physical problems: very good ones such as the vibrating drum head (Bessel functions), Schrödinger's wave equation, the hydrogen atom, spherical harmonics, solitons, Maxwell's equations, shock waves, water waves, and more! But it only gives 3 or 4 pages to each subject. There's also some more pure-math stuff, such as a long chapter on eigenfunctions that is not tied very well to applications.
The book is unsatisfying because it is trying to do too many things. It's very clearly written but there's not enough depth. A book I like that is very old but covers many of the same physical problems in much more detail, and develops the needed mathematical background, and is one-tenth the price, is Donald H. Menzel's Mathematical Physics (Dover reprint, original publication 1947). Another book that I like, and which will give you a much better skill at solving PDEs in about 140 pages (although it skimps on the applications), is Erwin Kreyszig's Advanced Engineering Mathematics.
Allen Stenger is a math hobbyist, library propagandist, and retired computer programmer. He volunteers in his spare time at MathNerds.com, a math help site that fosters inquiry learning. His mathematical interests are number theory and classical analysis.
Chapter 1 / Where PDEs Come From
1.1 What is a Partial Differential Equation?
1.2 First-Order Linear Equations
1.3 Flows, Vibrations, and Diffusions
1.4 Initial and Boundary Conditions
1.5 Well-Posed Problems
1.6 Types of Second-Order Equations
Chapter 2 / Waves and Diffusions
2.1 The Wave Equation
2.2 Causality and Energy
2.3 The Diffusion Equation
2.4 Diffusion on the Whole Line
2.5 Comparison of Waves and Diffusions
Chapter 3 / Reflections and Sources
3.1 Diffusion on the Half-Line
3.2 Reflections of Waves
3.3 Diffusion with a Source
3.4 Waves with a Source
3.5 Diffusion Revisited
Chapter 4 / Boundary Problems
4.1 Separation of Variables, The Dirichlet Condition
4.2 The Neumann Condition
4.3 The Robin Condition
Chapter 5 / Fourier Series
5.1 The Coefficients
5.2 Even, Odd, Periodic, and Complex Functions
5.3 Orthogonality and General Fourier Series
5.4 Completeness
5.5 Completeness and the Gibbs Phenomenon
5.6 Inhomogeneous Boundary Conditions
Chapter 6 / Harmonic Functions
6.1 Laplace's Equation
6.2 Rectangles and Cubes
6.3 Poisson's Formula
6.4 Circles, Wedges, and Annuli
Chapter 7 / Green's Identities and Green's Functions
7.1 Green's First Identity
7.2 Green's Second Identity
7.3 Green's Functions
7.4 Half-Space and Sphere
Chapter 8 / Computation of Solutions
8.1 Opportunities and Dangers
8.2 Approximations of Diffusions
8.3 Approximations of Waves
8.4 Approximations of Laplace's Equation
8.5 Finite Element Method
Chapter 9 / Waves in Space
9.1 Energy and Causality
9.2 The Wave Equation in Space-Time
9.3 Rays, Singularities, and Sources
9.4 The Diffusion and Schršdinger Equations
9.5 The Hydrogen Atom
Chapter 10 / Boundaries in the Plane and in Space
10.1 Fourier's Method, Revisited
10.2 Vibrations of a Drumhead
10.3 Solid Vibrations in a Ball
10.4 Nodes
10.5 Bessel Functions
10.6 Legendre Functions
10.7 Angular Momentum in Quantum Mechanics
Chapter 11 / General Eigenvalue Problems
11.1 The Eigenvalues Are Minima of the Potential Energy
11.2 Computation of Eigenvalues
11.3 Completeness
11.4 Symmetric Differential Operators
11.5 Completeness and Separation of Variables
11.6 Asymptotics of the Eigenvalues
Chapter 12 / Distributions and Transforms
12.1 Distributions
12.2 Green's Functions, Revisited
12.3 Fourier Transforms
12.4 Source Functions
12.5 Laplace Transform Techniques
Chapter 13 / PDE Problems from Physics
13.1 Electromagnetism
13.2 Fluids and Acoustics
13.3 Scattering
13.4 Continuous Spectrum
13.5 Equations of Elementary Particles
Chapter 14 / Nonlinear PDEs
14.1 Shock Waves
14.2 Solitons
14.3 Calculus of Variations
14.4 Bifurcation Theory
14.5 Water Waves
A.1 Continuous and Differentiable Functions
A.2 Infinite Series of Functions
A.3 Differentiation and Integration
A.4 Differential Equations
A.5 The Gamma Function
Answers and Hints to Selected Exercises


text:
The Italian cable company Prysmian Group has inaugurated its new submarine cable factory in Pikkala in Kirkkonummi, near Helsinki. The company has invested roughly EUR 40 million in expanding its production at the factory.
— Our positive experiences of the Finnish operating environment were a key factor in our decision to make this strategically important production unit part of the Pikkala factory, says Marcello Del Brenna, CEO of Prysmian Power Link, the Group's marine cable division.
— Several large-scale offshore wind farms will be constructed in Europe, which will need to transfer electricity over long distances in demanding conditions. The Pikkala factory is also known around the world as a producer of high voltage cables. Its location is logistically ideal and the cables can be loaded directly onto ships from the factory. It is a natural place for us to expand our production, Del Brenna explains.
Prysmian Group's current cable production in Finland dates all the way back to Salmisaari, Helsinki, in 1912. Today the old cable factory houses the cultural centre Kaapelitehdas.
Prysmian Group is the world's largest energy, specialty and telecom cable company with net sales of EUR 8 billion. The Group's commercial brands Prysmian and Draka are produced at 97 factories employing 22,000 people in 50 countries. The company has 500 employees in Finland and production plants in Kirkkonummi and Oulu.


text:
February 2011: Becoming A Global Agent
The February 2011 edition of Global Perspectives outlines the six steps REALTORS® can take to become a global agent -- and thus gain a share of the $66 billion dollars that foreign buyers invested in U.S. residential properties last year. The issue also highlights the resources NAR offers these global agents and the easiest ways to get involved in multicultural real estate.
Table of Contents:
I Can Become a Global Agent? Yes!
Building Your Global Business From The Ground Up: One Step At A Time
How NAR Supports Global Agents


text:
If you're looking for something movement based, you could check out Peter Meechan's Manchester Concertino .
I've also had a commission from Ben Tubb called "Metamorphosis", though I don't know if it's commercially available yet.....although I'm sure it will be after July.....
The views expressed in posts on non-recording and non-technical matters are the personal opinion of the Author, and are not necessarily representative of KMJ Recordings.
Keith Johnson
Find us on FACEBOOK
What I mean is exactly what Daisy Duck said - 'something a little more original that hasn't been heard a million times before!'
Thanks for the suggestions everyone - I will have a listen to them all later on!
Luke Dempsey


text:
Baby Bits - NEW !
NEW Books that are perfect for baby lap-reads are The Busy Little Squirrel by Nancy Tafuri; So Sleepy Story by Uri Shulevitz; and A Good Day by Kevin Henkes. They show pictures that baby sees in her world. They have words that sound lovely to say and use and repeat from the driver's seat.


text:
Status: Closed
Know more about this business than we do? Cool! Please submit any corrections or missing details you may have.Help us make it right
band and orchestra instruments, guitars, rentals, keyboards, PA, drums, percussion, trumpets, trombones, saxophones, flutes, clarinets, and repair service.
Be the first YellowBot user to add photos or videos of Highland Hill Music Ctr
Our pre-middle school son was just introduced to band class through his elementary school..........Lord help me, he chose the trombone!I really like the... read more »
This is a great little music store that provides instruments, sheet music, rentals and lessons all in one place. The employees are very fami...
Over 55 Years
Sales & Rentals
No Extended Obligation
Band & Orchestra Sales & Rentals
Rent One Month At A Time
Sheet Music Special Orders
DOD Electronics
Band & Orchestra
All Rent Applies to Optional Purchase
for Over 55 Years
Highland Hill Music Center
Sales & Rentals, Rent One Month At A Time, Over 55 Years, No Extended Obligation, Highland Hill Music Center, Band & Orchestra, All Rent Applies to Optional Purchase, Selmer
If you don't see your business listed on YellowBot, please add your business listing.
YellowBot wants to get your input! If you have a comment, find a bug or think of something neat we should do, let us know by emailing us.
© 2007-2015 Solfo, Inc. – All rights reserved


text:
If you cannot read the message below, click here
Hire Right By Using The Right Salary
<Customer's Name>
According to our latest annual jobseeker survey, jobseekers have indicated that "salary information" is the number 1 detail for consideration when applying for a job. Setting the right salary is one of the crucial steps in successfully recruiting the right hire. The benefits include:
Allowing you to remain competitive against other hiring companies
Confidently setting a salary range and not worrying about over or under paying new hires
Saving time by eliminating jobseekers who are not interested in the salary range
Minimise your job advertisement spend by interviewing only candidates who have expectations of the salary range
Salaries in the employment market happen to change often. JobStreet.com provides a FREE salary report to keep you informed - so that you can hire effectively.
Click on the button below to view the JobStreet Salary Report today!
Best regards,
<AM Name>
<AM Email Address>
Privacy Policy
© 2012
JobStreet.com Malaysia - Wisma JobStreet.com 27 Lorong Medan Tuanku 1 (Off Jalan Sultan Ismail) 50300 Kuala Lumpur


text:
Foreigner exchange: Portland's Deering High School chorus helps legendary band rock the State
PORTLAND — During its 38-year history, rock band Foreigner has cycled through dozens of members.
On Tuesday night, the group briefly gained another 24 when the Deering High School chorus joined their ranks for a sold-out show at the State Theatre.
John Lappen, head of marketing for Foreigner, said the band plays with local choirs at all of its shows. During the past six years, more than four hundred choirs have joined the band onstage for the same song – the 1984 chart-topper "I Wanna Know What Love Is" – which was originally recorded with the New Jersey Mass Choir.
The collaborations serve a greater purpose, Lappen said. It's an effort to raise money for the GRAMMY Foundation, whose mission is to promote arts and music education.
"Some schools don't have arts programs any more," Lappen said Monday during a telephone interview. "We just found that to be unacceptable."
At each city, the band asks student choirs to help sell copies of Foreigner's greatest hits compilation before and after the shows. A portion of the money is then donated to the foundation. Lappen said he doesn't know the exact amount, but it has been "tens of thousands" of dollars.
In many cities, schools compete for a chance to perform with the band, which also helps promote the show. In this case, however, the State sold out so quickly, additional promotion was unnecessary. Instead, Lappen contacted a few area high schools and gave the gig to Deering, the first school that replied.
The schools rehearse by singing along to a recording of the song. In most cases, the choirs don't have an opportunity for a live rehearsal before showtime, Lappen said, which was the case for the Deering students.
On Tuesday night, toward the end of a 90-minute set that covered the band's greatest hits from its 1980s heyday – "Juke Box Hero," "Urgent," "Hot Blooded" and the like – the 24-member chorus, dressed in matching black t-shirts, mounted the stage in front of 1,400 cheering fans.
Afterward, freshman Kodie Chontos stood alongside her classmates and hawked CDs as the crowd dispersed. She was still reeling from the experience, she said.
"It was crazy," Chontos said. "That's like the most people I've ever been in front of."
Senior Nancy Unba said she was familiar with the band's music long before the chorus began rehearsing last month. The song she helped perform is her favorite from the band's canon, she said.
"The adrenaline was rushing through my veins," she said. "I just couldn't believe I was up there singing with Foreigner. 'I sang with Foreigner.' I can say that. 'At the age of 18, I sang with Foreigner.'"
Even 30 years after the band last hit No. 1 in the U.S. and U.K. charts, their music is still ubiquitous, sophomore Will Weeks said.
"It's all over the radio," he said. "I love it."


text:
South Carolina running back Marcus Lattimore has had a couple of lousy years with devastating knee injuries, surgeries, and grueling rehab but it appears that things may be looking up. Lattimore worked out for reps of all 32 NFL teams yesterday and the room "burst into applause when he was done" according to Robert Klemko of USATODAYSports.
It appears that rumors of Lattimore's miraculous recovery have not been exaggerated. When Lattimore first suffered his most recent injury, many observers believed he would not be able to step on a football field in 2013 and some even worried that his football career could be over for good. There is still concern that Lattimore may be pushing himself too hard but miracles can happen as evidenced by the dominating performance put on this past season by Vikings RB Adrian Peterson after ACL surgery. It may be pushing it to expect Lattimore to be ready but he has "no doubt" heal be ready sometime in the first half of the NFL season.
Now the guessing game begins for team front offices. Based solely on talent, Lattimore could be the most gifted RB in this year's draft but his medical history makes him a major gamble. He could go any where from Round 2 if some team feels tremendously lucky to sliding to day three. He could be particularly attractive to some team with a still-effective-but-aging running back that doesn't need immediate production from the Lattimore pick.


text:
Guys for those who understand here I found this page from the Thread "Brick?":
I think it's how the Korean Wii Works maybe it can help
I didn't understand anything
Something new guys? Had anyone tried what it says in those 2 youtube vid? Let us know. We're desperate...
Guys for those who understand here I found this page from the Thread "Brick?":
I think it's how the Korean Wii Works maybe it can help
I didn't understand anything
i hope some other guys or the same person in the youtube can make again the video in better pictures because me and others "Unlucky Person" can revive their wii again....
OMG is that neccessary to buy a new motherboard for this kind of error...I think someone out there will come up with solution like their always do... Hopefully this error will lost again to those hacker of wii...i will keep waiting....
Guys I think I have BAD news.
This just arrived to my E-mail
Thank you for taking the time to complete our consumer email survey. We appreciate the feedback we receive and will use it to improve our service.
I wanted to address your initial email in saying that the error code indicates the Wii console was manufactured for a region that is not compatible with the Wii System Menu 4.2 update. I'm sorry to report that this incompatibility has made the system unplayable and that neither Nintendo nor its distributors is able to repair these systems.
I realize you may not have been aware your system was manufactured for another region. I can only recommend that you to contact the retailer or individual who sold it to you in order to resolve the situation.
Sincerely, Nintendo of America Inc.
David Marshall
Nintendo's home page: Country Selector at Nintendo
Power Line (Automated Product Info): (425) 885-7529"
I'm about to cut my nuts
i have ordered 2 new wii motherboards with USA region .Im just going to change the mobo i have spent alot of time on this and there is no solution for now .when i get time later im going to dump the nand using infectus and upload a nand image of an other korean wii to this wii's nand with any help i can get from bushing or anyone
Hi everyone, looking for solutions i found out the following:
I found the wii still connected to the wireless router, how? I get into my wifi router and list all connections an the IP of the Wii was there.
Right now, im in the same situation as many of you, black screen 003 error.
Maybe the wii console can be fixed remotely.
Any ideas?
Hi all!
I received similar responses from US and UK. I contacted the local seller (Cluj - Romania) and they asked me to send them free of charge the Wii for repairs. I don't have an answer yet but according the answers we all received confirms that they acknowledge the mistake selling Korean Wii s in different regions MODIFIING the region. This means an official SOFT MODDING!!!
Wrong move...
If is the same in your case, some Customer Protection regulation are in place and you can use them!
If I will receive mine fixed and any other details will arise (fees, taxes etc.) I will let you know.
If useful, pls. click the little button.


text:
Published: July 19, 2010
Randy Creech, St. Luke's Episcopal Hospital patient, recently celebrated the 20th anniversary of his heart transplant. Click here to watch his story.
Return to News and Events.
CHI St. Luke's Health | 6624 Fannin, Suite 1100 | Houston, Texas | 77030 USA
CHI St. Luke's Health: Baylor St. Luke's Medical Center | Sugar Land Hospital | The Woodlands Hospital | Lakeside Hospital (located in The Woodlands, TX)
The Vintage Hospital (located in Northwest Houston) | Patients Medical Center (located in Pasadena, TX) | Emergency Services
© 1999 - 2015 St. Luke's Health System Privacy Policy | Site Map | Contact Us | Follow Us on Twitter


text:
- Home
- Story
- Fresh Dirt
- Sustainability
- Vineyards
- Wines
- Gift Packs
- Our Family of Wines
- J. Lohr 40th Anniversary
- J. Lohr Cuvée Series
- J. Lohr Vineyard Series
- 2014 J. Lohr Carol's Vineyard Sauvignon Blanc
- 2012 J. Lohr October Night Chardonnay
- 2012 J. Lohr Arroyo Vista Chardonnay
- 2012 J. Lohr Highlands Bench Pinot Noir
- 2012 J. Lohr Fog's Reach Pinot Noir
- 2012 J. Lohr Carol's Vineyard Cabernet Sauvignon
- 2012 J. Lohr Hilltop Cabernet Sauvignon
- 2012 J. Lohr Tower Road Petite Sirah
- 2012 J. Lohr Late Harvest White Riesling
- J. Lohr Estates
- 2014 J. Lohr Estates Flume Crossing Sauvignon Blanc
- 2013 J. Lohr Estates Falcon's Perch Pinot Noir
- 2014 J. Lohr Estates Bay Mist White Riesling
- 2014 J. Lohr Estates Wildflower Valdiguié
- 2014 J. Lohr Estates Riverstone Chardonnay
- 2013 J. Lohr Estates Los Osos Merlot
- 2013 J. Lohr Estates Seven Oaks Cabernet Sauvignon
- 2013 J. Lohr Estates South Ridge Syrah
- J. Lohr Gesture
- ARIEL Non-Alcoholic Wines
- Cypress Vineyards
- Painter Bridge
- J. Lohr Vintage Chart
- Wine Review Finder
- J. Lohr Wine Store
- Wine Clubs
- Visit Us
- Events
- LohrStyle
J. Lohr Wine 101: Burgundy Unearthed
Thursday, March 22, 2012 - 6:30pm - 8:30pm
Lawrence Lohr, Director of Wine Education, takes you on a tour of Burgundy, with a specific focus on Chardonnay and Pinot Noir. This guided tasting and discussion will feature four of the Burgundy inspired wines of the J. Lohr Vineyard Series, including the brand new J. Lohr Highlands Bench Chardonnay and J. Lohr Highlands Bench Pinot Noir. Includes a light appetizer reception. Please note that this event is being added to the popular 2012 Wine 101 Education Series, which will conclude with a Wine & Appetizer Pairing class on March 29th.
$30 per person.Tickets available in the San Jose tasting room or by calling Lisa at (408) 918-2176. Email email@example.com for more information. Seating is limited. Advance ticket purchase required.


text:
BCTI, a Microsoft Silver Learning Solutions Partner, offers a number of professional, instructor-led courses covering a wide variety of Microsoft applications and technologies, as well as hardware and software training for both new and expert computer users.
Microsoft Using SharePoint Services 2007 Level 1, from 8:30 a.m. to 4:30 p.m. Aug. 25, introduces students to Windows SharePoint Services. They will create, edit, and manage a team site. Users will examine collaboration technology and Windows SharePoint Services 3.0 team sites, work with lists and libraries and perform basic site administration.
Microsoft PowerPoint 2010 Level 2, from 8:30 a.m. to 4:30 p.m. Aug. 30, will teach students to enhance presentations with PowerPoint's multimedia features in order to transform bland slides into a creative and effective means of visual communication.
Microsoft 6420-Fundamentals of Windows Server 2008, 8:30 a.m. to 4:30 p.m. Sept. 12-16, is for those who are seeking to gain fundamental knowledge and skills around security, networking, and administration in Windows Server 2008 R2. It can apply to home computer users, academic, information workers, developers, or help desk technicians wishing to begin a new skills path or up-skill to Windows Server technologies. Candidates for this course may also include IT Pros with skills within other IT areas or operating systems (such as Linux) who wish to gain an insight into Windows Server.
BCTI is authorized for operation by the Tennessee Higher Education Commission.The training facility is located at 110 KLM Drive, Suite 8, Johnson City. For pricing, a complete schedule of courses, or general inquiry, call BCTI at 283-0543, or visit www.bcti.com.


text:
Yesterday, Moscow took one more step away from the West when it announced that it would not support tougher sanctions against Iran for failing to halt its efforts to enrich uranium. The U.N. Security Council is scheduled to discuss implementing a third set of coercive measures against Tehran. Russian Foreign Minister Sergei Lavrov said his country wants to give the International Atomic Energy Agency, the U.N.'s nuclear watchdog, additional time to obtain cooperation from Iran pursuant to a deal arranged last month. On Friday, China announced its desire to see more negotiations with the Iranians, thereby supporting the Kremlin.
French Foreign Minister Bernard Kouchner, at the conclusion of his meeting with Lavrov in Moscow, said yesterday that, should the Security Council fail to impose new measures, the European Union should create a sanctions regime similar to America's. That set off Lavrov: "If we decided to act collectively on the basis of consensual decisions in the U.N. Security Council, what good does it do to take unilateral decisions?"
The assumption implicit in Lavrov's question is that the world's great powers, acting together, can solve the world's great problems. It is the basis of Bush administration policy. It is the notion that all of us want to believe. It is, unfortunately, no longer true—if it ever was.
Why? On Monday, IAEA chief Mohamed ElBaradei, trying to forestall the talk of war over Iran, asked the West to remember the lessons of Iraq. I do, and here they are in ascending order of importance: the American military can destroy almost any adversary, democracy cannot be imposed by force, and the concept of collective security no longer works. Before President Bush talked about democracy in Iraq, even before he mentioned weapons of mass destruction, American diplomats discussed the failure of the United Nations to enforce its own resolutions against Saddam's regime.
Russia and China this week have made it clear they will side with Iran until the theocrats announce they have the bomb—all the while saying they are defending the concept of joint action. As Thomas Friedman says, we are entering the post-post-cold-war period. And in that period the West has no choice but to realize that the world's authoritarian nations are banding together, and Russia and China are undermining the concept of collective security. Whether we like it or not, we are now engaged in a series of global struggles, with neither Beijing nor Moscow on our side.


text:
|OS X - Apps and Games Discussion of applications and games available for Mac OS X.
|Post Reply
|New Thread
|Thread Tools
Member Since: Apr 07, 2009
Location: Napier NZ
Posts: 3,291
Mac Specs: 27 iMac i5, MBP 13 & iMac 20, 2TB dual TC, AppleTV, iPh4S
Just changed to Fibre and a comparison with a mate showed he was getting faster downloads on copper than i was getting - Hmm.
Got onto ISP and techy came out and after a lot of trying things, have the cause, i think but not sure what to change/check/fix.
Here is what we ended up with: Time Caps connects to their server PPPoE and with 3 computers connected to Time Caps by ethernet leads - the PC laptop with windows gets 30/10 speeds, the iMac 20 on 10.6.3 gets sloooow downloads using speedtest.net in Safari to local server and the iMac 27 on 10.8.3 gets sloooow downloads using speedtest.net in Safari to local server BUT THEN if i use FireFox, in either iMac, doing exactly same tests speeds are same as PC. Both iMacs were open in a new admin user.
Any ideas out there?
|QUOTE Thanks
|Post Reply
|New Thread
|Thread Tools
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
All times are GMT -4. The time now is 10:18 PM.Powered by vBulletin