Fast Parallel Molecular Algorithms for DNA-Based Computation: Solving the Elliptic Curve Discrete Logarithm Problem over 𝐺𝐹(2^𝑛)

Abstract

Elliptic curve cryptographic algorithms convert input data to unrecognizable encryption and the unrecognizable data back again into its original decrypted form. The security of this form of encryption hinges on the enormous difficulty that is required to solve the elliptic curve discrete logarithm problem (ECDLP), especially over 𝐺𝐹(2^𝑛), 𝑛∈𝑍⁺. This paper describes an effective method to find solutions to the ECDLP by means of a molecular computer. We propose that this research accomplishment would represent a breakthrough for applied biological computation and this paper demonstrates that in principle this is possible. Three DNA-based algorithms: a parallel adder, a parallel multiplier, and a parallel inverse over 𝐺𝐹(2^𝑛) are described. The biological operation time of all of these algorithms is polynomial with respect to 𝑛. Considering this analysis, cryptography using a public key might be less secure. In this respect, a principal contribution of this paper is to provide enhanced evidence of the potential of molecular computing to tackle such ambitious computations.

1. Introduction

This paper proposes theoretical work that introduces powerful algorithms of molecular computation that could potentially compromise the security that is afforded by certain cryptography algorithms. Molecular computation [1] involves biochemistry and DNA rather than silicon chips to tackle formidable computations. Theoretical aspects of this interdisciplinary field are important to develop the potential and interest in this form of computation [2].

Elliptic curve cryptography (ECC) is a mathematical approach to public key cryptography using elliptic curves that are typically defined over finite fields [3]. Elliptic curves [4, 5] constitute a major area of current research that is particularly important to number theory, for example, elliptic curves had a role in the recent proof of Fermats last theorem. As applied to cryptography, not only has ECC become applied in Diffie-Hellman key exchange but also in the digital signature algorithm (DSA), a US federal government standard for digital signatures. It is known as the elliptic curve DSA (ECDSA) or that variant of the DSA operating on elliptic curve groups.

The security of these cryptosystems relies on the difficulty of solving the elliptic curve discrete logarithm problem [6, 7]. If 𝑃 is a point with order 𝑚 on an elliptic curve, and 𝑄 is some other point on the same curve, then the elliptic curve discrete logarithm problem is to determine an 𝑙 such that 𝑄=𝑙𝑃, where 𝑙 is an integer and 0≤𝑙≤𝑚−1. If this problem can be solved efficiently, then elliptic curve-based cryptosystems can be broken efficiently.

In order to tackle such a problem, Feynman proposed molecular computation in 1961 [8]. However, his idea was not implemented experimentally for some decades. In 1994, Adleman succeeded in solving an instance of the Hamiltonian path problem in a test tube, simply by the manipulation of DNA strands [1]. Following this, Lipton demonstrated that the Adleman techniques offered a solution to the satisfiability problem (the first considered NP-complete problem) [9].

Recent advances in molecular biology [10, 11] have made it possible to produce roughly 10¹⁸ DNA strands in a test tube. Those 10¹⁸ DNA strands can be made to represent 10¹⁸ bits of information. In a distant future, if biological operations may be run error free using a test tube with 10¹⁸ DNA strands, then it would be possible to process 10¹⁸ bits of information simultaneously. More details about test tube distributed systems are given in [2]. The objective for biological computing technology is to provide this enormous amount of parallelism for dealing with computationally intensive real world problems [12–14].

Advancement in DNA computing has already been made in many areas. In the field of cryptology, Boneh et al. have cracked DES using identical principles to those of Adleman's solution of the travelling salesman problem. Also, Chang et al. have developed a way to factor integers. They proposed three DNA-based algorithms: parallel subtractor; parallel comparator; and parallel modular arithmetic unit [15, 16].

In this paper, we take a step further with respect to Chang's work [16] in order to solve the elliptic curve discrete logarithm problem. We develop DNA-based algorithms for a parallel adder; a parallel multiplier; a parallel divider over 𝐺𝐹(2^𝑛) (i.e., a Galois field of characteristic 2); and a parallel adder for adding points on elliptic curves. We accomplish all of these by means of basic biological operations. We also showed that cryptosystems based on elliptic curves can be broken. Our work presents clear evidence of molecular computing abilities to accomplish complex mathematical operations.

The paper is organized as follows. Section 2 gives a brief background on DNA computing. Section 3 introduces the DNA computing that solves the elliptic curve discrete logarithm problem, for solution spaces of DNA strands. Conclusions are drawn in the final section.

2. Background

DNA (DeoxyriboNucleic Acid) is the molecule that plays the main role in DNA-based computing. DNA is a polymer, which is strung together from monomers called deoxyriboNucleotides. Distinct nucleotides are detected only with their bases, which come in two sorts: purines and pyrimidines. Purines include adenine and guanine, abbreviated A and G. Pyrimidines contain cytosine and thymine, abbreviated C and T. A DNA strand is essentially a sequence (polymer) of four types of nucleotides detected by one of four bases they contain. Two strands of DNA can form (under appropriate conditions) a double strand, if the respective bases are the Watson-Crick complements of each other—A matches T and C matches G. Hybridization is a special technology term for the pairing of two single DNA strands to make a double helix and also takes advantages of the specificity of DNA base pairing for the detection of specific DNA strands (for more discussions of the relevant biological background, refer to [10, 11]).

In the past decade, there have been revolutionary advances in the field of biomedical engineering, particularly in recombinant DNA and RNA manipulating. Due to the industrialization of the biotechnology field, laboratory techniques for recombinant DNA and RNA manipulation are becoming highly standardized. Basic principles about recombinant DNA can be found in [17–20]. In the following, we describe five biological operations that are useful for solving the elliptic curve discrete logarithm problem.

A (test) tube is a set of molecules of DNA (a multiset of finite strings over the alphabet {𝐴,𝐶,𝐺,𝑇}). Given a tube, one can perform the following operations.

(1)Extract. Given a tube 𝑃 and a short single strand of DNA, 𝑆, the operation produces two tubes +(𝑃,𝑆) and −(𝑃,𝑆), where +(𝑃,𝑆) is all of the molecules of DNA in 𝑃 which contain 𝑆 as a substrand and −(𝑃,𝑆) is all of the molecules of DNA in 𝑃 which do not contain 𝑆.(2)Merge. Given tubes 𝑃₁ and 𝑃₂, yield ∪(𝑃₁,𝑃₂), where ∪(𝑃₁,𝑃₂)=𝑃₁∪𝑃₂. This operation is to pour two tubes into one, without any change in the individual strands.(3)Amplify. Given a tube 𝑃, the operation Amplify (𝑃,𝑃₁,𝑃₂), will produce two new tubes 𝑃₁ and 𝑃₂ so that 𝑃₁ and 𝑃₂ are totally a copy of 𝑃 (𝑃₁ and 𝑃₂ are now identical) and 𝑃 becomes an empty tube.(4)Append. Given a tube 𝑃 containing a short strand of DNA 𝑍, the operation will append 𝑍 onto the end of every strand in 𝑃.(5)Append-head. Given a tube 𝑃 containing a short strand of DNA, 𝑍, the operation will append 𝑍 onto the head of every strand in 𝑃.

3. Finding the Discrete Logarithm on Elliptic Curve over 𝐺𝐹(2^𝑛)

3.1. Elliptic Curve Public Key Cryptosystem over 𝐺𝐹(2^𝑛)

An elliptic curve is defined to be the set of solutions (𝑥,𝑦)∈𝐺𝐹(2^𝑛)×𝐺𝐹(2^𝑛) to the equation𝑦²+𝑥𝑦=𝑥³+𝑎𝑥²+𝑏,(1)where 𝑎,𝑏∈𝐺𝐹(2^𝑛) and 𝑏≠0, together with the point on the curve at infinity 𝑂, (with homogeneous coordinates (0,0)).

The points on an elliptic curve form an Abelian group under a well-defined group operation. The identity of the group operation is the point 𝑂. For 𝑃=(𝑥₁,𝑦₁) a point on the curve, we define −𝑃 to be (𝑥₁,𝑦₁+𝑥₁), so 𝑃+(−𝑃)=(−𝑃)+𝑃=𝑂. Now suppose 𝑃 and 𝑄 are not 𝑂, and 𝑃≠−𝑄. Let 𝑃 be as above and 𝑄=(𝑥₂,𝑦₂), then 𝑃+𝑄=(𝑥₃,𝑦₃), where𝑥𝑦³=𝜇²+𝜇+𝑥₁+𝑥₂+𝑎,₃=𝜇(𝑥₁+𝑥₃)+𝑥₃+𝑦_1,𝜇=⎧⎪⎨⎪⎩𝑦²+𝑦₁𝑥₂+𝑥₁𝑥if𝑃≠𝑄,₂₁+𝑦𝑥₁if𝑃=𝑄,(2) (refer to [21]).

In this paper, for convenience, use 𝑏_𝑛−1𝑏_𝑛−2⋯𝑏₁𝑏₀ to denote the value of 𝑏_𝑛−1𝜔^𝑛−1+𝑏_𝑛−2𝜔^𝑛−2+⋯+𝑏₁𝜔+𝑏₀ over 𝐺𝐹(2^𝑛).

Let 𝐸 be an elliptic curve defined over 𝐺𝐹(2^𝑛), and let 𝐺∈𝐸 be a fixed and publicly known point. The receiver 𝐵 chooses 𝑎 randomly and publishes the key 𝑎𝐺, while keeping 𝑎 itself secret. To transmit a message 𝑚 to 𝐵, user 𝐴 chooses a random integer 𝑘 and sends the pair of points (𝑘𝐺,𝑃_𝑚+𝑘(𝑎𝐺)). To read the message, 𝐵 multiplies the first point in the pair by his secret 𝑎, and then subtracts the result from the second point in the pair. So, if a breaker can compute 𝑎 from public key 𝐺 and 𝑎𝐺, he can decrypt any encryption sent to 𝐵 (refer to [3]).

3.2. The Construction of a Parallel Adder over 𝐺𝐹(2^𝑛)

Over 𝐺𝐹(2^𝑛), the additive operation on two numbers is just doing XOR on each bit, respectively, without any carry. For instance, (1101)+(1001)=(0100). For every bit 𝑥_𝑗, two distinct 15 base value sequences are designed. One represents the value zero for 𝑥_𝑗 and the other represents the value one for 𝑥_𝑗. For convenience, we assume that 𝑥^1𝑗 denotes the value of 𝑥_𝑗 to be one and 𝑥^0𝑗 denotes the value of 𝑥_𝑗 to be zero. The following algorithm is used for parallel adding two 𝑛 bits binary number in a strand with one starts from the 𝑝th bit and the other one starts from the 𝑞th bit and appending the result from 𝑟th bit (see Algorithm 1).

(1) For 𝑗=0 to 𝑛−1  (1a) 𝑇1=+(𝑇0,𝑥1𝑝+𝑗) and 𝑇2=−(𝑇0,𝑥1𝑝+𝑗)  (1b) 𝑇3=+(𝑇1,𝑥1𝑞+𝑗) and 𝑇4=−(𝑇1,𝑥1𝑞+𝑗)  (1c) 𝑇5=+(𝑇2,𝑥1𝑞+𝑗) and 𝑇6=−(𝑇2,𝑥1𝑞+𝑗)  (1d) 𝑇7=∪(𝑇4,𝑇5) and 𝑇8=∪(𝑇3,𝑇6)  (1e) Append (𝑇7,𝑥1𝑟+𝑗) and Append (𝑇8,𝑥0𝑟+𝑗)  (1f) 𝑇0=∪(𝑇7,𝑇8)  EndFor EndProcedure

Algorithm 1 

Procedure ParallelAdder (𝑇₀,𝑛,𝑝,𝑞,𝑟).

Consider that 𝑛=3, 𝑝=1, 𝑞=4, and 𝑟=7. That is, two binary numbers to be added in parallel are both 3 bits, while one from the 1st bit and the other one from the 4th bit in a strand, and “append” operation starts from the 7th bit. We then suppose, tube 𝑇₀={110001,010101,001111,100011} which is regarded as an input tube for the algorithm ParallelAdder (𝑇₀,𝑛,𝑝,𝑞,𝑟). Because the value of 𝑛 is 3, step (1a) to step (1f) will be run 3 times. After the first execution of step (1a) is finished, 𝑇₁={110001,100011} and 𝑇₂={010101,001111}. Next, after the first execution of step (1b) and step (1c) is performed, 𝑇3=Φ, 𝑇₄={110001,100011}, 𝑇₅={010101,001111}, and 𝑇₆=Φ, while 𝑇₀=𝑇₁=𝑇₂=Φ. After first execution of step (1d) is run, tube 𝑇₇={110001,010101,001111,100011} and 𝑇8=Φ. After first execution of step (1e) and step (1f) is run, 𝑇₀={1100011,0101011,0011111,1000111}. Then, after the rest operations are performed, the result of tube 𝑇₀ is shown in Table 1.

Table 1 

Result of tube 𝑇₀.

Lemma 1. The algorithm ParallelAdder (𝑇₀,𝑛,𝑝,𝑞,𝑟) is applied to finish the function of a parallel adder.

Proof. The algorithm ParallelAdder (𝑇₀,𝑛,𝑝,𝑞,𝑟) is implemented by means of the extract, merge, and append operations. Each execution of step (1a) is used to produce two tubes 𝑇₁ and 𝑇₂, where all of the molecules of DNA in 𝑇₁ contain 𝑥^1𝑝+𝑗 and all of the molecules of DNA in 𝑇₂ contain 𝑥^0𝑝+𝑗. Each execution of step (1b) and step (1c) is used to produce four tubes 𝑇₃, 𝑇₄, 𝑇₅, 𝑇₆, where all DNA strands in 𝑇₃ contain 𝑥^1𝑝+𝑗 and 𝑥^1𝑞+𝑗, all DNA strands in 𝑇₄ contain 𝑥^1𝑝+𝑗 and 𝑥^0𝑞+𝑗, all DNA strands in 𝑇₅ contain 𝑥^0𝑝+𝑗 and 𝑥^1𝑞+𝑗, and all DNA strands in 𝑇₆ contain 𝑥^0𝑝+𝑗 and 𝑥^0𝑞+𝑗. According to the additive theorem over 𝐺𝐹(2^𝑛), the 𝑗th bit of the sum in 𝑇₄ and 𝑇₅ is 1 and the 𝑗th bit of the sum in 𝑇₃ and 𝑇₆ is 0.
From ParallelAdder (𝑇₀,𝑛,𝑝,𝑞,𝑟), it takes 3𝑛 extract operations, 3𝑛 merge operations, 2𝑛 append operations, and 9 test tubes to finish parallel addition. A value sequence for every bit contains 15 bases. Therefore, the algorithm will add 15𝑛 bases to all DNA strands in tube 𝑇₀.

3.3. The Construction of a Parallel Multiplier over 𝐺𝐹(2^𝑛)

Over 𝐺𝐹(2^𝑛), the multiplicative operation runs as follows:(𝑏=_𝑛−1𝜔𝑏^𝑛−1_𝑛−1+⋯+𝑏₁𝜔+𝑏₀)(𝑏^′_𝑛−1𝜔^𝑛−1+⋯+𝑏^′₁𝜔+𝑏^′₀)+⋯𝜔+𝑏^𝑛−1₀(𝑏^′_𝑛−1𝜔^𝑛−1+⋯+𝑏^′₁𝜔+𝑏^′₀)=ℎ_2𝑛−2(𝑏^′_𝑛−1𝜔^𝑛−1+⋯+𝑏^′₁𝜔+𝑏^′₀)ℎ_2𝑛−2𝜔^2𝑛−2+ℎ_2𝑛−3𝜔^2𝑛−3+⋯+ℎ₂𝜔²+ℎ₁𝜔+ℎ₀,ℎ_2𝑛−3=𝑏_𝑛−1𝑏^′_𝑛−1,ℎ=𝑏_𝑛−1𝑏^′_𝑛−2+𝑏_𝑛−2𝑏^′_𝑛−1,…,_𝑛−1ℎ=𝑏_𝑛−1𝑏^′₀+𝑏_𝑛−2𝑏^′₁+⋯+𝑏₀𝑏^′_𝑛−1,…,₁ℎ₀=𝑏₁𝑏^′₀+𝑏₀𝑏^′₁,=𝑏₀𝑏^′₀.(3)

The algorithm ParallelMultiplier (𝑇₀,𝑛,𝑝,𝑞) is used to multiply two 𝑛bit binary numbers on every strand in parallel with one starts from the 𝑝th bit and the other one starts from the 𝑞th bit. It runs as follows: at first, employ extract operation to form two tubes: 𝑇₁ and 𝑇₂. The first tube 𝑇₁ includes all of the strands on which 𝑥_𝑝=1 and the second tube 𝑇₂ includes all of the strands on which 𝑥_𝑝=0. Then, we copy the bits from 𝑞th to (𝑞+𝑛−1) th to the end of every strand in tube 𝑇₁ and append 𝑛 bits 0 to the end of every strand in tube 𝑇₂. After these operations, the (𝑞+𝑛)th bit to (𝑞+𝑛+𝑛−1)th bit show the coefficients of 𝜔^2𝑛−2 to 𝜔^𝑛−1. Using the same principle, we get the coefficients of 𝜔^2𝑛−3 to 𝜔^𝑛−2, 𝜔^2𝑛−4 to 𝜔^𝑛−3,…,𝜔^𝑛−1 to 𝜔⁰. At last, call algorithm ParallelAdder (𝑇₀,𝑛,𝑝,𝑞,𝑟) to compute the sum of coefficients of 𝜔^2𝑛−2, the sum of coefficient of 𝜔^2𝑛−3,…, and so on. As a result, the length of every strand will increase 𝑛×𝑛+2𝑛−1 bits.

From ParallelMultiplier (𝑇₀,𝑛,𝑝,𝑞), it takes 𝑂(𝑛²) extract operations, 𝑂(𝑛²) merge operations, 𝑂(𝑛²) append operations, and 𝑂(1) test tubes to finish the function of a parallel multiplier.

3.4. The Construction of a Parallel Shifter for Multiplicative Result

Because over 𝐺𝐹(2^𝑛), the exponent of 𝜔 cannot be beyond 𝑛−1, the result of parallel multiplying should be shifted by a certain irreducible polynomial, called primitive polynomial: 𝜔^𝑛+𝑏_𝑛−1𝜔^𝑛−1+⋯+𝑏₁𝜔+𝑏₀=0. The algorithm ParallelShifter ⇔𝜔^𝑛=𝑏_𝑛−1𝜔^𝑛−1+⋯+𝑏₁𝜔+𝑏₀, (𝑇₀,𝑛,𝑝) representing that the multiplicative result starts from the 𝑝th bit, is used to parallel shift the multiplicative result 𝑝 to legal form 𝑏_2𝑛−2𝜔^2𝑛−2+𝑏_2𝑛−3𝜔^2𝑛−3+⋯+𝑏₁𝜔+𝑏₀ over 𝑏_𝑛−1𝜔^𝑛−1+𝑏_𝑛−2𝜔^𝑛−2+⋯+𝑏₁𝜔+𝑏₀ which can be designed as follows: appends the primitive polynomial's coefficients from 𝐺𝐹(2^𝑛) to 𝜔^𝑛−1 to the end of every strand at first. Employ the extract operation to form two test tubes 𝜔⁰ and 𝑇₁. Tube 𝑇₂ includes all of the strands on which 𝑇₁ and tube 𝑥_𝑝=1 includes all of the strands on which 𝑇₂. Then, we add the coefficients, from item 𝑥_𝑝=0 to item 𝜔^2𝑛−3, to the coefficients of irreducible polynomial in parallel in tube 𝜔^𝑛−2. This forms the new coefficients from 𝑇₁ to 𝜔^2𝑛−3 and has deleted the 𝜔^𝑛−2 item. The coefficients from 𝜔^2𝑛−2 to 𝜔^𝑛−3 are without any change. For the 𝜔⁰ includes all of the strands that have 𝑇₂, so just copy the coefficients from 𝑥_𝑝=0 to 𝜔^2𝑛−3 without any change. After all the executions before are run, the highest exponent of 𝜔⁰ is reduced to 𝜔. Then, merge 2𝑛−3 and 𝑇₁ and begin new reduction. The principle of rest reducing turn is all like this above. When this algorithm is run out, the highest exponent of 𝑇₂ is reduced to 𝜔. This algorithm will totally append 𝑛−1 bits more to every strand.

From ParallelShifter 𝑛×𝑛+(𝑛−1)(𝑛−2)/2, it takes (𝑇₀,𝑛,𝑝) extract operations, 𝑂(𝑛²) merge operations, 𝑂(𝑛²) append operations, and 𝑂(𝑛²) test tubes to finish the function of a parallel shifter.

3.5. The Mathematical Principle of Division on 𝑂(1)

Over 𝐺𝐹(2^𝑛), to do a division operation for a dividend and a divisor, one should get the divisor's inverse first and then multiply the dividend. For the primitive polynomial 𝐺𝐹(2^𝑛) is irreducible, there exists a polynomial 𝜔^𝑛+𝑏_𝑛−1𝜔^𝑛−1+⋯+𝑏₁𝜔+𝑏₀ and a polynomial 𝑔(𝜔) that fit the equation (according to Euclid algorithm):𝑓(𝜔)

Because 𝑔(𝜔)×divisor+𝑓(𝜔)×(𝜔^𝑛+𝑏_𝑛−1𝜔^𝑛−1+⋯+𝑏₁𝜔+𝑏₀)=1.(4), 𝜔^𝑛+𝑏_𝑛−1𝜔^𝑛−1+⋯+𝑏₁𝜔+𝑏₀=0, which is to say 𝑔(𝜔)×divisor=1 is the inverse of the divisor. To find 𝑔(𝜔) and 𝑔(𝜔), one can do as follows, which is called Euclid algorithm, also called division algorithm; first, 𝑓(𝜔) is divided by the divisor. If the value of the remainder is 1, that is to say, 𝜔^𝑛+𝑏_𝑛−1𝜔^𝑛−1+⋯+𝑏₁𝜔+𝑏₀ with (𝜔^𝑛+𝑏_𝑛−1𝜔^𝑛−1+⋯+𝑏₁𝜔+𝑏₀)+𝑔(𝜔)×divisor=1 is the division result and the inverse of divisor has found which is 𝑔(𝜔); else let remainder be 𝑔(𝜔), let the divisor be the dividend and 𝑟(𝜔) be the divisor and do division operation again. Repeat the process until the remainder is 1. Because the highest exponent of 𝑟(𝜔) of remainder reduces by 1 in each repeat, it is at most repeating 𝜔 times. So in the first time division, the dividend is 𝑛−1 bits and the divisor is 𝑛+1 bits and the remainder is at most 𝑛 bits, and in the second time division the dividend is 𝑛−1 bits and the divisor is 𝑛 bits and the remainder is at most 𝑛−1 bits𝑛−2 and in last time division the dividend is 3 bits and the divisor is 2 bits and the remainder is 1 bit. Then, trace back to get the ,…,.

3.6. The Construction of a Parallel Comparator

Prior to each step of long division, comparison should be done first. Suppose the divisor is 𝑔(𝜔) bits at that time. At first compare the first two bits of dividend with divisor to determine that addition operation between first two bits of dividend and divisor should be done or not, then compare the first three bits of result with divisor𝑛 compare the first ,…, bits of result with divisor, the last time (finally), compare the last 𝑛 bits of result with divisor for this time the first bit of result is 0. The following algorithm is used to compare the divisor which is from 𝑛th bit to 𝑝th bit with the bits from 𝑞th bit to 𝑗th bit in parallel, and forms tube 𝑘 and 𝑇₁. 𝑇₂ contains all strands on which add execution will be done and 𝑇₂ contains all strands on which add execution will not be done (see Algorithm 2).

(1) If (𝑇0,𝑝,𝑞,𝑗,𝑘,𝑇1,𝑇2) then  (1a) For (𝑞−𝑝>𝑘−𝑗) to 𝑚=1   (1a1) 𝑞−𝑝−(𝑘−𝑗)   (1a2) 𝑇3=+(𝑇0,𝑥1𝑝+𝑚−1)  EndFor EndIf (2) For 𝑇1=∪(𝑇1,𝑇3) to 𝑚=𝑞−(𝑘−𝑗)−𝑝  (2a) 𝑞−𝑝  (2b) 𝑇3=+(𝑇0,𝑥1𝑝+𝑚)  (2c) 𝑇4=−(𝑇3,𝑥1𝑗+𝑚−(𝑞−𝑝−𝑘+𝑗))  (2d) 𝑇5=−(𝑇0,𝑥1𝑝+𝑚)  (2e) 𝑇6=+(𝑇5,𝑥1𝑗+𝑚−(𝑞−𝑝−𝑘+𝑗)) and 𝑇1=∪(𝑇1,𝑇4) and    𝑇2=∪(𝑇2,𝑇3,𝑇6) EndFor EndProcedure

Algorithm 2 

Procedure ParallelComparator 𝑇₁.

Lemma 2. The algorithm Parallel Comparator 𝑇₀=∪(𝑇₀,𝑇₅)(𝑇₀,𝑝,𝑞,𝑗, is applied to finish the function of parallel comparator.

Proof. If 𝑘,𝑇₁,𝑇₂), that means the bits of divisor is more than the bits of the result which are intended to compare this time. Step (1) considers the excessive bits of divisor and if any one bit is 1, which means the divisor is “bigger" than the bits of the result which are intended to compare this time and pour the strands to 𝑞−𝑝>𝑘−𝑗. Step (2) considers the rest of the bits of divisor and the bits of result which are intended to compare this time. 𝑇₁ contains all strands on which certain bit of divisor is 1 and corresponding bit of the result is 1; 𝑇₃ contains all strands on which certain bit of divisor is 1 and corresponding bit of the result is 0; 𝑇₄ contains all strands on which certain bit of divisor is 0 and corresponding bit of the result is 0; 𝑇₅ contains all strands on which certain bit of divisor is 0 and corresponding bit of the result is 1. So add execution can be done over strands in 𝑇₆ and 𝑇₃, which can not be done over strands in 𝑇₆, and strands in 𝑇₄ need more consideration.
From ParallelComparator 𝑇₅, it takes (𝑇₀,𝑝,𝑞,𝑗,𝑘,𝑇₁,𝑇₂) extract operations, 𝑂(𝑛) merge operations, and 𝑂(𝑛) test tubes to finish the function of a parallel comparator.

3.7. The Construction of a Parallel Long Division

Suppose the divisor is 𝑂(1) bits and is from 𝑛th bit and the dividend is 𝑝 bits and is from the 𝑛+1th bit in each strand. To do the long division, first compare the divisor with first two bits of dividend using ParallelComparator to get the first bit of the result of division and note down the result of first time addition result. Then, compare the divisor with the first three bits of the addition result last time to get the second bit of the result of the long division, and note down the addition result. Finally, compare the divisor with the last 𝑞 bits of addition result last time to get the last bit of division result and the remainder (see Algorithm 3).

(1) For (𝑇0,𝑛,𝑝,𝑞) to 𝑗=1  (1a) ParallelComparator 𝑛−1  (1b) Append (𝑇0,𝑝,𝑝+𝑛−1,𝑞+(𝑗−1)(𝑛+2),𝑞+(𝑗−1)(𝑛+2)+𝑗,𝑇1,𝑇2) and Append (𝑇1,𝑥0𝑞+𝑛+1+(𝑗−1)(𝑛+2))  (1c) For (𝑇2,𝑥1𝑞+𝑛+1+(𝑗−1)(𝑛+2)) to 𝑘=0   (1c1) 𝑛 and 𝑇3=+(𝑇1,𝑥1𝑞+(𝑛+2)(𝑗−1)+𝑘)   (1c2) Append 𝑇4=−(𝑇1,𝑥1𝑞+(𝑛+2)(𝑗−1)+𝑘) and Append (𝑇3,𝑥1𝑞+𝑗(𝑛+2)+𝑘)   (1c3) (𝑇4,𝑥0𝑞+𝑗(𝑛+2)+𝑘)  EndFor  (1d) ParallelAdder 𝑇1=∪(𝑇3,𝑇4)  (1e) For (𝑇2,𝑗+1,𝑞+(𝑗−1)(𝑛+2),𝑝+𝑛−𝑗−1,𝑞+(𝑛+2)𝑗) down to 1   (1e1) 𝑘=𝑛−𝑗 and 𝑇3=+(𝑇2,𝑥1𝑞+(𝑛+2)𝑗−𝑘−1)   (1e2) Append 𝑇4=−(𝑇2,𝑥1𝑞+(𝑛+2)𝑗−𝑘−1) and Append (𝑇3,𝑥1𝑞+(𝑗+1)(𝑛+2)−𝑘−1)   (1e3) (𝑇4,𝑥0𝑞+(𝑗+1)(𝑛+2)−𝑘−1)  EndFor  (1f) 𝑇2=∪(𝑇3,𝑇4) EndFor (2) ParallelComparator 𝑇0=∪(𝑇1,𝑇2) (3) Append (𝑇0,𝑝,𝑝+𝑛−1,𝑞+(𝑛+2)(𝑛−1)+1,𝑞+(𝑛+2)(𝑛−1)+𝑛,𝑇1,𝑇2) and Append (𝑇1,𝑥0𝑞+(𝑛+2)𝑛−1) (4) For (𝑇2,𝑥1𝑞+(𝑛+2)𝑛−1) to 𝑘=0  (4a) 𝑛 and 𝑇3=+(𝑇1,𝑥1𝑞+(𝑛+2)(𝑛−1)+𝑘)  (4b) Append 𝑇4=−(𝑇1,𝑥1𝑞+(𝑛+2)(𝑛−1)+𝑘) and Append (𝑇3,𝑥1𝑞+(𝑛+2)𝑛+𝑘)  (4c) (𝑇4,𝑥0𝑞+(𝑛+2)𝑛+𝑘) EndFor (5) Append 𝑇1=∪(𝑇3,𝑇4) (6) ParallelAdder (𝑇2,𝑥0𝑞+(𝑛+2)𝑛) (7) (𝑇2,𝑛,𝑞+(𝑛+2)(𝑛−1)+1,𝑝,𝑞+(𝑛+2)𝑛+1) EndProcedure

Algorithm 3 

Procedure SimilarDiv 𝑛.

Lemma 3. The algorithm SimilarDiv 𝑇₀=∪(𝑇₁,𝑇₂) is applied to finish the function of parallel long division.

Proof. Each execution of step (1) is to get each bit of the long division result. The rest part is to get the last bit of the long division result. Consider the first cycle of step (1), step (1a) compares the divisor with the first two bits of the dividend, and form two tubes (𝑇₀,𝑛,𝑝,𝑞) and 𝑇₁ that 𝑇₂ contains all strands on which add execution can be done, contrarily the 𝑇₂. Step (1b) appends 0 to all strands in 𝑇₁ and appends 1 to all strands in 𝑇₁. This bit is the first bit of the division result. Step (1c) just finishes to append the dividend in tube 𝑇₂. Step (1d) adds the divisor and the first two bits of the dividend in 𝑇₁. Step (1e) copies the rest of the bits of the dividend in 𝑇₂. Step (1f) pours 𝑇₂ and 𝑇₁ together and finishes the first execution of step (1) to get the first bit of the division result and the first time addition result. The second execution of step (1) is to compare the divisor with the first three bits of the addition result last time and get the second bit of the division result. The principle of other cycles and the rest of the steps are similar to the principle above. The length of each strand will reach to 𝑇₂ bits when this algorithm is run out.
From SimilarDiv 𝑞+𝑛+(𝑛+2)𝑛, it takes (𝑇₀,𝑛,𝑝,𝑞) extract operations, 𝑂(𝑛²) append operations, 𝑂(𝑛²) merge operations, and 𝑂(𝑛²) test tubes to finish the function of a parallel long division.

3.8. The Construction of Parallel Traceback

Suppose the irreducible polynomial 𝑂(1) and suppose 𝐴(𝜔)=𝜔^𝑛+𝑏_𝑛−1𝜔^𝑛−1+⋯+𝑏₁𝜔+𝑏₀ and 𝑔(𝜔) satisfy that 𝑓(𝜔), for the purpose of finding the divisor's inverse, 𝑔(𝜔)×divisor+𝑓(𝜔)𝐴(𝜔)=1, we need to do sometimes long division introduced in Section 3.7; let 𝑔(𝜔) be the dividend and divisor mentioned above be the divisor in first time and suppose the result is 𝐴(𝜔), and if the remainder is 1, then the division result 𝑔₁(𝜔) is 𝑔₁(𝜔). Else, let the divisor last time be the dividend and let the remainder last time be the divisor and do the long division. Suppose the result is 𝑔(𝜔) and 𝑝(𝜔), if the remainder is 1, the 𝑔₂(𝜔)=𝑝(𝜔)×𝑔₁(𝜔)+1 is 𝑔₂(𝜔). Else, let the divisor last time be the dividend and let the remainder last time be the divisor and do the long division. Suppose the result is 𝑔(𝜔) and 𝑝(𝜔), if the remainder is 1, the 𝑔₃(𝜔)=𝑝(𝜔)×𝑔₂(𝜔)+𝑔₁(𝜔) is 𝑔₃(𝜔). Generally speaking, we need to trace back after long division each time: first time, the tracing result is the division's result; the second time, the tracing's result is the sum of 1 and the product of the division's result and the tracing's result last time; from the third time, the tracing's result is the sum of the tracing's result last second time and the product of the division's result and the tracing's result last time. The following algorithm is used to do tracing operation from the third time in which 𝑔(𝜔), 𝑡, and 𝑑 mean that the tracing's result last second time is from the 𝑝th bit and the last tracing's result is from the 𝑡th bit and the division result is from the 𝑑th bit (see Algorithm 4).

(1) ParallelMultiplier (𝑇0,𝑡,𝑑,𝑝,𝑛) (2) ParallelShifter (𝑇0,𝑛,𝑑,𝑝) (3) ParallelAdder (𝑇0,𝑛,𝑝+𝑛+𝑛2) EndProcedure

Algorithm 4 

Procedure Traceback 𝑝.

Lemma 4. The algorithm TraceBack (𝑇₀,𝑛,𝑡,𝑝+𝑀,𝑝+𝑛+𝑀) is used to trace back after long division from the third time in order to get the divisor's inverse.Proof. In this and following procedures, (𝑇₀,𝑡,𝑑,𝑝,𝑛), which represent the total number of increased bits when ParallelMultiplier 𝑀=𝑛²+2𝑛−1+𝑛²+(𝑛−1)(𝑛−2)/2 and ParallelShifter (𝑇₀,𝑛,𝑝,𝑞) are called. Step (1) is used to multiply the last tracing's result from (𝑇₀,𝑛,𝑝)th bit to the long division result from 𝑑th bit in parallel. The result will be from the 𝑝th bit to (𝑝+𝑛+𝑛×𝑛)th bit. Step (2) is to shift the result of multiplication to legal form which will append (𝑝+𝑛+𝑛×𝑛+2𝑛−1) bits to every strand. And its result is from ((𝑛−1)(𝑛−2)/2+𝑛²)th bit to (𝑝+𝑀)th bit. Step (3) is used to add the result to the last second time's tracing's result in parallel.
From TraceBack (𝑝+𝑛+𝑀−1), it takes (𝑇₀,𝑡,𝑑,𝑝,𝑛) extract operations, 𝑂(𝑛²) append operations, 𝑂(𝑛²) merge operations, and 𝑂(𝑛²) test tubes to finish the function of tracing back.

3.9. The Construction of a Parallel inverse

From the algorithms introduced above, we can find divisors' inverses in parallel as follows: first pick out the strands on which divisor equals to 1. Then, let the primitive polynomial be the dividend and the divisor be the divisor and do long division. Trace back to get the tracing's result first time and pick up the strands on which the remainder equals to 1 and store them in tube 𝑂(1). Then, let the divisor last time be the dividend and the remainder last time be the divisor and do long division. Collect the quotient and trace back. Pick up the strands on which the remainder equals to 1 and store them in tube 𝑇₁𝑇₂ these executions, including long division, collecting every bit of the quotient and tracing back, are run ,…, times at most. In the following algorithm, the parameters 𝑛−1 and 𝑛 mean that the divisor is 𝑝 bits and it starts from 𝑛th bit in every strand. The last parameter 𝑝 is used to represent that each strand in tube is 𝑟 bit long and we begin append operation from 𝑟−1th bit of every strand.

Among the algorithm, the procedure Picking 𝑟 is used to pick out the strands on which the (𝑇₀,𝑛,𝑝,𝑇_𝑠)th bit to the 𝑝th bit are all 0 and the (𝑝+𝑛−2)th bit is 1 and store them in (𝑝+𝑛−1). It is easy to program, so just omitted here (see Algorithm 5).

(1) Picking (𝑇0,𝑛,𝑝,𝑟) (2) Append (𝑇0,𝑛,𝑝,𝑇𝑧) to the end of all strands in 𝐴(𝑥) (3) SimilarDiv 𝑇0 (4) For (𝑇0,𝑛,𝑝,𝑟) to 𝑗=0  (4a) 𝑛−1 and 𝑇𝑚=+(𝑇0,𝑥1𝑟+𝑛+1+(𝑛+2)𝑗)  (4b) Append 𝑇𝑠=−(𝑇0,𝑥1𝑟+𝑛+1+(𝑛+2)𝑗) and Append (𝑇𝑚,𝑥1𝑟+𝑛+1+(𝑛+2)𝑛+𝑗)  (4c) (𝑇𝑠,𝑥0𝑟+𝑛+1+(𝑛+2)𝑛+𝑗) EndFor (5) Picking 𝑇0=∪(𝑇𝑚,𝑇𝑠) (6) For (𝑇0,𝑛−1,𝑟+𝑛+1+(𝑛+2)(𝑛−1)+3,𝑇1) to 𝑗=0  (6a) 𝑛−1 and 𝑇𝑚=+(𝑇0,𝑥1𝑝+𝑗)  (6b) Append 𝑇𝑠=−(𝑇0,𝑥1𝑝+𝑗) and Append (𝑇𝑚,𝑥1𝑟+𝑠1+𝑗)  (6c) (𝑇𝑠,𝑥0𝑟+𝑠1+𝑗) EndFor (7) SimilarDiv 𝑇0=∪(𝑇𝑚,𝑇𝑠) (8) Append (𝑇0,𝑛−1,𝑟+𝑛+1+(𝑛+2)(𝑛−1)+3,𝑟+𝑠1) (9) For (𝑇0,𝑥0𝑟+𝑠1+𝑛+(𝑛+1)(𝑛−1)) to 𝑗=0  (9a) 𝑛−2 and 𝑇𝑚=+(𝑇0,𝑥1𝑟+𝑠1+𝑛+(𝑛+1)𝑗)  (9b) Append 𝑇𝑠=−(𝑇0,𝑥1𝑟+𝑠1+𝑛+(𝑛+1)𝑗) and Append (𝑇𝑚,𝑥1𝑟+𝑠1+𝑛+(𝑛+1)(𝑛−1)+1+𝑗)  (9c) (𝑇𝑠,𝑥0𝑟+𝑠1+𝑛+(𝑛+1)(𝑛−1)+1+𝑗) EndFor (10) ParallelMultiplier 𝑇0=∪(𝑇𝑚,𝑇𝑠) (11) ParallelShifter (𝑇0,𝑛,𝑟+𝑛+1+(𝑛+2)𝑛,𝑟+𝑠1+𝑛+(𝑛+1)(𝑛−1)) (12) Add 1 to the product above which will result in (𝑇0,𝑛,𝑟+𝑠1+𝑛+(𝑛+1)(𝑛−1)+𝑛+𝑛2) bits more to each strand (13) Picking 𝑛 (14) For (𝑇0,𝑛−2,𝑟+𝑠1+𝑛+(𝑛+1)(𝑛−2)+3,𝑇2) to 𝑗=2  (14a) Copy dividend (divisor last time) to the end  (14b) SimilarDiv 𝑛−2  (14c) Append (𝑇0,𝑛−𝑗,𝑟+𝑠1+⋯+𝑠𝑗−1+𝑛+2−𝑗+(𝑛+3−𝑗)(𝑛−𝑗)+3,𝑟+𝑠1+⋯+𝑠𝑗) bits 0 to the end  (14d) Collect 𝑗 bits quotient of this division to the end  (14e) Traceback 𝑛−𝑗  (14f) Picking (𝑇0,𝑟+𝑠1+⋯+𝑠𝑗−1−𝑛,𝑟+𝑠1+⋯+𝑠𝑗−𝑛,𝑟+𝑠1+⋯+𝑠𝑗+(𝑛+1−𝑗)+(𝑛+2−𝑗)(𝑛−𝑗),𝑛) EndFor (15) For (𝑇0,𝑛−1−𝑗,𝑟+𝑠1+⋯+𝑠𝑗+𝑛+1−𝑗+(𝑛+2−𝑗)(𝑛−1−𝑗)+3,𝑇𝑗+1) to 𝑗=1  (15a) For 𝑛−1 to 𝑘=0   (15a1) Append 𝑠𝑗+1+⋯+𝑠𝑛−1−1  EndFor  (15b) For (𝑇𝑗,𝑥0𝑟+𝑠1+⋯+𝑠𝑗+𝑘) to 𝑘=0   (15b1) 𝑛−1 and 𝑇𝑚=+(𝑇𝑗,𝑥1𝑟+𝑠1+⋯+𝑠𝑗−𝑛+𝑘)   (15b2) Append 𝑇𝑠=−(𝑇𝑗,𝑥1𝑟+𝑠1+⋯+𝑠𝑗−𝑛+𝑘) and Append (𝑇𝑚,𝑥1𝑟+𝑠1+⋯+𝑠𝑛−1+𝑘)   (15b3) (𝑇𝑠,𝑥0𝑟+𝑠1+⋯+𝑠𝑛−1+𝑘)  EndFor EndFor (16) For 𝑇𝑗=∪(𝑇𝑚,𝑇𝑠) to 𝑗=0  Append 𝑠1+⋯+𝑠𝑛−1+𝑛−2 EndFor (17) Append (𝑇𝑧,𝑥0𝑟+𝑗) (18) (𝑇𝑧,𝑥1𝑟+𝑠1+⋯+𝑠𝑛−1+𝑛−1) EndProcedure

Algorithm 5 

Procedure ParallelInverse 𝑇_𝑠.

Lemma 5. The algorithm ParallelInverse 𝑇₀=∪(𝑇_𝑧,𝑇₁,𝑇₂,…,𝑇_𝑛−1) is applied to find inverses over (𝑇₀,𝑛,𝑝,𝑟) in parallel.Proof. Step (2) is used to append 𝐺𝐹(2^𝑛) bits irreducible polynomial, which is the dividend in first long division, to every strand. The execution of step (3) calls the algorithm SimilarDiv 𝑛+1 to finish long division. Now the length of strands is added up to (𝑇₀,𝑛,𝑝,𝑟) bits. Step (4) finishes the function of collecting every bit of quotient and will add 𝑟+𝑛+(𝑛+2)𝑛 bits to every strand. This is the first time tracing result. Step (5) calls the procedure Picking 𝑛 to pick out the strands on which the remainder is 1 and store them in tube (𝑇₀,𝑛,𝑝,𝑇_𝑠). Step (6) finishes the operation of appending the dividend, which is divisor last time, to the strands. Note that 𝑇₁. Step (7) calls the algorithm SimilarDiv 𝑠₁=𝑛+1+(𝑛+2)𝑛+𝑛 to accomplish the second time long division. Step (8) employs the append operation to append a bit 0 in order to make the quotient to be (𝑇₀,𝑛,𝑝,𝑞) bits. Step (9) finishes the function of collecting every bit of quotient and will add 𝑛 bits to every strand. Steps (10) and (11) call the algorithm ParallelMultiplier 𝑛−1 and ParallelShifter (𝑇₀,𝑛,𝑝,𝑞). Step (12) is used to add 1 to the product. These three steps accomplish the function of tracing back of the second time. Now the length of every strand is (𝑇₀,𝑛,𝑝). Step (13) calls the algorithm Picking 𝑟+𝑠₁+𝑛+(𝑛+1)(𝑛−1)+𝑛+𝑀+𝑛−1 to pick out the strands on which the remainder is 1 and store them in tube (𝑇₀,𝑛,𝑝,𝑇_𝑠). One execution of step (14) finishes the function of long division and tracing back and picking out the strands on which the remainder is 1. The step will be looped 𝑇₂ times, because the long division should be done 𝑛−3 times to make sure that the remainder of each strand equals to 1 and long division has been done twice before. Note that while 𝑛−1, 𝑗≥2. Step (15a) is used to append certain bits 0 to each tube 𝑠_𝑗=𝑛+2−𝑗+(𝑛+3−𝑗)(𝑛+1−𝑗)+𝑛+𝑀+𝑛 to make sure that strands in 𝑇_𝑗 to 𝑇₁ are all 𝑇_𝑛−1 bits long. Step (15b) is used to append the inverse gotten before to the last of every strand in 𝑟+𝑠₁+⋯+𝑠_𝑛−1−1 to 𝑇₁. Step (18) pours strands in all tubes together to one tube 𝑇_𝑛−1. From all above, getting inverse one time needs increasing 𝑇₀ bits to every strand.
From ParallelInverse 𝑠₁+𝑠₂+⋯+𝑠_𝑛−1+𝑛, it takes (𝑇₀,𝑛,𝑝,𝑟) extract operations, 𝑂(𝑛³) append operations, 𝑂(𝑛³) merge operations, and 𝑂(𝑛³) test tubes to finish the function of finding inverse in parallel.

3.10. The Construction of a Parallel Divider

To do a division operation on 𝑂(𝑛), first one should calculate divisor's inverse using above mentioned algorithm then multiply the dividend. The following algorithm is used to finish the function of parallel division over 𝐺𝐹(2^𝑛) where the dividend begins with the 𝐺𝐹(2^𝑛),th bit and the divisor begins with the 𝑞th bit, and current bit is the 𝑝th bit (see Algorithm 6).

(1) ParallelInverse (𝑇0,𝑛,𝑝,𝑞,𝑟) (2) ParallelMultiplier (𝑇0,𝑛,𝑝,𝑟) (3) ParallelShifter (𝑇0,𝑛,𝑞,𝑟+𝑠1+⋯+𝑠𝑛−1) EndProcedure

Algorithm 6 

Procedure ParallelDivision 𝑟.

Lemma 6. The algorithm ParallelDivision (𝑇₀,𝑛,𝑟+𝑠₁+⋯+𝑠_𝑛−1+𝑛+𝑛×𝑛) is used to finish the function of parallel division over (𝑇₀,𝑛,𝑝,𝑞,𝑟).Proof. Step (1) calls the algorithm ParallelInverse 𝐺𝐹(2^𝑛) to get the divisor's inverse of every strand. The length of every strand is (𝑇₀,𝑛,𝑝,𝑟) bits now with the inverse from 𝑟+𝑠₁+⋯+𝑠_𝑛−1+𝑛−1th bit to (𝑟+𝑠₁+⋯+𝑠_𝑛−1)th bit. Step (2) calls ParallelMultiplier (𝑟+𝑠₁+⋯+𝑠_𝑛−1+𝑛−1) to finish the function of the inverse being multiplied by the dividend every strand with the dividend starting from the (𝑇₀,𝑛,𝑝,𝑞)th bit. Now the length of each strand adds up to 𝑞 bits. Step (3) shifts the product by calling ParallelShifter 𝑟+𝑠₁+⋯+𝑠_𝑛−1+𝑛+𝑛×𝑛+2𝑛−1−1 and will add (𝑇₀,𝑛,𝑝) bits to every strand. Generally speaking, doing parallel division one time need increasing the strands (𝑛−1)(𝑛−2)/2+𝑛×𝑛 bits.
From ParallelDivision 𝐷=𝑠₁+⋯+𝑠_𝑛−1+𝑛+𝑀, it takes (𝑇₀,𝑛,𝑝,𝑞,𝑟) extract operations, 𝑂(𝑛³) append operations, 𝑂(𝑛³) merge operations, and 𝑂(𝑛³) test tubes to finish the function of parallel division.

3.11. The Construction of a Parallel Adder of Two Points on Elliptic Curve

By far the addition, subtraction (the same to addition), multiplication, and division operations over 𝑂(𝑛) have been solved. Now consider how to execute addition of two points on an elliptic curve 𝐺𝐹(2^𝑛) in biological ways. We should consider five different cases: case 1, the first point is 𝑦²+𝑥𝑦=𝑥³+𝑎𝑥²+𝑏 and the point of sum equals to the second point; case 2, the second point is 𝑂 and the point of sum equals to the first point; case 3, one point is the inverse of the other one, and the point of sum is 𝑂; case 4, one point equals to the other one, and computes the sum as the formula in part 3.1; case 5, computes the sum using the formula in part 3.1.

The algorithm AddTwoNode 𝑂 is used to add two points. The first one's position (𝑇₀,𝑛,𝑥1,𝑦1,𝑥2,𝑦2,𝑟) starts from the 𝑥th bit and position (𝑥1) starts from the 𝑦th bit, and the second one's position (𝑦1) starts from the 𝑥th bit and (𝑥2) starts from the 𝑦th bit. The parameter (𝑦2) represents the current bit. In the procedure, it calls Picking01 𝑟 to pick out the strands on which the first point is (𝑇₀,𝑛,𝑥1,𝑦1,𝑥2,𝑦2,𝑇₁₁) and store them in 𝑂, Picking02 𝑇₁₁ to pick out the strands on which the second point is (𝑇₀,𝑛,𝑥1,𝑦1,𝑥2,𝑦2,𝑇₁₂) and store them in 𝑂, PickingInverse 𝑇₁₂ to pick out the strands on which one point is the inverse of the other one and store them in tube (𝑇₀,𝑛,𝑥1,𝑦1,𝑥2,𝑦2,𝑟,𝑇₂), and PickingEqual 𝑇₂ to pick out the strands on which one point equals to the other one and store them in tube (𝑇₀,𝑛,𝑥1,𝑦1,𝑥2,𝑦2,𝑇₃). These four algorithms are easy to design, so omitted here. Note that PickingInverse 𝑇₃ will increase (𝑇₀,𝑛,𝑥1,𝑦1,𝑥2,𝑦2,𝑟,𝑇₂) bits to every strand in 𝑛 (see Algorithm 7).

(1) Picking01 (𝑇0,𝑛,𝑥1,𝑦1,𝑥2,𝑦2,𝑟) (2) Picking02 (𝑇0,𝑛,𝑥1,𝑦1,𝑥2,𝑦2,𝑇11) (3) PickingInverse (𝑇0,𝑛,𝑥1,𝑦1,𝑥2,𝑦2,𝑇12) (4) PickingEqual (𝑇0,𝑛,𝑥1,𝑦1,𝑥2,𝑦2,𝑟,𝑇2) (5) For (𝑇0,𝑛,𝑥1,𝑦1,𝑥2,𝑦2,𝑇3) to 𝑗=0  (5a) Append 𝑀−1 EndFor (6) ParallelAdder (𝑇0,𝑥0𝑟+𝑛+𝑗) (7) ParallelAdder (𝑇0,𝑛,𝑦1,𝑦2,𝑟+𝑛+𝑀) (8) ParallelDivision (𝑇0,𝑛,𝑥1,𝑥2,𝑟+𝑛+𝑀+𝑛) (9) For (𝑇0,𝑛,𝑟+𝑛+𝑀+𝑛,𝑟+𝑛+𝑀,𝑟+𝑛+𝑀+2𝑛) to 𝑗=0  (9a) 𝑛−1 and 𝑇𝑚=+(𝑇3,𝑥1𝑥1+𝑗)  (9b) Append 𝑇𝑠=−(𝑇3,𝑥1𝑥1+𝑗) and Append (𝑇𝑚,𝑥1𝑟+𝑛+𝑗)  (9c) (𝑇𝑠,𝑥0𝑟+𝑛+𝑗) EndFor (10) ParallelMultiplier 𝑇3=∪(𝑇𝑚,𝑇𝑠) (11) ParallelShifter (𝑇3,𝑛,𝑟+𝑛,𝑟+𝑛) (12) ParallelAdder (𝑇3,𝑛,𝑟+𝑛+𝑛+𝑛×𝑛) (13) ParallelDivision (𝑇3,𝑛,𝑦1,𝑟+𝑛+𝑛+𝑀−𝑛,𝑟+𝑛+𝑛+𝑀) (14) (𝑇3,𝑛,𝑥1,𝑟+𝑛+𝑛+𝑀,𝑟+𝑛+𝑛+𝑀+𝑛) SUPPOSE 𝑇0=∪(𝑇0,𝑇3) (15) ParallelMultiplier 𝑈=𝑛+𝑀+𝑛+𝐷 (16) ParallelShifter (𝑇0,𝑛,𝑟+𝑛+𝑈−𝑛,𝑟+𝑛+𝑈−𝑛) (17) ParallelAdder (𝑇0,𝑛,𝑟+𝑛+𝑈+𝑛×𝑛) (18) ParallelAdder (𝑇0,𝑛,𝑟+𝑛+𝑈−𝑛,𝑟+𝑛+𝑈+𝑀−𝑛,𝑟+𝑛+𝑈+𝑀) (19) ParallelAdder (𝑇0,𝑛,𝑟+𝑛+𝑈+𝑀,𝑥1,𝑟+𝑛+𝑈+𝑀+𝑛) (20) For (𝑇0,𝑛,𝑟+𝑛+𝑈+𝑀+𝑛,𝑥2,𝑟+𝑛+𝑈+𝑀+𝑛+𝑛) to 𝑗=0  (20a) Append 𝑛−1 EndFor (21) ParallelAdder (𝑇0,𝑥𝑎,𝑟+𝑛+𝑈+𝑀+3𝑛+𝑗) SUPPOSE (𝑇0,𝑛,𝑟+𝑛+𝑈+𝑀+2𝑛,𝑟+𝑛+𝑈+𝑀+3𝑛,𝑟+𝑛+𝑈+𝑀+4𝑛) (22) ParallelAdder 𝑋=𝑈+𝑀+5𝑛 (23) ParallelMultiplier (𝑇0,𝑛,𝑥1,𝑟+𝑛+𝑋−𝑛,𝑟+𝑛+𝑋) (24) ParallelShifter (𝑇0,𝑛,𝑟+𝑛+𝑈−𝑛,𝑟+𝑛+𝑋) (25) ParallelAdder (𝑇0,𝑛,𝑟+𝑛+𝑋+𝑛+𝑛×𝑛) (26) ParallelAdder (𝑇0,𝑛,𝑟+𝑛+𝑋+𝑛+𝑀−𝑛,𝑟+𝑛+𝑋−𝑛,𝑟+𝑛+𝑋+𝑛+𝑀) SUPPOSE (𝑇0,𝑛,𝑟+𝑛+𝑋+𝑛+𝑀,𝑦1,𝑟+𝑛+𝑋+𝑛+𝑀+𝑛) (27) For 𝑌=𝑛+𝑀+𝑛+𝑛 to 𝑗=0  (27a) 𝑛−1 and 𝑇𝑚=+(𝑇0,𝑥1𝑟+𝑋+𝑗)  (27b) Append 𝑇𝑠=−(𝑇0,𝑥1𝑟+𝑋+𝑗) and Append (𝑇𝑚,𝑥1𝑟+𝑛+𝑋+𝑌+𝑗)  (27c) (𝑇𝑠,𝑥0𝑟+𝑛+𝑋+𝑌+𝑗) EndFor (28) For 𝑇0=∪(𝑇𝑚,𝑇𝑠) to 𝑗=0  (28a) 𝑛−1 and 𝑇𝑚=+(𝑇0,𝑥1𝑟+𝑛+𝑋+𝑌−𝑛+𝑗)  (28b) Append 𝑇𝑠=−(𝑇0,𝑥1𝑟+𝑛+𝑋+𝑌−𝑛+𝑗) and Append (𝑇𝑚,𝑥1𝑟+𝑛+𝑋+𝑌+𝑛+𝑗)  (28c) (𝑇𝑠,𝑥0𝑟+𝑛+𝑋+𝑌+𝑛+𝑗) EndFor (29) Append 𝑇0=∪(𝑇𝑚,𝑇𝑠) bits 0 to each strand in 𝑛+𝑋+𝑌 and 𝑇11. Then, append values of 𝑇12 and 𝑥2 of each strand to    the end in 𝑦2, and append values of 𝑇11 and 𝑥1 of each strand to the end in 𝑦1 (30) Append 𝑇12 bits 0 to every strand in 𝑋+𝑌+2𝑛 (31) 𝑇2 EndProcedure

Algorithm 7 

Procedure AddTwoNode 𝑇₀.

Lemma 7. The algorithm AddTwoNode 𝑇₀=∪(𝑇₁₁,𝑇₁₂,𝑇₂,𝑇₀)(𝑇₀,𝑛,𝑥1,𝑦1,𝑥2, can compute the sum of two points on elliptic curve.Proof. Step (5) employs append operation to append 𝑦2,𝑟) bits 0 to all strands in tube 𝑀. Step (6) to step (8) are operations on tube 𝑇₀ to get 𝑇₀ of strands in 𝜇. Step (9) to step (13) are operations on tube 𝑇₀ to get 𝑇₃ of strands in 𝜇. Step (14) pours 𝑇₃ and 𝑇₀ to 𝑇₃ and the length of every strand in 𝑇₀ now is 𝑇₀ bits. Step (15) to step (21) accomplish to compute the position 𝑟+𝑛+𝑛+𝑀+𝑛+𝐷−1 of point of sum and the result is from 𝑥th bit. The execution of steps (22) to (26) is used to get the position (𝑟+𝑋) of the sum which equals to 𝑦. And now, the position 𝜇(𝑥1+𝑥3)+𝑥3+𝑦1 of the sum is from 𝑦th bit and the length is (𝑟+𝑋+𝑌) bits.
Steps (27) and (28) are applied to append the value of positions 𝑟+𝑛+𝑋+𝑌−1 and 𝑥 of the sum of two points to the last of every strand. Now, the length of every strand in 𝑦 is 𝑇₀ bits with the value 𝑟+𝑛+𝑋+𝑌+2𝑛−1 from the 𝑥th bit and (𝑟+𝑛+𝑋+𝑌) from the 𝑦th bit.
From AddTwoNode (𝑟+𝑛+𝑋+𝑌+𝑛), it takes (𝑇₀,𝑛,𝑥1,𝑦1,𝑥2,𝑦2,𝑟) extract operations, 𝑂(𝑛³) append operations, 𝑂(𝑛³) merge operations, and 𝑂(𝑛³) test tubes to finish the function of a parallel adder for points on elliptic curve.

3.12. Breaking the Elliptic Curve Cryptosystem

We have constructed the algorithm above for parallel computing the point of the sum of two points. Then, we can solve elliptic curve discrete logarithm problem as follows: consider point 𝑂(𝑛) and 𝑃 are given, and 𝑄 is what we want to get which matches 𝑙. First, we amplify 𝑄=𝑙𝑃 into two tubes and add 𝑃 in one tube. Check if 𝑃 equals to 2𝑃; if not, note down the value of 𝑄 and pour two tubes together. Then, amplify the tube into two tubes and add 2𝑃 in one tube. Check if any point equals to 2𝑃; if not, note down the value of 𝑄 and pour two tubes together, or we get the value of 4𝑃. Then, amplify the tube into two tubes and add 𝑙 in one tube4𝑃 while this loop executes ,…, times, the value from 1 to 𝑛 for 2^𝑛 will have been checked, and the elliptic curve cryptosystem has been broken by the solved elliptic curve discrete logarithm problem.

4. Conclusion

This paper is the first effort in literature that demonstrates that the difficult problem for elliptic curve discrete logarithm can be solved on a DNA-based computer. While Chang's work makes great progress in application of DNA computing in cryptoanalysis [16], which is breaking RSA by factoring integer, this paper proposes application of DNA computing in another popular cryptosystem, ECC, which is more complex and has more challenge in cryptoanalysis. Though the algorithm is somewhat complex, it takes a series of steps that is polynomial in the input size, so it is feasible in theory and inspirits the development of DNA computing. Simultaneously, the paper also shows that humans' complex mathematical operations can directly be performed with basic biological operations. The property for the difficulty of elliptic curve discrete logarithm is the basis of elliptic curve cryptosystems. However, this property seems to be incorrect on a molecular computer. This indicates that the elliptic curve cryptosystems are perhaps insecure if the technique of DNA computing is skillful enough to run the algorithms efficiently as discussed in this paper.

Acknowledgments

The authors thank Daniel Howard (QinetiQ, Malvern Technology Centre, UK) for his great efforts in correcting this paper. This work is supported by National Natural Science Foundation (60603053) of China.