20 years of isogeny-based cryptography Luca De Feo feat. Jean - PowerPoint PPT Presentation

20 years of isogeny-based cryptography Luca De Feo feat. Jean Kieffer, Benjamin Smith Université Paris Saclay, UVSQ & Inria November 14, 2017, Elliptic Curve Cryptography, Nijmegen Slides online at http://defeo.lu/docet/

Overview Isogenies 1 Isogeny graphs in cryptography 2 Recent work 3 Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 2 / 49

Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... R Q P P ✰ Q Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 3 / 49

Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve...forget it! R Q P P ✰ Q Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 3 / 49

✰ ✰ Elliptic curves Let ✦ 1 ❀ ✦ 2 ✷ ❈ be linearly independent complex numbers. Set ✄ ❂ ✦ 1 ❩ ✟ ✦ 2 ❩ ✦ 2 ❈ ❂ ✄ is an ❈ ❂ ✄ elliptic curve. ✦ 1 Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 4 / 49

✰ ✦ ❈ ❂ ✄ ✰ ✦ Elliptic curves Addition law induced by addition on ❈ . b a Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 4 / 49

✦ ❈ ❂ ✄ ✰ ✦ Elliptic curves Addition law induced by a ✰ b addition on ❈ . b a Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 4 / 49

✦ ❈ ❂ ✄ ✰ ✦ Elliptic curves Addition law induced by a ✰ b addition on ❈ . b a Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 4 / 49

✰ ✦ ❈ ❂ ✄ ✦ Elliptic curves Addition law induced by addition on ❈ . b a a ✰ b Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 4 / 49

❬ ❪ ❬ ❪ Multiplication a Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 5 / 49

❬ ❪ Multiplication ❬ 3 ❪ a a Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 5 / 49

❬ ❪ Multiplication ❬ 3 ❪ a a Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 5 / 49

Torsion subgroups The ❵ -torsion subgroup is made up by the points ✒ i ✦ 1 ✓ ❵ ❀ j ✦ 2 ❵ It is a group of rank two E ❬ ❵ ❪ ❂ ❤ a ❀ b ✐ b ✬ ✭ ❩ ❂❵ ❩ ✮ 2 a Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 6 / 49

Isogenies Let a ✷ ❈ ❂ ✄ 1 be an ❵ -torsion point, and let ✄ 2 ❂ a ❩ ✟ ✄ 1 Then ✄ 1 ✚ ✄ 2 and we define a degree ❵ cover p ✣ ✿ ❈ ❂ ✄ 1 ✦ ❈ ❂ ✄ 2 ✣ is a morphism of complex Lie a groups and is called an isogeny. Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 7 / 49

Isogenies Let a ✷ ❈ ❂ ✄ 1 be an ❵ -torsion point, and let ✄ 2 ❂ a ❩ ✟ ✄ 1 Then ✄ 1 ✚ ✄ 2 and we define a degree ❵ cover p ✣ ✿ ❈ ❂ ✄ 1 ✦ ❈ ❂ ✄ 2 ✣ is a morphism of complex Lie a groups and is called an isogeny. Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 7 / 49

Isogenies Let a ✷ ❈ ❂ ✄ 1 be an ❵ -torsion point, and let ✄ 2 ❂ a ❩ ✟ ✄ 1 Then ✄ 1 ✚ ✄ 2 and we define a degree ❵ cover p ✣ ✿ ❈ ❂ ✄ 1 ✦ ❈ ❂ ✄ 2 ✣ is a morphism of complex Lie a groups and is called an isogeny. Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 7 / 49

Isogenies Taking a point b not in the kernel of ✣ , we obtain a new degree ❵ cover ❫ ✣ ✿ ❈ ❂ ✄ 2 ✦ ❈ ❂ ✄ 3 The composition ❫ ✣ ✍ ✣ has degree ❵ 2 p and is homothetic to the b multiplication by ❵ map. ❫ ✣ is called the dual isogeny of ✣ . Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 7 / 49

Isogenies Taking a point b not in the kernel of ✣ , we obtain a new degree ❵ cover ❫ ✣ ✿ ❈ ❂ ✄ 2 ✦ ❈ ❂ ✄ 3 The composition ❫ ✣ ✍ ✣ has degree ❵ 2 p and is homothetic to the b multiplication by ❵ map. ❫ ✣ is called the dual isogeny of ✣ . Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 7 / 49

Isogenies Taking a point b not in the kernel of ✣ , we obtain a new degree ❵ cover ❫ ✣ ✿ ❈ ❂ ✄ 2 ✦ ❈ ❂ ✄ 3 The composition ❫ ✣ ✍ ✣ has degree ❵ 2 and is homothetic to the b multiplication by ❵ p map. ❫ ✣ is called the dual isogeny of ✣ . Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 7 / 49

Isogenies over arbitrary fields Isogenies are just the right notion of morphism for elliptic curves Surjective group morphisms. Algebraic maps (i.e., defined by polynomials). (Separable) isogenies ✱ finite subgroups: ✦ E ✵ ✦ 0 ✣ 0 ✦ H ✦ E The kernel H determines the image curve E ✵ up to isomorphism def ❂ E ✵ ✿ E ❂ H Isogeny degree Neither of these definitions is quite correct, but they nearly are: The degree of ✣ is the cardinality of ❦❡r ✣ . (Bisson) the degree of ✣ is the time needed to compute it. Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 8 / 49

Easy and hard problems In practice: an isogeny ✣ is just a rational fraction (or maybe two) x n ✰ ✁ ✁ ✁ ✰ n 1 x ✰ n 0 N ✭ x ✮ with n ❂ ❞❡❣ ✣❀ D ✭ x ✮ ❂ ✷ k ✭ x ✮ ❀ x n � 1 ✰ ✁ ✁ ✁ ✰ d 1 x ✰ d 0 and D ✭ x ✮ vanishes on ❦❡r ✣ . ⑦ Vélu’s formulas ❖ ✭ n ✮ Input: A generator of the kernel H of the isogeny. Output: The curve E ❂ H and the rational fraction N ❂ D . The explicit isogeny problem Input: The curves E and E ❂ H , the degree n . Output: The rational fraction N ❂ D . Algorithms a ⑦ Elkies’ algorithm (and variants); ❖ ✭ n ✮ ⑦ Couveignes’ algorithm (and variants). ❖ ✭ n 2 ✮ a Elkies 1998; Couveignes 1996. Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 9 / 49

Easy and hard problems Isogeny evaluation Input: A description of the isogeny ✣ , a point P ✷ E ✭ k ✮ . Output: The curve E ❂ H and ✣ ✭ P ✮ . Examples Input = rational fraction; O ✭ n ✮ ⑦ Input = composition of low degree isogenies; ❖ ✭❧♦❣ n ✮ The isogeny walk problem O ✭❄❄✮ Input: Isogenous curves E , E ✵ . Output: A path of low degree isogenies from E to E ✵ . Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 10 / 49

Easy and hard problems Isogeny evaluation Input: A description of the isogeny ✣ , a point P ✷ E ✭ k ✮ . Output: The curve E ❂ H and ✣ ✭ P ✮ . Examples Input = rational fraction; O ✭ n ✮ ⑦ Input = composition of low degree isogenies; ❖ ✭❧♦❣ n ✮ The isogeny walk problem O ✭❄❄✮ Input: Isogenous curves E , E ✵ . Output: A path of low degree isogenies from E to E ✵ . Exponential separation... Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 10 / 49

Easy and hard problems Isogeny evaluation Input: A description of the isogeny ✣ , a point P ✷ E ✭ k ✮ . Output: The curve E ❂ H and ✣ ✭ P ✮ . Examples Input = rational fraction; O ✭ n ✮ ⑦ Input = composition of low degree isogenies; ❖ ✭❧♦❣ n ✮ The isogeny walk problem O ✭❄❄✮ Input: Isogenous curves E , E ✵ . Output: A path of low degree isogenies from E to E ✵ . Exponential separation...Crypto happens! Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 10 / 49

Isogeny graphs ✣ We look at the graph of elliptic curves with E ✵ E isogenies up to isomorphism. We say two isogenies ✣❀ ✣ ✵ are isomorphic if: ❡ ✣ ✵ E ✵ Example: Finite field, ordinary case, graph of isogenies of degree 3 . Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 11 / 49

Structure of the graph 1 Theorem (Serre-Tate) Two curves are isogenous over a finite field k if and only if they have the same number of points on k . The graph of isogenies of prime degree ❵ ✻ ❂ p Ordinary case (isogeny volcanoes) Nodes can have degree 0 ❀ 1 ❀ 2 or ❵ ✰ 1 . ■ For ✘ 50 ✪ of the primes ❵ , graphs are just isolated points; ■ For other ✘ 50 ✪ , graphs are 2 -regular; ■ other cases only happen for finitely many ❵ ’s. Supersingular case The graph is ❵ ✰ 1 -regular. There is a unique (finite) connected component made of all supersingular curves with the same number of points. 1 Deuring 1941; Kohel 1996; Fouquet and Morain 2002. Luca De Feo (U Paris Saclay) 20 years of isogeny-based cryptography Nov 14, 2017 — ECC (Nijmegen) 12 / 49