Computing supersingular isogenies on Kummer surfaces Craig Costello - - PowerPoint PPT Presentation

β–Ά
computing supersingular isogenies on kummer surfaces
SMART_READER_LITE
LIVE PREVIEW

Computing supersingular isogenies on Kummer surfaces Craig Costello - - PowerPoint PPT Presentation

Nov 14, 2023 571 likes β€’767 views

Computing supersingular isogenies on Kummer surfaces Craig Costello ASIACRYPT December 6, 2018 Brisbane, Australia ECC vs. post-quantum ECC W. Castryck (GIF): https://www.esat.kuleuven.be/cosic/?p=7404 Alice 2 " -isogenies, Bob 3 $

slide-1
SLIDE 1

Craig Costello

Computing supersingular isogenies on Kummer surfaces

ASIACRYPT December 6, 2018 Brisbane, Australia

slide-2
SLIDE 2
  • W. Castryck (GIF): https://www.esat.kuleuven.be/cosic/?p=7404

ECC vs. post-quantum ECC

slide-3
SLIDE 3

Alice 2"-isogenies, Bob 3$-isogenies

  • W. Castryck (GIF): https://www.esat.kuleuven.be/cosic/?p=7404
slide-4
SLIDE 4

In a nutshell: 𝐹(𝔾())

slide-5
SLIDE 5

In a nutshell: 𝐾,(𝔾()

slide-6
SLIDE 6

In a nutshell: 𝐿(𝔾()

slide-7
SLIDE 7

Why go hyperelliptic?

𝐹 ∢ 𝑧1 = 𝑦4 + β‹― 𝐷: 𝑧1 = 𝑦9 + β‹―

𝐻 = 𝐹 𝐻 = #𝐹

#𝐹 𝔾< β‰ˆ #𝐷 𝔾<

𝐻 β‰ˆ 𝐷×𝐷 𝐻 = #𝐷 1

slide-8
SLIDE 8

Why go Kummer? 𝐾(𝔾() 72 equations in β„™@A 𝐿(𝔾() = 𝐾(𝔾()/⟨±1⟩ 1 equation in β„™4

  • Genus 2 analogue of elliptic curve 𝑦-line
  • Extremely efficient arithmetic
slide-9
SLIDE 9

… a few of my favourite things…

slide-10
SLIDE 10

From elliptic to hyperelliptic

𝐹/𝐿: 𝑧1 = 𝑦4 + 1 𝐷/𝐿: 𝑧1 = 𝑦9 + 1

Consider Obvious map

πœ• ∢ 𝐷 𝐿 β†’ 𝐹 𝐿 𝑦, 𝑧 ↦ (𝑦1, 𝑧)

1: But what about πœ•K@ ∢ 𝐹 𝐿 β†’ 𝐷(? )… 2: Points on 𝐹 are group elements, points on 𝐷 are not… 3: Actually want map 𝐹 β†’ 𝐾,, but dim 𝐹 = 1 while dim 𝐾, = 2… 4: Want general πœ•, πœ•K@ between 𝑧1 = 𝑦4 + 𝐡𝑦1 + 𝑦 to 𝑧1 = 𝑦9 + 𝐡𝑦Q + 𝑦1 ???

slide-11
SLIDE 11

𝔾() = 𝔾((𝑗) with 𝑗1 + 1 = 0

Proposition 1

𝐹/𝔾(): 𝑧1= 𝑦 𝑦 βˆ’ 𝛽 𝑦 βˆ’ 1/𝛽

𝐷/𝔾(: 𝑧1= (𝑦1 + 𝑛𝑦 βˆ’ 1) 𝑦1 βˆ’ 𝑛𝑦 βˆ’ 1 𝑦1 βˆ’ π‘›π‘œπ‘¦ βˆ’ 1

𝛽 = 𝛽X + 𝛽@𝑗 with 𝛽X, 𝛽@ ∈ 𝔾( 𝑛 =

1Z[ Z\ , π‘œ = (Z[

)]Z\ )K@)

(Z[]Z\

)]@) both in 𝔾(

Then Res𝔾a)/𝔾a(𝐹) is (2,2)-isogenous to 𝐾,(𝔾() Or, pictorially,

πœƒ πœƒ πœƒΜ‚

ker(πœƒ) β‰… ker πœƒΜ‚ β‰… β„€1Γ—β„€1 πœƒ ∘ πœƒΜ‚ = [2]

slide-12
SLIDE 12
  • Weil restriction turns 1 equation over 𝔾() into two equations over 𝔾(
  • Simple linear transform of 𝐹/𝔾(): 𝑧1 = 𝑔 𝑦 = 𝑦4 + 𝐡𝑦1 + 𝑦 to

𝐹 l/𝔾(): 𝑧1 = 𝑕(𝑦) such that 𝐷/𝔾(): 𝑧1 = 𝑕(𝑦1) is non-singular

  • Pullback πœ•βˆ— of πœ• ∢ 𝑦, 𝑧 ↦ (𝑦1, 𝑧) gives 2 points in 𝐷 𝔾(o ,

but composition with Abel-Jacobi map bring these to 𝐾,(𝔾())

  • Need to go from 𝐾,(𝔾()) to 𝐾,(𝔾(); cue good old Trace map,

𝜐: 𝑄 ↦ r 𝜏(𝑄)

t u∈vwx(𝔾a)/𝔾a)

Unpacking Proposition 1

πœ” 𝜍 𝜐

πœƒ ∢ Res𝔾a)/𝔾a(𝐹) β†’ 𝐾,(𝔾(), 𝑄 ↦ (𝜐 ∘ 𝜍 ∘ πœ”)(𝑄)

slide-13
SLIDE 13

Matching 2-kernels in 𝔾() with (2,2)-kernels in 𝔾(

(0,0)

𝐾, 2 β‰… β„€1Γ—β„€1Γ—β„€1Γ—β„€1 𝐹 2 β‰… β„€1Γ—β„€1

𝑃

𝐾, β‰… β„€((]@)/1Γ—β„€((]@)/1Γ—β„€1Γ—β„€1 𝐹 β‰… β„€((]@)Γ—β„€((]@)

  • Fifteen (2,2)-kernels in 𝐾, 𝔾( . Number of ways to split 𝐷’s sextic into

three quadratic factors.

  • Le

Lemma mma 2: identifies 𝑃 ↔ (0,0) and Ξ₯, Ξ₯ ~ ↔ { 𝛽, 0 , 1/𝛽, 0 }

slide-14
SLIDE 14
  • Elliptic curve isogenies are easy/explicit/fast, thanks to VΓ©lu. But beyond elliptic curves, far from true!
  • 2,2 -isogenies in genus 2 are exception, thanks to work beginning with Richelot in 1836
  • Lessons learned from elliptic case:

(1) easiest to derive explicitly when the kernel is 𝑃, i.e. the kernel we don’t want! (2) when kernel is Ξ₯, precompose with isomorphism πœŠβ€š ∢ 𝐾, β†’ 𝐾,Ζ’ Ξ₯ ↦ 𝑃ƒ (3) πœŠβ€š either requires a square root, or torsion β€œfrom above” (4) who cares about the full Jacobian group, let’s move the Kummer variety

Richelot isogenies in genus 2

𝑃 πœŠβ€š(Ξ₯)

πœŠβ€š β‰…

slide-15
SLIDE 15

πΏβ€ž,…,†

‑ˆ‰ : 𝐺 β‹… π‘Œ@π‘Œ1π‘Œ4π‘ŒQ = π‘Œ@ 1 + π‘Œ1 1 + π‘Œ4 1 + π‘ŒQ 1 βˆ’ 𝐻 π‘Œ@ + π‘Œ1

π‘Œ4 + π‘ŒQ βˆ’ 𝐼 π‘Œ@π‘Œ1 + π‘Œ4π‘ŒQ

1

Supersingular Kummer surfaces

𝐼: β„“@: β„“1: β„“4: β„“Q ↦ (β„“@ + β„“1 + β„“4 + β„“Q: β„“@+β„“1 βˆ’ β„“4 βˆ’ β„“Q: β„“@ βˆ’ β„“1 + β„“4 βˆ’ β„“Q: β„“@ βˆ’ β„“1 βˆ’ β„“4 + β„“Q) 𝑇: β„“@: β„“1: β„“4: β„“Q ↦ (β„“@

1: β„“1 1: β„“4 1: β„“Q 1)

𝐷: β„“@: β„“1: β„“4: β„“Q ↦ (𝜌@β„“@: 𝜌1β„“1: 𝜌4β„“4: 𝜌Qβ„“Q)

Points π‘Œ@: π‘Œ1: π‘Œ4: π‘ŒQ ∈ β„™4(𝔾() Theta constants 𝜈@: 𝜈1: 1: 1 ∼ (πœ‡πœˆ@: πœ‡πœˆ1: πœ‡: πœ‡) Arithmetic constants 𝜌@: 𝜌1: 𝜌4: 𝜌Q ; functions of 𝜈@, 𝜈1 Surface constants 𝐺, 𝐻, 𝐼 ∈ 𝔾( Doubling 2 ”‒–—: 𝑄 ↦ (𝑇 ∘ 𝐷 ˜ ∘ 𝐼 ∘ 𝑇 ∘ 𝐷 ∘ 𝐼)(𝑄) 2-isogeny (splitting [2]) πœ’Ε‘: 𝑄 ↦ (𝑇 ∘ 𝐷 ∘ 𝐼)(𝑄)

𝑃

slide-16
SLIDE 16

Kummer isogenies for non-trivial kernels

  • 𝑄 point of order 2 on 𝐿 corresponding to G ∈ {Ξ₯, Ξ₯

~}. Write 𝐼 𝑄 = 𝑄

@ Ζ’: 𝑄1 Ζ’: 𝑄4 Ζ’: 𝑄 Q Ζ’

  • 𝑅 point of order 4 on 𝐿 such that 2 𝑅 = 𝑄.

Write 𝐼 𝑅 = 𝑅@

Ζ’: 𝑅1 Ζ’: 𝑅4 Ζ’: 𝑅Q Ζ’

  • Define 𝐷‒,ΕΎ ∢ π‘Œ@: π‘Œ1: π‘Œ4: π‘ŒQ ↦ 𝜌@

Ζ’π‘Œ@: 𝜌1 Ζ’π‘Œ1: 𝜌4 Ζ’π‘Œ4: 𝜌Q Ζ’π‘ŒQ

where 𝜌@: 𝜌1: 𝜌4: 𝜌Q = 𝑄1

ƒ𝑅Q Ζ’: 𝑄 @ ƒ𝑅Q Ζ’: 𝑄1 ƒ𝑅@ Ζ’: 𝑄1 ƒ𝑅@ Ζ’

  • Then πœ’ΕΎ: 𝐿Ÿ< β†’ 𝐿Ÿ< /𝐻 ,

𝑄 ↦ (𝑇 ∘ 𝐼 ∘ 𝐷‒,ΕΎ ∘ 𝐼)(𝑄) 4M+4S+16A

slide-17
SLIDE 17
  • Theta constants map to theta constants: no special map needed to find image surface
  • Comparison in Table/paper very conservative. Kummer will win in aggressive impl.:
  • Recall Kummer over 𝔾1\)Β‘K@ almost as fast as FourQ over 𝔾 1\)Β‘K@

) (scalars 4 x larger)

  • Recall that β€œdoubling” and β€œ2-isog. point” are bottlenecks in optimal tree strategy
  • Pushing points through 2β„“ for small β„“ likely to be better on Kummer, don’t need to

compute all intermediate surface constants

Implications

slide-18
SLIDE 18
  • To use this right now, Alice need to map back-and-forth using πœƒ and πœƒΜ‚. Certainly not a

deal-breaker! Thus, , this is a call for r skilled implementers!

  • But ideally we want Bob to be able to use the Kummer, too! Then uncompressed

SIDH/SIKE can be defined as Kummer everywhere! Thus, , this is a call for r fast (πŸ’, πŸ’)-is isogenie ies on fas ast Kummers!

  • Going further, general isogenies in Montgomery elliptic case have a nice explicit form (see

[C-Hisil, AsiaCrypt’17] and [Renes,PQCrypto’18]). Thus, , this is a call for r fast (β„“, β„“)- is isogenie ies on fas ast Kummers!

  • Gut feeling is that there’s a better way to write down supersingular Kummers, and their
  • arithmetic. Thus,

, this is a call for r smart rt geometers!

Related future work

slide-19
SLIDE 19

https://www.microsoft.com/en-us/download/details.aspx?id=57309

Cheers!

https://eprint.iacr.org/2018/850.pdf