[PPT] - How to prove a secret isogeny Luca De Feo Universit Paris Saclay PowerPoint Presentation

SLIDE 1

How to prove a secret isogeny

Luca De Feo

Université Paris Saclay – UVSQ, France

June 4, 2019, CTCrypt, Svetlogorsk

based on joint work with

J. Burdges, S. Galbraith,
S. Masson, C. Petit, A. Sanso

Slides online at https://defeo.lu/docet/

SLIDE 2

Elliptic curves

Let E ✿ y2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... P Q R P ✰ Q

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 2 / 30

SLIDE 3

What’s scalar multiplication? ❬n❪ ✿ P ✼✦ P ✰ P ✰ ✁ ✁ ✁ ✰ P

⑤ ④③ ⑥ n times

A map E ✦ E , a group morphism, with finite kernel (the torsion group E❬n❪ ✬ ✭❩❂n❩✮2), surjective (in the algebraic closure), given by rational maps of degree n2. ✱ ✦ ✦

✣

✦

✵ ✦

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 3 / 30

SLIDE 4

What’s/////// scalar////////////////// multiplication an isogeny? ❬n❪ ✿ P ✼✦ P ✰ P ✰ ✁ ✁ ✁ ✰ P

⑤ ④③ ⑥ n times

A map E ✦ E , a group morphism, with finite kernel (the torsion group E❬n❪ ✬ ✭❩❂n❩✮2), surjective (in the algebraic closure), given by rational maps of degree n2. ✱ ✦ ✦

✣

✦

✵ ✦

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 3 / 30

SLIDE 5

What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣✭P✮

A map E ✦ E , a group morphism, with finite kernel (the torsion group E❬n❪ ✬ ✭❩❂n❩✮2), surjective (in the algebraic closure), given by rational maps of degree n2. ✱ ✦ ✦

✣

✦

✵ ✦

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 3 / 30

SLIDE 6

What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣✭P✮

A map E ✦ E //E ✵, a group morphism, with finite kernel (the torsion group E❬n❪ ✬ ✭❩❂n❩✮2), surjective (in the algebraic closure), given by rational maps of degree n2. ✱ ✦ ✦

✣

✦

✵ ✦

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 3 / 30

SLIDE 7

What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣✭P✮

A map E ✦ E //E ✵, a group morphism, with finite kernel (//// the///////// torsion//////// group ///////////////////// E❬n❪ ✬ ✭❩❂n❩✮2 any finite subgroup H ✚ E), surjective (in the algebraic closure), given by rational maps of degree n2. ✱ ✦ ✦

✣

✦

✵ ✦

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 3 / 30

SLIDE 8

What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣✭P✮

A map E ✦ E //E ✵, a group morphism, with finite kernel (//// the///////// torsion//////// group ///////////////////// E❬n❪ ✬ ✭❩❂n❩✮2 any finite subgroup H ✚ E), surjective (in the algebraic closure), given by rational maps of degree/// n2 ★H. ✱ ✦ ✦

✣

✦

✵ ✦

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 3 / 30

SLIDE 9

What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣✭P✮

A map E ✦ E //E ✵, a group morphism, with finite kernel (//// the///////// torsion//////// group ///////////////////// E❬n❪ ✬ ✭❩❂n❩✮2 any finite subgroup H ✚ E), surjective (in the algebraic closure), given by rational maps of degree/// n2 ★H. (Separable) isogenies ✱ finite subgroups: 0 ✦ H ✦ E

✣

✦ E ✵ ✦ 0

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 3 / 30

SLIDE 10

Isogenies: an example over ❋11

E ✿ y2 ❂ x 3 ✰ x E ✵ ✿ y2 ❂ x 3 4x ✣✭x❀ y✮ ❂

✥

x 2 ✰ 1 x ❀ y x 2 1 x 2

✦

✼✦ ❋✄

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 4 / 30

SLIDE 11

Isogenies: an example over ❋11

E ✿ y2 ❂ x 3 ✰ x E ✵ ✿ y2 ❂ x 3 4x ✣✭x❀ y✮ ❂

✥

x 2 ✰ 1 x ❀ y x 2 1 x 2

✦

Kernel generator in red. This is a degree 2 map. Analogous to x ✼✦ x 2 in ❋✄

q.

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 4 / 30

SLIDE 12

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 13

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 14

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 15

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 16

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 17

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 18

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 19

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 20

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 21

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 22

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 23

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 24

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 25

Up to isomorphism

P Q R P ✰ Q

y2 ❂ x 3 ✰ ax ✰ b

✦

j ✑ 1728

4a3 4a3✰27b2

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 26

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 27

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 28

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 29

Up to isomorphism

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 30

Up to isomorphism

✰

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 31

Up to isomorphism

✰

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 32

Up to isomorphism

✰

❂ ✰ ✰

✦

✑

✰

j ❂ 1728 ✣ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 33

Up to isomorphism

✰

❂ ✰ ✰

✦

✑

✰

j ❂ 1728 ✣ j ❂ 287496

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 5 / 30

SLIDE 34

Isogeny graphs

We look at the graph of elliptic curves with isogenies up to isomorphism. We say two isogenies ✣❀ ✣✵ are isomorphic if: E E ✵ E ✵

✣ ✣✵

❡

Example: Finite field, ordinary case, graph of isogenies of degree 3.

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 6 / 30

SLIDE 35

The graph of isogenies of prime degree ❵ ✻❂ p

All graphs are undirected (dual isogeny theorem). Ordinary case (isogeny volcanoes) Nodes can have degree 0❀ 1❀ 2 or ❵ ✰ 1.

■ For ✘ 50✪ of the primes ❵, graphs are just isolated

points;

■ For other ✘ 50✪, graphs are 2-regular; ■ other cases only happen for finitely many ❵’s.

Supersingular case (❋p) If ❵ ❂ 2 nodes have degree 1, 2 or 3; For ✘ 50✪ of ❵, graphs are isolated points; For other ✘ 50✪, graphs are 2-regular; Supersingular case (❋p2) The graph is ❵ ✰ 1-regular. There is a unique (finite) connected component made

f all supersingular curves with the same number of

points.

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 7 / 30

SLIDE 36

Isogeny graphs taxonomy

Complex Multiplication (CM) graphs Ordinary / Supersingular (❋p) Superposition of isogeny cycles (one color per degree) Isomorphic to Cayley graph of a quadratic class group Large automorphism group Typical size O✭♣p✮ Used in: CSIDH Full supersingular graphs Supersingular (❋p2) One isogeny degree ✭❵ ✰ 1✮-regular Tiny automorphism group Size ✙ p❂12 Used in: SIDH

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 8 / 30

SLIDE 37

Post-quantum isogeny primitives

SIDH (Jao, De Feo 2011)

Pronounce S–I–D–H; Based on isogeny walks in the full supersingular graph over ❋p2; Basis for the NIST KEM candidate SIKE; Better asymptotic quantum security; Short keys, slow.

CSIDH (Couveignes 1996; Rostovtsev, Stolbunov 2006; Castryck, Lange, Martindale, Panny, Renes 2018)

Pronounce Sea–Side; Based on isogeny walks in the supersingular CM graph over ❋p; Straightforward generalization of Diffie–Hellman; More “natural” security assumption; Shorter keys, slower.

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 9 / 30

SLIDE 38

CSIDH key exchange

A set of supersingular elliptic curves over ❋p; ❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

E1

E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 10 / 30

SLIDE 39

CSIDH key exchange

A set of supersingular elliptic curves over ❋p; A group action by a commutative class group G; ❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ g g1 E1 E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 10 / 30

SLIDE 40

CSIDH key exchange

A set of supersingular elliptic curves over ❋p; A group action by a commutative class group G; Small degree generators of G:

degree 2, degree 3, degree 5, ...

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

E1

E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 10 / 30

SLIDE 41

CSIDH key exchange

A set of supersingular elliptic curves over ❋p; A group action by a commutative class group G; Small degree generators of G:

degree 2, degree 3, degree 5, ...

Key exchange: Alice picks secret a ❂ ga2

2 ga3 3 ga5 5 ✁ ✁ ✁ ,

❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

E

EA

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 10 / 30

SLIDE 42

CSIDH key exchange

A set of supersingular elliptic curves over ❋p; A group action by a commutative class group G; Small degree generators of G:

degree 2, degree 3, degree 5, ...

Key exchange: Alice picks secret a ❂ ga2

2 ga3 3 ga5 5 ✁ ✁ ✁ ,

Bob picks secret b ❂ gb2

2 gb3 3 gb5 5 ✁ ✁ ✁ ,

❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

E

EA EB

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 10 / 30

SLIDE 43

CSIDH key exchange

A set of supersingular elliptic curves over ❋p; A group action by a commutative class group G; Small degree generators of G:

degree 2, degree 3, degree 5, ...

Key exchange: Alice picks secret a ❂ ga2

2 ga3 3 ga5 5 ✁ ✁ ✁ ,

Bob picks secret b ❂ gb2

2 gb3 3 gb5 5 ✁ ✁ ✁ ,

They exchange EA ❂ a ✄ E1 and EB ❂ b ✄ E1, ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

E

EA EB

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 10 / 30

SLIDE 44

CSIDH key exchange

A set of supersingular elliptic curves over ❋p; A group action by a commutative class group G; Small degree generators of G:

degree 2, degree 3, degree 5, ...

Key exchange: Alice picks secret a ❂ ga2

2 ga3 3 ga5 5 ✁ ✁ ✁ ,

Bob picks secret b ❂ gb2

2 gb3 3 gb5 5 ✁ ✁ ✁ ,

They exchange EA ❂ a ✄ E1 and EB ❂ b ✄ E1, Shared secret is EAB ❂ ✭ab✮ ✄ E1 ❂ a ✄ EB ❂ b ✄ EA.

E

EA EB EAB

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 10 / 30

SLIDE 45

SIDH key exchange

Good news: there is no action of a commutative class group. Bad news: there is no action of a commutative class group. Idea: Let Alice and Bob walk in two different isogeny graphs on the same vertex set.

Figure: 2- and 3-isogeny graphs on ❋972.

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 11 / 30

SLIDE 46

SIDH key exchange

Good news: there is no action of a commutative class group. Bad news: there is no action of a commutative class group. Idea: Let Alice and Bob walk in two different isogeny graphs on the same vertex set.

Figure: 2- and 3-isogeny graphs on ❋972.

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 11 / 30

SLIDE 47

SIDH key exchange

Good news: there is no action of a commutative class group. Bad news: there is no action of a commutative class group. Idea: Let Alice and Bob walk in two different isogeny graphs on the same vertex set.

Figure: 2- and 3-isogeny graphs on ❋972.

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 11 / 30

SLIDE 48

SIDH key exchange

Fix small primes ❵A, ❵B; No canonical labeling of the ❵A- and ❵B-isogeny graphs; however... Walk of length eA ❂ Isogeny of degree ❵eA

A

❂ Kernel ❤P✐ ✚ E❬❵eA

A ❪

❦❡r ✣ ❂ ❤P✐ ✚ E❬❵eA

A ❪

❦❡r ✥ ❂ ❤Q✐ ✚ E❬❵eB

B ❪

❦❡r ✣✵ ❂ ❤✥✭P✮✐ ❦❡r ✥✵ ❂ ❤✣✭Q✮✐

E E❂❤P✐ E❂❤Q✐ E❂❤P❀ Q✐ ✣ ✣✵ ✥ ✥✵

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 12 / 30

SLIDE 49

Security assumptions

Isogeny walk problem

Input Two isogenous elliptic curves E❀ E ✵ over ❋q. Output A path E ✦ E ✵ in an isogeny graph.

SIDH problem (1)

Input Elliptic curves E❀ E ✵ over ❋q, isogenous of degree ❵eA

A .

Output The unique path E ✦ E ✵ of length eA in the ❵A-isogeny graph.

SIDH problem (2)

Input Elliptic curves E❀ E ✵ over ❋q, isogenous of degree ❵eA

A ;

The action of the isogeny on E❬❵eB

B ❪.

Output The unique path E ✦ E ✵ of length eA in the ❵A-isogeny graph.

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 13 / 30

SLIDE 50

Why prove a secret isogeny?

Public: Curves E❀ E ✵ Secret: An isogeny walk E ✦ E ✵

Why?

For interactive identification; For signing messages; For validating public keys (esp. SIDH); More...

Some properties

Zero knowledge Statistical Computational Quantum resistance Succinctness

CSIDH ❳ ❳ SIDH ❳ ❳ Pairings ❳

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 14 / 30

SLIDE 51

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; ✷ ❢ ❀ ❣ ❂

✁

♠♦❞ ★ ✭ ✮ ❂ g gs s

1Kids, do not try this at home! Use Schnorr!

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 15 / 30

SLIDE 52

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; Commit to a random element gr; ✷ ❢ ❀ ❣ ❂

✁

♠♦❞ ★ ✭ ✮ ❂ g gs s gr r

1Kids, do not try this at home! Use Schnorr!

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 15 / 30

SLIDE 53

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; Commit to a random element gr; Challenge with bit b ✷ ❢0❀ 1❣; ❂

✁

♠♦❞ ★ ✭ ✮ ❂ g gs s gr r

1Kids, do not try this at home! Use Schnorr!

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 15 / 30

SLIDE 54

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; Commit to a random element gr; Challenge with bit b ✷ ❢0❀ 1❣; Respond with c ❂ r b ✁ s ♠♦❞ ★G; ✭ ✮ ❂ g gs s gr r r s

1Kids, do not try this at home! Use Schnorr! Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 15 / 30

SLIDE 55

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; Commit to a random element gr; Challenge with bit b ✷ ❢0❀ 1❣; Respond with c ❂ r b ✁ s ♠♦❞ ★G; Verify that gc✭gs✮b ❂ gr. g gs s gr r r s

1Kids, do not try this at home! Use Schnorr! Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 15 / 30

SLIDE 56

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; Commit to a random element gr; Challenge with bit b ✷ ❢0❀ 1❣; Respond with c ❂ r b ✁ s ♠♦❞ ★G; Verify that gc✭gs✮b ❂ gr.

Zero-knowledge

Does not leak because: c is uniformly distributed and independent from s. g gs s gr r r s

1Kids, do not try this at home! Use Schnorr! Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 15 / 30

SLIDE 57

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; Commit to a random element gr; Challenge with bit b ✷ ❢0❀ 1❣; Respond with c ❂ r b ✁ s ♠♦❞ ★G; Verify that gc✭gs✮b ❂ gr.

Zero-knowledge

Does not leak because: c is uniformly distributed and independent from s. Unlike Schnorr, compatible with group action Diffie–Hellman. E1 Es gs Er gr grs

1Kids, do not try this at home! Use Schnorr! Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 15 / 30

SLIDE 58

The trouble with groups of unknown structure

In CSIDH secrets look like: g⑦

s ❂ gs2 2 gs3 3 gs5 5 ✁ ✁ ✁

the elements gi are fixed, the secret is the exponent vector ⑦ s ❂ ✭s2❀ s3❀ ✿ ✿ ✿ ✮ ✷ ❬B❀ B❪n, secrets must be sampled in a box ❬B❀ B❪n “large enough”... ⑦❀⑦

✩

✥ ❬ ❀ ❪ ⑦ ⑦ ⑦ ✰B B

✰B

B

❂

✰

Luca De Feo (UVSQ)

How to prove a secret isogeny https://defeo.lu/docet 16 / 30

SLIDE 59

The trouble with groups of unknown structure

In CSIDH secrets look like: g⑦

s ❂ gs2 2 gs3 3 gs5 5 ✁ ✁ ✁

the elements gi are fixed, the secret is the exponent vector ⑦ s ❂ ✭s2❀ s3❀ ✿ ✿ ✿ ✮ ✷ ❬B❀ B❪n, secrets must be sampled in a box ❬B❀ B❪n “large enough”...

The leakage

With⑦ s❀⑦ r

✩

✥ ❬B❀ B❪n, the distribution of ⑦ r ⑦ s depends on the long term secret⑦ s! ✰B B

✰B

B

❂

✰B B

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 16 / 30

SLIDE 60

The two fixes

Compute the group structure and stop whining

CSI-FiSh: Beullens, Kleinjung and Vercauteren 2019 (eprint:2019/498) Already suggested by Couveignes (1996) and Stolbunov (2006). Computationally intensive (subexponential parameter generation). Decent parameters, e.g.: 263 bytes, 390 ms, @NIST-1. – Technically not post-quantum.

Do like the lattice people

SeaSign: D. and Galbraith 2019 Use Fiat–Shamir with aborts (Lyubashevsky 2009). – Huge increase in signature size and time. Compromise signature size/time with public key size (still slow).

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 17 / 30

SLIDE 61

Rejection sampling

Sample long term secret⑦ s in the usual box ❬B❀ B❪n, Sample ephemeral ⑦ r in a larger box ❬✭✍ ✰ 1✮B❀ ✭✍ ✰ 1✮B❪n, Throw away ⑦ r ⑦ s if it is out of the box ❬✍B❀ ✍B❪n.

Zero-knowledge

Theorem: ⑦ r ⑦ s is uniformly distributed in ❬✍B❀ ✍B❪n. Problem: set ✍ so that rejection probability is low. ✰✭✍ ✰ 1✮B ✭✍ ✰ 1✮B

✰B

B

❂

✰✍B ✍B

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 18 / 30

SLIDE 62

Performance

For ✕-bit security, protocol must be repeated ✕ times in parallel; ✍ ❂ ✕n for a rejection probability ✔ 1❂3; Signature size ✙ ✕n coefficients ✷ ❬✍B❀ ✍B❪; Sign/verify time linear in ❦⑦ r ⑦ s❦✶ ✙ ✕2n2B.

CSIDH instantiation (NIST-1)

Parameters: ✕ ❂ 128❀ n ❂ 74❀ B ❂ 5; PK size: 64 B SK size: 32 B Signature: 20 KiB Verify time: 10 hours Sign time: 3✂ verify

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 19 / 30

SLIDE 63

Key/signature size compromise

One key pair ✭⑦ s❀ Es✮; Challenge b ✷ ❢0❀ 1❣; Reveal ⑦ r b⑦ s; ✦ ✕ iterations; ✦

✩

✥ ❬✕ ❀ ✕ ❪ ✭⑦ ❀ ✮ ✷ ❢ ❀ ❣ ⑦ ⑦ ✦ ✕❂ ✦

✩

✥ ❬✕ ❂ ❀ ✕ ❂ ❪ E1 Es

⑦ s ⑦ ⑦ ⑦ ⑦

Er

⑦ r ⑦ ⑦

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 20 / 30

SLIDE 64

Key/signature size compromise

One key pair ✭⑦ s❀ Es✮; Challenge b ✷ ❢0❀ 1❣; Reveal ⑦ r b⑦ s; ✦ ✕ iterations; ✦

✩

✥ ❬✕ ❀ ✕ ❪

Compromise: t-bit challenges

2t key pairs ✭⑦ si❀ Ei✮; Challenge b ✷ ❢0❀ 2t❣; Reveal ⑦ r ⑦ sb; ✦ ✕❂t iterations; ✦

✩

✥ ❬✕ ❂ ❀ ✕ ❂ ❪ E1

⑦

E1

⑦ s1

E2

⑦ s2

E3

⑦ s3

E4

⑦ s4

Er

⑦ r ⑦ r ⑦ s2

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 20 / 30

SLIDE 65

Key/signature size compromise

One key pair ✭⑦ s❀ Es✮; Challenge b ✷ ❢0❀ 1❣; Reveal ⑦ r b⑦ s; ✦ ✕ iterations; ✦ Sample r

✩

✥ ❬✕nB❀ ✕nB❪.

Compromise: t-bit challenges

2t key pairs ✭⑦ si❀ Ei✮; Challenge b ✷ ❢0❀ 2t❣; Reveal ⑦ r ⑦ sb; ✦ ✕❂t iterations; ✦

✩

✥ ❬✕ ❂ ❀ ✕ ❂ ❪ E1

⑦

E1

⑦ s1

E2

⑦ s2

E3

⑦ s3

E4

⑦ s4

Er

⑦ r ⑦ r ⑦ s2

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 20 / 30

SLIDE 66

Key/signature size compromise

One key pair ✭⑦ s❀ Es✮; Challenge b ✷ ❢0❀ 1❣; Reveal ⑦ r b⑦ s; ✦ ✕ iterations; ✦ Sample r

✩

✥ ❬✕nB❀ ✕nB❪.

Compromise: t-bit challenges

2t key pairs ✭⑦ si❀ Ei✮; Challenge b ✷ ❢0❀ 2t❣; Reveal ⑦ r ⑦ sb; ✦ ✕❂t iterations; ✦ Sample r

✩

✥ ❬✕nB❂t❀ ✕nB❂t❪. E1

⑦

E1

⑦ s1

E2

⑦ s2

E3

⑦ s3

E4

⑦ s4

Er

⑦ r ⑦ r ⑦ s2

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 20 / 30

SLIDE 67

Public key compression

E1 E1 ✭ ✮ E2 ✭ ✮ E3 ✭ ✮ E4 ✭ ✮ ✭✎❀ ✎✮ ✭✎❀ ✎✮ ✭✎❀ ✎✮ ❂

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 21 / 30

SLIDE 68

Public key compression

E1 E1 H✭E1✮ E2 H✭E2✮ E3 H✭E3✮ E4 H✭E4✮ H✭✎❀ ✎✮ H✭✎❀ ✎✮ H✭✎❀ ✎✮ ❂ pk Construct Merkle tree on top of public keys, root is the new public key;

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 21 / 30

SLIDE 69

Public key compression

E1 E1 H✭E1✮ E2 H✭E2✮ E3 H✭E3✮ E4 H✭E4✮ H✭✎❀ ✎✮ H✭✎❀ ✎✮ H✭✎❀ ✎✮ ❂ pk Construct Merkle tree on top of public keys, root is the new public key; Include Merkle proof in the signature.

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 21 / 30

SLIDE 70

SeaSign Performance (NIST-1)

t ❂ 1 bit challenges t ❂ 16 bits challenges PK compression Sig size 20 KiB 978 B 3136 B PK size 64 B 4 MiB 32 B SK size 32 B 16 B 1 MiB

Est. keygen time

30 ms 30 mins 30 mins

Est. sign time

30 hours 6 mins 6 mins

Est. verify time

10 hours 2 mins 2 mins Asymptotic sig size O✭✕2 ❧♦❣✭✕✮✮ O✭✕t ❧♦❣✭✕✮✮ O✭✕2t✮ Recent speed/size compromises by Decru, Panny and Vercauteren Sig size 36 KiB 2 KiB —

Est. sign time

30 mins 80 s —

Est. verify time

20 mins 20 s —

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 22 / 30

SLIDE 71

A ✝-protocol for SIDH

E E❂❤S✐ ❂❤ ✐ ❂❤ ❀ ✐ ✣

1 3-soundness

Secret ✣ of degree ❵eA

A .

✷ ❬❵ ❪ ❂❤ ✐ ❂❤ ❀ ✐

■

✥❀ ✥✵ ❵

■

✣✵ ✣

✥❀ ✥✵ ✣ ❬❵ ❪ ✮

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 23 / 30

SLIDE 72

A ✝-protocol for SIDH

E E❂❤S✐ E❂❤P✐ E❂❤P❀ S✐ ✣ ? ? ?

1 3-soundness

Secret ✣ of degree ❵eA

A .

1

Choose a random point P ✷ E❬❵eB

B ❪, compute the diagram;

2

Publish the curves E❂❤P✐ and E❂❤P❀ S✐;

■

✥❀ ✥✵ ❵

■

✣✵ ✣

✥❀ ✥✵ ✣ ❬❵ ❪ ✮

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 23 / 30

SLIDE 73

A ✝-protocol for SIDH

E E❂❤S✐ E❂❤P✐ E❂❤P❀ S✐ ✣ ? ✥ ?

1 3-soundness

Secret ✣ of degree ❵eA

A .

1

Choose a random point P ✷ E❬❵eB

B ❪, compute the diagram;

2

Publish the curves E❂❤P✐ and E❂❤P❀ S✐;

3

The verifier challenges to reveal one out of the 3 sides

■ Isogenies ✥❀ ✥✵ (degree ❵eB

B ) unrelated to secret;

■

✣✵ ✣

✥❀ ✥✵ ✣ ❬❵ ❪ ✮

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 23 / 30

SLIDE 74

A ✝-protocol for SIDH

E E❂❤S✐ E❂❤P✐ E❂❤P❀ S✐ ✣ ? ? ✥✵

1 3-soundness

Secret ✣ of degree ❵eA

A .

1

Choose a random point P ✷ E❬❵eB

B ❪, compute the diagram;

2

Publish the curves E❂❤P✐ and E❂❤P❀ S✐;

3

The verifier challenges to reveal one out of the 3 sides

■ Isogenies ✥❀ ✥✵ (degree ❵eB

B ) unrelated to secret;

■

✣✵ ✣

✥❀ ✥✵ ✣ ❬❵ ❪ ✮

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 23 / 30

SLIDE 75

A ✝-protocol for SIDH

E E❂❤S✐ E❂❤P✐ E❂❤P❀ S✐ ✣ ✣✵ ? ?

1 3-soundness

Secret ✣ of degree ❵eA

A .

1

Choose a random point P ✷ E❬❵eB

B ❪, compute the diagram;

2

Publish the curves E❂❤P✐ and E❂❤P❀ S✐;

3

The verifier challenges to reveal one out of the 3 sides

■ Isogenies ✥❀ ✥✵ (degree ❵eB

B ) unrelated to secret;

■ Isogeny ✣✵ conjectured to not reveal useful information on ✣.

✥❀ ✥✵ ✣ ❬❵ ❪ ✮

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 23 / 30

SLIDE 76

A ✝-protocol for SIDH

E E❂❤S✐ E❂❤P✐ E❂❤P❀ S✐ ✣ ? ✥ ✥✵

1 3-soundness

Secret ✣ of degree ❵eA

A .

1

Choose a random point P ✷ E❬❵eB

B ❪, compute the diagram;

2

Publish the curves E❂❤P✐ and E❂❤P❀ S✐;

3

The verifier challenges to reveal one out of the 3 sides

■ Isogenies ✥❀ ✥✵ (degree ❵eB

B ) unrelated to secret;

■ Isogeny ✣✵ conjectured to not reveal useful information on ✣.

Improving to 1

2-soundness

Reveal ✥❀ ✥✵ simultaneously; Reveals action of ✣ on E❬❵eB

B ❪

✮ Stronger security assumption.

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 23 / 30

SLIDE 77

SIDH signature performance (NIST-1)

According to Yoo, Azarderakhsh, Jalali, Jao and Vladimir Soukharev 2017: Size: ✙ 100KB, Time: seconds.

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 24 / 30

SLIDE 78

SIDH signature performance (NIST-1)

According to Yoo, Azarderakhsh, Jalali, Jao and Vladimir Soukharev 2017: Size: ✙ 100KB, Time: seconds.

Galbraith, Petit and Silva 2017

Concept similar to CSI-FiSh: exploits known structure of endomorphism ring; Statistical zero knowledge (under heuristic assumptions); Based on the generic isogeny walk problem (requires special starting curve, though); Size/performance comparable to Yoo et al. (and possibly slower).

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 24 / 30

SLIDE 79

Weil pairing and isogenies

Theorem

Let ✣ ✿ E ✦ E ✵ be an isogeny and ❫ ✣ ✿ E ✵ ✦ E its dual. Let eN be the Weil pairing of E and e✵

N that of E ✵. Then, for

eN ✭P❀ ❫ ✣✭Q✮✮ ❂ e✵

N ✭✣✭P✮❀ Q✮❀

for any P ✷ E❬N❪ and Q ✷ E ✵❬N❪.

Corollary

e✵

N ✭✣✭P✮❀ ✣✭Q✮✮ ❂ eN ✭P❀ Q✮❞❡❣ ✣✿

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 25 / 30

SLIDE 80

Refresher: Boneh–Lynn–Shacham (BLS) signatures

Setup: Elliptic curve E❂❋p, s.t N❥★E✭❋p✮ for a large prime N, (Weil) pairing eN ✿ E❬N❪ ✂ E❬N❪ ✦ ❋pk for some small embedding degree k, A decomposition E❬N❪ ❂ X1 ✂ X2, with X1 ❂ ❤P✐. A hash function H ✿ ❢0❀ 1❣✄ ✦ X2. Private key: s ✷ ❩❂N❩. Public key: sP. Sign: m ✼✦ sH✭m✮. Verifiy: eN ✭P❀ sH✭m✮✮ ❂ eN ✭sP❀ H✭m✮✮. X1 ✂ X2 X1 ✂ X2 X1 ✂ X2 ❋pk

❬s❪ ✂ 1 1 ✂ ❬s❪ eN eN

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 26 / 30

SLIDE 81

US patent 8,250,367 (Broker, Charles and Lauter 2012)

Signatures from isogenies + pairings

Replace the secret ❬s❪ ✿ E ✦ E with an isogeny ✣ ✿ E ✦ E ✵; Define decompositions E❬N❪ ❂ X1 ✂ X2❀ E ✵❬N❪ ❂ Y1 ✂ Y2❀ s.t. ✣✭X1✮ ❂ Y1 and ✣✭X2✮ ❂ Y2; Define a hash function H ✿ ❢0❀ 1❣✄ ✦ Y2. X1 ✂ Y2 Y1 ✂ Y2 X1 ✂ X2 ❋pk

✣ ✂ 1 1 ✂ ❫ ✣ e✵

N

eN

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 27 / 30

SLIDE 82

Pairing proofs: what for?

Non-interactive, not post-quantum, not zero knowledge; Useful for (partially) validating SIDH public keys; Succinct: proof size, verification time independent of walk length!

Application: Verifiable Delay Functions

D., Masson, Petit and Sanso 2019 (eprint:2019/166): Similar to time-lock puzzles; No secret: everything is public; Generating proof takes configurable sequential time T; Verifying proof takes time independent from T; Security assumptions very different and new! Applications to blockchains: randomness beacons, consensus protocols, ...

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 28 / 30

SLIDE 83

Conclusion

Different isogeny graphs enable different styles of proofs, different security assumptions. Post-quantum isogeny signatures are still far from practical. Practical isogeny signatures do exists (CSI-FiSh); you can start using them now if you are an isogeny hippie, but they do not scale. Pairing-based proofs are usable, but not interesting for signatures: look into succinctness, instead! Tons of open questions on classical and quantum security, on security proofs, and on constructions. Proofs can be chained easily: useful for multi-party supersingular curve generation (work in progress with J. Burdges). The isogenista dream: a one-pass post-quantum signature scheme based on walks in isogeny graphs.

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 29 / 30

SLIDE 84

Thank you

https://defeo.lu/ @luca_defeo

Luca De Feo (UVSQ) How to prove a secret isogeny https://defeo.lu/docet 30 / 30