Isogeny based crypto: what’s under the hood? Luca De Feo Université Paris Saclay – UVSQ Nov 15, 2018, École des Mines de Saint-Étienne, Gardanne
Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... R Q P P ✰ Q Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 2 / 36
✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 2 / 36
✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 2 / 36
✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 2 / 36
✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 2 / 36
✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 2 / 36
Elliptic curves I power 70% of WWW traffic! Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 3 / 36
The QUANTHOM Menace Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 4 / 36
Post-quantum cryptographer? Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 5 / 36
Elliptic curves of the world, UNITE! QUOUSQUE QUANTUM? QUANTUM SUFFICIT! Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 6 / 36
And so, they found a way around the Quanthom... Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 7 / 36
And so, they found a way around the Quanthom... Public curve Public curve Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 7 / 36
And so, they found a way around the Quanthom... Public curve Shared secret Public curve Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 7 / 36
A brief history of isogeny-based key exchange 1996 Couveignes introduces Hard Homogeneous Spaces. His work stays unpublished for 10 years. 2006 Rostovtsev & Stolbunov independently rediscover Couveignes ideas, suggest isogeny-based Diffie–Hellman as a quantum-resistant primitive. 2006-2010 Other isogeny-based protocols by Teske and Charles, Goren & Lauter. 2011-2012 D., Jao & Plût introduce SIDH, an efficient post-quantum key exchange inspired by Couveignes, Rostovtsev, Stolbunov, Charles, Goren, Lauter. 2017 SIDH is submitted to the NIST competition (with the name SIKE, only isogeny-based candidate). 2018 D., Kieffer & Smith resurrect the Couveignes–Rostovtsev–Stolbunov protocol, Castryck, Lange, Martindale, Panny & Renes publish an efficient variant named CSIDH. Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 8 / 36
What’s an isogeny? Isogenies are just the right notion TM of morphism for elliptic curves Surjective group morphisms. Algebraic maps (i.e., defined by polynomials). (Separable) isogenies ✱ finite subgroups: ✦ E ✵ ✦ 0 ✣ 0 ✦ H ✦ E Separable isogenies (write this down, now!) The kernel H determines the image curve E ✵ up to isomorphism: ❂ E ✵ ✿ def E ❂ H The degree of ✣ ✿ E ✦ E ❂ H is the size of the kernel H : def ❞❡❣ ✣ ❂ ★ ❦❡r ✣✿ Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 9 / 36
❋ ✄ ✼✦ Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x ✥ ✦ x 2 ✰ 1 y x 2 � 1 ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 10 / 36
Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x Kernel generator in red. ✥ ✦ x 2 ✰ 1 y x 2 � 1 This is a degree 2 map. ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Analogous to x ✼✦ x 2 in ❋ ✄ q . Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 10 / 36
Isogeny graphs ✣ E ✵ We look at the graph of elliptic curves with E isogenies up to isomorphism. We say two isogenies ✣❀ ✣ ✵ are isomorphic if: ❡ ✣ ✵ E ✵ Example: Finite field, ordinary case, graph of isogenies of degree 3 . Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 11 / 36
Structure of the graph Theorem (Serre-Tate) Two curves are isogenous over a finite field k if and only if they have the same number of points on k . The graph of isogenies of prime degree ❵ ✻ ❂ p Nodes can have degree 0 ❀ 1 ❀ 2 or ❵ ✰ 1 . Ordinary case (isogeny ■ For ✘ 50 ✪ of the primes ❵ , graphs are just isolated volcanoes) points; ■ For other ✘ 50 ✪ , graphs are 2 -regular; ■ other cases only happen for finitely many ❵ ’s. If ❵ ❂ 2 nodes have degree 1 , 2 or 3 ; Supersingular For ✘ 50 ✪ of ❵ , graphs are isolated points; case ( ❋ p ) For other ✘ 50 ✪ , graphs are 2 -regular; The graph is ❵ ✰ 1 -regular. Supersingular There is a unique (finite) connected component made of all case ( ❋ p 2 ) supersingular curves with the same number of points. Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 12 / 36
❈❧✭ ❖ ✮ Complex multiplication graphs Vertices are elliptic curves with complex E 3 multiplication by ❖ K E 4 E 2 (i.e., ❊♥❞✭ E ✮ ✬ ❖ K ✚ ♣ � D ✮ ). ◗ ✭ E 5 E 1 E 6 E 12 E 7 E 11 E 8 E 10 E 9 Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 13 / 36
❈❧✭ ❖ ✮ Complex multiplication graphs Vertices are elliptic curves with complex E 3 multiplication by ❖ K E 4 E 2 (i.e., ❊♥❞✭ E ✮ ✬ ❖ K ✚ ♣ � D ✮ ). ◗ ✭ Edges are horizontal E 5 E 1 isogenies of bounded prime degree. degree 2 E 6 E 12 E 7 E 11 E 8 E 10 E 9 Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 13 / 36
❈❧✭ ❖ ✮ Complex multiplication graphs Vertices are elliptic curves with complex E 3 multiplication by ❖ K E 4 E 2 (i.e., ❊♥❞✭ E ✮ ✬ ❖ K ✚ ♣ � D ✮ ). ◗ ✭ Edges are horizontal E 5 E 1 isogenies of bounded prime degree. degree 2 E 6 E 12 degree 3 E 7 E 11 E 8 E 10 E 9 Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 13 / 36
❈❧✭ ❖ ✮ Complex multiplication graphs Vertices are elliptic curves with complex E 3 multiplication by ❖ K E 4 E 2 (i.e., ❊♥❞✭ E ✮ ✬ ❖ K ✚ ♣ � D ✮ ). ◗ ✭ Edges are horizontal E 5 E 1 isogenies of bounded prime degree. degree 2 E 6 E 12 degree 3 E 7 E 11 degree 5 E 8 E 10 E 9 Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 13 / 36
Complex multiplication graphs Vertices are elliptic curves with complex E 3 multiplication by ❖ K E 4 E 2 (i.e., ❊♥❞✭ E ✮ ✬ ❖ K ✚ ♣ � D ✮ ). ◗ ✭ Edges are horizontal E 5 E 1 isogenies of bounded prime degree. degree 2 E 6 E 12 degree 3 E 7 E 11 degree 5 Isomorphic to a Cayley E 8 E 10 graph of ❈❧✭ ❖ K ✮ . E 9 Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 13 / 36
❂ ✄ ✄ ❂ ◗ ✷ ✄ ✦ ✄ ✄ ✄ ✄ ✄ ✄ Rostovtsev & Stolbunov key exchange (CRS) Public parameters: A starting curve E ❂ ❋ p with CM by ❖ K ; A set of ideals of small norm S ✚ ❈❧✭ ❖ K ✮ . E Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 14 / 36
❂ ✄ ✄ ✄ ✄ ✄ ✄ ✄ Rostovtsev & Stolbunov key exchange (CRS) Public parameters: A starting curve E ❂ ❋ p with a ✄ E CM by ❖ K ; A set of ideals of small norm S ✚ ❈❧✭ ❖ K ✮ . Alice takes a secret random 1 walk a ❂ ◗ s ✷ S s e s defining E an isogeny E ✦ a ✄ E ; Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 14 / 36
❂ ✄ ✄ ✄ ✄ ✄ ✄ Rostovtsev & Stolbunov key exchange (CRS) Public parameters: A starting curve E ❂ ❋ p with a ✄ E CM by ❖ K ; A set of ideals of small norm S ✚ ❈❧✭ ❖ K ✮ . Alice takes a secret random 1 walk a ❂ ◗ s ✷ S s e s defining b ✄ E E an isogeny E ✦ a ✄ E ; Bob does the same; 2 Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 14 / 36
❂ ✄ ✄ ✄ ✄ Rostovtsev & Stolbunov key exchange (CRS) Public parameters: A starting curve E ❂ ❋ p with a ✄ E CM by ❖ K ; A set of ideals of small norm S ✚ ❈❧✭ ❖ K ✮ . Alice takes a secret random 1 walk a ❂ ◗ s ✷ S s e s defining b ✄ E E an isogeny E ✦ a ✄ E ; Bob does the same; 2 They publish a ✄ E and b ✄ E ; 3 Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 14 / 36
❂ ✄ ✄ Rostovtsev & Stolbunov key exchange (CRS) Public parameters: A starting curve E ❂ ❋ p with a ✄ E CM by ❖ K ; A set of ideals of small norm S ✚ ❈❧✭ ❖ K ✮ . Alice takes a secret random 1 walk a ❂ ◗ s ✷ S s e s defining b ✄ E E an isogeny E ✦ a ✄ E ; Bob does the same; 2 They publish a ✄ E and b ✄ E ; 3 Alice repeats her secret walk 4 a starting from b ✄ E . ab ✄ E Luca De Feo (UVSQ) Isogeny based cryptography ENMSE, Nov 15, 2018 14 / 36
Recommend
More recommend
