Isogeny graphs in cryptography Luca De Feo Universit Paris Saclay, - - PowerPoint PPT Presentation

▶
isogeny graphs in cryptography
SMART_READER_LITE
LIVE PREVIEW

Isogeny graphs in cryptography Luca De Feo Universit Paris Saclay, - - PowerPoint PPT Presentation

Oct 18, 2023 414 likes •1.87k views

Isogeny graphs in cryptography Luca De Feo Universit Paris Saclay, UVSQ & Inria March 1923, 2018, Post-Scryptum Spring School, Les 7 Laux Slides online at http://defeo.lu/docet/ Photo courtesy of Elisa Lorenzo-Garca Overview

slide-1
SLIDE 1

Photo courtesy of Elisa Lorenzo-García

Isogeny graphs in cryptography

Luca De Feo

Université Paris Saclay, UVSQ & Inria

March 19–23, 2018, Post-Scryptum Spring School, Les 7 Laux Slides online at http://defeo.lu/docet/

slide-2
SLIDE 2

Overview

1

Foundations Elliptic curves Isogenies Complex multiplication

2

Isogeny-based cryptography Isogeny walks Key exchange from ordinary graphs Key exchange from supersingular graphs The SIKE submission

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 2 / 75

slide-3
SLIDE 3

Projective space

Definition (Projective space)

Let ✖ k an algebraically closed field, the projective space Pn✭✖ k✮ is the set of non-null ✭n ✰ 1✮-tuples ✭x0❀ ✿ ✿ ✿ ❀ xn✮ ✷ ✖ k n modulo the equivalence relation ✭x0❀ ✿ ✿ ✿ ❀ xn✮ ✘ ✭✕x0❀ ✿ ✿ ✿ ❀ ✕xn✮ with ✕ ✷ ✖ k ♥ ❢0❣✿ A class is denoted by ✭x0 ✿ ✁ ✁ ✁ ✿ xn✮.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 3 / 75

slide-4
SLIDE 4

Weierstrass equations

Let k be a field of characteristic ✻❂ 2❀ 3. An elliptic curve defined over k is the locus in P2✭✖ k✮ of an equation Y 2Z ❂ X 3 ✰ aXZ 2 ✰ bZ 3❀ where a❀ b ✷ k and 4a3 ✰ 27b2 ✻❂ 0. ❖ ❂ ✭ ✿ ✿ ✮ ❂ ✰ ✰

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 4 / 75

slide-5
SLIDE 5

Weierstrass equations

Let k be a field of characteristic ✻❂ 2❀ 3. An elliptic curve defined over k is the locus in P2✭✖ k✮ of an equation Y 2Z ❂ X 3 ✰ aXZ 2 ✰ bZ 3❀ where a❀ b ✷ k and 4a3 ✰ 27b2 ✻❂ 0. ❖ ❂ ✭0 ✿ 1 ✿ 0✮ is the point at infinity; ❂ ✰ ✰

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 4 / 75

slide-6
SLIDE 6

Weierstrass equations

Let k be a field of characteristic ✻❂ 2❀ 3. An elliptic curve defined over k is the locus in P2✭✖ k✮ of an equation Y 2Z ❂ X 3 ✰ aXZ 2 ✰ bZ 3❀ where a❀ b ✷ k and 4a3 ✰ 27b2 ✻❂ 0. ❖ ❂ ✭0 ✿ 1 ✿ 0✮ is the point at infinity; y2 ❂ x 3 ✰ ax ✰ b is the affine equation.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 4 / 75

slide-7
SLIDE 7

The group law

Bezout’s theorem

Every line cuts E in exactly three points (counted with multiplicity). Define a group law such that any three colinear points add up to zero. ❖ P Q R P ✰ Q

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 5 / 75

slide-8
SLIDE 8

The group law

Bezout’s theorem

Every line cuts E in exactly three points (counted with multiplicity). Define a group law such that any three colinear points add up to zero. The law is algebraic (it has formulas); ❖ P Q R P ✰ Q

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 5 / 75

slide-9
SLIDE 9

The group law

Bezout’s theorem

Every line cuts E in exactly three points (counted with multiplicity). Define a group law such that any three colinear points add up to zero. The law is algebraic (it has formulas); The law is commutative; ❖ is the group identity; Opposite points have the same x-value. P Q R P ✰ Q

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 5 / 75

slide-10
SLIDE 10

Group structure

Torsion structure

Let E be defined over an algebraically closed field ✖ k of characteristic p. E❬m❪ ✬ ❩❂m❩ ✂ ❩❂m❩ if p ✲ m, ❩❂pe❩

  • rdinary case,

E❬pe❪ ✬

✭

❢❖❣ supersingular case.

Free part

Let E be defined over a number field k, the group of k-rational points E✭k✮ is finitely generated.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 6 / 75

slide-11
SLIDE 11

Maps: isomorphisms

Isomorphisms

The only invertible algebraic maps between elliptic curves are of the form ✭x❀ y✮ ✼✦ ✭u2x❀ u3y✮ for some u ✷ ✖ k. They are group isomorphisms.

j -Invariant

Let E ✿ y2 ❂ x 3 ✰ ax ✰ b, its j -invariant is j ✭E✮ ❂ 1728 4a3 4a3 ✰ 27b2 ✿ Two elliptic curves E❀ E ✵ are isomorphic if and only if j ✭E✮ ❂ j ✭E ✵✮.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 7 / 75

slide-12
SLIDE 12

Maps: isogenies

Theorem

Let ✣ ✿ E ✦ E ✵ be a map between elliptic curves. These conditions are equivalent: ✣ is a surjective group morphism, ✣ is a group morphism with finite kernel, ✣ is a non-constant algebraic map of projective varieties sending the point at infinity of E onto the point at infinity of E ✵. If they hold ✣ is called an isogeny. Two curves are called isogenous if there exists an isogeny between them.

Example: Multiplication-by-m

On any curve, an isogeny from E to itself (i.e., an endomorphism): ❬m❪ ✿ E ✦ E❀ P ✼✦ ❬m❪P✿

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 8 / 75

slide-13
SLIDE 13

Isogenies: an example over ❋11

E ✿ y2 ❂ x 3 ✰ x E ✵ ✿ y2 ❂ x 3 4x ✣✭x❀ y✮ ❂

✥

x 2 ✰ 1 x ❀ y x 2 1 x 2

✦

✼✦ ❋✄

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 9 / 75

slide-14
SLIDE 14

Isogenies: an example over ❋11

E ✿ y2 ❂ x 3 ✰ x E ✵ ✿ y2 ❂ x 3 4x ✣✭x❀ y✮ ❂

✥

x 2 ✰ 1 x ❀ y x 2 1 x 2

✦

✼✦ ❋✄

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 9 / 75

slide-15
SLIDE 15

Isogenies: an example over ❋11

E ✿ y2 ❂ x 3 ✰ x E ✵ ✿ y2 ❂ x 3 4x ✣✭x❀ y✮ ❂

✥

x 2 ✰ 1 x ❀ y x 2 1 x 2

✦

✼✦ ❋✄

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 9 / 75

slide-16
SLIDE 16

Isogenies: an example over ❋11

E ✿ y2 ❂ x 3 ✰ x E ✵ ✿ y2 ❂ x 3 4x ✣✭x❀ y✮ ❂

✥

x 2 ✰ 1 x ❀ y x 2 1 x 2

✦

Kernel generator in red. ✼✦ ❋✄

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 9 / 75

slide-17
SLIDE 17

Isogenies: an example over ❋11

E ✿ y2 ❂ x 3 ✰ x E ✵ ✿ y2 ❂ x 3 4x ✣✭x❀ y✮ ❂

✥

x 2 ✰ 1 x ❀ y x 2 1 x 2

✦

Kernel generator in red. This is a degree 2 map. ✼✦ ❋✄

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 9 / 75

slide-18
SLIDE 18

Isogenies: an example over ❋11

E ✿ y2 ❂ x 3 ✰ x E ✵ ✿ y2 ❂ x 3 4x ✣✭x❀ y✮ ❂

✥

x 2 ✰ 1 x ❀ y x 2 1 x 2

✦

Kernel generator in red. This is a degree 2 map. Analogous to x ✼✦ x 2 in ❋✄

q.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 9 / 75

slide-19
SLIDE 19

Curves over finite fields

Frobenius endomorphism

Let E be defined over ❋q. The Frobenius endomorphism of E is the map ✙ ✿ ✭X ✿ Y ✿ Z✮ ✼✦ ✭X q ✿ Y q ✿ Z q✮✿

Hasse’s theorem

Let E be defined over ❋q, then ❥★E✭k✮ q 1❥ ✔ 2♣q✿

Serre-Tate theorem

Two elliptic curves E❀ E ✵ defined over a finite field k are isogenous over k if and only if ★E✭k✮ ❂ ★E ✵✭k✮.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 10 / 75

slide-20
SLIDE 20

Complex tori

❈❂✄ ✦1 ✦2 ✰ ✰ Let ✦1❀ ✦2 ✷ ❈ be linearly independent complex

  • numbers. Set

✄ ❂ ✦1❩ ✟ ✦2❩ ❈❂✄ is a complex torus.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 11 / 75

slide-21
SLIDE 21

Complex tori

❈❂✄ ✦ ✦ a b ✰ ✰ Addition law induced by addition on ❈.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 11 / 75

slide-22
SLIDE 22

Complex tori

❈❂✄ ✦ ✦ a b a ✰ b ✰ Addition law induced by addition on ❈.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 11 / 75

slide-23
SLIDE 23

Complex tori

❈❂✄ ✦ ✦ a b a ✰ b ✰ Addition law induced by addition on ❈.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 11 / 75

slide-24
SLIDE 24

Complex tori

❈❂✄ ✦ ✦ a b ✰ a ✰ b Addition law induced by addition on ❈.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 11 / 75

slide-25
SLIDE 25

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-26
SLIDE 26

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-27
SLIDE 27

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-28
SLIDE 28

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-29
SLIDE 29

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-30
SLIDE 30

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-31
SLIDE 31

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-32
SLIDE 32

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-33
SLIDE 33

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-34
SLIDE 34

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-35
SLIDE 35

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-36
SLIDE 36

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-37
SLIDE 37

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-38
SLIDE 38

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-39
SLIDE 39

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-40
SLIDE 40

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-41
SLIDE 41

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-42
SLIDE 42

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-43
SLIDE 43

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-44
SLIDE 44

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-45
SLIDE 45

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-46
SLIDE 46

Homotheties

a Two lattices are homothetic if there exist ☛ ✷ ❈ such that ☛✄1 ❂ ✄2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 12 / 75

slide-47
SLIDE 47

The j -invariant

We want to classify complex lattices/tori up to homothety.

Eisenstein series

Let ✄ be a complex lattice. For any integer k ❃ 0 define G2k✭✄✮ ❂

❳

✦✷✄♥❢0❣

✦2k✿ Also set g2✭✄✮ ❂ 60G4✭✄✮❀ g3✭✄✮ ❂ 140G6✭✄✮✿

Modular j -invariant

Let ✄ be a complex lattice, the modular j -invariant is j ✭✄✮ ❂ 1728 g2✭✄✮3 g2✭✄✮3 27g3✭✄✮2 ✿ Two lattices ✄❀ ✄✵ are homothetic if and only if j ✭✄✮ ❂ j ✭✄✵✮.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 13 / 75

slide-48
SLIDE 48

Elliptic curves over ❈

Weierstrass ⑥ function

Let ✄ be a complex lattice, the Weierstrass ⑥ function associated to ✄ is the series ⑥✭z❀ ✄✮ ❂ 1 z 2 ✰

❳

✦✷✄♥❢0❣

✒

1 ✭z ✦✮2 1 ✦2

✓

✿ Fix a lattice ✄, then ⑥ and its derivative ⑥✵ are elliptic functions: ⑥✭z ✰ ✦✮ ❂ ⑥✭z✮❀ ⑥✵✭z ✰ ✦✮ ❂ ⑥✵✭z✮ for all ✦ ✷ ✄.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 14 / 75

slide-49
SLIDE 49

Uniformization theorem

Let ✄ be a complex lattice. The curve E ✿ y2 ❂ 4x 3g2✭✄✮xg3✭✄✮ is an elliptic curve over ❈. The map ❈❂✄ ✦ E✭❈✮❀ 0 ✼✦ ✭0 ✿ 1 ✿ 0✮❀ z ✼✦ ✭⑥✭z✮ ✿ ⑥✵✭z✮ ✿ 1✮ is an isomorphism of Riemann surfaces and a group morphism. Conversely, for any elliptic curve E ✿ y2 ❂ x 3 ✰ ax ✰ b there is a unique complex lattice ✄ such that g2✭✄✮ ❂ 4a❀ g3✭✄✮ ❂ 4b✿ Moreover j ✭✄✮ ❂ j ✭E✮.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 15 / 75

slide-50
SLIDE 50

Multiplication

a ❬ ❪ ❬ ❪

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 16 / 75

slide-51
SLIDE 51

Multiplication

a ❬3❪a ❬ ❪

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 16 / 75

slide-52
SLIDE 52

Multiplication

a ❬ ❪ ❬3❪a

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 16 / 75

slide-53
SLIDE 53

Torsion subgroups

a b The ❵-torsion subgroup is made up by the points

✒i✦1

❵ ❀ j ✦2 ❵

✓

It is a group of rank two E❬❵❪ ❂ ❤a❀ b✐ ✬ ✭❩❂❵❩✮2

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 17 / 75

slide-54
SLIDE 54

Isogenies

a p Let a ✷ ❈❂✄1 be an ❵-torsion point, and let ✄2 ❂ a❩ ✟ ✄1 Then ✄1 ✚ ✄2 and we define a degree ❵ cover ✣ ✿ ❈❂✄1 ✦ ❈❂✄2 ✣ is a morphism of complex Lie groups and is called an isogeny.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 18 / 75

slide-55
SLIDE 55

Isogenies

a p Let a ✷ ❈❂✄1 be an ❵-torsion point, and let ✄2 ❂ a❩ ✟ ✄1 Then ✄1 ✚ ✄2 and we define a degree ❵ cover ✣ ✿ ❈❂✄1 ✦ ❈❂✄2 ✣ is a morphism of complex Lie groups and is called an isogeny.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 18 / 75

slide-56
SLIDE 56

Isogenies

a p Let a ✷ ❈❂✄1 be an ❵-torsion point, and let ✄2 ❂ a❩ ✟ ✄1 Then ✄1 ✚ ✄2 and we define a degree ❵ cover ✣ ✿ ❈❂✄1 ✦ ❈❂✄2 ✣ is a morphism of complex Lie groups and is called an isogeny.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 18 / 75

slide-57
SLIDE 57

Isogenies

b p Taking a point b not in the kernel of ✣, we obtain a new degree ❵ cover ❫ ✣ ✿ ❈❂✄2 ✦ ❈❂✄3 The composition ❫ ✣ ✍ ✣ has degree ❵2 and is homothetic to the multiplication by ❵ map. ❫ ✣ is called the dual isogeny of ✣.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 18 / 75

slide-58
SLIDE 58

Isogenies

b p Taking a point b not in the kernel of ✣, we obtain a new degree ❵ cover ❫ ✣ ✿ ❈❂✄2 ✦ ❈❂✄3 The composition ❫ ✣ ✍ ✣ has degree ❵2 and is homothetic to the multiplication by ❵ map. ❫ ✣ is called the dual isogeny of ✣.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 18 / 75

slide-59
SLIDE 59

Isogenies

b p Taking a point b not in the kernel of ✣, we obtain a new degree ❵ cover ❫ ✣ ✿ ❈❂✄2 ✦ ❈❂✄3 The composition ❫ ✣ ✍ ✣ has degree ❵2 and is homothetic to the multiplication by ❵ map. ❫ ✣ is called the dual isogeny of ✣.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 18 / 75

slide-60
SLIDE 60

Isogenies: back to algebra

Let ✣ ✿ E ✦ E ✵ be an isogeny defined over a field k of characteristic p. k✭E✮ is the field of all rational functions from E to k; ✣✄k✭E ✵✮ is the subfield of k✭E✮ defined as ✣✄k✭E ✵✮ ❂ ❢f ✍ ✣ ❥ f ✷ k✭E ✵✮❣✿

Degree, separability

1

The degree of ✣ is ❞❡❣ ✣ ❂ ❬k✭E✮ ✿ ✣✄k✭E ✵✮❪. It is always finite.

2

✣ is said to be separable, inseparable, or purely inseparable if the extension of function fields is.

3

If ✣ is separable, then ❞❡❣ ✣ ❂ ★ ❦❡r ✣.

4

If ✣ is purely inseparable, then ❦❡r ✣ ❂ ❢❖❣ and ❞❡❣ ✣ is a power of p.

5

Any isogeny can be decomposed as a product of a separable and a purely inseparable isogeny.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 19 / 75

slide-61
SLIDE 61

Isogenies: back to algebra

Let ✣ ✿ E ✦ E ✵ be an isogeny defined over a field k of characteristic p. k✭E✮ is the field of all rational functions from E to k; ✣✄k✭E ✵✮ is the subfield of k✭E✮ defined as ✣✄k✭E ✵✮ ❂ ❢f ✍ ✣ ❥ f ✷ k✭E ✵✮❣✿

Degree, separability

1

The degree of ✣ is ❞❡❣ ✣ ❂ ❬k✭E✮ ✿ ✣✄k✭E ✵✮❪. It is always finite.

2

✣ is said to be separable, inseparable, or purely inseparable if the extension of function fields is.

3

If ✣ is separable, then ❞❡❣ ✣ ❂ ★ ❦❡r ✣.

4

If ✣ is purely inseparable, then ❦❡r ✣ ❂ ❢❖❣ and ❞❡❣ ✣ is a power of p.

5

Any isogeny can be decomposed as a product of a separable and a purely inseparable isogeny.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 19 / 75

slide-62
SLIDE 62

Isogenies: separable vs inseparable

Purely inseparable isogenies

Examples: The Frobenius endomorphism is purely inseparable of degree q. All purely inseparable maps in characteristic p are of the form ✭X ✿ Y ✿ Z✮ ✼✦ ✭X pe ✿ Y pe ✿ Z pe✮.

Separable isogenies

Let E be an elliptic curve, and let G be a finite subgroup of E. There are a unique elliptic curve E ✵ and a unique separable isogeny ✣, such that ❦❡r ✣ ❂ G and ✣ ✿ E ✦ E ✵. The curve E ✵ is called the quotient of E by G and is denoted by E❂G.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 20 / 75

slide-63
SLIDE 63

The dual isogeny

Let ✣ ✿ E ✦ E ✵ be an isogeny of degree m. There is a unique isogeny ❫ ✣ ✿ E ✵ ✦ E such that ❫ ✣ ✍ ✣ ❂ ❬m❪E❀ ✣ ✍ ❫ ✣ ❂ ❬m❪E ✵✿ ❫ ✣ is called the dual isogeny of ✣; it has the following properties:

1

❫ ✣ is defined over k if and only if ✣ is;

2

❬ ✥ ✍ ✣ ❂ ❫ ✣ ✍ ❫ ✥ for any isogeny ✥ ✿ E ✵ ✦ E ✵✵;

3

❭ ✥ ✰ ✣ ❂ ❫ ✥ ✰ ❫ ✣ for any isogeny ✥ ✿ E ✦ E ✵;

4

❞❡❣ ✣ ❂ ❞❡❣ ❫ ✣;

5

❫ ❫ ✣ ❂ ✣.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 21 / 75

slide-64
SLIDE 64

Algebras, orders

A quadratic imaginary number field is an extension of ◗ of the form Q❬ ♣ D❪ for some non-square D ❃ 0. A quaternion algebra is an algebra of the form ◗ ✰ ☛◗ ✰ ☞◗ ✰ ☛☞◗, where the generators satisfy the relations ☛2❀ ☞2 ✷ ◗❀ ☛2 ❁ 0❀ ☞2 ❁ 0❀ ☞☛ ❂ ☛☞✿

Orders

Let K be a finitely generated ◗-algebra. An order ❖ ✚ K is a subring of K that is a finitely generated ❩-module of maximal dimension. An order that is not contained in any other order of K is called a maximal order. Examples: ❩ is the only order contained in ◗, ❩❬i❪ is the only maximal order of ◗❬i❪, ❩❬ ♣ 5❪ is a non-maximal order of ◗❬ ♣ 5❪, The ring of integers of a number field is its only maximal order, In general, maximal orders in quaternion algebras are not unique.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 22 / 75

slide-65
SLIDE 65

The endomorphism ring

The endomorphism ring ❊♥❞✭E✮ of an elliptic curve E is the ring of all isogenies E ✦ E (plus the null map) with addition and composition.

Theorem (Deuring)

Let E be an elliptic curve defined over a field k of characteristic p. ❊♥❞✭E✮ is isomorphic to one of the following: ❩, only if p ❂ 0 E is ordinary. An order ❖ in a quadratic imaginary field: E is ordinary with complex multiplication by ❖. Only if p ❃ 0, a maximal order in a quaternion algebraa: E is supersingular.

a(ramified at p and ✶) Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 23 / 75

slide-66
SLIDE 66

The finite field case

Theorem (Hasse)

Let E be defined over a finite field. Its Frobenius endomorphism ✙ satisfies a quadratic equation ✙2 t✙ ✰ q ❂ 0 in ❊♥❞✭E✮ for some ❥t❥ ✔ 2♣q, called the trace of ✙. The trace t is coprime to q if and only if E is ordinary. Suppose E is ordinary, then D✙ ❂ t2 4q ❁ 0 is the discriminant of ❩❬✙❪. K ❂ ◗❬✙❪ ❂ ◗❬♣D✙❪ is the endomorphism algebra of E. Denote by ❖K its ring of integers, then ❩ ✻❂ ❩❬✙❪ ✚ ❊♥❞✭E✮ ✚ ❖K✿ In the supersingular case, ✙ may or may not be in ❩, depending on q.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 24 / 75

slide-67
SLIDE 67

Endomorphism rings of ordinary curves

Classifying quadratic orders

Let K be a quadratic number field, and let ❖K be its ring of integers. Any order ❖ ✚ K can be written as ❖ ❂ ❩ ✰ f ❖K for an integer f , called the conductor of ❖, denoted by ❬❖k ✿ ❖❪. If dK is the discriminant of K, the discriminant of ❖ is f 2dK. If ❖❀ ❖✵ are two orders with discriminants d❀ d✵, then ❖ ✚ ❖✵ iff d✵❥d. ❖K ❩ ✰ 2❖K ❩ ✰ 3❖K ❩ ✰ 5❖K ❩ ✰ 6❖K ❩ ✰ 10❖K ❩ ✰ 15❖K ❩❬✙❪ ✬ ❩ ✰ 30❖K

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 25 / 75

slide-68
SLIDE 68

Isogeny volcanoes

Serre-Tate theorem reloaded

Two elliptic curves E❀ E ✵ defined over a finite field are isogenous iff their endomorphism algebras ❊♥❞✭E✮ ✡ ◗ and ❊♥❞✭E ✵✮ ✡ ◗ are isomorphic. Isogeny graphs Vertices are curves up to isomorphism, Edges are isogenies up to isomorphism. Isogeny volcanoes Curves are ordinary, Isogenies all have degree a prime ❵.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 26 / 75

slide-69
SLIDE 69

Volcanology I

Let E❀ E ✵ be curves with respective endomorphism rings ❖❀ ❖✵. Let ✣ ✿ E ✦ E ✵ be an isogeny of prime degree ❵, then: if ❖ ❂ ❖✵, ✣ is horizontal; if ❬❖✵ ✿ ❖❪ ❂ ❵, ✣ is ascending; if ❬❖ ✿ ❖✵❪ ❂ ❵, ✣ is descending. ❊♥❞✭E✮ ❖K ❩❬✙❪

Isogeny volcano of degree ❵ ❂ 3.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 27 / 75

slide-70
SLIDE 70

Volcanology II

❂

❵✭❬❖

✿ ❩❬✙❪❪✮ ❊♥❞✭E✮ ❖K ❩❬✙❪ Horizontal Ascending Descending ❵ ✲ ❬❖K ✿ ❖❪❪ ❵ ✲ ❬❖ ✿ ❩❬✙❪❪ 1 ✰

✏

DK ❵

✑

❵ ✲ ❬❖K ✿ ❖❪❪ ❵ ❥ ❬❖ ✿ ❩❬✙❪❪ 1 ✰

✏

DK ❵

✑

❵

✏

DK ❵

✑

❵ ❥ ❬❖K ✿ ❖❪❪ ❵ ❥ ❬❖ ✿ ❩❬✙❪❪ 1 ❵ ❵ ❥ ❬❖K ✿ ❖❪❪ ❵ ✲ ❬❖ ✿ ❩❬✙❪❪ 1

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 28 / 75

slide-71
SLIDE 71

Volcanology II

Height ❂ v❵✭❬❖K ✿ ❩❬✙❪❪✮. ❊♥❞✭E✮ ❖K ❩❬✙❪ Horizontal Ascending Descending ❵ ✲ ❬❖K ✿ ❖❪❪ ❵ ✲ ❬❖ ✿ ❩❬✙❪❪ 1 ✰

✏

DK ❵

✑

❵ ✲ ❬❖K ✿ ❖❪❪ ❵ ❥ ❬❖ ✿ ❩❬✙❪❪ 1 ✰

✏

DK ❵

✑

❵

✏

DK ❵

✑

❵ ❥ ❬❖K ✿ ❖❪❪ ❵ ❥ ❬❖ ✿ ❩❬✙❪❪ 1 ❵ ❵ ❥ ❬❖K ✿ ❖❪❪ ❵ ✲ ❬❖ ✿ ❩❬✙❪❪ 1

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 28 / 75

slide-72
SLIDE 72

Volcanology II

Height ❂ v❵✭❬❖K ✿ ❩❬✙❪❪✮. How large is the crater? ❊♥❞✭E✮ ❖K ❩❬✙❪ Horizontal Ascending Descending ❵ ✲ ❬❖K ✿ ❖❪❪ ❵ ✲ ❬❖ ✿ ❩❬✙❪❪ 1 ✰

✏

DK ❵

✑

❵ ✲ ❬❖K ✿ ❖❪❪ ❵ ❥ ❬❖ ✿ ❩❬✙❪❪ 1 ✰

✏

DK ❵

✑

❵

✏

DK ❵

✑

❵ ❥ ❬❖K ✿ ❖❪❪ ❵ ❥ ❬❖ ✿ ❩❬✙❪❪ 1 ❵ ❵ ❥ ❬❖K ✿ ❖❪❪ ❵ ✲ ❬❖ ✿ ❩❬✙❪❪ 1

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 28 / 75

slide-73
SLIDE 73

The class group

Let ❊♥❞✭E✮ ❂ ❖ ✚ ◗✭ ♣ D✮. Define ■✭❖✮, the group of invertible fractional ideals, P✭❖✮, the group of principal ideals,

The class group

The class group of ❖ is ❈❧✭❖✮ ❂ ■✭❖✮❂P✭O✮✿ It is a finite abelian group. Its order h✭❖✮ is called the class number of ❖. It arises as the Galois group of an abelian extension of ◗✭ ♣ D✮.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 29 / 75

slide-74
SLIDE 74

Complex multiplication

The a-torsion

Let a ✚ ❖ be an (integral invertible) ideal of ❖; Let E❬a❪ be the subgroup of E annihilated by a: E❬a❪ ❂ ❢P ✷ E ❥ ☛✭P✮ ❂ 0 for all ☛ ✷ a❣❀ Let ✣ ✿ E ✦ Ea, where Ea ❂ E❂E❬a❪. Then ❊♥❞✭Ea✮ ❂ ❖ (i.e., ✣ is horizontal).

Theorem (Complex multiplication)

The action on the set of elliptic curves with complex multiplication by ❖ defined by a ✄ j ✭E✮ ❂ j ✭Ea✮ factors through ❈❧✭❖✮, is faithful and transitive.

Corollary

Let ❊♥❞✭E✮ have discriminant D. Assume that

✏

D ❵

✑

❂ 1, then E is on a crater of an ❵-volcano, and the crater contains h✭❊♥❞✭E✮✮ curves.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 30 / 75

slide-75
SLIDE 75

Supersingular graphs

Every supersingular curve is defined

  • ver ❋p2.

For every maximal order type of the quaternion algebra ◗p❀✶ there are 1 or 2 curves over ❋p2 having endomorphism ring isomorphic to it. There is a unique isogeny class of supersingular curves over ✖ ❋p of size ✘ p❂12. Lef ideals act on the set of maximal

  • rders like isogenies.

The graph of ❵-isogenies is ✭❵ ✰ 1✮-regular.

Figure: 3-isogeny graph on ❋972.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 31 / 75

slide-76
SLIDE 76

Overview

1

Foundations Elliptic curves Isogenies Complex multiplication

2

Isogeny-based cryptography Isogeny walks Key exchange from ordinary graphs Key exchange from supersingular graphs The SIKE submission

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 32 / 75

slide-77
SLIDE 77

Isogeny graphs

Vertices are curves up to isomorphism, Edges are isogenies up to isomorphism.

Ordinary case

❵-isogeny graphs form volcanoes. The height of the volcano is given by the conductor of ❩❬✙❪. All curves on the same level have the same endomorphism ring (have complex multiplication by the same order ❖). Type of summit (one curve, two curves, crater) determined by

✏

D ❵

✑

. Size of the crater is h✭❖✮, and ❈❧✭❖✮ acts on it.

Supersingular case

There are ✘ p❂12 supersingular j -invariants, all defined over ❋p2. ❵-isogeny graphs are ✭❵ ✰ 1✮-regular and connected.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 33 / 75

slide-78
SLIDE 78

Graphs lexicon

Degree: Number of (outgoing/ingoing) edges. k-regular: All vertices have degree k. Connected: There is a path between any two vertices. Distance: The length of the shortest path between two vertices. Diamater: The longest distance between two vertices. ✕1 ✕ ✁ ✁ ✁ ✕ ✕n: The (ordered) eigenvalues of the adjacency matrix.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 34 / 75

slide-79
SLIDE 79

Expander graphs

Proposition

If G is a k-regular graph, its largest and smallest eigenvalues satisfy k ❂ ✕1 ✕ ✕n ✕ k✿

Expander families

An infinite family of connected k-regular graphs on n vertices is an expander family if there exists an ✎ ❃ 0 such that all non-trivial eigenvalues satisfy ❥✕❥ ✔ ✭1 ✎✮k for n large enough. Expander graphs have short diameter (O✭❧♦❣ n✮); Random walks mix rapidly (afer O✭❧♦❣ n✮ steps, the induced distribution on the vertices is close to uniform).

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 35 / 75

slide-80
SLIDE 80

Expander graphs from isogenies

Theorem (Pizer 1990, 1998)

Let ❵ be fixed. The family of graphs of supersingular curves over ❋p2 with ❵-isogenies, as p ✦ ✶, is an expander familya.

aEven better, it has the Ramanujan property.

In the ordinary case, for all primes ❵ ✲ t2 4q: 50% of ❵-isogeny graphs are isolated points,

✏

DK ❵

✑

❂ 1 50% of ❵-isogeny graphs are cycles.

✏

DK ❵

✑

❂ ✰1

Theorem (Jao, Miller, and Venkatesan 2009)

Let ❖ ✚ ◗❬ ♣ D❪ be an order in a quadratic imaginary field. The graphs of all curves over ❋q with complex multiplication by ❖, with isogenies of prime degree boundeda by ✭❧♦❣ q✮2✰✍, are expanders.

aMay contain traces of GRH. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 36 / 75

slide-81
SLIDE 81

Isogeny based cryptography is 20 years old!

1996 Couveignes suggests isogeny-based key-exchange at a seminar in École Normale Supérieure; 1997 He submits “Hard Homogeneous Spaces” to Crypto;

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 37 / 75

slide-82
SLIDE 82

Isogeny based cryptography is 20 years old!

1996 Couveignes suggests isogeny-based key-exchange at a seminar in École Normale Supérieure; 1997 He submits “Hard Homogeneous Spaces” to Crypto; 1997 His paper gets rejected;

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 37 / 75

slide-83
SLIDE 83

Isogeny based cryptography is 20 years old!

1996 Couveignes suggests isogeny-based key-exchange at a seminar in École Normale Supérieure; 1997 He submits “Hard Homogeneous Spaces” to Crypto; 1997 His paper gets rejected; 1997–2006 ...Nothing happens for about 10 years.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 37 / 75

slide-84
SLIDE 84

Isogeny based cryptography is 20 years old!

1996 Couveignes suggests isogeny-based key-exchange at a seminar in École Normale Supérieure; 1997 He submits “Hard Homogeneous Spaces” to Crypto; 1997 His paper gets rejected; 1997–2006 ...Nothing happens for about 10 years.

  • Ok. Let’s move on to the next 10 years!

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 37 / 75

slide-85
SLIDE 85

Isogeny problems

Isogeny computation ✭★ ✮

Given an elliptic curve E with Frobenius endomorphism ✙, and a subgroup G ✚ E such that ✙✭G✮ ❂ G, compute the rational fractions and the image curve of the separable isogeny ✣ ✿ E ✦ E❂G.

Explicit isogeny ✭ ✮

Given two elliptic curves E❀ E ✵ over a finite field, isogenous of known degree d, find an isogeny ✣ ✿ E ✦ E ✵ of degree d.

Isogeny walk ❡①♣✭❧♦❣ ★ ✮

Given two elliptic curves E❀ E ✵ over a finite field k, such that ★E ❂ ★E ✵, find an isogeny ✣ ✿ E ✦ E ✵ of smooth degree.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 38 / 75

slide-86
SLIDE 86

Isogeny problems

Isogeny computation poly✭★G✮

Given an elliptic curve E with Frobenius endomorphism ✙, and a subgroup G ✚ E such that ✙✭G✮ ❂ G, compute the rational fractions and the image curve of the separable isogeny ✣ ✿ E ✦ E❂G.

Explicit isogeny ✭ ✮

Given two elliptic curves E❀ E ✵ over a finite field, isogenous of known degree d, find an isogeny ✣ ✿ E ✦ E ✵ of degree d.

Isogeny walk ❡①♣✭❧♦❣ ★ ✮

Given two elliptic curves E❀ E ✵ over a finite field k, such that ★E ❂ ★E ✵, find an isogeny ✣ ✿ E ✦ E ✵ of smooth degree.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 38 / 75

slide-87
SLIDE 87

Isogeny problems

Isogeny computation poly✭★G✮

Given an elliptic curve E with Frobenius endomorphism ✙, and a subgroup G ✚ E such that ✙✭G✮ ❂ G, compute the rational fractions and the image curve of the separable isogeny ✣ ✿ E ✦ E❂G.

Explicit isogeny poly✭d✮

Given two elliptic curves E❀ E ✵ over a finite field, isogenous of known degree d, find an isogeny ✣ ✿ E ✦ E ✵ of degree d.

Isogeny walk ❡①♣✭❧♦❣ ★ ✮

Given two elliptic curves E❀ E ✵ over a finite field k, such that ★E ❂ ★E ✵, find an isogeny ✣ ✿ E ✦ E ✵ of smooth degree.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 38 / 75

slide-88
SLIDE 88

Isogeny problems

Isogeny computation poly✭★G✮

Given an elliptic curve E with Frobenius endomorphism ✙, and a subgroup G ✚ E such that ✙✭G✮ ❂ G, compute the rational fractions and the image curve of the separable isogeny ✣ ✿ E ✦ E❂G.

Explicit isogeny poly✭d✮

Given two elliptic curves E❀ E ✵ over a finite field, isogenous of known degree d, find an isogeny ✣ ✿ E ✦ E ✵ of degree d.

Isogeny walk ❡①♣✭❧♦❣ ★k✮

Given two elliptic curves E❀ E ✵ over a finite field k, such that ★E ❂ ★E ✵, find an isogeny ✣ ✿ E ✦ E ✵ of smooth degree.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 38 / 75

slide-89
SLIDE 89

Isogeny walks and cryptanalysis2 (circa 2000)

Fact: Having a weak DLP is not (always) isogeny invariant. E E ✵ weak curve strong curve E ✵✵

Fourth root attacks

Start two random walks from the two curves and wait for a collision. Over ❋q, the average size of an isogeny class is h✭❖K✮ ✘ ♣q. A collision is expected afer O✭

♣

h✭❖K✮✮ ❂ O✭q

1 4 ✮ steps.

Note: Can be used to build trapdoor systems1.

1Teske 2006. 2Galbraith 1999; Galbraith, Hess, and Smart 2002; Bisson and Sutherland 2011. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 39 / 75

slide-90
SLIDE 90

Random walks and hash functions (circa 2006)

Any expander graph gives rise to a hash function. v

1 1 1 1 1 1

v ✵ H✭010101✮ ❂ v ✵ Fix a starting vertex v; The value to be hashed determines a random path to v ✵; v ✵ is the hash.

Provably secure hash functions

Use the expander graph of supersingular 2-isogenies;a Collision resistance = hardness of finding cycles in the graph; Preimage resistance = hardness of finding a path from v to v ✵.

aCharles, K. E. Lauter, and Goren 2009; Doliskani, Pereira, and Barreto 2017. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 40 / 75

slide-91
SLIDE 91

Random walks and key exchange Let’s try something harder...

1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1

Public v0 Alice’s public vA Bob’s public vB Shared secret

...is this even possible?

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 41 / 75

slide-92
SLIDE 92

Expander graphs from groups

g2 g4 g8 g3 g6 g12 g11 g9 g5 g10 g7 g1 Let G ❂ ❤g✐ be a cyclic group of order p. ✚ ✭❩❂ ❩✮✂

✚

✭ ❀ ♥ ❢ ❣✮ ✼✦ ✼✦ ✼✦

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 42 / 75

slide-93
SLIDE 93

Expander graphs from groups

g2 g4 g8 g3 g6 g12 g11 g9 g5 g10 g7 g1 Let G ❂ ❤g✐ be a cyclic group of order p. ✚ ✭❩❂ ❩✮✂

✚

✭ ❀ ♥ ❢ ❣✮ x ✼✦ x 2 ✼✦ ✼✦

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 42 / 75

slide-94
SLIDE 94

Expander graphs from groups

g2 g4 g8 g3 g6 g12 g11 g9 g5 g10 g7 g1 Let G ❂ ❤g✐ be a cyclic group of order p. ✚ ✭❩❂ ❩✮✂

✚

✭ ❀ ♥ ❢ ❣✮ x ✼✦ x 2 x ✼✦ x 3 ✼✦

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 42 / 75

slide-95
SLIDE 95

Expander graphs from groups

g2 g4 g8 g3 g6 g12 g11 g9 g5 g10 g7 g1 Let G ❂ ❤g✐ be a cyclic group of order p. ✚ ✭❩❂ ❩✮✂

✚

✭ ❀ ♥ ❢ ❣✮ x ✼✦ x 2 x ✼✦ x 3 x ✼✦ x 5

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 42 / 75

slide-96
SLIDE 96

Expander graphs from groups

g2 g4 g8 g3 g6 g12 g11 g9 g5 g10 g7 g1 Let G ❂ ❤g✐ be a cyclic group of order p. Let S ✚ ✭❩❂p❩✮✂ s.t. S 1 ✚ S. The Schreier graph of ✭S❀ G ♥ ❢1❣✮ is (usually) an expander. x ✼✦ x 2 x ✼✦ x 3 x ✼✦ x 5

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 42 / 75

slide-97
SLIDE 97

Key exchange from Schreier graphs

g ❂ Public parameters: A group G ❂ ❤g✐ of order p; A subset S ✚ ✭❩❂p❩✮✂. ✿ ✦ ✭❧♦❣ ✮

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 43 / 75

slide-98
SLIDE 98

Key exchange from Schreier graphs

g gA ❂ Public parameters: A group G ❂ ❤g✐ of order p; A subset S ✚ ✭❩❂p❩✮✂.

1

Alice takes a secret random walk sA ✿ g ✦ gA of length O✭❧♦❣ p✮;

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 43 / 75

slide-99
SLIDE 99

Key exchange from Schreier graphs

g gA gB ❂ Public parameters: A group G ❂ ❤g✐ of order p; A subset S ✚ ✭❩❂p❩✮✂.

1

Alice takes a secret random walk sA ✿ g ✦ gA of length O✭❧♦❣ p✮;

2

Bob does the same;

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 43 / 75

slide-100
SLIDE 100

Key exchange from Schreier graphs

g gA gB ❂ Public parameters: A group G ❂ ❤g✐ of order p; A subset S ✚ ✭❩❂p❩✮✂.

1

Alice takes a secret random walk sA ✿ g ✦ gA of length O✭❧♦❣ p✮;

2

Bob does the same;

3

They publish gA and gB;

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 43 / 75

slide-101
SLIDE 101

Key exchange from Schreier graphs

g gA gB gBA ❂ Public parameters: A group G ❂ ❤g✐ of order p; A subset S ✚ ✭❩❂p❩✮✂.

1

Alice takes a secret random walk sA ✿ g ✦ gA of length O✭❧♦❣ p✮;

2

Bob does the same;

3

They publish gA and gB;

4

Alice repeats her secret walk sA starting from gB.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 43 / 75

slide-102
SLIDE 102

Key exchange from Schreier graphs

g gA gB gBA ❂ gAB Public parameters: A group G ❂ ❤g✐ of order p; A subset S ✚ ✭❩❂p❩✮✂.

1

Alice takes a secret random walk sA ✿ g ✦ gA of length O✭❧♦❣ p✮;

2

Bob does the same;

3

They publish gA and gB;

4

Alice repeats her secret walk sA starting from gB.

5

Bob repeats his secret walk sB starting from gA.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 43 / 75

slide-103
SLIDE 103

Key exchange from Schreier graphs

g gA gB gBA ❂ gAB Why does this work? gA ❂ g2✁3✁2✁5❀ gB ❂ g32✁5✁2❀ gBA ❂ gAB ❂ g23✁33✁52❀ and gA❀ gB❀ gAB are uniformly distributed in G...

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 43 / 75

slide-104
SLIDE 104

Key exchange from Schreier graphs

g gA gB gBA ❂ gAB Why does this work? gA ❂ g2✁3✁2✁5❀ gB ❂ g32✁5✁2❀ gBA ❂ gAB ❂ g23✁33✁52❀ and gA❀ gB❀ gAB are uniformly distributed in G... ...Indeed, this is just a twisted presentation of the classical Diffie-Hellman protocol!

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 43 / 75

slide-105
SLIDE 105

Group action on isogeny graphs

❵1-isogenies ❵2-isogenies There is a group action of the ideal class group ❈❧✭❖✮ on the set of ordinary curves with complex multiplication by ❖. Its Schreier graph is an isogeny graph (and an expander if we take enough generators)

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 44 / 75

slide-106
SLIDE 106

Key exchange in graphs of ordinary isogenies3 (circa 2006)

Parameters: E❂❋p ordinary elliptic curve with Frobenius endomorphism ✙, primes ❵1,❵2,... such that

✏

D✙ ❵i

✑

❂ 1. A direction for each ❵i (i.e. a choice of a root of ✙2 t✙ ✰ q ♠♦❞ ❵). Secret data: Random walks a❀ b ✷ ❈❧✭❖✮ in the isogeny graph.

E a ✄ E b ✄ E ab ✄ E ❂ ba ✄ E

❵a1

1 ❵a2 2 ✁ ✁ ✁ ❂ ◆✭a✮

◆✭b✮ ❂ ❵b1

1 ❵b2 2 ✁ ✁ ✁

3Couveignes 2006; Rostovtsev and Stolbunov 2006. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 45 / 75

slide-107
SLIDE 107

CRS key exchange

Key generation: compose small degree isogenies (Isogeny Computation Problem) polynomial in the length of the random walk. Attack: Isogeny Walk Problem polynomial in the degree, exponential in the length. Open problem: Make this thing practical!

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 46 / 75

slide-108
SLIDE 108

Security of CRS

Size of the graph: h✭❖✮ ✘ ♣p, Key space size: Exponential in the number of primes ❵1,❵2,... Meet in the middle attack: O✭ 4 ♣p✮.

The Abelian Hidden Shif Problem

Let G be a group and S be a set. Given two oracles f0❀ f1 ✿ G ✦ S such that f0✭g✮ ❂ f1✭gs✮ for some s ✷ G, find s.

Ordinary isogeny walk ✦ Hidden shif

To find a secret isogeny walk E0 ✦ E1, set f0 ✿ ❈❧✭❖✮ ✦ V f1 ✿ ❈❧✭❖✮ ✦ V a ✼✦ a ✄ E0 a ✼✦ a ✄ E1 Then the hidden shif is s such that s ✄ E0 ❂ E1.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 47 / 75

slide-109
SLIDE 109

Quantum attack on CRS4

1

Lp✭1❂2❀ ♣ 3❂2✮ classical algorithm for evaluating f0❀ f1.

2

Hidden Shif Problem ✦ Dihedral Hidden Subgroup Problem.

Quantum algorithms for dihedral HSP

Kuperberga: 2O✭♣

❧♦❣ ❥G❥✮ quantum time, space and query complexity.

Regevb: L❥G❥✭ 1

2❀

♣ 2✮ quantum time and query complexity, poly✭❧♦❣✭❥G❥✮ quantum space.

aKuperberg 2005. bRegev 2004. 4Childs, Jao, and Soukharev 2010. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 48 / 75

slide-110
SLIDE 110

Key exchange with supersingular curves (2011)

Good news: there is no action of a commutative class group. Bad news: there is no action of a commutative class group. Idea: Let Alice and Bob walk in two different isogeny graphs on the same vertex set.

Figure: 2- and 3-isogeny graphs on ❋972.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 49 / 75

slide-111
SLIDE 111

Key exchange with supersingular curves (2011)

Good news: there is no action of a commutative class group. Bad news: there is no action of a commutative class group. Idea: Let Alice and Bob walk in two different isogeny graphs on the same vertex set.

Figure: 2- and 3-isogeny graphs on ❋972.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 49 / 75

slide-112
SLIDE 112

Key exchange with supersingular curves (2011)

Good news: there is no action of a commutative class group. Bad news: there is no action of a commutative class group. Idea: Let Alice and Bob walk in two different isogeny graphs on the same vertex set.

Figure: 2- and 3-isogeny graphs on ❋972.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 49 / 75

slide-113
SLIDE 113

Key exchange with supersingular curves

Fix small primes ❵A, ❵B; No canonical labeling of the ❵A- and ❵B-isogeny graphs; however... Walk of length eA ❂ Isogeny of degree ❵eA

A

❂ Kernel ❤P✐ ✚ E❬❵eA

A ❪

❦❡r ✣ ❂ ❤P✐ ✚ E❬❵eA

A ❪

❦❡r ✥ ❂ ❤Q✐ ✚ E❬❵eB

B ❪

❦❡r ✣✵ ❂ ❤✥✭P✮✐ ❦❡r ✥✵ ❂ ❤✣✭Q✮✐

E E❂❤P✐ E❂❤Q✐ E❂❤P❀ Q✐ ✣ ✣✵ ✥ ✥✵

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 50 / 75

slide-114
SLIDE 114

Supersingular Isogeny Diffie-Hellman5

Parameters: Prime p such that p ✰ 1 ❂ ❵a

A❵b B;

Supersingular curve E ✬ ✭❩❂✭p ✰ 1✮❩✮2; E❬❵a

A❪ ❂ ❤PA❀ QA✐;

E❬❵b

B❪ ❂ ❤PB❀ QB✐.

Secret data: RA ❂ mAPA ✰ nAQA, RB ❂ mBPB ✰ nBQB,

E E❂❤RA✐

✣✭ ✮ ✣✭ ✮

E❂❤RB✐

✥✭ ✮ ✥✭ ✮

E❂❤RA✐ ✣✭RB✮ ✬

E❂❤RA❀ RB✐

✬ E❂❤RB✐

✥✭RA✮

✣ ✥ ✥✵ ✣✵

✣✭ ✮ ✥✭ ✮

5Jao and De Feo 2011; De Feo, Jao, and Plût 2014. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 51 / 75

slide-115
SLIDE 115

Supersingular Isogeny Diffie-Hellman5

Parameters: Prime p such that p ✰ 1 ❂ ❵a

A❵b B;

Supersingular curve E ✬ ✭❩❂✭p ✰ 1✮❩✮2; E❬❵a

A❪ ❂ ❤PA❀ QA✐;

E❬❵b

B❪ ❂ ❤PB❀ QB✐.

Secret data: RA ❂ mAPA ✰ nAQA, RB ❂ mBPB ✰ nBQB,

E E❂❤RA✐

✣✭PB✮ ✣✭QB✮

E❂❤RB✐

✥✭PA✮ ✥✭QA✮

E❂❤RA✐ ✣✭RB✮ ✬

E❂❤RA❀ RB✐

✬ E❂❤RB✐

✥✭RA✮

✣ ✥ ✥✵ ✣✵

✣✭ ✮ ✥✭ ✮

5Jao and De Feo 2011; De Feo, Jao, and Plût 2014. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 51 / 75

slide-116
SLIDE 116

Supersingular Isogeny Diffie-Hellman5

Parameters: Prime p such that p ✰ 1 ❂ ❵a

A❵b B;

Supersingular curve E ✬ ✭❩❂✭p ✰ 1✮❩✮2; E❬❵a

A❪ ❂ ❤PA❀ QA✐;

E❬❵b

B❪ ❂ ❤PB❀ QB✐.

Secret data: RA ❂ mAPA ✰ nAQA, RB ❂ mBPB ✰ nBQB,

E E❂❤RA✐

✣✭PB✮ ✣✭QB✮

E❂❤RB✐

✥✭PA✮ ✥✭QA✮

E❂❤RA✐ ✣✭RB✮ ✬

E❂❤RA❀ RB✐

✬ E❂❤RB✐

✥✭RA✮

✣ ✥ ✥✵ ✣✵

✣✭RB✮ ✥✭RA✮

5Jao and De Feo 2011; De Feo, Jao, and Plût 2014. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 51 / 75

slide-117
SLIDE 117

Generic attacks

Problem: Given E❀ E ✵, isogenous of degree ❵n, find ✣ ✿ E ✦ E ✵.

E E❂❤P0✐ Ei❂❤Pi✐ E❂❤P❵n❂2✐ . . . . . . E ✵

❵n❂2 ❵n❂2 With high probability ✣ is the unique collision (or claw) O✭❵n❂2✮. A quantum claw finding6 algorithm solves the problem in O✭❵n❂3✮.

6Tani 2009. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 52 / 75

slide-118
SLIDE 118

Security

The SIDH problem

Given E, Alice’s public data E❂❤RA✐❀ ✣✭PB✮❀ ✣✭QB✮, and Bob’s public data E❂❤RB✐❀ ✥✭PA✮❀ ✥✭QA✮, find the shared secret E❂❤RA❀ RB✐. Under the SIDH assumption: The SIDH key exchange protocol is session-key secure. The derived El Gamal-type PKE is CPA secure.

Reductions

SIDH ✦ Isogeny Walk Problem; SIDH ✦ Computing the endomorphism rings of E and E❂❤RA✐.a

aKohel, K. Lauter, Petit, and Tignol 2014; Galbraith, Petit, Shani, and Ti 2016. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 53 / 75

slide-119
SLIDE 119

Chosen ciphertext attack7

For simplicity, assume Alice’s prime is ❵ ❂ 2.

Evil Bob

Alice has a long-term secret R ❂ mP ✰ nQ ✷ E❬2e❪; Bob produces an ephemeral secret ✥; Bob sends to Alice ✥✭P✮❀ ✥✭Q ✰ 2e1P✮; Alice computes the shared secret correctly iff R ❂ mP ✰ nQ ❂ mP ✰ nQ ✰ n2e1P❀ i.e., iff n is even; Bob learns one bit of the secret key by checking that Alice gets the right shared secret. Bob repeats the queries in a similar fashion, learning one bit per query. Detecting Bob’s faulty key seems to be as hard as breaking SIDH.

7Galbraith, Petit, Shani, and Ti 2016. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 54 / 75

slide-120
SLIDE 120

Bonus: a ZK proof of knowledge8

Secret: knowledge of the kernel of a degree ❵eA

A isogeny from E to E❂❤S✐.

E E❂❤S✐ ❂❤ ✐ ❂❤ ❀ ✐ ✣

✷ ❬❵ ❪ ❂❤ ✐ ❂❤ ❀ ✐

■

❵

■ 8De Feo, Jao, and Plût 2014. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 55 / 75

slide-121
SLIDE 121

Bonus: a ZK proof of knowledge8

Secret: knowledge of the kernel of a degree ❵eA

A isogeny from E to E❂❤S✐.

E E❂❤S✐ E❂❤P✐ E❂❤P❀ S✐ ✣ ? ? ?

1

Choose a random point P ✷ E❬❵eB

B ❪, compute the diagram;

2

Publish the curves E❂❤P✐ and E❂❤P❀ S✐;

■

❵

■ 8De Feo, Jao, and Plût 2014. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 55 / 75

slide-122
SLIDE 122

Bonus: a ZK proof of knowledge8

Secret: knowledge of the kernel of a degree ❵eA

A isogeny from E to E❂❤S✐.

E E❂❤S✐ E❂❤P✐ E❂❤P❀ S✐ ✣ ? ✥ ✥✵

1

Choose a random point P ✷ E❬❵eB

B ❪, compute the diagram;

2

Publish the curves E❂❤P✐ and E❂❤P❀ S✐;

3

The verifier asks one of the two questions:

■ Reveal the degree ❵eB

B isogenies;

■ 8De Feo, Jao, and Plût 2014. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 55 / 75

slide-123
SLIDE 123

Bonus: a ZK proof of knowledge8

Secret: knowledge of the kernel of a degree ❵eA

A isogeny from E to E❂❤S✐.

E E❂❤S✐ E❂❤P✐ E❂❤P❀ S✐ ✣ ✣✵ ? ?

1

Choose a random point P ✷ E❬❵eB

B ❪, compute the diagram;

2

Publish the curves E❂❤P✐ and E❂❤P❀ S✐;

3

The verifier asks one of the two questions:

■ Reveal the degree ❵eB

B isogenies;

■ Reveal the bottom isogeny. 8De Feo, Jao, and Plût 2014. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 55 / 75

slide-124
SLIDE 124

Bonus: a ZK proof of knowledge8

Secret: knowledge of the kernel of a degree ❵eA

A isogeny from E to E❂❤S✐.

E E❂❤S✐ E❂❤P✐ E❂❤P❀ S✐ ✣ ✣✵ ? ?

1

Choose a random point P ✷ E❬❵eB

B ❪, compute the diagram;

2

Publish the curves E❂❤P✐ and E❂❤P❀ S✐;

3

The verifier asks one of the two questions:

■ Reveal the degree ❵eB

B isogenies;

■ Reveal the bottom isogeny.

Can derive Fiat-Shamir signatures: secure under SIDH...but very slow!

8De Feo, Jao, and Plût 2014. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 55 / 75

slide-125
SLIDE 125

SIKE: Supersingular Isogeny Key Encapsulation

Submission to the NIST PQ competition: SIKE.PKE: El Gamal-type system with IND-CPA security proof, SIKE.KEM: generically transformed system with IND-CCA security proof. Security levels 1, 3 and 5. Smallest communication complexity among all proposals in each level. Slowest among all benchmarked proposals in each level. A team of 14 submitters, from 8 universities and companies. Download the package here. p

  • cl. security
  • q. security

speed comm. SIKEp503 22503159 1 126 bits 84 bits 10ms 0.4KB SIKEp751 23723239 1 188 bits 125 bits 30ms 0.6KB SIKEp964 24863301 1 241 bits 161 bits 0.8KB

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 56 / 75

slide-126
SLIDE 126

Parameter choices

For efficiency: p ❂ 2a3b 1, with a even; For security: a ✘ ✭❧♦❣2 3✮b ✕

✭

2 ✂ classical security parameter, 3 ✂ quantum security parameter; For verifiability: Special starting curve E0 ✿ y2 ❂ x 3 ✰ x; PA❀ QA❀ PB❀ QB chosen as the lexicographically first points satisfying the necessary conditions.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 57 / 75

slide-127
SLIDE 127

Implementation: finite field

Arithmetic in ❋p

p ❂ 2a3b 1 lends itself to optimizations:

■ Adapted Comba-based Montgomery reductiona, ■ Adapted Barret reductionb; ■ Assembly optimized. aCostello, Longa, and Naehrig 2016. bKarmakar, Roy, Vercauteren, and Verbauwhede 2016.

Arithmetic in ❋p2

Because p ❂ 1 ♠♦❞ 4, then 1 is not a quadratic residue in ❋p. We define ❋p2 ❂ ❋p❬i❪ ❂ ❋p❬X ❪❂✭X 2 ✰ 1✮. Arithmetic similar to ◗❬i❪; Karatsuba-like formulas for multiplication and squaring; Inversion only requires one inversion in ❋p; Optimizations similar to pairing-base crypto (e.g., BN254).

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 58 / 75

slide-128
SLIDE 128

Implementation: curves

Montgomery curves

Not a Weierstrass equation: by2 ❂ x 3 ✰ ax 2 ✰ x Only possible for curves with a 4-torsion point (we’re lucky); Very efficient arithmetic in XZ-coordinates: identify ✝P by dropping the Y -coordinate Doubling: ❬2❪✭X ✿ ✁ ✿ Z✮ ❂

✭X 2 Z 2✮2 ✿ ✁ ✿ 4XZ✭X 2 ✰ aXZ ✰ Z 2✮ ✁

Tripling:

❬3❪✭X ✿ ✁ ✿ Z✮ ❂ X ✭X 46X 2Z 24aXZ 33Z 4✮ ✿ ✁ ✿ Z✭3X 4✰4aX 3Z✰6X 2Z 3Z 4✮✁

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 59 / 75

slide-129
SLIDE 129

Implementation: curves

Computing mP ✰ nQ

Observe that mP ✰ nQ and P ✰ ✭n❂m✮Q generate the same isogeny kernel; Constant time Montgomery ladder tailoreda to P ✰ cQ. For simplicity and constant-time sampling, SIKE secret keys are restricted to P ✰ cQ with c ✷ ❬0❀ ✿ ✿ ✿ ❀ 2x 1❪.

aFaz-Hernández, López, Ochoa-Jiménez, and Rodríguez-Henríquez 2017.

Input P ❂ ✭XP ✿ ZP✮❀ Q ❂ ✭XQ ✿ ZQ✮❀ P Q ❂ ✭XPQ ✿ ZPQ✮,

a scalar c;

Output P ✰ cQ.

1

Set R0 ❂ Q❀ R1 ❂ P❀ R2 ❂ Q P

2

For i from 0 to ❜❧♦❣2 c❝:

■ if ci ❂ 0, let

R0❀ R1 ❂ 2R0❀ R0 ✰ R1;

■ if ci ❂ 1, let

R0❀ R2 ❂ 2R0❀ R0 ✰ R2;

3

Return R1.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 60 / 75

slide-130
SLIDE 130

Implementation: isogenies

Vélu’s formulas

Given a group G ✚ E, the isogeny ✣ ✿ E ✦ E❂G is defined by:

✣✭P✮ ❂

✵ ❅x✭P✮ ✰ ❳

Q✷G♥❢❖❣

x✭P ✰ Q✮ x✭Q✮❀ y✭P✮ ✰

❳

Q✷G♥❢❖❣

y✭P ✰ Q✮ y✭Q✮

✶ ❆ ✿

3-isogenies of Montgomery curves

Let P ❂ ✭X3 ✿ Z3✮ be a point of order 3 on by2 ❂ x 3 ✰ ax 2 ✰ x. The curve E❂❤P✐ has equation by2 ❂ x 3 ✰ a✵x 2 ✰ x where a✵ ❂ ✭aX3Z3 ✰ 6✭Z 2

3 X 2 3 ✮✮X3❂Z 3 3 ✿

It is defined by the map ✣✭X ✿ Z✮ ❂

X ✭X3X Z3Z✮2 ✿ Z✭Z3X X3Z✮2✁✿

Similar formula for 4-isogenies.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 61 / 75

slide-131
SLIDE 131

Implementation: isogeny walks

♦r❞✭R✮ ❂ ❵e and ✣ ❂ ✣0 ✍ ✣1 ✍ ✁ ✁ ✁ ✍ ✣e1, each of degree ❵ R R1 R2 R3 R4 R5 ❬❵1❪R ❬❵2❪R ❬❵3❪R ❬❵4❪R ❬❵5❪R ✣0 ✣0 ✣0 ✣0 ✣0 ✣1 ✣1 ✣1 ✣1 ✣2 ✣2 ✣2 ✣3 ✣3 ✣4 ❬❵❪ ❬❵❪ ❬❵❪ ❬❵❪ ❬❵❪

❬❵4❪R1 ❬❵3❪R2 ❬❵2❪R3 ❬❵1❪R4

✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ ✎ For each i, one needs to compute ❬❵ei❪Ri in order to compute ✣i.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 62 / 75

slide-132
SLIDE 132

Implementation: isogeny walks

✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁ ✁

Figure: The seven well formed strategies for e ❂ 4.

Right edges are ❵-isogeny evaluation; Lef edges are multiplications by ❵ (about twice as expensive); The best strategy can be precomputed offline and hardcoded. Evaluation is done in constant time! Pre-computed optimized strategies are given in the SIKE submission document.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 63 / 75

slide-133
SLIDE 133

Example

Figure: Optimal strategy for e ❂ 512, ❵ ❂ 2.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 64 / 75

slide-134
SLIDE 134

Implementation: constant time

Secret key sampling in constant time by restricting key space; P ✰ cQ in constant time via Montgomery ladder; Isogeny walk in constant time via any strategy.

Finite field operations in constant time

Only problem is to avoid inversions as much as possible, but Vélu’s formulas require one inversion per curve on the walk. Solutiona: projectivize curve equations E ✿ CBy2 ❂ Cx 3 ✰ Ax 2 ✰ Cx✿ Slightly increases operation counts of formulas; Delays all inversions to the very end; Only the value ✭A ✿ C✮ is needed in computations. Then: j ✭E✮ ❂ 256✭A2 3C 2✮ C 4✭A2 4C 2✮ ✿

aCostello, Longa, and Naehrig 2016. Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 65 / 75

slide-135
SLIDE 135

Summary

Public parameters: p ❂ 2a3b 1, Staring curve E ✿ y2 ❂ x 3 ✰ x, Torsion generators PA ❂ ✭Xa1 ✿ Za1✮❀ QA ❂ ✭Xa2 ✿ Za2✮❀ PA QA ❂ ✭Xa3 ✿ Za3✮❀ PB ❂ ✭Xb1 ✿ Zb1✮❀ QB ❂ ✭Xb2 ✿ Zb2✮❀ PB QB ❂ ✭Xb3 ✿ Zb3✮✿ Secret keys: RA ❂ PA ✰ cQA with c ✷ ❬0❀ ✿ ✿ ✿ ❀ 2a 1❪, RB ❂ PA ✰ cQA with c ✷ ❬0❀ ✿ ✿ ✿ ❀ 2b❜❧♦❣2 3❝ 1❪. Public keys (curve equation can be interpolated from three points): ✣✭PB✮❀ ✣✭QB✮❀ ✣✭PB QB✮, ✥✭PA✮❀ ✥✭QA✮❀ ✥✭PA QA✮. Shared secret: j ❂ 256✭A2 3C 2✮❂C 4✭A2 4C 2✮.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 66 / 75

slide-136
SLIDE 136

Thank you

http://defeo.lu/ @luca_defeo

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 67 / 75

slide-137
SLIDE 137

References I

Pizer, Arnold K. (1990). “Ramanujan graphs and Hecke operators.” In: Bull. Amer. Math. Soc. (N.S.) 23.1. — (1998). “Ramanujan graphs.” In: Computational perspectives on number theory (Chicago, IL, 1995).

  • Vol. 7.

AMS/IP Stud. Adv. Math. Providence, RI: Amer. Math. Soc. Jao, David, Stephen D. Miller, and Ramarathnam Venkatesan (June 2009). “Expander graphs based on GRH with an application to elliptic curve cryptography.” In: Journal of Number Theory 129.6,

  • Pp. 1491–1504.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 68 / 75

slide-138
SLIDE 138

References II

Teske, Edlyn (Jan. 2006). “An Elliptic Curve Trapdoor System.” In: Journal of Cryptology 19.1,

  • Pp. 115–133.

Galbraith, Steven D. (1999). “Constructing Isogenies between Elliptic Curves Over Finite Fields.” In: LMS Journal of Computation and Mathematics 2,

  • Pp. 118–138.

Galbraith, Steven D., Florian Hess, and Nigel P. Smart (2002). “Extending the GHS Weil descent attack.” In: Advances in cryptology—EUROCRYPT 2002 (Amsterdam).

  • Vol. 2332.

Lecture Notes in Comput. Sci. Berlin: Springer,

  • Pp. 29–44.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 69 / 75

slide-139
SLIDE 139

References III

Bisson, Gaetan and Andrew V. Sutherland (June 2011). “A low-memory algorithm for finding short product representations in finite groups.” In: Designs, Codes and Cryptography 63.1,

  • Pp. 1–13.

Charles, Denis X., Kristin E. Lauter, and Eyal Z. Goren (Jan. 2009). “Cryptographic Hash Functions from Expander Graphs.” In: Journal of Cryptology 22.1,

  • Pp. 93–113.

Doliskani, Javad, Geovandro C. C. F. Pereira, and Paulo S. L. M. Barreto (2017). Faster Cryptographic Hash Function From Supersingular Isogeny Graphs. Cryptology ePrint Archive, Report 2017/1202. https://eprint.iacr.org/2017/1202.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 70 / 75

slide-140
SLIDE 140

References IV

Couveignes, Jean-Marc (2006). Hard Homogeneous Spaces. Rostovtsev, Alexander and Anton Stolbunov (2006). Public-key cryptosystem based on isogenies. http://eprint.iacr.org/2006/145/. Kuperberg, Greg (2005). “A subexponential-time quantum algorithm for the dihedral hidden subgroup problem.” In: SIAM J. Comput. 35.1,

  • Pp. 170–188.

eprint: quant-ph/0302112. Regev, Oded (June 2004). A Subexponential Time Algorithm for the Dihedral Hidden Subgroup Problem with Polynomial Space. arXiv: quant-ph/0406151.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 71 / 75

slide-141
SLIDE 141

References V

Childs, Andrew M., David Jao, and Vladimir Soukharev (Dec. 2010). “Constructing elliptic curve isogenies in quantum subexponential time.” Jao, David and Luca De Feo (2011). “Towards Quantum-Resistant Cryptosystems from Supersingular Elliptic Curve Isogenies.” In: Post-Quantum Cryptography.

  • Ed. by Bo-Yin Yang.
  • Vol. 7071.

Lecture Notes in Computer Science. Taipei, Taiwan: Springer Berlin / Heidelberg.

  • Chap. 2, pp. 19–34.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 72 / 75

slide-142
SLIDE 142

References VI

De Feo, Luca, David Jao, and Jérôme Plût (2014). “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies.” In: Journal of Mathematical Cryptology 8.3,

  • Pp. 209–247.

Tani, Seiichiro (2009). “Claw finding algorithms using quantum walk.” In: Theoretical Computer Science 410.50,

  • Pp. 5285–5297.

Kohel, David, Kristin Lauter, Christophe Petit, and Jean-Pierre Tignol (2014). “On the quaternion-isogeny path problem.” In: LMS Journal of Computation and Mathematics 17.A,

  • Pp. 418–432.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 73 / 75

slide-143
SLIDE 143

References VII

Galbraith, Steven D., Christophe Petit, Barak Shani, and Yan Bo Ti (2016). “On the security of supersingular isogeny cryptosystems.” In: Advances in Cryptology–ASIACRYPT 2016: 22nd International Conference on the Theory and Application of Cryptology and Information Security, Hanoi, Vietnam, December 4-8, 2016, Proceedings, Part I 22. Springer,

  • Pp. 63–91.

Costello, Craig, Patrick Longa, and Michael Naehrig (2016). “Efficient Algorithms for Supersingular Isogeny Diffie-Hellman.” In: Advances in Cryptology – CRYPTO 2016: 36th Annual International Cryptology Conference.

  • Ed. by Matthew Robshaw and Jonathan Katz.

Springer Berlin Heidelberg,

  • Pp. 572–601.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 74 / 75

slide-144
SLIDE 144

References VIII

Karmakar, Angshuman, Sujoy Sinha Roy, Frederik Vercauteren, and Ingrid Verbauwhede (2016). “Efficient Finite Field Multiplication for Isogeny Based Post Quantum Cryptography.” In: Proceedings of WAIFI 2016. Faz-Hernández, Armando, Julio López, Eduardo Ochoa-Jiménez, and Francisco Rodríguez-Henríquez (2017). A Faster Sofware Implementation of the Supersingular Isogeny Diffie-Hellman Key Exchange Protocol. Cryptology ePrint Archive, Report 2017/1015. http://eprint.iacr.org/2017/1015.

Luca De Feo (U Paris Saclay) Isogeny graphs in cryptography Mar 19–23, 2018 — Post-Scryptum 75 / 75