SeaSign: Compact isogeny signatures from class group actions Luca De - - PowerPoint PPT Presentation

▶
seasign compact isogeny signatures from class group
SMART_READER_LITE
LIVE PREVIEW

SeaSign: Compact isogeny signatures from class group actions Luca De - - PowerPoint PPT Presentation

Jun 12, 2023 290 likes •742 views

SeaSign: Compact isogeny signatures from class group actions Luca De Feo 1 , Steven D. Galbraith 2 1 Universit Paris Saclay UVSQ, France 2 University of Auckland, New Zeland May 23, 2019, Eurocrypt, Darmstadt Slides online at

slide-1
SLIDE 1

SeaSign: Compact isogeny signatures from class group actions

Luca De Feo1, Steven D. Galbraith2

1Université Paris Saclay – UVSQ, France 2University of Auckland, New Zeland

May 23, 2019, Eurocrypt, Darmstadt Slides online at https://defeo.lu/docet

slide-2
SLIDE 2

Post-quantum isogeny primitives

SIDH (Jao, De Feo 2011)

Pronounce S–I–D–H; Based on random isogeny walks in the full supersingular graph over ❋p2; Basis for the NIST KEM candidate SIKE; Better asymptotic quantum security; Short keys, slow.

CSIDH (Couveignes 1996; Rostovtsev Stolbunov 2006; Castryck, Lange, Martindale, Panny, Renes 2018)

Pronounce Sea–Side; Based on random isogeny walks in the ❋p-restricted supersingular isogeny graph; Straightforward generalization of Diffie–Hellman; More “natural” security assumption; Shorter keys, slower.

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 2 / 14

slide-3
SLIDE 3

Post-quantum isogeny primitives

SIDH (Jao, De Feo 2011)

Pronounce S–I–D–H; Based on random isogeny walks in the full supersingular graph over ❋p2; Basis for the NIST KEM candidate SIKE; Better asymptotic quantum security; Short keys, slow. Crappy signatures (slow, large). Not this talk.

CSIDH (Couveignes 1996; Rostovtsev Stolbunov 2006; Castryck, Lange, Martindale, Panny, Renes 2018)

Pronounce Sea–Side; Based on random isogeny walks in the ❋p-restricted supersingular isogeny graph; Straightforward generalization of Diffie–Hellman; More “natural” security assumption; Shorter keys, slower.

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 2 / 14

slide-4
SLIDE 4

Post-quantum isogeny primitives

SIDH (Jao, De Feo 2011)

Pronounce S–I–D–H; Based on random isogeny walks in the full supersingular graph over ❋p2; Basis for the NIST KEM candidate SIKE; Better asymptotic quantum security; Short keys, slow. Crappy signatures (slow, large). Not this talk.

CSIDH (Couveignes 1996; Rostovtsev Stolbunov 2006; Castryck, Lange, Martindale, Panny, Renes 2018)

Pronounce Sea–Side; Based on random isogeny walks in the ❋p-restricted supersingular isogeny graph; Straightforward generalization of Diffie–Hellman; More “natural” security assumption; Shorter keys, slower. Also crappy signatures, but different! This talk.

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 2 / 14

slide-5
SLIDE 5

What is CSIDH?

A set of supersingular elliptic curves over ❋p; ✷

■

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

  • E1

E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-6
SLIDE 6

What is CSIDH?

A set of supersingular elliptic curves over ❋p; A group action by an abelian group G; ✷

■

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ g g1 E1 E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-7
SLIDE 7

What is CSIDH?

A set of supersingular elliptic curves over ❋p; A group action by an abelian group G; Only efficient to evaluate the action of some small degree generators g ✷ G, e.g.:

■

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

  • E1

E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-8
SLIDE 8

What is CSIDH?

A set of supersingular elliptic curves over ❋p; A group action by an abelian group G; Only efficient to evaluate the action of some small degree generators g ✷ G, e.g.:

■ degree 2,

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

  • E1

E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-9
SLIDE 9

What is CSIDH?

A set of supersingular elliptic curves over ❋p; A group action by an abelian group G; Only efficient to evaluate the action of some small degree generators g ✷ G, e.g.:

■ degree 2, degree 3,

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

  • E1

E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-10
SLIDE 10

What is CSIDH?

A set of supersingular elliptic curves over ❋p; A group action by an abelian group G; Only efficient to evaluate the action of some small degree generators g ✷ G, e.g.:

■ degree 2, degree 3, degree 5, ...

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

  • E1

E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-11
SLIDE 11

What is CSIDH?

A set of supersingular elliptic curves over ❋p; A group action by an abelian group G; Only efficient to evaluate the action of some small degree generators g ✷ G, e.g.:

■ degree 2, degree 3, degree 5, ...

Graph structure isomorphic to a Cayley graph; ❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

  • E1

E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-12
SLIDE 12

What is CSIDH?

A set of supersingular elliptic curves over ❋p; A group action by an abelian group G; Only efficient to evaluate the action of some small degree generators g ✷ G, e.g.:

■ degree 2, degree 3, degree 5, ...

Graph structure isomorphic to a Cayley graph; Good algorithm to do random walks in the graph. ❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

  • E1

E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-13
SLIDE 13

What is CSIDH?

A set of supersingular elliptic curves over ❋p; A group action by an abelian group G; Only efficient to evaluate the action of some small degree generators g ✷ G, e.g.:

■ degree 2, degree 3, degree 5, ...

Graph structure isomorphic to a Cayley graph; Good algorithm to do random walks in the graph. Key exchange: ❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

  • E1

E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-14
SLIDE 14

What is CSIDH?

A set of supersingular elliptic curves over ❋p; A group action by an abelian group G; Only efficient to evaluate the action of some small degree generators g ✷ G, e.g.:

■ degree 2, degree 3, degree 5, ...

Graph structure isomorphic to a Cayley graph; Good algorithm to do random walks in the graph. Key exchange: Alice picks secret a ❂ ga2

2 ga3 3 ga5 5 ✁ ✁ ✁ ,

❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

  • EA
  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-15
SLIDE 15

What is CSIDH?

A set of supersingular elliptic curves over ❋p; A group action by an abelian group G; Only efficient to evaluate the action of some small degree generators g ✷ G, e.g.:

■ degree 2, degree 3, degree 5, ...

Graph structure isomorphic to a Cayley graph; Good algorithm to do random walks in the graph. Key exchange: Alice picks secret a ❂ ga2

2 ga3 3 ga5 5 ✁ ✁ ✁ ,

Bob picks secret b ❂ gb2

2 gb3 3 gb5 5 ✁ ✁ ✁ ,

❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

  • EA

EB

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-16
SLIDE 16

What is CSIDH?

A set of supersingular elliptic curves over ❋p; A group action by an abelian group G; Only efficient to evaluate the action of some small degree generators g ✷ G, e.g.:

■ degree 2, degree 3, degree 5, ...

Graph structure isomorphic to a Cayley graph; Good algorithm to do random walks in the graph. Key exchange: Alice picks secret a ❂ ga2

2 ga3 3 ga5 5 ✁ ✁ ✁ ,

Bob picks secret b ❂ gb2

2 gb3 3 gb5 5 ✁ ✁ ✁ ,

They exchange EA ❂ a ✄ E1 and EB ❂ b ✄ E1, ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄

  • EA

EB

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-17
SLIDE 17

What is CSIDH?

A set of supersingular elliptic curves over ❋p; A group action by an abelian group G; Only efficient to evaluate the action of some small degree generators g ✷ G, e.g.:

■ degree 2, degree 3, degree 5, ...

Graph structure isomorphic to a Cayley graph; Good algorithm to do random walks in the graph. Key exchange: Alice picks secret a ❂ ga2

2 ga3 3 ga5 5 ✁ ✁ ✁ ,

Bob picks secret b ❂ gb2

2 gb3 3 gb5 5 ✁ ✁ ✁ ,

They exchange EA ❂ a ✄ E1 and EB ❂ b ✄ E1, Shared secret is EAB ❂ ✭ab✮ ✄ E1 ❂ a ✄ EB ❂ b ✄ EA.

  • EA

EB EAB

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

slide-18
SLIDE 18

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; ✷ ❢ ❀ ❣ ❂

  • ✁

♠♦❞ ★ ✭ ✮ ❂ g gs s

  • 1Kids, do not try this at home! Use Schnorr!
  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 4 / 14

slide-19
SLIDE 19

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; Commit to a random element gr; ✷ ❢ ❀ ❣ ❂

  • ✁

♠♦❞ ★ ✭ ✮ ❂ g gs s gr r

  • 1Kids, do not try this at home! Use Schnorr!
  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 4 / 14

slide-20
SLIDE 20

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; Commit to a random element gr; Challenge with bit b ✷ ❢0❀ 1❣; ❂

  • ✁

♠♦❞ ★ ✭ ✮ ❂ g gs s gr r

  • 1Kids, do not try this at home! Use Schnorr!
  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 4 / 14

slide-21
SLIDE 21

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; Commit to a random element gr; Challenge with bit b ✷ ❢0❀ 1❣; Respond with c ❂ r b ✁ s ♠♦❞ ★G; ✭ ✮ ❂ g gs s gr r r s

1Kids, do not try this at home! Use Schnorr!

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 4 / 14

slide-22
SLIDE 22

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; Commit to a random element gr; Challenge with bit b ✷ ❢0❀ 1❣; Respond with c ❂ r b ✁ s ♠♦❞ ★G; Verify that gc✭gs✮b ❂ gr. g gs s gr r r s

1Kids, do not try this at home! Use Schnorr!

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 4 / 14

slide-23
SLIDE 23

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; Commit to a random element gr; Challenge with bit b ✷ ❢0❀ 1❣; Respond with c ❂ r b ✁ s ♠♦❞ ★G; Verify that gc✭gs✮b ❂ gr.

Zero-knowledge

Does not leak because: c is uniformly distributed and independent from s. g gs s gr r r s

1Kids, do not try this at home! Use Schnorr!

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 4 / 14

slide-24
SLIDE 24

A ✝-protocol from Diffie–Hellman1

A key pair ✭s❀ gs✮; Commit to a random element gr; Challenge with bit b ✷ ❢0❀ 1❣; Respond with c ❂ r b ✁ s ♠♦❞ ★G; Verify that gc✭gs✮b ❂ gr.

Zero-knowledge

Does not leak because: c is uniformly distributed and independent from s. Unlike Schnorr, compatible with group action Diffie–Hellman. E1 Es gs Er gr grs

1Kids, do not try this at home! Use Schnorr!

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 4 / 14

slide-25
SLIDE 25

The trouble with groups of unknown structure

In CSIDH secrets look like: g⑦

s ❂ gs2 2 gs3 3 gs5 5 ✁ ✁ ✁

the elements gi are fixed, the secret is the exponent vector ⑦ s ❂ ✭s2❀ s3❀ ✿ ✿ ✿ ✮ ✷ ❬B❀ B❪n, secrets must be sampled in a box ❬B❀ B❪n “large enough”... ⑦❀⑦

✩

✥ ❬ ❀ ❪ ⑦ ⑦ ⑦ ✰B B

  • ✰B

B

❂

✰

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 5 / 14

slide-26
SLIDE 26

The trouble with groups of unknown structure

In CSIDH secrets look like: g⑦

s ❂ gs2 2 gs3 3 gs5 5 ✁ ✁ ✁

the elements gi are fixed, the secret is the exponent vector ⑦ s ❂ ✭s2❀ s3❀ ✿ ✿ ✿ ✮ ✷ ❬B❀ B❪n, secrets must be sampled in a box ❬B❀ B❪n “large enough”...

The leakage

With⑦ s❀⑦ r

✩

✥ ❬B❀ B❪n, the distribution of ⑦ r ⑦ s depends on the long term secret⑦ s! ✰B B

  • ✰B

B

❂

✰B B

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 5 / 14

slide-27
SLIDE 27

The two fixes

Compute the group structure and stop whining

Already suggested by Couveignes (1996) and Rostovtsev–Stolbunov (2006). Computationally intensive (subexponential parameter generation). Technically not post-quantum (rather, post-post-quantum). Done last week by Beullens, Kleinjung and Vercauteren: CSI-FiSh (eprint:2019/498). Decent parameters, e.g.: 263 bytes, 390 ms, @NIST-1. Not this work.

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 6 / 14

slide-28
SLIDE 28

The two fixes

Compute the group structure and stop whining

Already suggested by Couveignes (1996) and Rostovtsev–Stolbunov (2006). Computationally intensive (subexponential parameter generation). Technically not post-quantum (rather, post-post-quantum). Done last week by Beullens, Kleinjung and Vercauteren: CSI-FiSh (eprint:2019/498). Decent parameters, e.g.: 263 bytes, 390 ms, @NIST-1. Not this work.

Do like the lattice people

Use Fiat–Shamir with aborts (Lyubashevsky 2009). Huge increase in signature size and time. Compromise signature size/time with public key size. This work.

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 6 / 14

slide-29
SLIDE 29

Rejection sampling

Sample long term secret⑦ s in the usual box ❬B❀ B❪n, Sample ephemeral ⑦ r in a larger box ❬✭✍ ✰ 1✮B❀ ✭✍ ✰ 1✮B❪n, Throw away ⑦ r ⑦ s if it is out of the box ❬✍B❀ ✍B❪n.

Zero-knowledge

Theorem: ⑦ r ⑦ s is uniformly distributed in ❬✍B❀ ✍B❪n. Problem: set ✍ so that rejection probability is low. ✰✭✍ ✰ 1✮B ✭✍ ✰ 1✮B

  • ✰B

B

❂

✰✍B ✍B

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 7 / 14

slide-30
SLIDE 30

Performance

For ✕-bit security, protocol must be repeated ✕ times in parallel; ✍ ❂ ✕n for a rejection probability ✔ 1❂3; Signature size ✙ ✕n coefficients ✷ ❬✍B❀ ✍B❪; Sign/verify time linear in ❦⑦ r ⑦ s❦✶ ✙ ✕2n2B.

CSIDH instantiation (NIST-1)

Parameters: ✕ ❂ 128❀ n ❂ 74❀ B ❂ 5; PK size: 64 B SK size: 32 B Signature: 20 KiB Verify time: 10 hours Sign time: 3✂ verify

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 8 / 14

slide-31
SLIDE 31

Key/signature size compromise

One key pair ✭⑦ s❀ Es✮; Challenge b ✷ ❢0❀ 1❣; Reveal ⑦ r b⑦ s; ✦ ✕ iterations; ✦

✩

✥ ❬✕ ❀ ✕ ❪ ✭⑦ ❀ ✮ ✷ ❢ ❀ ❣ ⑦ ⑦ ✦ ✕❂ ✦

✩

✥ ❬✕ ❂ ❀ ✕ ❂ ❪ E1 Es

⑦ s ⑦ ⑦ ⑦ ⑦

Er

⑦ r ⑦ ⑦

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 9 / 14

slide-32
SLIDE 32

Key/signature size compromise

One key pair ✭⑦ s❀ Es✮; Challenge b ✷ ❢0❀ 1❣; Reveal ⑦ r b⑦ s; ✦ ✕ iterations; ✦

✩

✥ ❬✕ ❀ ✕ ❪

Compromise: t-bit challenges

2t key pairs ✭⑦ si❀ Ei✮; Challenge b ✷ ❢0❀ 2t❣; Reveal ⑦ r ⑦ sb; ✦ ✕❂t iterations; ✦

✩

✥ ❬✕ ❂ ❀ ✕ ❂ ❪ E1

⑦

E1

⑦ s1

E2

⑦ s2

E3

⑦ s3

E4

⑦ s4

Er

⑦ r ⑦ r ⑦ s2

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 9 / 14

slide-33
SLIDE 33

Key/signature size compromise

One key pair ✭⑦ s❀ Es✮; Challenge b ✷ ❢0❀ 1❣; Reveal ⑦ r b⑦ s; ✦ ✕ iterations; ✦ Sample r

✩

✥ ❬✕nB❀ ✕nB❪.

Compromise: t-bit challenges

2t key pairs ✭⑦ si❀ Ei✮; Challenge b ✷ ❢0❀ 2t❣; Reveal ⑦ r ⑦ sb; ✦ ✕❂t iterations; ✦

✩

✥ ❬✕ ❂ ❀ ✕ ❂ ❪ E1

⑦

E1

⑦ s1

E2

⑦ s2

E3

⑦ s3

E4

⑦ s4

Er

⑦ r ⑦ r ⑦ s2

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 9 / 14

slide-34
SLIDE 34

Key/signature size compromise

One key pair ✭⑦ s❀ Es✮; Challenge b ✷ ❢0❀ 1❣; Reveal ⑦ r b⑦ s; ✦ ✕ iterations; ✦ Sample r

✩

✥ ❬✕nB❀ ✕nB❪.

Compromise: t-bit challenges

2t key pairs ✭⑦ si❀ Ei✮; Challenge b ✷ ❢0❀ 2t❣; Reveal ⑦ r ⑦ sb; ✦ ✕❂t iterations; ✦ Sample r

✩

✥ ❬✕nB❂t❀ ✕nB❂t❪. E1

⑦

E1

⑦ s1

E2

⑦ s2

E3

⑦ s3

E4

⑦ s4

Er

⑦ r ⑦ r ⑦ s2

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 9 / 14

slide-35
SLIDE 35

Public key compression

E1 E1 ✭ ✮ E2 ✭ ✮ E3 ✭ ✮ E4 ✭ ✮ ✭✎❀ ✎✮ ✭✎❀ ✎✮ ✭✎❀ ✎✮ ❂

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 10 / 14

slide-36
SLIDE 36

Public key compression

E1 E1 H✭E1✮ E2 H✭E2✮ E3 H✭E3✮ E4 H✭E4✮ H✭✎❀ ✎✮ H✭✎❀ ✎✮ H✭✎❀ ✎✮ ❂ pk Construct Merkle tree on top of public keys, root is the new public key;

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 10 / 14

slide-37
SLIDE 37

Public key compression

E1 E1 H✭E1✮ E2 H✭E2✮ E3 H✭E3✮ E4 H✭E4✮ H✭✎❀ ✎✮ H✭✎❀ ✎✮ H✭✎❀ ✎✮ ❂ pk Construct Merkle tree on top of public keys, root is the new public key; Include Merkle proof in the signature.

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 10 / 14

slide-38
SLIDE 38

Performance

t ❂ 1 bit challenges t ❂ 16 bits challenges PK compression Sig size 20 KiB 978 B 3136 B PK size 64 B 4 MiB 32 B SK size 32 B 16 B 1 MiB

  • Est. keygen time

30 ms 30 mins 30 mins

  • Est. sign time

30 hours 6 mins 6 mins

  • Est. verify time

10 hours 2 mins 2 mins Asymptotic sig size O✭✕2 ❧♦❣✭✕✮✮ O✭✕t ❧♦❣✭✕✮✮ O✭✕2t✮

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 11 / 14

slide-39
SLIDE 39

Performance

t ❂ 1 bit challenges t ❂ 16 bits challenges PK compression Sig size 20 KiB 978 B 3136 B PK size 64 B 4 MiB 32 B SK size 32 B 16 B 1 MiB

  • Est. keygen time

30 ms 30 mins 30 mins

  • Est. sign time

30 hours 6 mins 6 mins

  • Est. verify time

10 hours 2 mins 2 mins Asymptotic sig size O✭✕2 ❧♦❣✭✕✮✮ O✭✕t ❧♦❣✭✕✮✮ O✭✕2t✮ Recent speed/size compromises by Decru, Panny and Vercauteren Sig size 36 KiB 2 KiB —

  • Est. sign time

30 mins 80 s —

  • Est. verify time

20 mins 20 s —

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 11 / 14

slide-40
SLIDE 40

Security proofs

Standard proofs using forking lemma

ROM only, non tight; Secret key space ★❬B❀ B❪n ✢

♣★❋p to (heuristically) cover all the isogeny graph, but:

■ Public keys not uniformly sampled ✮ problematic random-self reduction; ■ Only managed to reduce to a one-out-of-22t isogeny walk problem.

★❬ ❀ ❪ ✜

♣★❋

■ ■

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 12 / 14

slide-41
SLIDE 41

Security proofs

Standard proofs using forking lemma

ROM only, non tight; Secret key space ★❬B❀ B❪n ✢

♣★❋p to (heuristically) cover all the isogeny graph, but:

■ Public keys not uniformly sampled ✮ problematic random-self reduction; ■ Only managed to reduce to a one-out-of-22t isogeny walk problem.

Alternative proofs based on lossy keys (Kiltz, Lyubashevsky and Schaffner 2018)

ROM, QROM, tight! Requires ★❬B❀ B❪n ✜

♣★❋p:

■ Public keys cover a small fraction of the isogeny graph; ■ Asymptotically natural choice for quantum security;

Additional assumption on indistinguishability of public keys.

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 12 / 14

slide-42
SLIDE 42

Take home ✭msg❀ ✛✮

By combining ideas from isogeny + lattice + hash based signatures, we give work to all cryptanalysts in this room. Post-quantum isogeny signatures are still far from practical. Post-post-quantum isogeny signatures look more realistic, you can start using them now if you are an isogeny hippie. Tons of open questions on classical and quantum security, and proofs. The isogenista dream: a one-pass post-quantum signature scheme based on walks in isogeny graphs.

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 13 / 14

slide-43
SLIDE 43

Thank you

https://defeo.lu/ @luca_defeo

  • L. De Feo, S. Galbraith (UVSQ, UniAuckland)

SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 14 / 14