SeaSign: Compact isogeny signatures from class group actions Luca De - PowerPoint PPT Presentation

SeaSign: Compact isogeny signatures from class group actions Luca De Feo 1 , Steven D. Galbraith 2 1 Université Paris Saclay – UVSQ, France 2 University of Auckland, New Zeland May 23, 2019, Eurocrypt, Darmstadt Slides online at https://defeo.lu/docet

Post-quantum isogeny primitives CSIDH (Couveignes 1996; Rostovtsev Stolbunov 2006; Castryck, Lange, SIDH (Jao, De Feo 2011) Martindale, Panny, Renes 2018) Pronounce S–I–D–H; Pronounce Sea–Side; Based on random isogeny walks in the Based on random isogeny walks in the full supersingular graph over ❋ p 2 ; ❋ p -restricted supersingular isogeny Basis for the NIST KEM candidate graph; SIKE; Straightforward generalization of Better asymptotic quantum security; Diffie–Hellman; Short keys, slow. More “natural” security assumption; Shorter keys, slower. L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 2 / 14

Post-quantum isogeny primitives CSIDH (Couveignes 1996; Rostovtsev Stolbunov 2006; Castryck, Lange, SIDH (Jao, De Feo 2011) Martindale, Panny, Renes 2018) Pronounce S–I–D–H; Pronounce Sea–Side; Based on random isogeny walks in the Based on random isogeny walks in the full supersingular graph over ❋ p 2 ; ❋ p -restricted supersingular isogeny Basis for the NIST KEM candidate graph; SIKE; Straightforward generalization of Better asymptotic quantum security; Diffie–Hellman; Short keys, slow. More “natural” security assumption; Crappy signatures (slow, large). Shorter keys, slower. Not this talk. L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 2 / 14

Post-quantum isogeny primitives CSIDH (Couveignes 1996; Rostovtsev Stolbunov 2006; Castryck, Lange, SIDH (Jao, De Feo 2011) Martindale, Panny, Renes 2018) Pronounce S–I–D–H; Pronounce Sea–Side; Based on random isogeny walks in the Based on random isogeny walks in the full supersingular graph over ❋ p 2 ; ❋ p -restricted supersingular isogeny Basis for the NIST KEM candidate graph; SIKE; Straightforward generalization of Better asymptotic quantum security; Diffie–Hellman; Short keys, slow. More “natural” security assumption; Crappy signatures (slow, large). Shorter keys, slower. Not this talk. Also crappy signatures, but different! This talk. L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 2 / 14

■ ❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ ✷ � What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E 3 E 4 E 2 E 5 E 1 E 6 E 12 E 7 E 11 E 8 E 10 E 9 L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

■ ❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ ✷ What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E 3 A group action by an abelian group G ; E 4 E 2 g E 5 E 1 E 6 E 12 g � 1 E 7 E 11 E 8 E 10 E 9 L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ ■ � What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E 3 A group action by an abelian group G ; E 4 E 2 Only efficient to evaluate the action of some small degree generators g ✷ G , e.g.: E 5 E 1 E 6 E 12 E 7 E 11 E 8 E 10 E 9 L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ � What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E 3 A group action by an abelian group G ; E 4 E 2 Only efficient to evaluate the action of some small degree generators g ✷ G , e.g.: E 5 E 1 ■ degree 2, E 6 E 12 E 7 E 11 E 8 E 10 E 9 L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ � What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E 3 A group action by an abelian group G ; E 4 E 2 Only efficient to evaluate the action of some small degree generators g ✷ G , e.g.: E 5 E 1 ■ degree 2, degree 3, E 6 E 12 E 7 E 11 E 8 E 10 E 9 L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ � What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E 3 A group action by an abelian group G ; E 4 E 2 Only efficient to evaluate the action of some small degree generators g ✷ G , e.g.: E 5 E 1 ■ degree 2, degree 3, degree 5, ... E 6 E 12 E 7 E 11 E 8 E 10 E 9 L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ � What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E 3 A group action by an abelian group G ; E 4 E 2 Only efficient to evaluate the action of some small degree generators g ✷ G , e.g.: E 5 E 1 ■ degree 2, degree 3, degree 5, ... Graph structure isomorphic to a Cayley graph; E 6 E 12 E 7 E 11 E 8 E 10 E 9 L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ � What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E 3 A group action by an abelian group G ; E 4 E 2 Only efficient to evaluate the action of some small degree generators g ✷ G , e.g.: E 5 E 1 ■ degree 2, degree 3, degree 5, ... Graph structure isomorphic to a Cayley graph; Good algorithm to do random walks in the graph. E 6 E 12 E 7 E 11 E 8 E 10 E 9 L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

� ❂ ✁ ✁ ✁ ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E 3 A group action by an abelian group G ; E 4 E 2 Only efficient to evaluate the action of some small degree generators g ✷ G , e.g.: E 5 E 1 ■ degree 2, degree 3, degree 5, ... Graph structure isomorphic to a Cayley graph; Good algorithm to do random walks in the graph. E 6 E 12 Key exchange: E 7 E 11 E 8 E 10 E 9 L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

� ❂ ✁ ✁ ✁ ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E A A group action by an abelian group G ; Only efficient to evaluate the action of some small degree generators g ✷ G , e.g.: ■ degree 2, degree 3, degree 5, ... Graph structure isomorphic to a Cayley graph; Good algorithm to do random walks in the graph. Key exchange: Alice picks secret a ❂ g a 2 2 g a 3 3 g a 5 5 ✁ ✁ ✁ , L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

� ❂ ✄ ❂ ✄ ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E A A group action by an abelian group G ; Only efficient to evaluate the action of some small degree generators g ✷ G , e.g.: ■ degree 2, degree 3, degree 5, ... Graph structure isomorphic to a Cayley graph; Good algorithm to do random walks in the graph. E B Key exchange: Alice picks secret a ❂ g a 2 2 g a 3 3 g a 5 5 ✁ ✁ ✁ , Bob picks secret b ❂ g b 2 2 g b 3 3 g b 5 5 ✁ ✁ ✁ , L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

� ❂ ✭ ✮ ✄ ❂ ✄ ❂ ✄ What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E A A group action by an abelian group G ; Only efficient to evaluate the action of some small degree generators g ✷ G , e.g.: ■ degree 2, degree 3, degree 5, ... Graph structure isomorphic to a Cayley graph; Good algorithm to do random walks in the graph. E B Key exchange: Alice picks secret a ❂ g a 2 2 g a 3 3 g a 5 5 ✁ ✁ ✁ , Bob picks secret b ❂ g b 2 2 g b 3 3 g b 5 5 ✁ ✁ ✁ , They exchange E A ❂ a ✄ E 1 and E B ❂ b ✄ E 1 , L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14

� What is CSIDH? A set of supersingular elliptic curves over ❋ p ; E A A group action by an abelian group G ; Only efficient to evaluate the action of some small degree generators g ✷ G , e.g.: ■ degree 2, degree 3, degree 5, ... Graph structure isomorphic to a Cayley graph; Good algorithm to do random walks in the graph. E B Key exchange: Alice picks secret a ❂ g a 2 2 g a 3 3 g a 5 5 ✁ ✁ ✁ , Bob picks secret b ❂ g b 2 2 g b 3 3 g b 5 5 ✁ ✁ ✁ , They exchange E A ❂ a ✄ E 1 and E B ❂ b ✄ E 1 , E AB Shared secret is E AB ❂ ✭ ab ✮ ✄ E 1 ❂ a ✄ E B ❂ b ✄ E A . L. De Feo, S. Galbraith (UVSQ, UniAuckland) SeaSign: isogeny signatures Eurocrypt 2019 — https://defeo.lu/docet 3 / 14