Security on the Line: Modern Curve-based Cryptography Joost Renes - - PowerPoint PPT Presentation

▶
security on the line modern curve based cryptography
SMART_READER_LITE
LIVE PREVIEW

Security on the Line: Modern Curve-based Cryptography Joost Renes - - PowerPoint PPT Presentation

Sep 16, 2022 404 likes •1.4k views

Security on the Line: Modern Curve-based Cryptography Joost Renes SCA Workshop 18 June 2019 Modern curve-based cryptography Modern curve-based cryptography 1 / 11 Modern curve-based cryptography Internet of Things Size & speed

slide-1
SLIDE 1

Security on the Line: Modern Curve-based Cryptography

Joost Renes

SCA Workshop

18 June 2019

slide-2
SLIDE 2

Modern curve-based cryptography

“Modern” curve-based cryptography

1 / 11

slide-3
SLIDE 3

Modern curve-based cryptography

“Modern” curve-based cryptography Internet of Things Genus 2 Size & speed Kummer varieties ...

1 / 11

slide-4
SLIDE 4

Modern curve-based cryptography

“Modern” curve-based cryptography Internet of Things Genus 2 Size & speed Kummer varieties ... Classical setting (Ben Smith’s talk)

1 / 11

slide-5
SLIDE 5

Modern curve-based cryptography

“Modern” curve-based cryptography Internet of Things Genus 2 Size & speed Kummer varieties ... Classical setting (Ben Smith’s talk) Isogeny-based cryptography

1 / 11

slide-6
SLIDE 6

Elliptic curves in cryptography

Discrete-log-based elliptic-curve cryptography [Mil86; Kob87]

2 / 11

slide-7
SLIDE 7

Elliptic curves in cryptography

Discrete-log-based elliptic-curve cryptography [Mil86; Kob87] Ordinary isogeny-based group actions [Cou06; RS06; DKS18]

2 / 11

slide-8
SLIDE 8

Elliptic curves in cryptography

Discrete-log-based elliptic-curve cryptography [Mil86; Kob87] Ordinary isogeny-based group actions [Cou06; RS06; DKS18] Supersingular isogeny-based cryptography / Fp2 [CLG09; JF11]

2 / 11

slide-9
SLIDE 9

Elliptic curves in cryptography

Discrete-log-based elliptic-curve cryptography [Mil86; Kob87] Ordinary isogeny-based group actions [Cou06; RS06; DKS18] Supersingular isogeny-based cryptography / Fp2 [CLG09; JF11] Supersingular isogeny-based group actions / Fp [Cas+18]

2 / 11

slide-10
SLIDE 10

Elliptic curves & isogenies (1)

Fixed: prime p Ea,b : y2 = x3 + ax + b

3 / 11

slide-11
SLIDE 11

Elliptic curves & isogenies (1)

Fixed: prime p Ea,b : y2 = x3 + ax + b Ec,d : y2 = x3 + cx + d

3 / 11

slide-12
SLIDE 12

Elliptic curves & isogenies (1)

Fixed: prime p Ea,b : y2 = x3 + ax + b Ec,d : y2 = x3 + cx + d          isogeny x → f(x)/g(x), y → . . .

3 / 11

slide-13
SLIDE 13

Elliptic curves & isogenies (1)

Fixed: prime p Ea,b : y2 = x3 + ax + b Ec,d : y2 = x3 + cx + d          ℓ-isogeny x → f(x)/g(x), y → . . . with deg(f) = ℓ and deg(g) = ℓ − 1

3 / 11

slide-14
SLIDE 14

Elliptic curves & isogenies (1)

Fixed: prime p Ea,b : y2 = x3 + ax + b Ec,d : y2 = x3 + cx + d          1-isogeny x → f(x)/g(x), y → . . . with deg(f) = 1 and deg(g) = 0

3 / 11

slide-15
SLIDE 15

Elliptic curves & isogenies (1)

Fixed: prime p Ea,b : y2 = x3 + ax + b Ec,d : y2 = x3 + cx + d          2-isogeny x → f(x)/g(x), y → . . . with deg(f) = 2 and deg(g) = 1

3 / 11

slide-16
SLIDE 16

Elliptic curves & isogenies (1)

Fixed: prime p Ea,b : y2 = x3 + ax + b Ec,d : y2 = x3 + cx + d          3-isogeny x → f(x)/g(x), y → . . . with deg(f) = 3 and deg(g) = 2

3 / 11

slide-17
SLIDE 17

Elliptic curves & isogenies (1)

Fixed: prime p Ea,b : y2 = x3 + ax + b Ec,d : y2 = x3 + cx + d          5-isogeny x → f(x)/g(x), y → . . . with deg(f) = 5 and deg(g) = 4

3 / 11

slide-18
SLIDE 18

Elliptic curves & isogenies (1)

Fixed: prime p Ea,b : y2 = x3 + ax + b Ec,d : y2 = x3 + cx + d          7-isogeny x → f(x)/g(x), y → . . . with deg(f) = 7 and deg(g) = 6

3 / 11

slide-19
SLIDE 19

Elliptic curves & isogenies (1)

Fixed: prime p Ea,b : y2 = x3 + ax + b Ec,d : y2 = x3 + cx + d          11-isogeny x → f(x)/g(x), y → . . . with deg(f) = 11 and deg(g) = 10

3 / 11

slide-20
SLIDE 20

Elliptic curves & isogenies (1)

Fixed: prime p Ea,b : y2 = x3 + ax + b Ec,d : y2 = x3 + cx + d          13-isogeny x → f(x)/g(x), y → . . . with deg(f) = 13 and deg(g) = 12

3 / 11

slide-21
SLIDE 21

Elliptic curves & isogenies (1)

Fixed: prime p , EndFp(Ea,b) = OQ(π)

3 / 11

slide-22
SLIDE 22

Elliptic curves & isogenies (1)

Fixed: prime p , EndFp(Ea,b) = OQ(π) , ℓ = 2

3 / 11

slide-23
SLIDE 23

Elliptic curves & isogenies (1)

Fixed: prime p , EndFp(Ea,b) = OQ(π) , ℓ = 2

3 / 11

slide-24
SLIDE 24

Elliptic curves & isogenies (1)

Fixed: prime p , EndFp(Ea,b) = OQ(π) , ℓ = 2

3 / 11

slide-25
SLIDE 25

Elliptic curves & isogenies (1)

Fixed: prime p , EndFp(Ea,b) = OQ(π) , ℓ = 3

3 / 11

slide-26
SLIDE 26

Elliptic curves & isogenies (1)

Fixed: prime p , EndFp(Ea,b) = OQ(π) , ℓ = 5

3 / 11

slide-27
SLIDE 27

Elliptic curves & isogenies (1)

Fixed: prime p , EndFp(Ea,b) = OQ(π) , ℓ = 7

3 / 11

slide-28
SLIDE 28

Elliptic curves & isogenies (1)

Fixed: prime p , EndFp(Ea,b) = OQ(π) , ℓ = 11

3 / 11

slide-29
SLIDE 29

Elliptic curves & isogenies (1)

Fixed: prime p , EndFp(Ea,b) = OQ(π) , ℓ = 13

3 / 11

slide-30
SLIDE 30

Elliptic curves & isogenies (2)

2

4 / 11

slide-31
SLIDE 31

Elliptic curves & isogenies (2)

2

4 / 11

slide-32
SLIDE 32

Elliptic curves & isogenies (2)

2

4 / 11

slide-33
SLIDE 33

Elliptic curves & isogenies (2)

2

4 / 11

slide-34
SLIDE 34

Elliptic curves & isogenies (2)

2

4 / 11

slide-35
SLIDE 35

Elliptic curves & isogenies (2)

3

4 / 11

slide-36
SLIDE 36

Elliptic curves & isogenies (2)

3

4 / 11

slide-37
SLIDE 37

Elliptic curves & isogenies (2)

3

4 / 11

slide-38
SLIDE 38

Elliptic curves & isogenies (2)

3

4 / 11

slide-39
SLIDE 39

Elliptic curves & isogenies (2)

3

4 / 11

slide-40
SLIDE 40

Elliptic curves & isogenies (2)

5

4 / 11

slide-41
SLIDE 41

Elliptic curves & isogenies (2)

7

4 / 11

slide-42
SLIDE 42

Isogeny volcanoes

2 3 5 7 11 13

5 / 11

slide-43
SLIDE 43

Isogeny-based cryptography (1)

2

6 / 11

slide-44
SLIDE 44

Isogeny-based cryptography (1)

2

6 / 11

slide-45
SLIDE 45

Isogeny-based cryptography (1)

3

6 / 11

slide-46
SLIDE 46

Isogeny-based cryptography (1)

3

6 / 11

slide-47
SLIDE 47

Isogeny-based cryptography (1)

5

6 / 11

slide-48
SLIDE 48

Isogeny-based cryptography (1)

5

6 / 11

slide-49
SLIDE 49

Isogeny-based cryptography (1)

2 3 5 7 11 13

6 / 11

slide-50
SLIDE 50

Isogeny-based cryptography (1)

6 / 11

slide-51
SLIDE 51

Isogeny-based cryptography (1)

# primes: 1 Work (per prime): ≤ t Work (total): ≤ t Entropy: t

6 / 11

slide-52
SLIDE 52

Isogeny-based cryptography (1)

# primes: 1 Work (per prime): ≤ t Work (total): ≤ t Entropy: t

6 / 11

slide-53
SLIDE 53

Isogeny-based cryptography (1)

# primes: 1 Work (per prime): ≤ t Work (total): ≤ t Entropy: t

6 / 11

slide-54
SLIDE 54

Isogeny-based cryptography (1)

# primes: 2 Work (per prime): ≤ t Work (total): ≤ 2 · t Entropy: t2

6 / 11

slide-55
SLIDE 55

Isogeny-based cryptography (1)

# primes: 3 Work (per prime): ≤ t Work (total): ≤ 3 · t Entropy: t3

6 / 11

slide-56
SLIDE 56

Isogeny-based cryptography (1)

# primes: 4 Work (per prime): ≤ t Work (total): ≤ 4 · t Entropy: t4

6 / 11

slide-57
SLIDE 57

Isogeny-based cryptography (1)

# primes: 5 Work (per prime): ≤ t Work (total): ≤ 5 · t Entropy: t5

6 / 11

slide-58
SLIDE 58

Isogeny-based cryptography (1)

# primes: 6 Work (per prime): ≤ t Work (total): ≤ 6 · t Entropy: t6

6 / 11

slide-59
SLIDE 59

Isogeny-based cryptography (1)

# primes: L Work (per prime): ≤ t Work (total): ≤ L · t Entropy: tL

6 / 11

slide-60
SLIDE 60

OIDH & CSIDH

Two different ways to instantiate;

  • 1. Ordinary isogeny Diffie–Hellman (OIDH)
  • 2. Supersingular isogeny Diffie–Hellman (CSIDH)

The idea for OIDH first by Couveignes in ’96 [Cou06] = ⇒ Post-quantum security with very small keys [DKS18] = ⇒ CSIDH almost identical but easier to instantiate [Cas+18]

7 / 11

slide-61
SLIDE 61

State of CSIDH

(∼ NIST level I security)

  • 1. CSIDH key exchange

◮ Non-interactive with 64-byte public keys ◮ ∼ 80 ms for full exchange (not constant-time)

8 / 11

slide-62
SLIDE 62

State of CSIDH

(∼ NIST level I security)

  • 1. CSIDH key exchange

◮ Non-interactive with 64-byte public keys ◮ ∼ 80 ms for full exchange (not constant-time)

  • 2. Constant-time implementations [MCR18] (at ∼ 246 ms)

8 / 11

slide-63
SLIDE 63

State of CSIDH

(∼ NIST level I security)

  • 1. CSIDH key exchange

◮ Non-interactive with 64-byte public keys ◮ ∼ 80 ms for full exchange (not constant-time)

  • 2. Constant-time implementations [MCR18] (at ∼ 246 ms)
  • 3. SeaSign signatures [DG19] large and/or slow

8 / 11

slide-64
SLIDE 64

State of CSIDH

(∼ NIST level I security)

  • 1. CSIDH key exchange

◮ Non-interactive with 64-byte public keys ◮ ∼ 80 ms for full exchange (not constant-time)

  • 2. Constant-time implementations [MCR18] (at ∼ 246 ms)
  • 3. SeaSign signatures [DG19] large and/or slow
  • 4. CSI-FiSh signatures [BKV19] smaller and faster (small p)

8 / 11

slide-65
SLIDE 65

State of CSIDH

(∼ NIST level I security)

  • 1. CSIDH key exchange

◮ Non-interactive with 64-byte public keys ◮ ∼ 80 ms for full exchange (not constant-time)

  • 2. Constant-time implementations [MCR18] (at ∼ 246 ms)
  • 3. SeaSign signatures [DG19] large and/or slow
  • 4. CSI-FiSh signatures [BKV19] smaller and faster (small p)
  • 5. Bunch of cryptanalysis [BS18; Ber+19]

◮ Quantum subexponential attacks!

8 / 11

slide-66
SLIDE 66

State of CSIDH

(∼ NIST level I security)

  • 1. CSIDH key exchange

◮ Non-interactive with 64-byte public keys ◮ ∼ 80 ms for full exchange (not constant-time)

  • 2. Constant-time implementations [MCR18] (at ∼ 246 ms)
  • 3. SeaSign signatures [DG19] large and/or slow
  • 4. CSI-FiSh signatures [BKV19] smaller and faster (small p)
  • 5. Bunch of cryptanalysis [BS18; Ber+19]

◮ Quantum subexponential attacks!

Lots of stuff coming out!

8 / 11

slide-67
SLIDE 67

Isogeny-based cryptography (2)

2

9 / 11

slide-68
SLIDE 68

Isogeny-based cryptography (2)

2

9 / 11

slide-69
SLIDE 69

Isogeny-based cryptography (2)

9 / 11

slide-70
SLIDE 70

Isogeny-based cryptography (2)

2

# primes: 1 (ℓ = 2) Work (per prime): 1 Work (total): 1 Entropy: 3

9 / 11

slide-71
SLIDE 71

Isogeny-based cryptography (2)

2

# primes: 1 (ℓ = 2) Work (per prime): 2 Work (total): 2 Entropy: 3 · 2

9 / 11

slide-72
SLIDE 72

Isogeny-based cryptography (2)

2

# primes: 1 (ℓ = 2) Work (per prime): 3 Work (total): 3 Entropy: 3 · 22

9 / 11

slide-73
SLIDE 73

Isogeny-based cryptography (2)

2

# primes: 1 (ℓ = 2) Work (per prime): 4 Work (total): 4 Entropy: 3 · 23

9 / 11

slide-74
SLIDE 74

Isogeny-based cryptography (2)

2

# primes: 1 (ℓ = 2) Work (per prime): 5 Work (total): 5 Entropy: 3 · 24

9 / 11

slide-75
SLIDE 75

Isogeny-based cryptography (2)

3

# primes: 1 (ℓ = 3) Work (per prime): 1 Work (total): 1 Entropy: 4

9 / 11

slide-76
SLIDE 76

Isogeny-based cryptography (2)

3

# primes: 1 (ℓ = 3) Work (per prime): 2 Work (total): 2 Entropy: 4 · 3

9 / 11

slide-77
SLIDE 77

Isogeny-based cryptography (2)

3

# primes: 1 (ℓ = 3) Work (per prime): 3 Work (total): 3 Entropy: 4 · 32

9 / 11

slide-78
SLIDE 78

Isogeny-based cryptography (2)

3

# primes: 1 (ℓ = 3) Work (per prime): 4 Work (total): 4 Entropy: 4 · 33

9 / 11

slide-79
SLIDE 79

Isogeny-based cryptography (2)

3

# primes: 1 (ℓ = 3) Work (per prime): 5 Work (total): 5 Entropy: 4 · 34

9 / 11

slide-80
SLIDE 80

Isogeny-based cryptography (2)

5

# primes: 1 (ℓ = 5) Work (per prime): 1 Work (total): 1 Entropy: 5

9 / 11

slide-81
SLIDE 81

Isogeny-based cryptography (2)

5

# primes: 1 (ℓ = 5) Work (per prime): 2 Work (total): 2 Entropy: 6 · 5

9 / 11

slide-82
SLIDE 82

Isogeny-based cryptography (2)

5

# primes: 1 (ℓ = 5) Work (per prime): 3 Work (total): 3 Entropy: 6 · 52

9 / 11

slide-83
SLIDE 83

Isogeny-based cryptography (2)

# primes: 1 Work (per prime): t Work (total): t Entropy: ∼ ℓt

9 / 11

slide-84
SLIDE 84

Isogeny-based cryptography (2)

Alice:

2

Bob:

3

9 / 11

slide-85
SLIDE 85

Isogeny-based cryptography (2)

Alice:

2

Bob:

5

9 / 11

slide-86
SLIDE 86

Isogeny-based cryptography (2)

Alice:

7

Bob:

5

9 / 11

slide-87
SLIDE 87

State of SIDH / SIKE

(NIST level I security)

  • 1. SIKE key encapsulation [Jao+]

◮ ∼ 330-byte public keys / ciphertexts ◮ ∼ 6.3 ms for enc + dec (constant-time)

(Recall CSIDH has 64-byte pk and ∼ 246 ms exchange)

10 / 11

slide-88
SLIDE 88

State of SIDH / SIKE

(NIST level I security)

  • 1. SIKE key encapsulation [Jao+]

◮ ∼ 330-byte public keys / ciphertexts ◮ ∼ 6.3 ms for enc + dec (constant-time)

(Recall CSIDH has 64-byte pk and ∼ 246 ms exchange)

  • 2. Public-key compression [Aza+16; Cos+17; Zan+18; NR19]

◮ ∼ 200-byte public keys / ciphertexts ◮ ∼ 9.5 ms for enc + dec (constant-time)

10 / 11

slide-89
SLIDE 89

State of SIDH / SIKE

(NIST level I security)

  • 1. SIKE key encapsulation [Jao+]

◮ ∼ 330-byte public keys / ciphertexts ◮ ∼ 6.3 ms for enc + dec (constant-time)

(Recall CSIDH has 64-byte pk and ∼ 246 ms exchange)

  • 2. Public-key compression [Aza+16; Cos+17; Zan+18; NR19]

◮ ∼ 200-byte public keys / ciphertexts ◮ ∼ 9.5 ms for enc + dec (constant-time)

  • 3. Signatures large and slow [Yoo+17; GPS17]

10 / 11

slide-90
SLIDE 90

Thanks!

2 3 5 7 11 13

Questions?

11 / 11

slide-91
SLIDE 91

References I

[Aza+16] Reza Azarderakhsh, David Jao, Kassem Kalach, Brian Koziel and Christopher Leonardi. ‘Key Compression for Isogeny-Based Cryptosystems’. In: Proceedings of the 3rd ACM International Workshop on ASIA Public-Key Cryptography, AsiaPKC@AsiaCCS, Xi’an, China, May 30 - June 03, 2016. Ed. by Keita Emura, Goichiro Hanaoka and Rui Zhang. ACM, 2016, pp. 1–10. DOI: 10.1145/2898420.2898421. URL: http://doi.acm.org/10.1145/2898420.2898421. [Ber+19] Daniel J. Bernstein, Tanja Lange, Chloe Martindale and Lorenz Panny. ‘Quantum Circuits for the CSIDH: Optimizing Quantum Evaluation of Isogenies’. In: Advances in Cryptology – EUROCRYPT 2019. Ed. by Yuval Ishai and Vincent Rijmen. Cham: Springer International Publishing, 2019, pp. 409–441.

ISBN: 978-3-030-17656-3. DOI: 10.1007/978-3-030-17656-3_15.

[BKV19] Ward Beullens, Thorsten Kleinjung and Frederik Vercauteren. CSI-FiSh: Efficient Isogeny based Signatures through Class Group

  • Computations. Cryptology ePrint Archive, Report 2019/498.

https://eprint.iacr.org/2019/498. 2019.

12 / 11

slide-92
SLIDE 92

References II

[BS18] Xavier Bonnetain and André Schrottenloher. Quantum Security Analysis of CSIDH and Ordinary Isogeny-based Schemes. IACR Cryptology ePrint Archive 2018/537, version 20180621:135910. https://eprint.iacr.org/2018/537/20180621:135910. 2018. [Cas+18] Wouter Castryck, Tanja Lange, Chloe Martindale, Lorenz Panny and Joost Renes. ‘CSIDH: An Efficient Post-Quantum Commutative Group Action’. In: Advances in Cryptology – ASIACRYPT 2018. Ed. by Thomas Peyrin and Steven Galbraith. Cham: Springer International Publishing, 2018, pp. 395–427.

ISBN: 978-3-030-03332-3.

[CLG09] Denis X. Charles, Kristin E. Lauter and Eyal Z. Goren. ‘Cryptographic Hash Functions from Expander Graphs’. In: Journal of Cryptology 22.1 (2009), pp. 93–113. ISSN: 1432-1378. DOI: 10.1007/s00145-007-9002-x. URL: https://doi.org/10.1007/s00145-007-9002-x.

13 / 11

slide-93
SLIDE 93

References III

[Cos+17] Craig Costello, David Jao, Patrick Longa, Michael Naehrig, Joost Renes and David Urbanik. ‘Efficient Compression of SIDH Public Keys’. In: Advances in Cryptology – EUROCRYPT 2017.

  • Ed. by Jean-Sébastien Coron and Jesper Buus Nielsen. Cham:

Springer International Publishing, 2017, pp. 679–706. ISBN: 978-3-319-56620-7. [Cou06] Jean-Marc Couveignes. Hard Homogeneous Spaces. IACR Cryptology ePrint Archive 2006/291 https://ia.cr/2006/291. 2006. [DG19] Luca De Feo and Steven D. Galbraith. ‘SeaSign: Compact Isogeny Signatures from Class Group Actions’. In: Advances in Cryptology – EUROCRYPT 2019. Ed. by Yuval Ishai and Vincent Rijmen. Cham: Springer International Publishing, 2019, pp. 759–789.

ISBN: 978-3-030-17659-4. DOI: 10.1007/978-3-030-17659-4_26.

14 / 11

slide-94
SLIDE 94

References IV

[DKS18] Luca De Feo, Jean Kieffer and Benjamin Smith. ‘Towards Practical Key Exchange from Ordinary Isogeny Graphs’. In: Advances in Cryptology – ASIACRYPT 2018. Ed. by Thomas Peyrin and Steven Galbraith. Cham: Springer International Publishing, 2018, pp. 365–394. ISBN: 978-3-030-03332-3. DOI: 10.1007/978-3-030-03332-3_14. [GPS17] Steven D. Galbraith, Christophe Petit and Javier Silva. ‘Identification Protocols and Signature Schemes Based on Supersingular Isogeny Problems’. In: Advances in Cryptology – ASIACRYPT 2017. Ed. by Tsuyoshi Takagi and Thomas Peyrin. Cham: Springer International Publishing, 2017, pp. 3–33. ISBN: 978-3-319-70694-8. DOI: 10.1007/978-3-319-70694-8_1. [Jao+] David Jao, Reza Azarderakhsh, Matthew Campagna, Craig Costello, Luca De Feo, Basil Hess, Amir Jalali, Brian Koziel, Brian LaMacchia, Patrick Longa, Michael Naehrig, Joost Renes, Vladimir Soukharev and David Urbanik. SIKE. Supersingular Isogeny Key Encapsulation. Submission to [nistpqc]. http://sike.org.

15 / 11

slide-95
SLIDE 95

References V

[JF11] David Jao and Luca De Feo. ‘Towards Quantum-Resistant Cryptosystems from Supersingular Elliptic Curve Isogenies’. In: Post-Quantum Cryptography - 4th International Workshop, PQCrypto 2011, Taipei, Taiwan, November 29 - December 2, 2011. Proceedings. 2011, pp. 19–34. DOI: 10.1007/978-3-642-25405-5_2. URL: http://dx.doi.org/10.1007/978-3-642-25405-5_2. [Kob87] Neal Koblitz. ‘Elliptic curve cryptosystems’. In: Mathematics of Computation 48 (1987), pp. 203–209. DOI: 10.1090/S0025-5718-1987-0866109-5. [MCR18] Michael Meyer, Fabio Campos and Steffen Reith. On Lions and Elligators: An efficient constant-time implementation of CSIDH. Cryptology ePrint Archive, Report 2018/1198. https://eprint.iacr.org/2018/1198. 2018. [Mil86] Victor S. Miller. ‘Use of Elliptic Curves in Cryptography’. In: Advances in Cryptology — CRYPTO ’85 Proceedings. Ed. by Hugh C. Williams. Berlin, Heidelberg: Springer Berlin Heidelberg, 1986, pp. 417–426. ISBN: 978-3-540-39799-1. DOI: 10.1007/3-540-39799-X_31.

16 / 11

slide-96
SLIDE 96

References VI

[NR19] Michael Naehrig and Joost Renes. Dual Isogenies and Their Application to Public-key Compression for Isogeny-based

  • Cryptography. Cryptology ePrint Archive, Report 2019/499.

https://eprint.iacr.org/2019/499. 2019. [RS06] Alexander Rostovtsev and Anton Stolbunov. Public-Key Cryptosystem Based on Isogenies. IACR Cryptology ePrint Archive 2006/145 https://ia.cr/2006/145. 2006. [Yoo+17] Youngho Yoo, Reza Azarderakhsh, Amir Jalali, David Jao and Vladimir Soukharev. ‘A Post-Quantum Digital Signature Scheme Based on Supersingular Isogenies’. In: IACR Cryptology ePrint Archive 2017 (2017), p. 186. URL: http://eprint.iacr.org/2017/186.

17 / 11

slide-97
SLIDE 97

References VII

[Zan+18] Gustavo H. M. Zanon, Marcos A. Simplicio, Geovandro C. C. F. Pereira, Javad Doliskani and Paulo S. L. M. Barreto. ‘Faster Isogeny-Based Compressed Key Agreement’. In: Post-Quantum Cryptography. Ed. by Tanja Lange and Rainer Steinwandt. Cham: Springer International Publishing, 2018, pp. 248–268. ISBN: 978-3-319-79063-3. DOI: 10.1007/978-3-319-79063-3_12.

18 / 11