SLIDE 1
CSIDH:
An Efficient Post-Quantum Commutative Group Action
Wouter Castryck1 Tanja Lange2 Chloe Martindale2 Lorenz Panny2 Joost Renes3
1KU Leuven 2TU Eindhoven 3Radboud Universiteit
Brisbane, 6 December 2018
["si:saId] Why CSIDH? Drop-in post-quantum replacement for - - PowerPoint PPT Presentation
["si:saId] Why CSIDH? Drop-in post-quantum replacement for - - PowerPoint PPT Presentation
CSIDH : An Efficient Post-Quantum Commutative Group Action Wouter Castryck 1 Tanja Lange 2 Chloe Martindale 2 Lorenz Panny 2 Joost Renes 3 1 KU Leuven 2 TU Eindhoven 3 Radboud Universiteit Brisbane, 6 December 2018 ["si:saId] Why CSIDH?
SLIDE 2
SLIDE 3
["si:saId]
SLIDE 4
Why CSIDH?
◮ Drop-in post-quantum replacement for (EC)DH.
https://csidh.isogeny.org 1/15
SLIDE 5
Why CSIDH?
◮ Drop-in post-quantum replacement for (EC)DH. ◮ Non-interactive key exchange (full public-key validation);
previously only slow solutions post-quantumly.
https://csidh.isogeny.org 1/15
SLIDE 6
Why CSIDH?
◮ Drop-in post-quantum replacement for (EC)DH. ◮ Non-interactive key exchange (full public-key validation);
previously only slow solutions post-quantumly.
◮ Small keys: 64 bytes at conjectured AES-128 security level
https://csidh.isogeny.org 1/15
SLIDE 7
Why CSIDH?
◮ Drop-in post-quantum replacement for (EC)DH. ◮ Non-interactive key exchange (full public-key validation);
previously only slow solutions post-quantumly.
◮ Small keys: 64 bytes at conjectured AES-128 security level ◮ Competitive speed: ∼ 35 ms per operation. (Skylake i5 w
/ TurboBoost)
https://csidh.isogeny.org 1/15
SLIDE 8
Why CSIDH?
◮ Drop-in post-quantum replacement for (EC)DH. ◮ Non-interactive key exchange (full public-key validation);
previously only slow solutions post-quantumly.
◮ Small keys: 64 bytes at conjectured AES-128 security level ◮ Competitive speed: ∼ 35 ms per operation. (Skylake i5 w
/ TurboBoost)
◮ Clean mathematical structure: a true group action.
(No noise, no auxiliary points, no compromises.)
https://csidh.isogeny.org 1/15
SLIDE 9
Why CSIDH?
◮ Drop-in post-quantum replacement for (EC)DH. ◮ Non-interactive key exchange (full public-key validation);
previously only slow solutions post-quantumly.
◮ Small keys: 64 bytes at conjectured AES-128 security level ◮ Competitive speed: ∼ 35 ms per operation. (Skylake i5 w
/ TurboBoost)
◮ Clean mathematical structure: a true group action.
(No noise, no auxiliary points, no compromises.)
◮ By the way: not ‘better’ or ‘worse’ than SIDH. It’s simply
different and likely to be useful for different applications.
https://csidh.isogeny.org 1/15
SLIDE 10
Ordinary isogeny graphs
Nodes: Ordinary elliptic curves defined over k up to ∼ =k. Edges: 3-, 5-, and 7-isogenies defined over k up to ∼ =k. Components look something like this:
https://csidh.isogeny.org 2/15
SLIDE 11
Ordinary isogeny graphs (cycles)
Nodes: Ordinary elliptic curves defined over k up to ∼ =k. Edges: 3-, 5-, and 7-isogenies defined over k up to ∼ =k.
https://csidh.isogeny.org 2/15
SLIDE 12
Ordinary isogeny graphs (cycles)
Nodes: Ordinary elliptic curves defined over k up to ∼ =k. Edges: 3-, 5-, and 7-isogenies defined over k up to ∼ =k. ??? Easy: Compute a random path, output the final node. Hard problem: Find a path between two given nodes.
https://csidh.isogeny.org 2/15
SLIDE 13
Alice vs. Eve
Intuition: Combining edges from different cycles allows taking shortcuts to remote parts of the graph!
https://csidh.isogeny.org 3/15
SLIDE 14
Alice vs. Eve
g0 g1 g3 g11 ·g1 ·g2 ·g8
Intuition: Combining edges from different cycles allows taking shortcuts to remote parts of the graph!
- cf. Square-&-Multiply: Alice gets an advantage over Eve.
https://csidh.isogeny.org 3/15
SLIDE 15
Point counting
De Feo–Kieffer–Smith want an ordinary curve E/Fq with many small primes ℓ | E(Fq). This seems difficult.
https://csidh.isogeny.org 4/15
SLIDE 16
https://csidh.isogeny.org 5/15
SLIDE 17
Pictures: https://github.com/CardsAgainstCryptography
https://csidh.isogeny.org 5/15
SLIDE 18
Pictures: https://github.com/CardsAgainstCryptography
I’ve been experimenting with supersingular curves in this context, because they have all the properties Kieffer was looking for. Are there any security issues with using supersingular curves? Hope I did not overlook anything stupid here!
— an anonymous CSIDH coauthor https://csidh.isogeny.org 5/15
SLIDE 19
Pictures: https://github.com/CardsAgainstCryptography
I’ve been experimenting with supersingular curves in this context, because they have all the properties Kieffer was looking for. Are there any security issues with using supersingular curves? Hope I did not overlook anything stupid here!
— an anonymous CSIDH coauthor
Wouter, you are a genius!
— me https://csidh.isogeny.org 5/15
SLIDE 20
Supersingular isogeny graphs
Nodes: Supersingular elliptic curves defined over k up to ∼ =k. Edges: 3-, 5-, and 7-isogenies defined over k up to ∼ =k.
https://csidh.isogeny.org 6/15
SLIDE 21
Supersingular isogeny graphs
Nodes: Supersingular elliptic curves defined over k up to ∼ =k. Edges: 3-, 5-, and 7-isogenies defined over k up to ∼ =k. k = F4192
(same as F419)
https://csidh.isogeny.org 6/15
SLIDE 22
Supersingular isogeny graphs
Nodes: Supersingular elliptic curves defined over k up to ∼ =k. Edges: 3-, 5-, and 7-isogenies defined over k up to ∼ =k. k = F4192
(same as F419)
k = F419
https://csidh.isogeny.org 6/15
SLIDE 23
Supersingular isogeny graphs
- Theorem. The Fp-rational endomorphism ring of an elliptic
curve defined over Fp is an imaginary quadratic order.
https://csidh.isogeny.org 7/15
SLIDE 24
Supersingular isogeny graphs
- Theorem. The Fp-rational endomorphism ring of an elliptic
curve defined over Fp is an imaginary quadratic order.
...even in the supersingular case!
https://csidh.isogeny.org 7/15
SLIDE 25
Supersingular isogeny graphs
- Theorem. The Fp-rational endomorphism ring of an elliptic
curve defined over Fp is an imaginary quadratic order.
...even in the supersingular case!
Theorem/fact/definition. Let p > 3. An elliptic curve E over Fp is supersingular if and only if #E(Fp) = p + 1.
https://csidh.isogeny.org 7/15
SLIDE 26
Supersingular isogeny graphs
- Theorem. The Fp-rational endomorphism ring of an elliptic
curve defined over Fp is an imaginary quadratic order.
...even in the supersingular case!
Theorem/fact/definition. Let p > 3. An elliptic curve E over Fp is supersingular if and only if #E(Fp) = p + 1. = ⇒ We can simply craft a curve with a good number of points.
https://csidh.isogeny.org 7/15
SLIDE 27
Reminder
The class group action is defined as follows:
◮ Inputs:
An elliptic curve E with endomorphism ring O, an ideal a ⊆ O of prime norm ℓ.
◮ Output:
The elliptic curve [a]E.
- 1. Compute the subgroup E[a] =
α∈a ker α killed by a.
- 2. Compute an ℓ-isogeny E −
→ E′ with kernel E[a].
- 3. Output E′.
https://csidh.isogeny.org 8/15
SLIDE 28
Reminder
The class group action is defined as follows:
◮ Inputs:
An elliptic curve E with endomorphism ring O, an ideal a ⊆ O of prime norm ℓ.
◮ Output:
The elliptic curve [a]E.
- 1. Compute the subgroup E[a] =
α∈a ker α killed by a.
- 2. Compute an ℓ-isogeny E −
→ E′ with kernel E[a].
- 3. Output E′.
Typically E[a] is only defined over Fqm for m ≈ ℓ. = ⇒ Complexity of computing with E[a] is exponentiaℓ... : (
https://csidh.isogeny.org 8/15
SLIDE 29
CSIDH in one cslide (terrible pun totally intended)
https://csidh.isogeny.org 9/15
SLIDE 30
CSIDH in one cslide (terrible pun totally intended)
1.
◮ Choose some small odd primes ℓ1, ..., ℓn. ◮ Make sure p = 4 · ℓ1 · · · ℓn − 1 is prime. ◮ Let X = {supersingular y2 = x3+Ax2+x defined over Fp}.
https://csidh.isogeny.org 9/15
SLIDE 31
CSIDH in one cslide (terrible pun totally intended)
1.
◮ Choose some small odd primes ℓ1, ..., ℓn. ◮ Make sure p = 4 · ℓ1 · · · ℓn − 1 is prime. ◮ Let X = {supersingular y2 = x3+Ax2+x defined over Fp}.
2.
◮ All curves in X have Fp-endomorphism ring O = Z[√p].
Define the ideals li = (ℓi, π − 1) of O.
◮ Let K = {[le1 1 · · · le1 n ] | (e1, ..., en) is ‘short’} ⊆ cl(O).
https://csidh.isogeny.org 9/15
SLIDE 32
CSIDH in one cslide (terrible pun totally intended)
1.
◮ Choose some small odd primes ℓ1, ..., ℓn. ◮ Make sure p = 4 · ℓ1 · · · ℓn − 1 is prime. ◮ Let X = {supersingular y2 = x3+Ax2+x defined over Fp}.
2.
◮ All curves in X have Fp-endomorphism ring O = Z[√p].
Define the ideals li = (ℓi, π − 1) of O.
◮ Let K = {[le1 1 · · · le1 n ] | (e1, ..., en) is ‘short’} ⊆ cl(O).
3.
magic math happens!∗
∗ see next slides
https://csidh.isogeny.org 9/15
SLIDE 33
CSIDH in one cslide (terrible pun totally intended)
1.
◮ Choose some small odd primes ℓ1, ..., ℓn. ◮ Make sure p = 4 · ℓ1 · · · ℓn − 1 is prime. ◮ Let X = {supersingular y2 = x3+Ax2+x defined over Fp}.
2.
◮ All curves in X have Fp-endomorphism ring O = Z[√p].
Define the ideals li = (ℓi, π − 1) of O.
◮ Let K = {[le1 1 · · · le1 n ] | (e1, ..., en) is ‘short’} ⊆ cl(O).
3.
magic math happens!∗
∗ see next slides
4.
◮ cl(O) acts on X and the action of K is very efficient!
https://csidh.isogeny.org 9/15
SLIDE 34
Magic (base field arithmetic)
◮ All the ideals ℓiO split as li · li where li = (ℓi, π − 1).
= ⇒ We can use all ℓi we started with (generally: about 1/2).
https://csidh.isogeny.org 10/15
SLIDE 35
Magic (base field arithmetic)
◮ All the ideals ℓiO split as li · li where li = (ℓi, π − 1).
= ⇒ We can use all ℓi we started with (generally: about 1/2).
◮ The subgroup corresponding to li is E[li] = E(Fp)[ℓi]. (Note that ker(π − 1) is just the Fp-rational points!)
https://csidh.isogeny.org 10/15
SLIDE 36
Magic (base field arithmetic)
◮ All the ideals ℓiO split as li · li where li = (ℓi, π − 1).
= ⇒ We can use all ℓi we started with (generally: about 1/2).
◮ The subgroup corresponding to li is E[li] = E(Fp)[ℓi]. (Note that ker(π − 1) is just the Fp-rational points!) ◮ The subgroup corresponding to li is
E[li] = {P ∈ E[ℓi] | π(P) = −P}.
https://csidh.isogeny.org 10/15
SLIDE 37
Magic (base field arithmetic)
◮ All the ideals ℓiO split as li · li where li = (ℓi, π − 1).
= ⇒ We can use all ℓi we started with (generally: about 1/2).
◮ The subgroup corresponding to li is E[li] = E(Fp)[ℓi]. (Note that ker(π − 1) is just the Fp-rational points!) ◮ The subgroup corresponding to li is
E[li] = {P ∈ E[ℓi] | π(P) = −P}. For Montgomery curves, E[li] = {(x, y) ∈ E[ℓi] | x ∈ Fp; y / ∈ Fp} ∪ {∞}.
https://csidh.isogeny.org 10/15
SLIDE 38
Magic (base field arithmetic)
◮ All the ideals ℓiO split as li · li where li = (ℓi, π − 1).
= ⇒ We can use all ℓi we started with (generally: about 1/2).
◮ The subgroup corresponding to li is E[li] = E(Fp)[ℓi]. (Note that ker(π − 1) is just the Fp-rational points!) ◮ The subgroup corresponding to li is
E[li] = {P ∈ E[ℓi] | π(P) = −P}. For Montgomery curves, E[li] = {(x, y) ∈ E[ℓi] | x ∈ Fp; y / ∈ Fp} ∪ {∞}. = ⇒ With x-only arithmetic everything can be done over Fp.
https://csidh.isogeny.org 10/15
SLIDE 39
Magic (public keys)
- Theorem. For p > 3 and p ≡ 3 (mod 8),
a supersingular elliptic curve over Fp can be written in the form EA : y2 = x3 + Ax2 + x if and only if the Fp-rational endomorphism ring of E is Z[√p]. Moreover, in that case, A ∈ Fp is unique.
https://csidh.isogeny.org 11/15
SLIDE 40
Magic (public keys)
- Theorem. For p > 3 and p ≡ 3 (mod 8),
a supersingular elliptic curve over Fp can be written in the form EA : y2 = x3 + Ax2 + x if and only if the Fp-rational endomorphism ring of E is Z[√p]. Moreover, in that case, A ∈ Fp is unique.
◮ Public keys are represented by a single coefficient A ∈ Fp. Tiny keys.
https://csidh.isogeny.org 11/15
SLIDE 41
Magic (public keys)
- Theorem. For p > 3 and p ≡ 3 (mod 8),
a supersingular elliptic curve over Fp can be written in the form EA : y2 = x3 + Ax2 + x if and only if the Fp-rational endomorphism ring of E is Z[√p]. Moreover, in that case, A ∈ Fp is unique.
◮ Public keys are represented by a single coefficient A ∈ Fp. Tiny keys. ◮ Public-key validation:
Check that EA is supersingular, i.e., has p + 1 points.
Easy Monte-Carlo algorithm: Pick random P on EA and check [p+1]P = ∞. This algorithm has a negligible chance 8/ √p + o(1) of false positives. We actually use a variant that proves that EA has p + 1 points.
https://csidh.isogeny.org 11/15
SLIDE 42
Magic (public keys)
- Theorem. For p > 3 and p ≡ 3 (mod 8),
a supersingular elliptic curve over Fp can be written in the form EA : y2 = x3 + Ax2 + x if and only if the Fp-rational endomorphism ring of E is Z[√p]. Moreover, in that case, A ∈ Fp is unique.
◮ Public keys are represented by a single coefficient A ∈ Fp. Tiny keys. ◮ Public-key validation:
Check that EA is supersingular, i.e., has p + 1 points.
Easy Monte-Carlo algorithm: Pick random P on EA and check [p+1]P = ∞. This algorithm has a negligible chance 8/ √p + o(1) of false positives. We actually use a variant that proves that EA has p + 1 points. ◮ About √p of all A ∈ Fp are valid keys.
https://csidh.isogeny.org 11/15
SLIDE 43
Security
Classical:
◮ Meet-in-the-middle variants: Time O( 4
√p). [Delfs–Galbraith]
https://csidh.isogeny.org 12/15
SLIDE 44
Security
Classical:
◮ Meet-in-the-middle variants: Time O( 4
√p). [Delfs–Galbraith] Quantum:
◮ Hidden-shift algorithms: Subexponential complexity.
https://csidh.isogeny.org 12/15
SLIDE 45
Security
Classical:
◮ Meet-in-the-middle variants: Time O( 4
√p). [Delfs–Galbraith] Quantum:
◮ Hidden-shift algorithms: Subexponential complexity.
◮ Literature contains mostly asymptotics. ◮ Time-space trade-off: Fastest variants need huge memory. ◮ [BS] ignores much of the cost. No need to panic!
https://csidh.isogeny.org 12/15
SLIDE 46
CSIDH-512
Sizes:
◮ Private keys: 32 bytes. ◮ Public keys: 64 bytes.
https://csidh.isogeny.org 13/15
SLIDE 47
CSIDH-512
Sizes:
◮ Private keys: 32 bytes. ◮ Public keys: 64 bytes.
Performance:
◮ Wall-clock time: 35 ms per operation. ◮ Clock cycles (Skylake): about 108 per operation. ◮ Memory usage (x86_64): about 4 kilobytes.
https://csidh.isogeny.org 13/15
SLIDE 48
CSIDH-512
Sizes:
◮ Private keys: 32 bytes. ◮ Public keys: 64 bytes.
Performance:
◮ Wall-clock time: 35 ms per operation. ◮ Clock cycles (Skylake): about 108 per operation. ◮ Memory usage (x86_64): about 4 kilobytes.
Security:
◮ Classical: at least 128 bits.
https://csidh.isogeny.org 13/15
SLIDE 49
CSIDH-512
Sizes:
◮ Private keys: 32 bytes. ◮ Public keys: 64 bytes.
Performance:
◮ Wall-clock time: 35 ms per operation. ◮ Clock cycles (Skylake): about 108 per operation. ◮ Memory usage (x86_64): about 4 kilobytes.
Security:
◮ Classical: at least 128 bits. ◮ Quantum: complicated. AFAWK it reaches NIST level 1. [BS] says 232.5 queries; [BLMP] estimates ≈ 281 quantum gates using millions of qubits.
https://csidh.isogeny.org 13/15
SLIDE 50
Work in progress & future work
◮ Fast and constant-time implementation
(Quick ’n’ slightly dirty version based on [BLMP] is ≈ 6 times slower.)
https://csidh.isogeny.org 14/15
SLIDE 51
Work in progress & future work
◮ Fast and constant-time implementation
(Quick ’n’ slightly dirty version based on [BLMP] is ≈ 6 times slower.)
◮ More security analysis
https://csidh.isogeny.org 14/15
SLIDE 52
Work in progress & future work
◮ Fast and constant-time implementation
(Quick ’n’ slightly dirty version based on [BLMP] is ≈ 6 times slower.)
◮ More security analysis ◮ More applications
https://csidh.isogeny.org 14/15
SLIDE 53
Work in progress & future work
◮ Fast and constant-time implementation
(Quick ’n’ slightly dirty version based on [BLMP] is ≈ 6 times slower.)
◮ More security analysis ◮ More applications ◮ [Your paper here!]
https://csidh.isogeny.org 14/15
SLIDE 54
Questions?
[CSIDH] https://ia.cr/2018/383 [BS] https://ia.cr/2018/537 [BLMP] https://ia.cr/2018/1059
SLIDE 55
SIDH vs. CSIDH
CSIDH = SIDH?
SLIDE 56
SIDH vs. CSIDH
CSIDH = SIDH + C
SLIDE 57
SIDH vs. CSIDH
Sizes and times are for (conjectured) NIST level 1. SIDH parameters are more conservative.
SIDH CSIDH Time per key exchange ≈ 10 ms ≈ 70 ms Public keys 378 b 64 b Public key compression 222 b (≈ 15 ms) n/a Constant-time slowdown ≈ 1 ≈ 6 (quick ’n’ dirty) In the NIST not-a-competition yes no Maturity 7 years 7 months Classical security p1/4 p1/4 Quantum security p1/6 Lp[1/2] Key size scaling linear quadratic Chosen-ciphertext security (KEM) generic transform built-in Non-interactive key exchange slow built-in Signatures (now) seconds snail speed Signatures (future?) still seconds? seconds
(slide mostly stolen from Chloe Martindale, who mostly stole it from Luca De Feo)