[PPT] - Side channel protections for CSIDH Luca De Feo IBM Research Zrich PowerPoint Presentation

SLIDE 1

Side channel protections for CSIDH

Luca De Feo

IBM Research Zürich

October 16, 2019, PHISIC, Gardanne

based on joint work with

D. Cervantes-Vázquez, M. Chenu, J.J. Chi-Domínguez, F. Rodríguez-Henríquez, B. Smith

Slides online at https://defeo.lu/docet

SLIDE 2

Why isogenies?

Six families still in NIST post-quantum competition: Lattices 9 encryption 3 signature Codes 7 encryption Multivariate 4 signature Isogenies 1 encryption Hash-based 1 signature MPC 1 signature

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 2 / 19

SLIDE 3

Why isogenies?

Six families still in NIST post-quantum competition: Lattices 9 encryption 3 signature Codes 7 encryption Multivariate 4 signature Isogenies 1 encryption Hash-based 1 signature MPC 1 signature Public key size NIST-1 level (AES128)

(not to scale)

Codes 1 – 300 KB Lattices 0.5 – 10 KB Isogenies 209 B

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 2 / 19

SLIDE 4

Why isogenies?

Six families still in NIST post-quantum competition: Lattices 9 encryption 3 signature Codes 7 encryption Multivariate 4 signature Isogenies 1 encryption Hash-based 1 signature MPC 1 signature Encryption performance NIST-1 level (AES128)

(not to scale)

Codes 1 Mcycles Lattices 0.5 – 5 Mcycles Isogenies 190 Mcycles

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 2 / 19

SLIDE 5

Iso-what?!

Keywords

An isogeny is a map between two elliptic curves; ✣✭ ✰ ✮ ❂ ✣✭ ✮ ✰ ✣✭ ✮❀ ✣✭ ❀ ✮ ❂

✥

✭ ✮ ✭ ✮❀

✒ ✭ ✮

✭ ✮

✓✵✦

❀ ❂ ❂ ✙

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 3 / 19

SLIDE 6

Iso-what?!

Keywords

An isogeny is a map between two elliptic curves; It is a group morphism: ✣✭P ✰ Q✮ ❂ ✣✭P✮ ✰ ✣✭Q✮❀ ✣✭ ❀ ✮ ❂

✥

✭ ✮ ✭ ✮❀

✒ ✭ ✮

✭ ✮

✓✵✦

❀ ❂ ❂ ✙

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 3 / 19

SLIDE 7

Iso-what?!

Keywords

An isogeny is a map between two elliptic curves; It is a group morphism: ✣✭P ✰ Q✮ ❂ ✣✭P✮ ✰ ✣✭Q✮❀ It is an algebraic map: ✣✭x❀ y✮ ❂

✥

g✭x✮ h✭x✮❀ y

✒g✭x✮

h✭x✮

✓✵✦

❀ ❂ ❂ ✙

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 3 / 19

SLIDE 8

Iso-what?!

Keywords

An isogeny is a map between two elliptic curves; It is a group morphism: ✣✭P ✰ Q✮ ❂ ✣✭P✮ ✰ ✣✭Q✮❀ It is an algebraic map: ✣✭x❀ y✮ ❂

✥

g✭x✮ h✭x✮❀ y

✒g✭x✮

h✭x✮

✓✵✦

❀ It is entirely determined by its kernel (i.e., by a single point); ❂ ❂ ✙

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 3 / 19

SLIDE 9

Iso-what?!

Keywords

An isogeny is a map between two elliptic curves; It is a group morphism: ✣✭P ✰ Q✮ ❂ ✣✭P✮ ✰ ✣✭Q✮❀ It is an algebraic map: ✣✭x❀ y✮ ❂

✥

g✭x✮ h✭x✮❀ y

✒g✭x✮

h✭x✮

✓✵✦

❀ It is entirely determined by its kernel (i.e., by a single point); Isogeny degree ❂ size of the kernel ❂ order of kernel generator ✙ size of the polynomials;

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 3 / 19

SLIDE 10

Isogenies: an example over ❋11

E ✿ y2 ❂ x 3 ✰ x E ✵ ✿ y2 ❂ x 3 4x ✣✭x❀ y✮ ❂

✥

x 2 ✰ 1 x ❀ y x 2 1 x 2

✦

✼✦ ❋✄

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 4 / 19

SLIDE 11

Isogenies: an example over ❋11

E ✿ y2 ❂ x 3 ✰ x E ✵ ✿ y2 ❂ x 3 4x ✣✭x❀ y✮ ❂

✥

x 2 ✰ 1 x ❀ y x 2 1 x 2

✦

Kernel generator in red. This is a degree 2 map. Analogous to x ✼✦ x 2 in ❋✄

q.

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 4 / 19

SLIDE 12

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 13

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 14

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 15

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 16

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 17

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 18

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 19

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 20

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 21

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 22

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 23

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 24

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 25

Isogeny graphs

P Q R P ✰ Q

y2 ❂ x 3 ✰ ax ✰ b

✦

j ✑ 1728

4a3 4a3✰27b2

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 26

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 27

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 28

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 29

Isogeny graphs

P Q R P ✰ Q

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 30

Isogeny graphs

✰

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 31

Isogeny graphs

✰

❂ ✰ ✰

✦

✑

✰

❂ ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 32

Isogeny graphs

✰

❂ ✰ ✰

✦

✑

✰

j ❂ 1728 ✣ ❂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 33

Isogeny graphs

✰

❂ ✰ ✰

✦

✑

✰

j ❂ 1728 ✣ j ❂ 287496

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 34

Isogeny graphs

✰

❂ ✰ ✰

✦

✑

✰

j ❂ 1728 ✣ j ❂ 287496

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 5 / 19

SLIDE 35

The beauty and the beast

(credit: Lorenz Panny)

Components of particular isogeny graphs look like this: Which of these is good for crypto?

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 6 / 19

SLIDE 36

The beauty and the beast

(credit: Lorenz Panny)

Components of particular isogeny graphs look like this: Which of these is good for crypto? Both.

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 6 / 19

SLIDE 37

The beauty and the beast

(credit: Lorenz Panny)

At this time, there are two distinct families of systems: ❋p CSIDH [pron.: sea-side]

https://csidh.isogeny.org

❋p2 SIDH

https://sike.org

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 6 / 19

SLIDE 38

CSIDH vs SIDH

CSIDH SIDH Speed (on x64 arch., NIST 1) ✘ 70ms ✘ 6ms Public key size (NIST 1) 64B 346B Key compression ✣ speed ✘ 11ms ✣ size 209B Submitted to NIST no yes TRL 4 6 Best classical attack p1❂4 p1❂4 (p3❂8) Best quantum attack ⑦ ❖

✏

3 ♣

❧♦❣3 p✑

p1❂6 (p3❂8) Key size scales quadratically linearly CPA security yes yes CCA security yes Fujisaki-Okamoto Constant time it’s complicated yes Non-interactive key exchange yes no Signatures short but (slow ❥ do not scale) big and slow

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 7 / 19

SLIDE 39

CSIDH vs SIDH

CSIDH SIDH Speed (on x64 arch., NIST 1) ✘ 70ms ✘ 6ms Public key size (NIST 1) 64B 346B Key compression ✣ speed ✘ 11ms ✣ size 209B Submitted to NIST no yes TRL 4 6 Best classical attack p1❂4 p1❂4 (p3❂8) Best quantum attack ⑦ ❖

✏

3 ♣

❧♦❣3 p✑

p1❂6 (p3❂8) Key size scales quadratically linearly CPA security yes yes CCA security yes Fujisaki-Okamoto Constant time it’s complicated yes Non-interactive key exchange yes no Signatures short but (slow ❥ do not scale) big and slow

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 7 / 19

SLIDE 40

The CSIDH graph

E1 E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12 Vertices are supersingular elliptic curves

ver ❋p.

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 8 / 19

SLIDE 41

The CSIDH graph

E1 E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12 Vertices are supersingular elliptic curves

ver ❋p.

Edges are isogenies

f bounded prime degree.

degree 3

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 8 / 19

SLIDE 42

The CSIDH graph

E1 E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12 Vertices are supersingular elliptic curves

ver ❋p.

Edges are isogenies

f bounded prime degree.

degree 3 degree 5

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 8 / 19

SLIDE 43

The CSIDH graph

E1 E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12 Vertices are supersingular elliptic curves

ver ❋p.

Edges are isogenies

f bounded prime degree.

degree 3 degree 5 degree 7

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 8 / 19

SLIDE 44

CSIDH key exchange

E0 ❂ Public parameters: A supersingular curve E0❂❋p; A set of small prime degree isogenies. ✣ ✿ ✦ ✭❧♦❣ ✮ ✣ ✣

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 9 / 19

SLIDE 45

CSIDH key exchange

E0 EA ❂ Public parameters: A supersingular curve E0❂❋p; A set of small prime degree isogenies.

1

Alice takes a secret random walk ✣A ✿ E0 ✦ EA of length O✭❧♦❣ p✮; ✣ ✣

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 9 / 19

SLIDE 46

CSIDH key exchange

E0 EA EB ❂ Public parameters: A supersingular curve E0❂❋p; A set of small prime degree isogenies.

1

Alice takes a secret random walk ✣A ✿ E0 ✦ EA of length O✭❧♦❣ p✮;

2

Bob does the same; ✣ ✣

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 9 / 19

SLIDE 47

CSIDH key exchange

E0 EA EB ❂ Public parameters: A supersingular curve E0❂❋p; A set of small prime degree isogenies.

1

Alice takes a secret random walk ✣A ✿ E0 ✦ EA of length O✭❧♦❣ p✮;

2

Bob does the same;

3

They publish EA and EB; ✣ ✣

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 9 / 19

SLIDE 48

CSIDH key exchange

E0 EA EB EBA ❂ Public parameters: A supersingular curve E0❂❋p; A set of small prime degree isogenies.

1

Alice takes a secret random walk ✣A ✿ E0 ✦ EA of length O✭❧♦❣ p✮;

2

Bob does the same;

3

They publish EA and EB;

4

Alice repeats her secret walk ✣A starting from EB. ✣

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 9 / 19

SLIDE 49

CSIDH key exchange

E0 EA EB EBA ❂ EAB Public parameters: A supersingular curve E0❂❋p; A set of small prime degree isogenies.

1

Alice takes a secret random walk ✣A ✿ E0 ✦ EA of length O✭❧♦❣ p✮;

2

Bob does the same;

3

They publish EA and EB;

4

Alice repeats her secret walk ✣A starting from EB.

5

Bob repeats his secret walk ✣B starting from EA.

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 9 / 19

SLIDE 50

CSIDH data flow

Your secret: a vector of number of isogeny steps for each degree

5❀ 1❀ 4❀ ✿ ✿ ✿ ✁

Your public key: (the j -invariant of) a supersingular elliptic curve j ❂ 0x23baf75419531a44f3b97cc9d8291a275047fcdae0c9a0c0ebb993964f821f2 0c11058a4200ff38c4a85e208345300033b0d3119ff4a7c1be0acd62a622002a9

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 10 / 19

SLIDE 51

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 52

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 53

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 Q ❂ P ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 54

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 55

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 Q ❂ ❬11❪P ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 56

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 Q ❂ ❬11❪P ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 57

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 58

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤P✐ ❂ 3 ✁ 7 ✁ 11 Q ❂ ❬3 ✁ 11❪P ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 59

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤P✐ ❂ 3 ✁ 7 ✁ 11 Q ❂ ❬3 ✁ 11❪P ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 60

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 61

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 Q ❂ ❬3 ✁ 7 ✁ 11❪P

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 62

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 Q ❂ ❬3 ✁ 7 ✁ 11❪P

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 63

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 64

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 Q ❂ ❬3 ✁ 7 ✁ 11❪P

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 65

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 66

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 Q ❂ ❬3 ✁ 7 ✁ 11❪P

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 67

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 68

Isogeny evaluation

Repeat: Take a random point P ✷ E✭❋p✮; Set Q ❂ ❬c❪P, where c is an appropriate cofactor, so that N ❂ ★❤Q✐ contains only useful prime factors; Advance by the degree N isogeny of kernel ❤Q✐. E0 EA ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ❪ ★❤ ✐ ❂ ✁ ✁ ❂ ❬ ✁ ❪ ★❤ ✐ ❂ ✁ ✁ ✁ ❂ ❬ ✁ ✁ ❪

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 11 / 19

SLIDE 69

In seek of constant time

Two obstacles for constant time:

1

Some random points P may lack some factors;

2

Number of isogeny evaluations dependent on secret key.

■ ■

✂ ✿ ✂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 12 / 19

SLIDE 70

In seek of constant time

Two obstacles for constant time:

1

Some random points P may lack some factors; Unrelated to secret key if truly random.

2

Number of isogeny evaluations dependent on secret key.

■ ■

✂ ✿ ✂

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 12 / 19

SLIDE 71

In seek of constant time

Two obstacles for constant time:

1

Some random points P may lack some factors; Unrelated to secret key if truly random.

2

Number of isogeny evaluations dependent on secret key.

Meyer, Campos, Reith 2018; Onuki, Aikawa, Yamazaki, Takagi 2019

“Dummy” isogenies:

■ Always do exactly the same number of isogeny evaluations per prime degree, ■ discard computations in excess;

4✂ slowdown (MCR) / 2✿5✂ slowdown (OAYT). Protected against SPA...

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 12 / 19

SLIDE 72

In seek of constant time

Two obstacles for constant time:

1

Some random points P may lack some factors; Unrelated to secret key if truly random.

2

Number of isogeny evaluations dependent on secret key.

Meyer, Campos, Reith 2018; Onuki, Aikawa, Yamazaki, Takagi 2019

“Dummy” isogenies:

■ Always do exactly the same number of isogeny evaluations per prime degree, ■ discard computations in excess;

4✂ slowdown (MCR) / 2✿5✂ slowdown (OAYT). Protected against SPA...but very easy to attack by fault!

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 12 / 19

SLIDE 73

SLIDE 74

Isogeny evaluation with dummies

E0 ★❤ ✐ ❂ ✁ ✁ ✁ ★❤ ✐ ❂ ✁ ✁

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 14 / 19

SLIDE 75

Isogeny evaluation with dummies

E0 ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 ★❤ ✐ ❂ ✁ ✁

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 14 / 19

SLIDE 76

Isogeny evaluation with dummies

E0 ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 ★❤ ✐ ❂ ✁ ✁

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 14 / 19

SLIDE 77

Isogeny evaluation with dummies

E0 ★❤ ✐ ❂ ✁ ✁ ✁ ★❤P✐ ❂ 3 ✁ 7 ✁ 11

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 14 / 19

SLIDE 78

Isogeny evaluation with dummies

E0 ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 ★❤ ✐ ❂ ✁ ✁

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 14 / 19

SLIDE 79

Isogeny evaluation with dummies

E0 ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 ★❤ ✐ ❂ ✁ ✁

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 14 / 19

SLIDE 80

Isogeny evaluation with dummies

E0 ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 ★❤ ✐ ❂ ✁ ✁

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 14 / 19

SLIDE 81

Isogeny evaluation with dummies

E0 EA ★❤P✐ ❂ 3 ✁ 5 ✁ 7 ✁ 11 ★❤ ✐ ❂ ✁ ✁

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 14 / 19

SLIDE 82

Our work (Latincrypt 2019)

Fixed a leak related to the sampling of random points.

■ ■

✂

■ Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 15 / 19

SLIDE 83

Our work (Latincrypt 2019)

Fixed a leak related to the sampling of random points. Speed-up both MCR and OAYT constant time implementations:

■ Fully Twisted Edwards implementation; ■ Use of Shortest Differential Addition Chains;

✂

■ Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 15 / 19

SLIDE 84

Our work (Latincrypt 2019)

Fixed a leak related to the sampling of random points. Speed-up both MCR and OAYT constant time implementations:

■ Fully Twisted Edwards implementation; ■ Use of Shortest Differential Addition Chains;

Protection against fault attack at the cost of a 2✂ slowdown:

■ Got rid of “dummy isogenies”. Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 15 / 19

SLIDE 85

Our work (Latincrypt 2019)

Fixed a leak related to the sampling of random points. Speed-up both MCR and OAYT constant time implementations:

■ Fully Twisted Edwards implementation; ■ Use of Shortest Differential Addition Chains;

Protection against fault attack at the cost of a 2✂ slowdown:

■ Got rid of “dummy isogenies”.

Initiated study of fully constant time variant (very expensive, though).

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 15 / 19

SLIDE 86

Avoiding dummies

We change the format of the secret key: Original: vectors with coefficients in ❬B❀ B❪. Modified: vectors with odd1 coefficients in ❬B❀ B❪. ✝

3 5 3 1

❂ ✰ ✰ ✰ ✰

1Or even, all the same. Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 16 / 19

SLIDE 87

Avoiding dummies

We change the format of the secret key: Original: vectors with coefficients in ❬B❀ B❪. Modified: vectors with odd1 coefficients in ❬B❀ B❪. Translate vector to sum of ✝1 vectors; Each vector costs exactly one isogeny evaluation per degree.

3 5 3 1

❂ ✰ ✰ ✰ ✰

1Or even, all the same. Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 16 / 19

SLIDE 88

Running-time: measured clock cycles

Clock cycle counts for constant-time CSIDH implementations, averaged over 1024 experiments. The ratio is computed using MCR 2018 as baseline implementation. Implementation CSIDH algorithm Mcycles Ratio Castryck et al. unprotected, unmodified 155 0.39 Meyer–Campos–Reith unmodified 395 1.00 This work MCR-style 337 0.85 OAYT-style 239 0.61 No-dummy 481 1.22

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 17 / 19

SLIDE 89

Summary Repeat with me: I need isogeny-based crypto! CSIDH is the new Diffie–Hellman: Very short keys, easy key validation, ... Implementing isogeny-based crypto efficiently is challenging, even more so with side-channel protections.

Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH https://defeo.lu/docet PHISIC 2019 18 / 19

SLIDE 90

Thank you

https://defeo.lu/ @luca_defeo