Supersingular Isogeny Key Encapsulation Reza Azarderakhsh, Matthew - - PowerPoint PPT Presentation

β–Ά
supersingular isogeny key encapsulation
SMART_READER_LITE
LIVE PREVIEW

Supersingular Isogeny Key Encapsulation Reza Azarderakhsh, Matthew - - PowerPoint PPT Presentation

Sep 20, 2023 19 likes β€’772 views

Supersingular Isogeny Key Encapsulation Reza Azarderakhsh, Matthew Campagna, Craig Costello, Luca De Feo, Basil Hess, Brian Koziel, Brian LaMacchia, Patrick Longa, Michael Naehrig, Joost Renes, Vladimir Soukharev November 14 ECC 2017 Nijmegen,

slide-1
SLIDE 1

Supersingular Isogeny Key Encapsulation

November 14 ECC 2017 Nijmegen, The Netherlands

Reza Azarderakhsh, Matthew Campagna, Craig Costello, Luca De Feo, Basil Hess, Brian Koziel, Brian LaMacchia, Patrick Longa, Michael Naehrig, Joost Renes, Vladimir Soukharev

slide-2
SLIDE 2

Supersingular Isogeny Key Encapsulation

November 14 ECC 2017 Nijmegen, The Netherlands

Reza Azarderakhsh, Matthew Campagna, Craig Costello, Luca De Feo, Basil Hess, Brian Koziel, Brian LaMacchia, Patrick Longa, Michael Naehrig, Joost Renes, Vladimir Soukharev

slide-3
SLIDE 3

Part 1: Quick re-motivation Part 2: Quick tutorial recap Part 3: SIKE

slide-4
SLIDE 4
  • Quantum computers break elliptic curves, finite fields,

factoring, everything currently used for PKC

  • NIST calls for quantum-secure key exchange and
  • signatures. Deadline Nov 30, 2017.

Quantum computers ↔ Cryptopocalypse

slide-5
SLIDE 5

Diffie-Hellman instantiations

𝑕𝑏 mod π‘Ÿ 𝑕𝑐 mod π‘Ÿ 𝑏 𝑄 𝑐 𝑄 𝜚𝐡(𝐹) 𝜚𝐢(𝐹)

β„€π‘Ÿ β„€π‘Ÿ

slide-6
SLIDE 6

Diffie-Hellman instantiations

DH DH ECDH SIDH Elem ements ents integers 𝑕 modulo prime points 𝑄 in curve group curves 𝐹 in isogeny class Secr crets ets exponents 𝑦 scalars 𝑙 isogenies 𝜚 co comp mputatio ions ns 𝑕, 𝑦 ↦ 𝑕𝑦 𝑙, 𝑄 ↦ 𝑙 𝑄 𝜚, 𝐹 ↦ 𝜚(𝐹) hard d pr probl blem given 𝑕, 𝑕𝑦 find 𝑦 given 𝑄, 𝑙 𝑄 find 𝑙 given 𝐹, 𝜚(𝐹) find 𝜚

slide-7
SLIDE 7

Part 1: Quick re-motivation Part 2: Quick tutorial recap Part 3: SIKE

slide-8
SLIDE 8
  • W. Castryck (GIF): ”Elliptic curves are dead: long live elliptic curves” https://www.esat.kuleuven.be/cosic/?p=7404
slide-9
SLIDE 9

Supersingular isogeny graph for β„“ = 2: π‘Œ(𝑇2412,2)

Credit to Fre Vercauteren for example and pictures…

slide-10
SLIDE 10

Supersingular isogeny graph for β„“ = 3: π‘Œ(𝑇2412,3)

Credit to Fre Vercauteren for example and pictures…

slide-11
SLIDE 11

𝐹0 𝐹𝐡 = 𝐹0/〈𝐡βŒͺ 𝐹0/〈𝐢βŒͺ = 𝐹𝐢 𝐹𝐡𝐢 = 𝐹0/〈𝐡, 𝐢βŒͺ

𝜚𝐡 𝜚𝐢 πœšπ΅β€² 𝜚𝐢

β€²

params public private 𝐹’s are isogenous curves 𝑄’s, 𝑅’s, 𝑆’s, 𝑇’s are points

SIDH: in a nutshell

slide-12
SLIDE 12

𝐹0 𝐹𝐡 = 𝐹0/βŒ©π‘„

𝐡 + 𝑑𝐡 𝑅𝐡βŒͺ

𝐹0/βŒ©π‘„πΆ + 𝑑𝐢 𝑅𝐢βŒͺ = 𝐹𝐢 𝐹𝐡𝐢 = 𝐹0/〈𝐡, 𝐢βŒͺ

𝜚𝐡 𝜚𝐢 πœšπ΅β€² 𝜚𝐢

β€²

params public private 𝐹’s are isogenous curves 𝑄’s, 𝑅’s, 𝑆’s, 𝑇’s are points

SIDH: in a nutshell

(𝜚𝐢(𝑄

𝐡), 𝜚𝐢(𝑅𝐡)) = (𝑆𝐢, 𝑇𝐢)

(𝑆𝐡, 𝑇𝐡) = (𝜚𝐡(𝑄𝐢), 𝜚𝐡(𝑅𝐢))

𝐹𝐡/βŒ©π‘†π΅ + 𝑑𝐢 𝑇𝐡βŒͺ β‰… 𝐹0/βŒ©π‘„

𝐡 + 𝑑𝐡 𝑅𝐡 , 𝑄𝐢 + 𝑑𝐢 𝑅𝐢βŒͺ β‰… 𝐹𝐢/βŒ©π‘†πΆ + 𝑑𝐡 𝑇𝐢βŒͺ

Key: : Alice sends her isogeny evaluated at Bob’s generators, and vice versa

slide-13
SLIDE 13

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝑄 𝐹6 = 𝐹0/βŸ¨π‘„

0⟩

slide-14
SLIDE 14

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

[2]𝑄 𝐹5 = 𝐹0/⟨[2]𝑄

0⟩

𝑄

slide-15
SLIDE 15

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

[4]𝑄 𝐹4 = 𝐹0/⟨[4]𝑄

0⟩

𝑄

slide-16
SLIDE 16

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

[8]𝑄 𝐹3 = 𝐹0/⟨[8]𝑄

0⟩

𝑄

slide-17
SLIDE 17

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

[16]𝑄 𝐹2 = 𝐹0/⟨[16]𝑄

0⟩

𝑄

slide-18
SLIDE 18

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

[32]𝑄 𝐹

1 = 𝐹0/⟨[32]𝑄 0⟩

= 𝜚0(𝐹0) 𝑄

slide-19
SLIDE 19

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝑄

1 = 𝜚0(𝑄 0)

𝑄 𝑄

1

𝜚0 𝐹

1 = 𝐹0/⟨[32]𝑄 0⟩

= 𝜚0(𝐹0)

slide-20
SLIDE 20

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝑄

1

𝜚0 𝐹6 = 𝐹

1/βŸ¨π‘„ 1⟩

slide-21
SLIDE 21

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

[2]𝑄

1

𝜚0 𝐹5 = 𝐹

1/⟨[2]𝑄 1⟩

𝑄

1

slide-22
SLIDE 22

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

[4]𝑄

1

𝜚0 𝐹4 = 𝐹

1/⟨[4]𝑄 1⟩

𝑄

1

slide-23
SLIDE 23

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

[8]𝑄

1

𝜚0 𝐹3 = 𝐹

1/⟨[8]𝑄 1⟩

𝑄

1

slide-24
SLIDE 24

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

[16]𝑄

1

𝜚0 𝐹2 = 𝐹

1/⟨[16]𝑄 1⟩

= 𝜚1(𝐹

1)

𝑄

1

slide-25
SLIDE 25

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹2 = 𝐹

1/⟨[16]𝑄 1⟩

= 𝜚1(𝐹

1)

𝑄

1

𝑄

2 = 𝜚1(𝑄 1)

𝑄

2

𝜚1

slide-26
SLIDE 26

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹6 = 𝐹2/βŸ¨π‘„

2⟩

𝑄

2

𝜚1

slide-27
SLIDE 27

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹5 = 𝐹2/⟨[2]𝑄

2⟩

𝑄

2

𝜚1 [2]𝑄

2

slide-28
SLIDE 28

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹4 = 𝐹2/⟨[4]𝑄

2⟩

𝑄

2

𝜚1 [4]𝑄

2

slide-29
SLIDE 29

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹3 = 𝐹2/⟨[8]𝑄

2⟩

= 𝜚2(𝐹2) 𝑄

2

𝜚1 [8]𝑄

2

slide-30
SLIDE 30

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹3 = 𝐹2/⟨[8]𝑄

2⟩

= 𝜚2(𝐹2) 𝑄

2

𝜚1 [8]𝑄

2

𝑄

3 = 𝜚2(𝑄 2)

𝑄

3

𝜚2

slide-31
SLIDE 31

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹6 = 𝐹3/βŸ¨π‘„

3⟩

𝜚1 𝑄

3

𝜚2

slide-32
SLIDE 32

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹5 = 𝐹3/⟨[2]𝑄

3⟩

𝜚1 𝑄

3

𝜚2 [2]𝑄

3

slide-33
SLIDE 33

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹4 = 𝐹3/⟨[4]𝑄

3⟩

𝜚1 𝑄

3

𝜚2 [4]𝑄

3

slide-34
SLIDE 34

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹4 = 𝐹3/⟨[4]𝑄

3⟩

𝜚1 𝑄

3

𝜚2 [4]𝑄

3

𝑄

4 = 𝜚3(𝑄 3)

𝑄

4

𝜚3

slide-35
SLIDE 35

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹6 = 𝐹4/βŸ¨π‘„

4⟩

𝜚1 𝜚2 𝑄

4

𝜚3

slide-36
SLIDE 36

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹5 = 𝐹4/⟨[2]𝑄

4⟩

𝜚1 𝜚2 𝑄

4

𝜚3 [2]𝑄

4

slide-37
SLIDE 37

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹5 = 𝐹4/⟨[2]𝑄

4⟩

𝜚1 𝜚2 𝑄

4

𝜚3 [2]𝑄

4

𝑄

5 = 𝜚4(𝑄 4)

𝑄

5

𝜚4

slide-38
SLIDE 38

Computing ℓ𝑓 degree isogenies

𝐹0 𝐹

1

𝐹2 𝐹3 𝐹4 𝐹5 𝐹6

(suppose β„“ = 2 and 𝑓 = 6) 𝜚 ∢ 𝐹

0 β†’ 𝐹 6 is degree 64

64 elements in its kernel ker 𝜚 = βŸ¨π‘„

0⟩

𝜚0 𝐹6 = 𝐹5/βŸ¨π‘„

5⟩

𝜚1 𝜚2 𝜚3 𝑄

5

𝜚4 𝜚5

slide-39
SLIDE 39

Computing ℓ𝑓 degree isogenies 𝜚 ∢ 𝐹0 β†’ 𝐹6 𝜚 = 𝜚5 ∘ 𝜚4 ∘ 𝜚3 ∘ 𝜚2 ∘ 𝜚1 ∘ 𝜚0 𝜚0 𝜚1 𝜚2 𝜚3 𝜚4 𝜚5 𝐹0 𝐹6

slide-40
SLIDE 40

𝐹 𝐹′

?

slide-41
SLIDE 41

Claw algorithm

𝐹 𝐹′

Given 𝐹 and 𝐹′ = 𝜚(𝐹), with 𝜚 degree ℓ𝑓, find 𝜚

slide-42
SLIDE 42

Claw algorithm

𝐹 𝐹′

Compute and store ℓ𝑓/2-isogenies on one side

slide-43
SLIDE 43

Claw algorithm

𝐹 𝐹′

Compute and store ℓ𝑓/2-isogenies on one side

slide-44
SLIDE 44

Claw algorithm

𝐹 𝐹′

… until you have all of them

slide-45
SLIDE 45

Claw algorithm

𝐹 𝐹′

Now compute ℓ𝑓/2-isogenies on the other side

slide-46
SLIDE 46

Claw algorithm

𝐹 𝐹′

… discarding them until you find a collision

slide-47
SLIDE 47

Claw algorithm

𝐹 𝐹′

… discarding them until you find a collision

slide-48
SLIDE 48

Claw algorithm

𝐹 𝐹′

… discarding them until you find a collision

slide-49
SLIDE 49

Claw algorithm

𝐹 𝐹′

Collision will most likely be unique shortest path

slide-50
SLIDE 50

Claw algorithm

𝐹 𝐹′ This path describes secret isogeny 𝜚 ∢ 𝐹 β†’ 𝐹′

slide-51
SLIDE 51

Claw algorithm: classical analysis

  • There are 𝑃(ℓ𝑓/2) curves ℓ𝑓/2-isogenous to 𝐹′ (the blue nodes

) thus 𝑃(ℓ𝑓/2) = 𝑃(π‘ž1/4) classical memory

  • There are 𝑃(ℓ𝑓/2) curves ℓ𝑓/2-isogenous to 𝐹′ (the blue nodes ), and

there are 𝑃(ℓ𝑓/2) curves ℓ𝑓/2-isogenous to 𝐹 (the purple nodes ) thus 𝑃(ℓ𝑓/2) = 𝑃(π‘ž1/4) classical time

  • Best

st (known)

  • wn) att

ttack cks: s: classical 𝑃(π‘ž1/4) and quantum 𝑃(π‘ž1/6)

  • Conf

nfid iden ence ce: : both complexities are optimal for a black-box claw attack

slide-52
SLIDE 52

SIDH protocol summary

  • Se

Settin ing: g: supersingular elliptic curves 𝐹/π”Ύπ‘ž2 where π‘ž = 2𝑗3π‘˜ βˆ’ 1

  • Param

ameter eters: s: 𝐹0/π”Ύπ‘ž2 ∢ 𝑧3 = 𝑦3 + 𝑦 with #𝐹0 = 2𝑗3π‘˜ 2 𝑄

𝐡, 𝑅𝐡 ∈ 𝐹0 2𝑗

and 𝑄𝐢, 𝑅𝐢 ∈ 𝐹0[3π‘˜]

  • Public

lic key y generatio eration n (A (Alic ice): e): 𝑑 ∈ 0, 2𝑗 𝑇𝐡 = 𝑄

𝐡 + 𝑑 𝑅𝐡

𝜚𝐡 ∢ 𝐹0 β†’ 𝐹𝐡: = 𝐹0/βŸ¨π‘‡π΅βŸ© send 𝐹𝐡, 𝜚𝐡 𝑄𝐢 , 𝜚𝐡(𝑅𝐢) to Bob

  • Sh

Shared ed key y generation ration (A (Alice): lice): 𝑇𝐡𝐢 = 𝜚𝐢 𝑄

𝐡 + 𝑑 𝜚𝐢 𝑅𝐡 ∈ 𝐹𝐢

πœšπ΅β€² ∢ 𝐹𝐢 β†’ 𝐹𝐡𝐢: = 𝐹𝐢/βŸ¨π‘‡π΅πΆβŸ© π‘˜π΅πΆ = π‘˜(𝐹𝐡𝐢)

𝐹 𝐹

1

𝐹

2

𝐹

3

𝐹

𝐡

𝑇

𝐡

𝐹

𝐢

𝐹

1β€²

𝐹

2β€²

𝐹

3β€²

𝐹

𝐡𝐢

𝑇

𝐡𝐢

𝐹0 𝐹𝐡 = 𝐹0/βŒ©π‘‡π΅βŒͺ 𝐹0/βŒ©π‘‡πΆβŒͺ = 𝐹𝐢 𝜚𝐡 𝜚𝐢 πœšπ΅β€² 𝜚𝐢

β€²

slide-53
SLIDE 53

SIDH security summary

  • Se

Setting ting: : supersingular elliptic curves 𝐹/π”Ύπ‘ž2 where π‘ž is a large prime

  • Hard problem

blem: Given 𝑄, 𝑅 ∈ 𝐹 and 𝜚 𝑄 , 𝜚 𝑅 ∈ 𝜚(𝐹), compute 𝜚 (where 𝜚 has fixed, smooth, public degree)

  • Be

Best st (kno nown) n) atta tacks ks: classical 𝑃(π‘ž1/4) and quantum 𝑃(π‘ž1/6)

slide-54
SLIDE 54

Part 1: Quick re-motivation Part 2: Quick tutorial recap Part 3: SIKE

slide-55
SLIDE 55

β€œThe poor user is given enough rope with which to hang himself – something a standard should not do.”

  • Ron Rivest, 1992 (on DSA standard)
slide-56
SLIDE 56

public key compression

slide-57
SLIDE 57

𝐹𝑏,𝑐 ∢ 𝑐𝑧2 = 𝑦3 + 𝑏𝑦2 + 𝑦

Point and isogeny arithmetic in β„™1

𝐹𝐡

𝐷,𝐢 𝐷

: 𝐢𝑍2π‘Ž = π·π‘Œ3 + π΅π‘Œ2π‘Ž + π·π‘Œπ‘Ž2 𝑦, 𝑧 ↔ (π‘Œ ∢ 𝑍 ∢ π‘Ž) 𝑏, 𝑐 ↔ (𝐡 ∢ 𝐢 ∢ 𝐷) β„™1 point arithmetic: π‘Œ ∢ π‘Ž ↦ (π‘Œβ€²: π‘Žβ€²) β„™1 isogeny arithmetic: 𝐡 ∢ 𝐷 ↦ 𝐡′: 𝐷′ ECDH: move around different points on a fixed curve. SIDH: move around different points and different curves

𝐢 coefficient only fixes the quadratic twist, but π‘˜ 𝐹 = π‘˜(𝐹′)

slide-58
SLIDE 58

𝜚3 ∢ 𝐹𝑏,𝑐 β†’ 𝐹𝑏′,𝑐′

Point and isogeny arithmetic in β„™1

𝑦, 𝑧 ↦ 𝑦 β‹… 𝑦 β‹… 𝑦3 βˆ’ 1 𝑦 βˆ’ 𝑦3

2

, 𝑦 β‹… 𝑦3 βˆ’ 1 𝑦2 β‹… 𝑦3 βˆ’ 3𝑦 β‹… 𝑦3

2 + 𝑦 + 𝑦3

𝑦 βˆ’ 𝑦3 3 𝑏′, 𝑐′ = 𝑏 β‹… 𝑦3 βˆ’6𝑦3

2 + 6 β‹… 𝑦3, 𝑐 β‹… 𝑦3 2

𝜚3 ∢ 𝐹𝐡/𝐷 ,𝐢/𝐷/{Β±1} β†’ 𝐹𝐡′/𝐷′,𝐢′/𝐷′/{Β±1}

π‘Œ ∢ π‘Ž ↦ π‘Œ π‘Œ3π‘Œ βˆ’ π‘Ž3π‘Ž 2 ∢ π‘Ž π‘Ž3π‘Œ βˆ’ π‘Œ3π‘Ž 2 𝐡′: 𝐷′ = π‘Ž3

4 + 18π‘Œ3 2π‘Ž3 2 βˆ’ 27π‘Œ3 2

∢ 4π‘Œ3π‘Ž3

3

slide-59
SLIDE 59

Public keys are in π”Ύπ‘ž2

3

𝑄𝐿

𝐡 =

π‘¦πœšπ΅ 𝑄𝐢 , π‘¦πœšπ΅ 𝑅𝐢 , π‘¦πœšπ΅ π‘…πΆβˆ’π‘„πΆ

Conversely, if 𝑆 = Β±(𝑅 βˆ’ 𝑄) on 𝐹𝑏 ∢ 𝑧2 = 𝑦3 + 𝑏𝑦2 + 𝑦, then 𝑏 = 1 βˆ’ 𝑦𝑄𝑦𝑅 βˆ’ 𝑦𝑄𝑦𝑆 βˆ’ 𝑦𝑅𝑦𝑆

2

4𝑦𝑄𝑦𝑅𝑦𝑆 βˆ’ 𝑦𝑄 βˆ’ 𝑦𝑅 βˆ’ 𝑦𝑆

slide-60
SLIDE 60

The starting curve

𝐹0 ∢ 𝑧2 = 𝑦3 + 𝑦

Computing 𝜚 ∢ 𝐹0 β†’ 𝐹′ is broadly equivalent to computing End(𝐹′)

(see Kohel’s thesis, Galbraith-Vercauteren survey, Galbraith-Petit-Shani-Ti)

Computing 𝜚 ∢ 𝐹0 β†’ 𝐹′ is subexponential if 𝐹′ is defined over π”Ύπ‘ž

(see Biasse-Jao-Sankar, Galbraith-Delfs)

Known security not damaged, but perhaps we’d prefer to start on 𝐹0/π”Ύπ‘ž2 when End 𝐹 is not known. Don’t know how?

slide-61
SLIDE 61

Generating secret kernels

Recall We take

  • 𝑄

𝐡, 𝑅𝐡 ∈ 𝐹0[2𝑓𝐡] and 𝑄𝐢, 𝑅𝐢 ∈ 𝐹0[3𝑓𝐢] with full order Weil pairings

  • Alice’s secret is 𝑛𝐡 𝑄

𝐡 + π‘œπ΅ 𝑅𝐡 , Bob’s is ⟨ 𝑛𝐢 𝑄𝐢 + π‘œπΆ π‘…πΆβŸ©

  • 𝑛𝐡 = 𝑛𝐢 = 1, π‘œπ΅ ∈ [0,2β„“) and π‘œπΆ ∈ [0,2β„“β€²)
  • 𝑅𝐡 = [3𝑓𝐢] 𝑨1, βˆ’ and 𝑄

𝐡 = [3𝑓𝐢](𝑨2 + 𝑗, βˆ’)

  • 𝑅𝐢 = 2𝑓𝐡

𝑨3, βˆ’ and 𝑄𝐢 = [2𝑓𝐡](𝑨4 + 𝑗, βˆ’) Consequences

  • Simple, uniform β€œ3 point ladder” for computing 𝑄 + π‘œ 𝑅 [see FLOR’17]
  • 𝑆 = 𝑄 + π‘œ 𝑅 can never be such that [2𝑨]𝑆 = 0,0 , so one 4-isogeny function
  • Don’t reach all possible subgroups. Problem?

𝑨𝑗 ∈ β„• smallest such that points span torsions π”Ύπ‘ž π”Ύπ‘ž2

slide-62
SLIDE 62

The main loop

Optimal strategy [DJP’11] is harder , but much faster Simple, but slow e.g. πŸ‘πŸ—πŸ“πŸ“πŸ Γ— 3 + πŸ‘πŸ’πŸ˜ Γ— 𝜚3 𝑦 e.g. πŸ—πŸπŸ Γ— 3 + πŸπŸπŸ‘πŸ“ Γ— 𝜚3 𝑦 Spec/code gives concrete algorithm for deriving, checking and executing the optimal strategy

slide-63
SLIDE 63
  • Galbraith-Petit-Shani-Ti: 𝑄, 𝑅 both order 2𝑓𝐡, and Alice’s static secret 𝛽 ∈ β„€

𝑄 + 𝛽 𝑅 = βŸ¨π‘„ + 𝛽 𝑅 + 2π‘“π΅βˆ’1 𝑄 ⟩ iff 𝛽 is even

  • Send Alice ΰ·¨

𝑄 = 𝑄 and ΰ·¨ 𝑅 = (𝑅 + 2π‘“π΅βˆ’1 𝑄), if DH works fine, then 𝛽 is even, else odd

  • Even

n case (𝛽 = 2 ො 𝛽): 𝑄 + 2 ො 𝛽 𝑅 = βŸ¨π‘„ + 2 ො 𝛽 𝑅 + 2π‘“π΅βˆ’2 𝑄 ⟩ iff ො 𝛽 is even so send ΰ·¨ 𝑄 = 𝑄and ΰ·¨ 𝑅 = (𝑅 + 2π‘“π΅βˆ’2 𝑄)

  • Odd case (𝛽 = 2 ො

𝛽 + 1): 𝑄 + 2 ො 𝛽 + 1 𝑅 = βŸ¨π‘„ βˆ’ 2π‘“π΅βˆ’2 𝑅 + 2 ො 𝛽 + 1 𝑅 + 2π‘“π΅βˆ’2 𝑅 ⟩ iff ො 𝛽 is even so send ΰ·¨ 𝑄 = 1 βˆ’ 2π‘“π΅βˆ’2 𝑄 and ΰ·¨ 𝑅 = 1 + 2π‘“π΅βˆ’2 𝑅

  • … continuing yields 𝛽 in log2𝛽 adaptive interactions!!!

No known Weil to detect foul play, provided ΰ·¨ 𝑄, ΰ·¨ 𝑅 are scaled correctly!

The problem with reusing static keys

slide-64
SLIDE 64

Alice Passively secure encryption (IND-CPA PKE), Γ  la ElGamal Bob

𝑄𝐿

𝐡 =

𝜚𝐡 𝐹0 , 𝜚𝐡 𝑄𝐢 , 𝜚𝐡 𝑅𝐢 𝑄𝐿𝐢 = 𝜚𝐢 𝐹0 , 𝜚𝐢 𝑄

𝐡 , 𝜚𝐢 𝑅𝐡

π‘˜ = π‘˜ 𝐹𝐢𝐡 = π‘˜ 𝜚𝐢 𝜚𝐡 𝐹0 𝑄𝐿𝐢 , 𝐼1 π‘˜ βŠ• 𝑛 π‘˜ = π‘˜ 𝐹𝐡𝐢 = π‘˜ 𝜚𝐡 𝜚𝐢 𝐹0

slide-65
SLIDE 65

Actively secure key encapsulation (IND-CCA KEM) Alice Bob

𝑄𝐿

𝐡 =

𝜚𝐡 𝐹0 , 𝜚𝐡 𝑄𝐢 , 𝜚𝐡 𝑅𝐢 𝑄𝐿𝐢 = 𝜚𝐢 𝐹0 , 𝜚𝐢 𝑄

𝐡 , 𝜚𝐢 𝑅𝐡

π‘˜ = π‘˜ 𝐹𝐢𝐡 = π‘˜ 𝜚𝐢 𝜚𝐡 𝐹0 π‘˜ = π‘˜ 𝐹𝐡𝐢 = π‘˜ 𝜚𝐡 𝜚𝐢 𝐹0 𝑄𝐿𝐢 , 𝐼1 π‘˜ βŠ• 𝑛

slide-66
SLIDE 66

Actively secure key encapsulation (IND-CCA KEM) Alice Bob

𝑄𝐿

𝐡 =

𝜚𝐡 𝐹0 , 𝜚𝐡 𝑄𝐢 , 𝜚𝐡 𝑅𝐢 𝑄𝐿𝐢(𝑠) = 𝜚𝐢 𝐹0 , 𝜚𝐢 𝑄

𝐡 , 𝜚𝐢 𝑅𝐡

π‘˜ = π‘˜ 𝐹𝐢𝐡 = π‘˜ 𝜚𝐢 𝜚𝐡 𝐹0 π‘˜ = π‘˜ 𝐹𝐡𝐢 = π‘˜ 𝜚𝐡 𝜚𝐢 𝐹0 𝑄𝐿𝐢(𝑠) , 𝐼1 π‘˜ βŠ• 𝑛 𝑑 βˆˆπ‘† 0,1 β„“ 𝑛 βˆˆπ‘† 0,1 β„“ 𝑠 = 𝐼2(𝑄𝐿

𝐡, 𝑛)

slide-67
SLIDE 67

Actively secure key encapsulation (IND-CCA KEM) Alice Bob

𝑄𝐿

𝐡 =

𝜚𝐡 𝐹0 , 𝜚𝐡 𝑄𝐢 , 𝜚𝐡 𝑅𝐢 𝑄𝐿𝐢(𝑠) = 𝜚𝐢 𝐹0 , 𝜚𝐢 𝑄

𝐡 , 𝜚𝐢 𝑅𝐡

π‘˜ = π‘˜ 𝐹𝐢𝐡 = π‘˜ 𝜚𝐢 𝜚𝐡 𝐹0 π‘˜ = π‘˜ 𝐹𝐡𝐢 = π‘˜ 𝜚𝐡 𝜚𝐢 𝐹0 𝑑 = 𝑄𝐿𝐢(𝑠) , 𝐼1 π‘˜ βŠ• 𝑛 𝑑 βˆˆπ‘† 0,1 β„“ 𝑛 βˆˆπ‘† 0,1 β„“ 𝑠 = 𝐼2(𝑄𝐿

𝐡, 𝑛)

𝐿 = 𝐼3(𝑑, 𝑛)

slide-68
SLIDE 68

Actively secure key encapsulation (IND-CCA KEM) Alice Bob

𝑄𝐿

𝐡 =

𝜚𝐡 𝐹0 , 𝜚𝐡 𝑄𝐢 , 𝜚𝐡 𝑅𝐢 𝑄𝐿𝐢(𝑠) = 𝜚𝐢 𝐹0 , 𝜚𝐢 𝑄

𝐡 , 𝜚𝐢 𝑅𝐡

π‘˜ = π‘˜ 𝐹𝐢𝐡 = π‘˜ 𝜚𝐢 𝜚𝐡 𝐹0 π‘˜ = π‘˜ 𝐹𝐡𝐢 = π‘˜ 𝜚𝐡 𝜚𝐢 𝐹0 𝑑 = 𝑄𝐿𝐢(𝑠) , 𝐼1 π‘˜ βŠ• 𝑛 𝑑 βˆˆπ‘† 0,1 β„“ 𝑛 βˆˆπ‘† 0,1 β„“ 𝑠 = 𝐼2(𝑄𝐿

𝐡, 𝑛)

𝐿 = 𝐼3(𝑑, 𝑛) 𝑛′ = 𝑑 2 βŠ• 𝐼1(π‘˜)

slide-69
SLIDE 69

Actively secure key encapsulation (IND-CCA KEM) Alice Bob

𝑄𝐿

𝐡 =

𝜚𝐡 𝐹0 , 𝜚𝐡 𝑄𝐢 , 𝜚𝐡 𝑅𝐢 𝑄𝐿𝐢(𝑠) = 𝜚𝐢 𝐹0 , 𝜚𝐢 𝑄

𝐡 , 𝜚𝐢 𝑅𝐡

π‘˜ = π‘˜ 𝐹𝐢𝐡 = π‘˜ 𝜚𝐢 𝜚𝐡 𝐹0 π‘˜ = π‘˜ 𝐹𝐡𝐢 = π‘˜ 𝜚𝐡 𝜚𝐢 𝐹0 𝑑 = 𝑄𝐿𝐢(𝑠) , 𝐼1 π‘˜ βŠ• 𝑛 𝑑 βˆˆπ‘† 0,1 β„“ 𝑛 βˆˆπ‘† 0,1 β„“ 𝑠 = 𝐼2(𝑄𝐿

𝐡, 𝑛)

𝐿 = 𝐼3(𝑑, 𝑛) 𝑛′ = 𝑑 2 βŠ• 𝐼1(π‘˜) 𝑠′ = 𝐼2(𝑄𝐿

𝐡, 𝑛′)

slide-70
SLIDE 70

Actively secure key encapsulation (IND-CCA KEM) Alice Bob

𝑄𝐿

𝐡 =

𝜚𝐡 𝐹0 , 𝜚𝐡 𝑄𝐢 , 𝜚𝐡 𝑅𝐢 𝑄𝐿𝐢(𝑠) = 𝜚𝐢 𝐹0 , 𝜚𝐢 𝑄

𝐡 , 𝜚𝐢 𝑅𝐡

π‘˜ = π‘˜ 𝐹𝐢𝐡 = π‘˜ 𝜚𝐢 𝜚𝐡 𝐹0 π‘˜ = π‘˜ 𝐹𝐡𝐢 = π‘˜ 𝜚𝐡 𝜚𝐢 𝐹0 𝑑 = 𝑄𝐿𝐢(𝑠) , 𝐼1 π‘˜ βŠ• 𝑛 𝑑 βˆˆπ‘† 0,1 β„“ 𝑛 βˆˆπ‘† 0,1 β„“ 𝑠 = 𝐼2(𝑄𝐿

𝐡, 𝑛)

𝐿 = 𝐼3(𝑑, 𝑛) 𝑛′ = 𝑑 2 βŠ• 𝐼1(π‘˜) 𝑠′ = 𝐼2(𝑄𝐿

𝐡, 𝑛′)

if if 𝑄𝐿𝐢 𝑠′ = 𝑑[1] then 𝐿 = 𝐼3(𝑑, 𝑛′) else se 𝐿 = 𝐼3(𝑑, 𝑑)

slide-71
SLIDE 71

Actively secure key encapsulation (IND-CCA KEM) Alice Bob

𝑄𝐿

𝐡 =

𝜚𝐡 𝐹0 , 𝜚𝐡 𝑄𝐢 , 𝜚𝐡 𝑅𝐢 𝑄𝐿𝐢(𝑠) = 𝜚𝐢 𝐹0 , 𝜚𝐢 𝑄

𝐡 , 𝜚𝐢 𝑅𝐡

π‘˜ = π‘˜ 𝐹𝐢𝐡 = π‘˜ 𝜚𝐢 𝜚𝐡 𝐹0 π‘˜ = π‘˜ 𝐹𝐡𝐢 = π‘˜ 𝜚𝐡 𝜚𝐢 𝐹0 𝑑 = 𝑄𝐿𝐢(𝑠) , 𝐼1 π‘˜ βŠ• 𝑛 𝑑 βˆˆπ‘† 0,1 β„“ 𝑛 βˆˆπ‘† 0,1 β„“ 𝑠 = 𝐼2(𝑄𝐿

𝐡, 𝑛)

𝐿 = 𝐼3(𝑑, 𝑛) 𝑛′ = 𝑑 2 βŠ• 𝐼1(π‘˜) 𝑠′ = 𝐼2(𝑄𝐿

𝐡, 𝑛′)

if if 𝑄𝐿𝐢 𝑠′ = 𝑑[1] then 𝐿 = 𝐼3(𝑑, 𝑛′) else se 𝐿 = 𝐼3(𝑑, 𝑑)

𝐼1 π‘˜ = cSHAKE256(π‘˜, 𝑙, " ", 2) 𝐼2 𝑄𝐿

𝐡, 𝑛 = cSHAKE256(𝑛||𝑄𝐿 𝐡, 𝑓2, " ", 0)

𝐼3 𝑑, 𝑛 = cSHAKE256(𝑛||𝑑, 𝑙, " " , 1)

slide-72
SLIDE 72

The curves and their security estimates

Name (SIKEp+ ⌈log2 π‘žβŒ‰) (𝒇𝑩, 𝒇π‘ͺ) 𝒍 πŸ‘π’βˆ’πŸ 𝐧𝐣𝐨 ( πŸ‘π’‡π‘©, πŸ’π’‡πŸ’) βˆšπŸ‘π’ 𝐧𝐣𝐨 (βˆ›πŸ‘π’‡πŸ‘, βˆ›πŸ’π’‡πŸ’) SIKEp503 (250,159) 128 2127 2125 264 283 SIKEp761 (372,239) 192 2191 2186 296 2124 SIKEp964 (486,301) 256 2255 2238 2128 2159 π‘ž = 2𝑓𝐡3eB βˆ’ 1

slide-73
SLIDE 73

SIKE vs. IND-CCA lattice KEMs

Name Primitive Quantum sec (bits) Encaps+ Decaps (ms) Size of Encaps. (KB) NTRU-KEM NTRU 123 0.03 1.3 Kyber M-LWE 161 0.07 1.2 FrodoKEM LWE 103-150 1.2 – 2.3 9.5 – 15.4 SIKE Supersingular Isogeny 84-125 10 – 30 0.4 – 0.6

Results obtained on 3.4GHz Intel Haswell (Kyber and NTRU-KEM) or Skylake (FrodoKEM and SIKE)

slide-74
SLIDE 74

Easy ECDH hybrid

There are exponentially many 𝑏 such that 𝐹𝑏 /π”Ύπ‘ž2: 𝑧2 = 𝑦3 + 𝑏𝑦2 + 𝑦 is in the supersingular isogeny class. These are all unsuitable for ECDH. There are also exponentially many 𝐡 such that 𝐹𝑏 /π”Ύπ‘ž: 𝑧2 = 𝑦3 + 𝑏𝑦2 + 𝑦 is suitable for ECDH. E.g., smallest 𝑏 ∈ π”Ύπ‘ž such that 𝐹𝑏 is twist-secure.

Public keys only 1.17x larger , slowdown less than this, but…. e.g., on smallest curve we replace 128-bit classical security (SSDDH) with 256-bit classical security (ECDLP)

slide-75
SLIDE 75

Questions?