Verifiable Delay Functions and More from Isogenies and Pairings Luca - - PowerPoint PPT Presentation

▶
verifiable delay functions and more from isogenies and
SMART_READER_LITE
LIVE PREVIEW

Verifiable Delay Functions and More from Isogenies and Pairings Luca - - PowerPoint PPT Presentation

Nov 21, 2022 199 likes •929 views

Verifiable Delay Functions and More from Isogenies and Pairings Luca De Feo based on joint work with J. Burdges, S. Masson, C. Petit, A. Sanso IBM Research Zrich December 4, 2019, ECC, Bochum Slides online at https://defeo.lu/docet

slide-1
SLIDE 1

Verifiable Delay Functions and More from Isogenies and Pairings

Luca De Feo based on joint work with J. Burdges, S. Masson, C. Petit, A. Sanso

IBM Research Zürich December 4, 2019, ECC, Bochum Slides online at https://defeo.lu/docet

slide-2
SLIDE 2

Distributed lottery

Participants A, B, ..., Z want to agree on a random winning ticket.

Flawed protocol

Each participant x broadcasts a random string sx; Winning ticket is H✭sA❀ ✿ ✿ ✿ ❀ sZ ✮.

■ ■

❂ ✭ ❀ ✿ ✿ ✿ ❀ ✮

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 2 / 28

slide-3
SLIDE 3

Distributed lottery

Participants A, B, ..., Z want to agree on a random winning ticket.

Flawed protocol

Each participant x broadcasts a random string sx; Winning ticket is H✭sA❀ ✿ ✿ ✿ ❀ sZ ✮. Cheating participant Z waits to see all other strings, then brute-forces sZ to win lottery.

■ ■

❂ ✭ ❀ ✿ ✿ ✿ ❀ ✮

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 2 / 28

slide-4
SLIDE 4

Distributed lottery

Participants A, B, ..., Z want to agree on a random winning ticket.

Flawed protocol

Each participant x broadcasts a random string sx; Winning ticket is H✭sA❀ ✿ ✿ ✿ ❀ sZ ✮. Cheating participant Z waits to see all other strings, then brute-forces sZ to win lottery.

Fixes

Make the hash function sloooooooooooooooooooooooooooow;

■ e.g., participants have 10 minutes to submit sx, ■ outcome will be known afer 20 minutes.

❂ ✭ ❀ ✿ ✿ ✿ ❀ ✮

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 2 / 28

slide-5
SLIDE 5

Distributed lottery

Participants A, B, ..., Z want to agree on a random winning ticket.

Flawed protocol

Each participant x broadcasts a random string sx; Winning ticket is H✭sA❀ ✿ ✿ ✿ ❀ sZ ✮. Cheating participant Z waits to see all other strings, then brute-forces sZ to win lottery.

Fixes

Make the hash function sloooooooooooooooooooooooooooow;

■ e.g., participants have 10 minutes to submit sx, ■ outcome will be known afer 20 minutes.

Make it possible to verify w ❂ H✭sA❀ ✿ ✿ ✿ ❀ sZ ✮ fast.

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 2 / 28

slide-6
SLIDE 6

Verifiable Delay Functions (Boneh, Bonneau, Bünz, Fisch 2018)

Wanted

Function (family) f ✿ X ✦ Y s.t.: Evaluating f ✭x✮ takes long time:

■ uniformly long time, ■ on almost all random inputs x, ■ even afer having seen many values of f ✭x ✵✮, ■ even given massive number of processors;

Verifying y ❂ f ✭x✮ is efficient:

■ ideally, exponential separation between evaluation and verification. Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 3 / 28

slide-7
SLIDE 7

Verifiable Delay Functions (Boneh, Bonneau, Bünz, Fisch 2018)

Wanted

Function (family) f ✿ X ✦ Y s.t.: Evaluating f ✭x✮ takes long time:

■ uniformly long time, ■ on almost all random inputs x, ■ even afer having seen many values of f ✭x ✵✮, ■ even given massive number of processors;

Verifying y ❂ f ✭x✮ is efficient:

■ ideally, exponential separation between evaluation and verification.

Exercise

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 3 / 28

slide-8
SLIDE 8

Verifiable Delay Functions (Boneh, Bonneau, Bünz, Fisch 2018)

Wanted

Function (family) f ✿ X ✦ Y s.t.: Evaluating f ✭x✮ takes long time:

■ uniformly long time, ■ on almost all random inputs x, ■ even afer having seen many values of f ✭x ✵✮, ■ even given massive number of processors;

Verifying y ❂ f ✭x✮ is efficient:

■ ideally, exponential separation between evaluation and verification.

Exercise Think of a function you like with these properties

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 3 / 28

slide-9
SLIDE 9

Verifiable Delay Functions (Boneh, Bonneau, Bünz, Fisch 2018)

Wanted

Function (family) f ✿ X ✦ Y s.t.: Evaluating f ✭x✮ takes long time:

■ uniformly long time, ■ on almost all random inputs x, ■ even afer having seen many values of f ✭x ✵✮, ■ even given massive number of processors;

Verifying y ❂ f ✭x✮ is efficient:

■ ideally, exponential separation between evaluation and verification.

Exercise Think of a function you like with these properties Got it?

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 3 / 28

slide-10
SLIDE 10

Verifiable Delay Functions (Boneh, Bonneau, Bünz, Fisch 2018)

Wanted

Function (family) f ✿ X ✦ Y s.t.: Evaluating f ✭x✮ takes long time:

■ uniformly long time, ■ on almost all random inputs x, ■ even afer having seen many values of f ✭x ✵✮, ■ even given massive number of processors;

Verifying y ❂ f ✭x✮ is efficient:

■ ideally, exponential separation between evaluation and verification.

Exercise Think of a function you like with these properties Got it? You’re probably wrong!

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 3 / 28

slide-11
SLIDE 11

Sequentiality

Ideal functionality: y ❂ f ✭x✮ ❂ H✭H✭✁ ✁ ✁ ✭H✭x✮✮✮✮

⑤ ④③ ⑥

T times

Sequential assuming hash output “unpredictability”, but how do you verify? (you’re not allowed to say “SNARKs”)

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 4 / 28

slide-12
SLIDE 12

VDFs from groups of unknown order (inspired by Rivest–Shamir–Wagner time-lock puzzle)

Setup

A group of unknown order, e.g.: ❩❂N❩ with N ❂ pq an RSA modulus, p❀ q unknown (e.g., generated by some trusted authority), Class group of imaginary quadratic order.

Evaluation

With delay parameter T: f ✿ G ✦ G x ✼ ✦ x 2T Conjecturally, fastest algorithm is repeated squaring. x ♠♦❞ ✬✭ ✮

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 5 / 28

slide-13
SLIDE 13

VDFs from groups of unknown order (inspired by Rivest–Shamir–Wagner time-lock puzzle)

Setup

A group of unknown order, e.g.: ❩❂N❩ with N ❂ pq an RSA modulus, p❀ q unknown (e.g., generated by some trusted authority), Class group of imaginary quadratic order.

Evaluation

With delay parameter T: f ✿ G ✦ G x ✼ ✦ x 2T Conjecturally, fastest algorithm is repeated squaring. x x 2 ♠♦❞ ✬✭ ✮

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 5 / 28

slide-14
SLIDE 14

VDFs from groups of unknown order (inspired by Rivest–Shamir–Wagner time-lock puzzle)

Setup

A group of unknown order, e.g.: ❩❂N❩ with N ❂ pq an RSA modulus, p❀ q unknown (e.g., generated by some trusted authority), Class group of imaginary quadratic order.

Evaluation

With delay parameter T: f ✿ G ✦ G x ✼ ✦ x 2T Conjecturally, fastest algorithm is repeated squaring. x x 2 x 4 ♠♦❞ ✬✭ ✮

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 5 / 28

slide-15
SLIDE 15

VDFs from groups of unknown order (inspired by Rivest–Shamir–Wagner time-lock puzzle)

Setup

A group of unknown order, e.g.: ❩❂N❩ with N ❂ pq an RSA modulus, p❀ q unknown (e.g., generated by some trusted authority), Class group of imaginary quadratic order.

Evaluation

With delay parameter T: f ✿ G ✦ G x ✼ ✦ x 2T Conjecturally, fastest algorithm is repeated squaring. x x 2 x 4 x 2T ♠♦❞ ✬✭ ✮

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 5 / 28

slide-16
SLIDE 16

VDFs from groups of unknown order (inspired by Rivest–Shamir–Wagner time-lock puzzle)

Setup

A group of unknown order, e.g.: ❩❂N❩ with N ❂ pq an RSA modulus, p❀ q unknown (e.g., generated by some trusted authority), Class group of imaginary quadratic order.

Evaluation

With delay parameter T: f ✿ G ✦ G x ✼ ✦ x 2T Conjecturally, fastest algorithm is repeated squaring. x x 2 x 4 x 2T 2T ♠♦❞ ✬✭N✮

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 5 / 28

slide-17
SLIDE 17

VDFs from groups of unknown order (inspired by Rivest–Shamir–Wagner time-lock puzzle)

Setup

A group of unknown order, e.g.: ❩❂N❩ with N ❂ pq an RSA modulus, p❀ q unknown (e.g., generated by some trusted authority), Class group of imaginary quadratic order.

Evaluation

With delay parameter T: f ✿ G ✦ G x ✼ ✦ x 2T Conjecturally, fastest algorithm is repeated squaring.

Verification

Interactive proofs that y ❂ f ✭x✮, (non interactivity via Fiat-Shamir): ✭❧♦❣✭ ✮✮ ✷ ✮ ✭ ✮

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 5 / 28

slide-18
SLIDE 18

VDFs from groups of unknown order (inspired by Rivest–Shamir–Wagner time-lock puzzle)

Setup

A group of unknown order, e.g.: ❩❂N❩ with N ❂ pq an RSA modulus, p❀ q unknown (e.g., generated by some trusted authority), Class group of imaginary quadratic order.

Evaluation

With delay parameter T: f ✿ G ✦ G x ✼ ✦ x 2T Conjecturally, fastest algorithm is repeated squaring.

Verification

Interactive proofs that y ❂ f ✭x✮, (non interactivity via Fiat-Shamir): Pietrzak ’19: Proof size O✭❧♦❣✭T✮✮, Hard to find (non-trivial) w ✷ G of known order ✮ Proof is sound. ✭ ✮

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 5 / 28

slide-19
SLIDE 19

VDFs from groups of unknown order (inspired by Rivest–Shamir–Wagner time-lock puzzle)

Setup

A group of unknown order, e.g.: ❩❂N❩ with N ❂ pq an RSA modulus, p❀ q unknown (e.g., generated by some trusted authority), Class group of imaginary quadratic order.

Evaluation

With delay parameter T: f ✿ G ✦ G x ✼ ✦ x 2T Conjecturally, fastest algorithm is repeated squaring.

Verification

Interactive proofs that y ❂ f ✭x✮, (non interactivity via Fiat-Shamir): Pietrzak ’19: Proof size O✭❧♦❣✭T✮✮, Hard to find (non-trivial) w ✷ G of known order ✮ Proof is sound. Wesolowski ’19: Proof size O✭1✮, More emphad hoc security assumption.

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 5 / 28

slide-20
SLIDE 20

Where have I seen this before?

■ ■

❂❋

❊♥❞✭ ✮ ✩ ✩ ✩ ✩ ✩ x 20 x 21 x 22 x 23 x 24 x 25 x 26 x 27 x 28 x 29 x 210 x 211 x 212 x 213 x 214x 215 x 216

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 6 / 28

slide-21
SLIDE 21

Where have I seen this before?

Isogeny cycles

Vertices are elliptic curves:

■ Ordinary, ■ Supersingular ❂❋p.

Edges are horizontal isogenies. ❊♥❞✭ ✮ ✩ ✩ ✩ ✩ ✩ E0 E1 E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12 E13 E14 E15 E16

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 6 / 28

slide-22
SLIDE 22

Where have I seen this before?

Isogeny cycles

Vertices are elliptic curves:

■ Ordinary, ■ Supersingular ❂❋p.

Edges are horizontal isogenies. The class group of ❊♥❞✭E✮ acts upon the cycle: isogeny ✩ ideal endomorphism ✩ principal ideal degree ✩ norm dual ✩ complex conjugate cycle size ✩

  • rder of the ideal

E0 E1 E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12 E13 E14 E15 E16

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 6 / 28

slide-23
SLIDE 23

Where have I seen this before?

Isogeny cycles

Vertices are elliptic curves:

■ Ordinary,

Couveignes–Rostovtsev–Stolbunov

■ Supersingular ❂❋p.

CSIDH

Edges are horizontal isogenies. The class group of ❊♥❞✭E✮ acts upon the cycle: isogeny ✩ ideal endomorphism ✩ principal ideal degree ✩ norm dual ✩ complex conjugate cycle size ✩

  • rder of the ideal

E0 E1 E2 E3 E4 E5 E6 E7 E8 E9 E10 E11 E12 E13 E14 E15 E16

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 6 / 28

slide-24
SLIDE 24

Slooooooooooooooooooooooooooooooooooooooooooow isogenies

Setup

With delay parameter T: A laaaaaaaaaaaaaaaaaaaaaaaarge isogeny cycle, ✣ ✿ ✦ ✣ ✣ ✿ ✭❋ ✮ ✦ ✭❋ ✮ ✼ ✦ ✣✭ ✮ E0 E1 E2 ET

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 7 / 28

slide-25
SLIDE 25

Slooooooooooooooooooooooooooooooooooooooooooow isogenies

Setup

With delay parameter T: A laaaaaaaaaaaaaaaaaaaaaaaarge isogeny cycle, A starting curve E0, An isogeny ✣ ✿ E0 ✦ ET of degree 2T. ✣ ✣ ✿ ✭❋ ✮ ✦ ✭❋ ✮ ✼ ✦ ✣✭ ✮ E0 E1 E2 ET

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 7 / 28

slide-26
SLIDE 26

Slooooooooooooooooooooooooooooooooooooooooooow isogenies

Setup

With delay parameter T: A laaaaaaaaaaaaaaaaaaaaaaaarge isogeny cycle, A starting curve E0, An isogeny ✣ ✿ E0 ✦ ET of degree 2T.

Evaluation

✣ is the VDF: ✣ ✿ E0✭❋p✮ ✦ ET✭❋p✮ P ✼ ✦ ✣✭P✮ Conjecturally, no faster way than composing degree 2 isogenies. E0 E1 E2 ET

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 7 / 28

slide-27
SLIDE 27

Slooooooooooooooooooooooooooooooooooooooooooow isogenies

Setup

With delay parameter T: A laaaaaaaaaaaaaaaaaaaaaaaarge isogeny cycle, A starting curve E0, An isogeny ✣ ✿ E0 ✦ ET of degree 2T.

Evaluation

✣ is the VDF: ✣ ✿ E0✭❋p✮ ✦ ET✭❋p✮ P ✼ ✦ ✣✭P✮ Conjecturally, no faster way than composing degree 2 isogenies. E0 E1 E2 ET

How to verify?

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 7 / 28

slide-28
SLIDE 28

Isogeny <3 Pairing

Theorem

Let ✣ ✿ E ✦ E ✵ be an isogeny and ❫ ✣ ✿ E ✵ ✦ E its dual. Let eN be the Weil pairing of E and e✵

N

that of E ✵. Then eN ✭P❀ ❫ ✣✭Q✮✮ ❂ e✵

N ✭✣✭P✮❀ Q✮❀

for any P ✷ E❬N❪ and Q ✷ E ✵❬N❪.

Corollary

e✵

N ✭✣✭P✮❀ ✣✭Q✮✮ ❂ eN ✭P❀ Q✮❞❡❣ ✣✿

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 8 / 28

slide-29
SLIDE 29

Refresher: Boneh–Lynn–Shacham (BLS) signatures

Setup: Elliptic curve E❂❋p, s.t N❥★E✭❋p✮ for a large prime N, (Weil) pairing eN ✿ E❬N❪ ✂ E❬N❪ ✦ ❋pk for some small embedding degree k, A decomposition E❬N❪ ❂ X1 ✂ X2, with X1 ❂ ❤P✐. A hash function H ✿ ❢0❀ 1❣✄ ✦ X2. Private key: s ✷ ❩❂N❩. Public key: sP. Sign: m ✼✦ sH✭m✮. Verifiy: eN ✭P❀ sH✭m✮✮ ❂ eN ✭sP❀ H✭m✮✮. X1 ✂ X2 X1 ✂ X2 X1 ✂ X2 ❋pk

❬s❪ ✂ 1 1 ✂ ❬s❪ eN eN

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 9 / 28

slide-30
SLIDE 30

US patent 8,250,367 (Broker, Charles and Lauter 2012)

Signatures from isogenies + pairings

Replace the secret ❬s❪ ✿ E ✦ E with an isogeny ✣ ✿ E ✦ E ✵; Define decompositions E❬N❪ ❂ X1 ✂ X2❀ E ✵❬N❪ ❂ Y1 ✂ Y2❀ s.t. ✣✭X1✮ ❂ Y1 and ✣✭X2✮ ❂ Y2; Define a hash function H ✿ ❢0❀ 1❣✄ ✦ Y2. X1 ✂ Y2 Y1 ✂ Y2 X1 ✂ X2 ❋pk

✣ ✂ 1 1 ✂ ❫ ✣ e✵

N

eN

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 10 / 28

slide-31
SLIDE 31

Isogeny VDF (principle)

Setup

Pairing friendly curve E, Isogeny ✣ ✿ E ✦ E ✵ of degree ❵T, Point P ✷ X1, image ✣✭P✮ ✷ Y1.

Evaluation

Input: random Q ✷ Y2, Output: ❫ ✣✭Q✮ ✷ X2.

Verification eN✭P❀ ❫ ✣✭Q✮✮

❄

❂ e✵

N✭✣✭P✮❀ Q✮✿

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 11 / 28

slide-32
SLIDE 32

Instantiation over ❋p

The curves

Need a large enough isogeny class; Need pairing friendliness;

✮

✮ supersingular curves.

Technicalities

✰ ❂ ✁

■

❵ ❂ ❥

❂❋ ❵

■

❵ ❂ ✮

■

❵

✁ ❂

❵ ❂ ❬ ❪ ❭ ✭❋ ✮

■

❂ ❬✭ ❀ ✙ ✰ ✮❪❀ ❂ ❬✭ ❀ ✙ ✮❪✿

■

❂

✵❬✭

❀ ✙ ✰ ✮❪❀ ❂

✵❬✭

❀ ✙ ✮❪✿

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 12 / 28

slide-33
SLIDE 33

Instantiation over ❋p

The curves

Need a large enough isogeny class; Need pairing friendliness;

✮

✮ supersingular curves.

Technicalities

Choose p ✰ 1 ❂ N ✁ f ,

■ for degree ❵ ❂ 2 also need 8❥f ;

❂❋ ❵

■

❵ ❂ ✮

■

❵

✁ ❂

❵ ❂ ❬ ❪ ❭ ✭❋ ✮

■

❂ ❬✭ ❀ ✙ ✰ ✮❪❀ ❂ ❬✭ ❀ ✙ ✮❪✿

■

❂

✵❬✭

❀ ✙ ✰ ✮❪❀ ❂

✵❬✭

❀ ✙ ✮❪✿

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 12 / 28

slide-34
SLIDE 34

Instantiation over ❋p

The curves

Need a large enough isogeny class; Need pairing friendliness;

✮

✮ supersingular curves.

Technicalities

Choose p ✰ 1 ❂ N ✁ f ,

■ for degree ❵ ❂ 2 also need 8❥f ;

Choose E❂❋p on an ❵-isogeny cycle

■ If ❵ ❂ 2 ✮ choose E with maximal endomorphism ring; ■ Otherwise

p

❵

✁ ❂ 1.

❵ ❂ ❬ ❪ ❭ ✭❋ ✮

■

❂ ❬✭ ❀ ✙ ✰ ✮❪❀ ❂ ❬✭ ❀ ✙ ✮❪✿

■

❂

✵❬✭

❀ ✙ ✰ ✮❪❀ ❂

✵❬✭

❀ ✙ ✮❪✿

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 12 / 28

slide-35
SLIDE 35

Instantiation over ❋p

The curves

Need a large enough isogeny class; Need pairing friendliness;

✮

✮ supersingular curves.

Technicalities

Choose p ✰ 1 ❂ N ✁ f ,

■ for degree ❵ ❂ 2 also need 8❥f ;

Choose E❂❋p on an ❵-isogeny cycle

■ If ❵ ❂ 2 ✮ choose E with maximal endomorphism ring; ■ Otherwise

p

❵

✁ ❂ 1.

There are only two ❵T-isogenies from E, choose any. ❂ ❬ ❪ ❭ ✭❋ ✮

■

❂ ❬✭ ❀ ✙ ✰ ✮❪❀ ❂ ❬✭ ❀ ✙ ✮❪✿

■

❂

✵❬✭

❀ ✙ ✰ ✮❪❀ ❂

✵❬✭

❀ ✙ ✮❪✿

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 12 / 28

slide-36
SLIDE 36

Instantiation over ❋p

The curves

Need a large enough isogeny class; Need pairing friendliness;

✮

✮ supersingular curves.

Technicalities

Choose p ✰ 1 ❂ N ✁ f ,

■ for degree ❵ ❂ 2 also need 8❥f ;

Choose E❂❋p on an ❵-isogeny cycle

■ If ❵ ❂ 2 ✮ choose E with maximal endomorphism ring; ■ Otherwise

p

❵

✁ ❂ 1.

There are only two ❵T-isogenies from E, choose any. Set X2 ❂ E❬N❪ ❭ E✭❋p✮ and X1 as the other eigenspace of Frobenius:

■ Short notation:

X1 ❂ E❬✭N❀ ✙ ✰ 1✮❪❀ X2 ❂ E❬✭N❀ ✙ 1✮❪✿

■ Similarly:

Y1 ❂ E ✵❬✭N❀ ✙ ✰ 1✮❪❀ Y2 ❂ E ✵❬✭N❀ ✙ 1✮❪✿

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 12 / 28

slide-37
SLIDE 37

Instantiation over ❋p2

There’s nothing special with isogeny cycles

May as well use isogeny walks in the full supersingular graph (like Charles–Goren–Lauter, SIDH, ...) But we still need a canonical decomposition E❬N❪ ❂ X1 ✂ X2 ✮ start from E❂❋p.

Technicalities

✰ ❂ ✁ ✭ ❀ ❵✮ ❵ ❂ ✣✭ ✮

■

✵❬

❪

■

❫ ✣ ❂❋

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 13 / 28

slide-38
SLIDE 38

Instantiation over ❋p2

There’s nothing special with isogeny cycles

May as well use isogeny walks in the full supersingular graph (like Charles–Goren–Lauter, SIDH, ...) But we still need a canonical decomposition E❬N❪ ❂ X1 ✂ X2 ✮ start from E❂❋p.

Technicalities

p ✰ 1 ❂ N ✁ f , no conditions on ✭p❀ ❵✮; ❵ ❂ ✣✭ ✮

■

✵❬

❪

■

❫ ✣ ❂❋

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 13 / 28

slide-39
SLIDE 39

Instantiation over ❋p2

There’s nothing special with isogeny cycles

May as well use isogeny walks in the full supersingular graph (like Charles–Goren–Lauter, SIDH, ...) But we still need a canonical decomposition E❬N❪ ❂ X1 ✂ X2 ✮ start from E❂❋p.

Technicalities

p ✰ 1 ❂ N ✁ f , no conditions on ✭p❀ ❵✮; There are exponentially many ❵T-isogenies, choose any (pseudorandomly); ❂ ✣✭ ✮

■

✵❬

❪

■

❫ ✣ ❂❋

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 13 / 28

slide-40
SLIDE 40

Instantiation over ❋p2

There’s nothing special with isogeny cycles

May as well use isogeny walks in the full supersingular graph (like Charles–Goren–Lauter, SIDH, ...) But we still need a canonical decomposition E❬N❪ ❂ X1 ✂ X2 ✮ start from E❂❋p.

Technicalities

p ✰ 1 ❂ N ✁ f , no conditions on ✭p❀ ❵✮; There are exponentially many ❵T-isogenies, choose any (pseudorandomly); Impossible to hash into Y2 ❂ ✣✭X2✮:

■ Domain of VDF is all of E ✵❬N❪; ■ To make the protocol sound we compose ❫

✣ with the trace of E❂❋p2.

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 13 / 28

slide-41
SLIDE 41

Comparison

Wesolowski Pietrzak Ours RSA class group RSA class group ❋p ❋p2 proof size O✭1✮ O✭1✮ O✭❧♦❣✭T✮✮ O✭❧♦❣✭T✮✮ — — aggregatable yes yes yes yes — — watermarkable yes yes yes yes (yes) (yes) perfect soundness no no no no yes yes long setup no no no no yes yes trusted setup yes no yes no yes yes best attack LN ✭1❂3✮ LN ✭1❂2✮ LN ✭1❂3✮ LN ✭1❂2✮ Lp✭1❂3✮ Lp✭1❂3✮ quantum annoying no (yes) no (yes) no yes

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 14 / 28

slide-42
SLIDE 42

Implementation

PoC implementation in SageMath (re-implemented Montgomery isogenies); p ✰ 1 ❂ N ✁ 21244 ✁ 63, enables time/memory compromise in evaluation. Protocol Step Parameters size (T ✙ 216) Time Throughput ❋p graph Setup 238 kb — 0.75 isog/ms Evaluation — — 0.75 isog/ms Verification — 0✿3 s — ❋p2 graph Setup 491 kb — 0.35 isog/ms Evaluation — — 0.23 isog/ms Verification — 4 s —

Table: Benchmarks (Intel Core i7-8700 @3.20GHz) at 128 bits of security (aggressively optimizing for size).

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 15 / 28

slide-43
SLIDE 43

Security

slide-44
SLIDE 44

Attacks

Security goal

Given the isogeny ✣ ✿ E ✦ E, the adversary is allowed ♣♦❧②✭T✮ precomputation. Later, it is given a random Q ✷ Y2: its probability of computing ❫ ✣✭Q✮ in less than “T steps” must be negligible. Attack avenues:

1

Speed-up/parallelize isogeny computation;

2

Solve the pairing equation;

3

Find isogeny shortcuts.

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 17 / 28

slide-45
SLIDE 45

Attacking the computation?

RSA: x ✼ ✦ x 2 ♠♦❞ N Isogenies: x ✼ ✦ x x☛i 1 x ☛i ♠♦❞ p

(☛1❀ ✿ ✿ ✿ ❀ ☛T depend on the chosen isogeny)

e.g., ❧♦❣2 N ✙ 2048❀ ❧♦❣2 p ✙ 1500. No speedup? Even with unlimited parallelism? Really? See Bernstein, Sorenson. Modular exponentiation via the explicit Chinese remainder theorem.

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 18 / 28

slide-46
SLIDE 46

Attacking the pairing

A pairing inversion problem: e✭P❀ ❄❄❄✮ ❂ e✭✣✭P✮❀ Q✮ Quantum: Broken by Shor’s algorithm; Classical: Subexponential Lp✭1❂3✮ attack. Note: Solving the equation gives the true value of ❫ ✣✭Q✮ (perfect soundness)

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 19 / 28

slide-47
SLIDE 47

Computing shortcuts

Isogeny degree ❂ ❵T ✩ walk length ❂ T;

■ e.g., for delay ✙ 1 hour, T ✙ 220; ■

❂ ✭❧♦❣ ✮ ✙

■

E

✵

✥

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 20 / 28

slide-48
SLIDE 48

Computing shortcuts

Isogeny degree ❂ ❵T ✩ walk length ❂ T;

■ e.g., for delay ✙ 1 hour, T ✙ 220; ■ Typically much larger than graph

diameter (❂ O✭❧♦❣ p✮ ✙ 210).

■ (which isogeny graph is meant depends

  • n the variant)

E E ✵ ✥

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 20 / 28

slide-49
SLIDE 49

Computing shortcuts

Isogeny degree ❂ ❵T ✩ walk length ❂ T;

■ e.g., for delay ✙ 1 hour, T ✙ 220; ■ Typically much larger than graph

diameter (❂ O✭❧♦❣ p✮ ✙ 210).

■ (which isogeny graph is meant depends

  • n the variant)

Goal: find a shortcut, i.e., a shorter walk. E E ✵ ✥

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 20 / 28

slide-50
SLIDE 50

❊♥❞✭E✮ gives shortcuts

❋p case

❊♥❞❋p✭E✮ ✚ ◗✭♣p✮: the class group ❈❧✭4p✮ acts on the set

  • f supersingular curves ❂❋p;

Structure of ❈❧✭4p✮ ♠ relations between ideal classes ♠ shortcuts in the graph.

■ see CSI-FiSh signatures

(Beullens–Kleinjung–Vercauteren);

■ akin to attack on class group VDF.

Some additional work to find endomorphism ✦ such that ✦ ✍ ❫ ✥✭Q✮ ❂ ❫ ✣✭Q✮.

❋ ❋

❊♥❞✭ ✮ ❊♥❞✭ ✮ ❊♥❞✭

✵✮

♠ ❋

■

✦ ✷ ❊♥❞✭ ✮ ❊♥❞✭ ✮

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 21 / 28

slide-51
SLIDE 51

❊♥❞✭E✮ gives shortcuts

❋p case

❊♥❞❋p✭E✮ ✚ ◗✭♣p✮: the class group ❈❧✭4p✮ acts on the set

  • f supersingular curves ❂❋p;

Structure of ❈❧✭4p✮ ♠ relations between ideal classes ♠ shortcuts in the graph.

■ see CSI-FiSh signatures

(Beullens–Kleinjung–Vercauteren);

■ akin to attack on class group VDF.

Some additional work to find endomorphism ✦ such that ✦ ✍ ❫ ✥✭Q✮ ❂ ❫ ✣✭Q✮.

General case (both ❋p and ❋p2)

❊♥❞✭E✮ isomorphic to an

  • rder in a quaternion algebra;

Structure of ❊♥❞✭E✮ (or ❊♥❞✭E ✵✮) ♠ shortcuts (through ❋p2).

■ Related to attacks on the

Charles–Goren–Lauter hash function.

Additional work to find ✦ ✷ ❊♥❞✭E✮. ❊♥❞✭ ✮

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 21 / 28

slide-52
SLIDE 52

❊♥❞✭E✮ gives shortcuts

❋p case

❊♥❞❋p✭E✮ ✚ ◗✭♣p✮: the class group ❈❧✭4p✮ acts on the set

  • f supersingular curves ❂❋p;

Structure of ❈❧✭4p✮ ♠ relations between ideal classes ♠ shortcuts in the graph.

■ see CSI-FiSh signatures

(Beullens–Kleinjung–Vercauteren);

■ akin to attack on class group VDF.

Some additional work to find endomorphism ✦ such that ✦ ✍ ❫ ✥✭Q✮ ❂ ❫ ✣✭Q✮.

General case (both ❋p and ❋p2)

❊♥❞✭E✮ isomorphic to an

  • rder in a quaternion algebra;

Structure of ❊♥❞✭E✮ (or ❊♥❞✭E ✵✮) ♠ shortcuts (through ❋p2).

■ Related to attacks on the

Charles–Goren–Lauter hash function.

Additional work to find ✦ ✷ ❊♥❞✭E✮. WE HAVE A PROBLEM! No known way to construct supersingular curves without knowledge of ❊♥❞✭E✮. Only known fix: Trusted setup.

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 21 / 28

slide-53
SLIDE 53

Trusted setup

y2 ❂ x 3 ✰ x Start from a well known supersingular curve, ❋ ❋ ❋ ❋ ✭ ❂ ✮ ✭♣ ✮ ♣♦❧②❧♦❣✭ ✮ ✭♣ ✮ ✭ ❂ ✮ ✭ ❂ ✮ ♣♦❧②❧♦❣✭ ✮ ♣♦❧②❧♦❣✭ ✮ ❋

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 22 / 28

slide-54
SLIDE 54

Trusted setup

y2 ❂ x 3 ✰ x E Start from a well known supersingular curve, Do a random walk, ❋ ❋ ❋ ❋ ✭ ❂ ✮ ✭♣ ✮ ♣♦❧②❧♦❣✭ ✮ ✭♣ ✮ ✭ ❂ ✮ ✭ ❂ ✮ ♣♦❧②❧♦❣✭ ✮ ♣♦❧②❧♦❣✭ ✮ ❋

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 22 / 28

slide-55
SLIDE 55

Trusted setup

y2 ❂ x 3 ✰ x E Start from a well known supersingular curve, Do a random walk, Forget it. ❋ ❋ ❋ ❋ ✭ ❂ ✮ ✭♣ ✮ ♣♦❧②❧♦❣✭ ✮ ✭♣ ✮ ✭ ❂ ✮ ✭ ❂ ✮ ♣♦❧②❧♦❣✭ ✮ ♣♦❧②❧♦❣✭ ✮ ❋

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 22 / 28

slide-56
SLIDE 56

Trusted setup

y2 ❂ x 3 ✰ x E Start from a well known supersingular curve, Do a random walk, Forget it. Classical Quantum ❋p graph ❋p2 graph ❋p graph ❋p2 graph Computing shortcuts Lp✭1❂2✮ O✭♣p✮ ♣♦❧②❧♦❣✭p✮ O✭ 4 ♣p✮ Pairing inversion Lp✭1❂3✮ Lp✭1❂3✮ ♣♦❧②❧♦❣✭p✮ ♣♦❧②❧♦❣✭p✮ Quantum annoyance: Computing shortcuts in ❋p2 is quantumly hard; Pairing inversion attacks must be run online, useless if Shor’s algorithm takes much longer than target delay.

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 22 / 28

slide-57
SLIDE 57

Distributed trusted setups

y2 ❂ x 3 ✰ x E1 ✙ ✙ ✙ Mitigate trusted setup woes by distributing trust: Participant i performs a random walk (in ❋p), ❀ ❂ ❍✭ ❀

✰ ✮❀

✭ ❀ ❫ ✣ ✭ ✮✮ ❂

✰ ✭✣ ✭

✮❀ ✮✿

  • Luca De Feo (IBM Research Zürich)

VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 23 / 28

slide-58
SLIDE 58

Distributed trusted setups

y2 ❂ x 3 ✰ x E1 ✙1 ✙ ✙ Mitigate trusted setup woes by distributing trust: Participant i performs a random walk (in ❋p), Publishes a proof of isogeny knowledge, ❀ ❂ ❍✭ ❀

✰ ✮❀

✭ ❀ ❫ ✣ ✭ ✮✮ ❂

✰ ✭✣ ✭

✮❀ ✮✿

  • Luca De Feo (IBM Research Zürich)

VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 23 / 28

slide-59
SLIDE 59

Distributed trusted setups

y2 ❂ x 3 ✰ x E1 ✙1 E2 ✙ ✙ Mitigate trusted setup woes by distributing trust: Participant i performs a random walk (in ❋p), Publishes a proof of isogeny knowledge, Repeat. ❀ ❂ ❍✭ ❀

✰ ✮❀

✭ ❀ ❫ ✣ ✭ ✮✮ ❂

✰ ✭✣ ✭

✮❀ ✮✿

  • Luca De Feo (IBM Research Zürich)

VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 23 / 28

slide-60
SLIDE 60

Distributed trusted setups

y2 ❂ x 3 ✰ x E1 ✙1 E2 ✙2 ✙ Mitigate trusted setup woes by distributing trust: Participant i performs a random walk (in ❋p), Publishes a proof of isogeny knowledge, Repeat. ❀ ❂ ❍✭ ❀

✰ ✮❀

✭ ❀ ❫ ✣ ✭ ✮✮ ❂

✰ ✭✣ ✭

✮❀ ✮✿

  • Luca De Feo (IBM Research Zürich)

VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 23 / 28

slide-61
SLIDE 61

Distributed trusted setups

y2 ❂ x 3 ✰ x E1 ✙1 E2 ✙2 E3 ✙ Mitigate trusted setup woes by distributing trust: Participant i performs a random walk (in ❋p), Publishes a proof of isogeny knowledge, Repeat. ❀ ❂ ❍✭ ❀

✰ ✮❀

✭ ❀ ❫ ✣ ✭ ✮✮ ❂

✰ ✭✣ ✭

✮❀ ✮✿

  • Luca De Feo (IBM Research Zürich)

VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 23 / 28

slide-62
SLIDE 62

Distributed trusted setups

y2 ❂ x 3 ✰ x E1 ✙1 E2 ✙2 E3 ✙3 Mitigate trusted setup woes by distributing trust: Participant i performs a random walk (in ❋p), Publishes a proof of isogeny knowledge, Repeat. ❀ ❂ ❍✭ ❀

✰ ✮❀

✭ ❀ ❫ ✣ ✭ ✮✮ ❂

✰ ✭✣ ✭

✮❀ ✮✿

  • Luca De Feo (IBM Research Zürich)

VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 23 / 28

slide-63
SLIDE 63

Distributed trusted setups

y2 ❂ x 3 ✰ x E1 ✙1 E2 ✙2 E3 ✙3 Mitigate trusted setup woes by distributing trust: Participant i performs a random walk (in ❋p), Publishes a proof of isogeny knowledge, Repeat. Proof options: Generic ZK proofs, Isogeny ZK proofs (SeaSign), Pairing proofs (not ZK!): P❀ Q ❂ ❍✭Ei❀ Ei✰1✮❀ ei✭P❀ ❫ ✣i✭Q✮✮ ❂ ei✰1✭✣i✭P✮❀ Q✮✿ Properties: asynchronous, robust against n 1 coalition, verification scales linearly, updatable, ...

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 23 / 28

slide-64
SLIDE 64

Beyond VDFs

slide-65
SLIDE 65

Watermarking

Goal: reward evaluator for its effort. Watermarking: issue proof of evaluation tied to evaluator identity E Emid E ✵ ❫ ✣1 ❫ ✣2 ❫ ✣ ❂ ❫ ✣2 ✍ ❫ ✣1 Secret key: scalar s ✷ ❩❂N❩, Public key: s✣✭P✮ ✷ E ✵ (+ proof of exponent knowledge), Proof of work: s ❫ ✣1✭Q✮ ✷ Emid, Verification: emid✭✣2✭P✮❀ s ❫ ✣1✭Q✮✮ ❂ e✵✭s✣✭P✮❀ Q✮. Properties: blind (can be checked before the computation is complete).

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 25 / 28

slide-66
SLIDE 66

Encryption to the future (time-locks)

Goal: encrypt now, decryption only possible afer delay. Applications: auctions, voting, ... Idea: start from Boneh–Franklin IBE, just add isogeniesTM. Bidder Auctioneer Publishes auction key Q ❂ ❍✭sid✮ starts evaluating ❫ ✣✭Q✮ samples random s ✷ ❩❂N❩ computes k ❂ e✭✣✭P✮❀ Q✮s encrypts offer ok ❂ Enck✭o✮ sends ✭ok❀ sP✮

  • ✦

. . . computes k ❂ e✭sP❀ ❫ ✣✭Q✮✮ decrypts ok

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 26 / 28

slide-67
SLIDE 67

Open questions

Understand the impact of large memory requirements in evaluation; is a time/memory trade-off reasonable?

■ ■ Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 27 / 28

slide-68
SLIDE 68

Open questions

Understand the impact of large memory requirements in evaluation; is a time/memory trade-off reasonable? Remove trusted setup:

■ Hash into the supersingular set, or ■ Construct ordinary pairing friendly curves with large discriminant. Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 27 / 28

slide-69
SLIDE 69

Open questions

Understand the impact of large memory requirements in evaluation; is a time/memory trade-off reasonable? Remove trusted setup:

■ Hash into the supersingular set, or ■ Construct ordinary pairing friendly curves with large discriminant.

Explore more advanced pairing+delay constructions.

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 27 / 28

slide-70
SLIDE 70

Open questions

Understand the impact of large memory requirements in evaluation; is a time/memory trade-off reasonable? Remove trusted setup:

■ Hash into the supersingular set, or ■ Construct ordinary pairing friendly curves with large discriminant.

Explore more advanced pairing+delay constructions. Spend millions on dedicated hardware for 2-isogenies.

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 27 / 28

slide-71
SLIDE 71

Open questions

Understand the impact of large memory requirements in evaluation; is a time/memory trade-off reasonable? Remove trusted setup:

■ Hash into the supersingular set, or ■ Construct ordinary pairing friendly curves with large discriminant.

Explore more advanced pairing+delay constructions. Spend millions on dedicated hardware for 2-isogenies.

Just Add IsogeniesTM!

Luca De Feo (IBM Research Zürich) VDFs from Isogenies and Pairings https://defeo.lu/docet ECC 2019 27 / 28

slide-72
SLIDE 72

Thank you

https://defeo.lu/ @luca_defeo