Arithmetic Considerations for Isogeny-Based Cryptography

Abstract

In this paper we investigate various arithmetic techniques which can be used to potentially enhance the performance in the supersingular isogeny Diffie-Hellman (SIDH) key-exchange protocol which is one of the more recent contenders in the post-quantum public-key arena. First, we give a systematic overview of techniques to compute efficient arithmetic modulo $2^xp^y\pm 1$2xpy±1. Our overview shows that in the SIDH setting, where arithmetic over a quadratic extension field is required, the approaches based on the Montgomery reduction for such primes of a special shape are to be preferred. Moreover, the outcome of our investigation reveals that there exist moduli which allow even faster implementations. Second, we investigate if it is beneficial to use other curve models to speed up the elliptic curve scalar multiplication. The use of twisted Edwards curves allows one to search for efficient addition-subtraction chains for fixed scalars while this is not possible with the differential addition law when using Montgomery curves. Our preliminary results show that despite the fact that we found such efficient chains, using twisted Edwards curves does not result in faster scalar multiplication arithmetic in the setting of SIDH.