Supersingular Isogeny Research Articles

Memory Efficient Implementation of Modular Multiplication for 32-bit ARM Cortex-M4

In this paper, we present scalable multi-precision multiplication implementation and scalable multi-precision squaring implementation for 32-bit ARM Cortex-M4 microcontrollers. For efficient computation and scalable functionality, we present optimized Multiplication and ACcumulation (MAC) techniques for the target microcontrollers. In particular, we present the 64-bit wise MAC operation with the Unsigned Long Multiply with Accumulate Accumulate (UMAAL) instruction. The MAC is used to perform column-wise multiplication/squaring (i.e., product-scanning) with general-purpose registers in an optimal way. Second, the squaring algorithm is further optimized through an efficient doubling routine together with an optimized product-scanning method. Finally, the proposed implementations achieved a very small memory footprint and high scalability to cover algorityms ranging from well-known public key cryptography (i.e., Rivest–Shamir–Adleman (RSA) and Elliptic Curve Cryptography (ECC)) to post-quantum cryptography (i.e., Supersingular Isogeny Key Encapsulation (SIKE)). All SIKE round 2 protocols were evaluated with the proposed modular reduction implementations. The results demonstrate that the scalable implementation can achieve the smallest code size together with a reasonable performance.

High Performance Modular Multiplication for SIDH

The latest research indicates that quantum computers will be realized in the near future. In theory, the computation speed of a quantum computer is much faster than current computers, which will pose a serious threat to current cryptosystems. Post-quantum cryptography (PQC) is a class of cryptography based on underlying mathematical problems that are considered infeasible to crack even with access to a quantum computer. The supersingular isogeny Diffie–Hellman (SIDH) key exchange protocol is a new post-quantum cryptosystem, which offers advantages in reduced secret key length and attack resistance. SIDH is the basis of the supersingular isogeny key encapsulation (SIKE) protocol, which is in the second round of the U.S. National Institute of Standards and Technology (NIST) PQC standardization process. In this article, we propose a new modular multiplication algorithm and a new interleaved hardware architecture for SIDH. Performance results for the proposed modular multiplier using four parameter sets for the prime, $p$ that correspond to the SIKE Round 2 parameter sets show significant advantages in speed.

A Performance Analysis and Evaluation of SIDH Applied Several Implementation-Friendly Quadratic Extension Fields

It is well-known that quadratic extension fields (QEFs) based on optimal extension fields (OEFs) are typically used for supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol. On the other hand, there is a possibility of the performance improvement of SIDH by employing other attractive choices of QEFs with efficient performing arithmetics which are based on all-one polynomial extension fields (AOPFs) and extension fields with normal basis representation (EFNs). Thus, the authors confirm that the applicability of the new candidates of QEFs for SIDH and evaluate SIDH applied the possible choices of QEFs. As a result of the experiment, the authors found that the performances of SIDH applied the QEFs based on AOPF and EFN are comparable to that of the previous QEF. Moreover, one of the QEFs based on EFN result in a new efficient implementation of the SIDH with SIDH-friendly prime given as p= 2^{e_A}3^{e_B}f+1 where e_A, e_B and $f$ are positive integers.

The security of all private-key bits in isogeny-based schemes

We study the computational hardness of recovering single bits of the private key in the supersingular isogeny Diffie–Hellman (SIDH) key exchange and similar schemes. Our objective is to give a polynomial-time reduction between the problem of computing the private key in SIDH to the problem of computing any of its bits. The parties in the SIDH protocol work over elliptic curve torsion groups of different order N. Our results depend on the parity of N. Our main result shows that if N is odd, then each of the top and lower O(loglogN) bits of the private key is as hard to compute, with any noticeable advantage, as the entire key. A similar, but conditional, result holds for each of the middle bits. This condition can be checked, and heuristically holds almost always. The case of even N is a bit more challenging. We give several results, one of which is similar to the result for an odd N, under the assumption that one always succeeds to recover the designated bit. To achieve these results we extend the solution to the chosen-multiplier hidden number problem, for domains of a prime-power order, by studying the Fourier coefficients of single-bit functions over these domains.

ARMv8 SIKE: Optimized Supersingular Isogeny Key Encapsulation on ARMv8 Processors

In this paper, we present highly-optimized constant-time software libraries for supersingular isogeny key encapsulation (SIKE) protocol on ARMv8 processors. Our optimized hand-crafted assembly libraries provide the most efficient timing results on 64-bit ARM-powered devices. Moreover, the presented libraries can be integrated into any other cryptography primitives targeting the same finite field size. We design a new mixed implementation of field arithmetic on 64-bit ARM processors by exploiting the A64 and Advanced SIMD processing units working in parallel. Using these techniques, we are able to improve the performance of the entire protocol by the factor of $5\times $ compared to optimized C implementations on 64-bit ARM high-performance cores, providing 83-, 124-, and 159-bit quantum-security levels. Furthermore, we compare the performance of our proposed library with the previous highly-optimized ARMv8 assembly library available in the literature. The implementation results illustrate the overall 10% performance improvement in comparison with previous work, highlighting the benefit of using mixed implementation over relatively-large finite field size.

Supersingular Isogeny Diffie-Hellman Key Exchange on 64-Bit ARM

We present an efficient implementation of the supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol on 64-bit ARMv8 processors for 125- and 160-bit post-quantum security levels. We analyze the use of both affine and projective SIDH formulas and provide a comprehensive analysis of both approaches based on the inversion-to-multiplication ratio. Implementation results show that regardless of security concerns, affine SIDH is competitive with the projective coordinates implementation, and even outperforms projective implementation in the final round of SIDH; however, projective SIDH shows better overall performance for the whole key exchange protocol. Notably, over larger finite fields, using optimized field multiplication leads to the much better performance of projective compared to affine formulas. We integrate our optimized software into the open quantum-safe OpenSSL library and compare our software with other available post-quantum primitives. The benchmark results on ARMv8 demonstrate speedup of up to 5X over the generic version of SIDH implementation which is available inside the OQS library for the same quantum security level. We observe that our highly-optimized implementation still suffers from a large number of operations for computing isogenies of elliptic curves. However, in terms of communication overhead, supersingular isogeny-based cryptosystem provides significantly smaller key size compared to its counterparts.

Arithmetic Considerations for Isogeny-Based Cryptography

In this paper we investigate various arithmetic techniques which can be used to potentially enhance the performance in the supersingular isogeny Diffie-Hellman (SIDH) key-exchange protocol which is one of the more recent contenders in the post-quantum public-key arena. First, we give a systematic overview of techniques to compute efficient arithmetic modulo $2^xp^y\pm 1$2xpy±1. Our overview shows that in the SIDH setting, where arithmetic over a quadratic extension field is required, the approaches based on the Montgomery reduction for such primes of a special shape are to be preferred. Moreover, the outcome of our investigation reveals that there exist moduli which allow even faster implementations. Second, we investigate if it is beneficial to use other curve models to speed up the elliptic curve scalar multiplication. The use of twisted Edwards curves allows one to search for efficient addition-subtraction chains for fixed scalars while this is not possible with the differential addition law when using Montgomery curves. Our preliminary results show that despite the fact that we found such efficient chains, using twisted Edwards curves does not result in faster scalar multiplication arithmetic in the setting of SIDH.

Hash functions from superspecial genus-2 curves using Richelot isogenies

AbstractIn 2018 Takashima proposed a version of Charles, Goren and Lauter’s hash function using Richelot isogenies, starting from a genus-2 curve that allows for all subsequent arithmetic to be performed over a quadratic finite field 𝔽p2. In 2019 Flynn and Ti pointed out that Takashima’s hash function is insecure due to the existence of small isogeny cycles. We revisit the construction and show that it can be repaired by imposing a simple restriction, which moreover clarifies the security analysis. The runtime of the resulting hash function is dominated by the extraction of 3 square roots for every block of 3 bits of the message, as compared to one square root per bit in the elliptic curve case; however in our setting the extractions can be parallelized and are done in a finite field whose bit size is reduced by a factor 3. Along the way we argue that the full supersingular isogeny graph is the wrong context in which to study higher-dimensional analogues of Charles, Goren and Lauter’s hash function, and advocate the use of the superspecial subgraph, which is the natural framework in which to view Takashima’s 𝔽p2-friendly starting curve.

Optimized Modular Multiplication for Supersingular Isogeny Diffie-Hellman

Recent progress in quantum physics shows that quantum computers may be a reality in the not too distant future. Post-quantum cryptography (PQC) refers to cryptographic schemes that are based on hard problems which are believed to be resistant to attacks from quantum computers. The supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol shows promising security properties among various post-quantum cryptosystems that have been proposed. In this paper, we propose two efficient modular multiplication algorithms with special primes that can be used in SIDH key exchange protocol. Hardware architectures for the two proposed algorithms are also proposed. The hardware implementations are provided and compared with the original modular multiplication algorithm. The results show that the proposed finite field multiplier is over 6.79 times faster than the original multiplier in hardware. Moreover, the SIDH hardware/software codesign implementation using the proposed FFM2 hardware is over 31 percent faster than the best SIDH software implementation.

Faster modular arithmetic for isogeny-based crypto on embedded devices

We show how to implement the Montgomery reduction algorithm for isogeny-based cryptography such that it can utilize the unsigned multiply accumulate accumulate long instruction present on modern ARM architectures. This results in a practical speedup of a factor 1.34 compared to the approach used by SIKE: the supersingular isogeny-based submission to the ongoing post-quantum standardization effort. Moreover, motivated by the recent work of Costello and Hisil (A simple and compact algorithm for SIDH with arbitrary degree isogenies. In: ASIACRYPT 2017, Part II, LNCS. Springer, Heidelberg 2017), which shows that there is only a moderate degradation in performance when evaluating large odd-degree isogenies, we search for more general supersingular isogeny friendly moduli. Using graphics processing units to accelerate this search, we find many such moduli which allow for faster implementations on embedded devices. By combining these two approaches, we manage to make the modular reduction 1.5 times as fast on a 32-bit ARM platform.

Identification Protocols and Signature Schemes Based on Supersingular Isogeny Problems

We present signature schemes whose security relies on computational assumptions relating to isogeny graphs of supersingular elliptic curves. We give two schemes, both of them based on interactive identification protocols. The first identification protocol is due to De Feo, Jao and Plût. The second one, and the main contribution of the paper, makes novel use of an algorithm of Kohel, Lauter, Petit and Tignol for the quaternion version of the ell -isogeny problem, for which we provide a more complete description and analysis, and is based on a more standard and potentially stronger computational problem. Both identification protocols lead to signatures that are existentially unforgeable under chosen message attacks in the random oracle model using the well-known Fiat-Shamir transform, and in the quantum random oracle model using another transform due to Unruh. A version of the first signature scheme was independently published by Yoo, Azarderakhsh, Jalali, Jao and Soukharev. This is the full version of a paper published at ASIACRYPT 2017.

New Hybrid Method for Isogeny-Based Cryptosystems Using Edwards Curves

Along with the resistance against quantum computers, isogeny-based cryptography offers attractive cryptosystems due to small key sizes and compatibility with the current elliptic curve primitives. While the state-of-the-art implementation uses Montgomery curves, which facilitates efficient elliptic curve arithmetic and isogeny computations, other forms of elliptic curves can be used to produce an efficient result. In this paper, we present the new hybrid method for isogeny-based cryptosystem using Edwards curves. Unlike the previous hybrid methods, we exploit Edwards curves for recovering the curve coefficients and Montgomery curves for other operations. To this end, we first carefully examine and compare the computational cost of Montgomery and Edwards isogenies. Then, we fine-tune and tailor Edwards isogenies in order to blend with Montgomery isogenies efficiently. Additionally, we present the implementation results of Supersingular Isogeny Diffie–Hellman (SIDH) key exchange using the proposed method. We demonstrate that our method outperforms the previously proposed hybrid method, and is as fast as Montgomery-only implementation. Our results show that proper use of Edwards curves for isogeny-based cryptosystem can be quite practical.

Fast Large Integer Modular Addition in GF(p) Using Novel Attribute-Based Representation

Addition is an essential operation in all cryptographic algorithms. Higher levels of security require larger key sizes and this becomes a limiting factor in GF(p) using large integers because of the carry propagation problem. We propose a novel and efficient attribute-based large integer representation scheme suitable for large integers commonly used in cryptography such as the five NIST primes and the Pierpont primes used in supersingular isogeny Diffie-Hellman (SIDH) for post-quantum cryptography. Algorithms are proposed for this new representation to implement arithmetic operations such as two's complement, addition/subtraction, comparison, sign detection, and modular reduction. Algorithms are also developed for converting binary numbers to attribute representation and vice versa. The extensive numerical simulations were done to verify the performance of the new number representation. Results show that addition is done faster in our proposed representation when compared with binary and residue number system (RNS)-based additions. Attribute addition outperformed RNS addition for all values of m where 128 ≤ m ≤ 32768 bits for all machine word sizes w where 4 ≤ w ≤ 128 bits. Attribute-based addition outperforms Kogge-Stone binary adders for a wide range of m when w is small. For increasing values of w, the speed advantages are evident only for large values of m. This makes the proposed number representation suitable for implementing cryptographic applications in embedded processors for IoT and consumer electronic devices where w is small.

A High-Performance and Scalable Hardware Architecture for Isogeny-Based Cryptography

In this work, we present a high-performance and scalable architecture for isogeny-based cryptosystems. In particular, we use the architecture in a fast, constant-time FPGA implementation of the quantum-resistant supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol. On a Virtex-7 FPGA, we show that our architecture is scalable by implementing at 83, 124, 168, and 252-bit quantum security levels. This is the first SIDH implementation at close to the 256-bit quantum security level to appear in literature. Further, our implementation completes the SIDH protocol 2 times faster than performance-optimized software implementations and 1.34 times faster than the previous best FPGA implementation, both running a similar set of formulas. Our implementation employs inversion-free projective isogeny formulas. By replicating multipliers and utilizing an efficient scheduling methodology, we can heavily parallelize quadratic extension field arithmetic and the isogeny evaluation stage of the large-degree isogeny computation. For a constant-time implementation of 124-bit quantum security SIDH on a Virtex-7 FPGA, we generate ephemeral public keys in 8.0 and 8.6 ms and generate the shared secret key in 7.1 and 7.9 ms for Alice and Bob, respectively. Finally, we show that this architecture could also be used to efficiently generate undeniable and digital signatures based on supersingular isogenies.

A Faster Software Implementation of the Supersingular Isogeny Diffie-Hellman Key Exchange Protocol

Since its introduction by Jao and De Feo in 2011, the supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol has positioned itself as a promising candidate for post-quantum cryptography. One salient feature of the SIDH protocol is that it requires exceptionally short key sizes. However, the latency associated to SIDH is higher than the ones reported for other post-quantum cryptosystem proposals. Aiming to accelerate the SIDH runtime performance, we present in this work several algorithmic optimizations targeting both elliptic-curve and field arithmetic operations. We introduce in the context of the SIDH protocol a more efficient approach for calculating the elliptic curve operation <inline-formula><tex-math notation="LaTeX">$P+[k]Q$</tex-math></inline-formula> . Our strategy achieves a factor 1.4 speedup compared with the popular variable-three-point ladder algorithm regularly used in the SIDH shared secret phase. Moreover, profiting from pre-computation techniques our algorithm yields a factor 1.7 acceleration for the computation of this operation in the SIDH key generation phase. We also present an optimized evaluation of the point tripling formula, and discuss several algorithmic and implementation techniques that lead to faster field arithmetic computations. A software implementation of the above improvements on an Intel Skylake Core i7-6700 processor gives a factor 1.33 speedup against the state-of-the-art software implementation of the SIDH protocol reported by Costello-Longa-Naehrig in CRYPTO 2016.

Computational problems in supersingular elliptic curve isogenies

We present an overview of supersingular isogeny cryptography and how it fits into the broad theme of post-quantum public-key crypto. The paper also gives a brief tutorial of elliptic curve isogenies and the computational problems relevant for supersingular isogeny crypto. Supersingular isogeny crypto is attracting attention due to the fact that the best attacks, both classical and quantum, require exponential time. However, the underlying computational problems have not been sufficiently studied by quantum algorithm researchers, especially since there are significant mathematical preliminaries needed to fully understand isogeny crypto. The main goal of the paper is to advertise various related computational problems and to explain the relationships between them, in a way that is accessible to experts in quantum algorithms.

SIDH on ARM: Faster Modular Multiplications for Faster Post-Quantum Supersingular Isogeny Key Exchange

We present high-speed implementations of the post-quantum supersingular isogeny Diffie-Hellman key exchange (SIDH) and the supersingular isogeny key encapsulation (SIKE) protocols for 32-bit ARMv7-A processors with NEON support. The high performance of our implementations is mainly due to carefully optimized multiprecision and modular arithmetic that finely integrates both ARM and NEON instructions in order to reduce the number of pipeline stalls and memory accesses, and a new Montgomery reduction technique that combines the use of the UMAAL instruction with a variant of the hybrid-scanning approach. In addition, we present efficient implementations of SIDH and SIKE for 64-bit ARMv8-A processors, based on a high-speed Montgomery multiplication that leverages the power of 64-bit instructions. Our experimental results consolidate the practicality of supersingular isogeny-based protocols for many real-world applications. For example, a full key-exchange execution of SIDHp503 is performed in about 176 million cycles on an ARM Cortex-A15 from the ARMv7-A family (i.e., 88 milliseconds @2.0GHz). On an ARM Cortex-A72 from the ARMv8-A family, the same operation can be carried out in about 90 million cycles (i.e., 45 milliseconds @1.992GHz). All our software is protected against timing and cache attacks. The techniques for modular multiplication presented in this work have broad applications to other cryptographic schemes.

Postquantum Opportunities: Lattices, Homomorphic Encryption, and Supersingular Isogeny Graphs

Supersingular isogeny graph–based cryptography has not yet been standardized, but the underlying hard problem has now been proposed as the basis for many cryptographic protocols. This motivates further investigation into the hardness of the underlying problem and the security of the proposed protocols.

Post-Quantum Cryptography on FPGA Based on Isogenies on Elliptic Curves

To the best of our knowledge, we present the first hardware implementation of isogeny-based cryptography available in the literature. Particularly, we present the first implementation of the supersingular isogeny Diffie-Hellman (SIDH) key exchange, which features quantum-resistance. We optimize this design for speed by creating a high throughput multiplier unit, taking advantage of parallelization of arithmetic in $\mathbb {F}_{p^{2}}$ , and minimizing pipeline stalls with optimal scheduling. Consequently, our results are also faster than software libraries running affine SIDH even on Intel Haswell processors. For our implementation at 85-bit quantum security and 128-bit classical security, we generate ephemeral public keys in 1.655 million cycles for Alice and 1.490 million cycles for Bob. We generate the shared secret in an additional 1.510 million cycles for Alice and 1.312 million cycles for Bob. On a Virtex-7, these results are approximately 1.5 times faster than known software implementations running the same 512-bit SIDH. Our results and observations show that the isogeny-based schemes can be implemented with high efficiency on reconfigurable hardware.

Computing isogenies between supersingular elliptic curves over $${\mathbb {F}}_p$$ F p

Let $$p>3$$ be a prime and let $$E$$ , $$E'$$ be supersingular elliptic curves over $${\mathbb {F}}_p$$ . We want to construct an isogeny $$\phi :E\rightarrow E'$$ . The currently fastest algorithm for finding isogenies between supersingular elliptic curves solves this problem in the full supersingular isogeny graph over $${\mathbb {F}}_{p^2}$$ . It takes an expected $$\tilde{\mathcal {O}}(p^{1/2})$$ bit operations, and also $$\tilde{\mathcal {O}}(p^{1/2})$$ space, by performing a “meet-in-the-middle” breadth-first search in the isogeny graph. In this paper we consider the structure of the isogeny graph of supersingular elliptic curves over $${\mathbb {F}}_p$$ . We give an algorithm to construct isogenies between supersingular curves over $${\mathbb {F}}_p$$ that works in $$\tilde{\mathcal {O}}(p^{1/4})$$ bit operations. We then discuss how this algorithm can be used to obtain an improved algorithm for the general supersingular isogeny problem.