Supersingular Isogeny Diffie-Hellman Research Articles

Efficient Commutative PQC Algorithms on Isogenies of Edwards Curves

The article presents the author’s works in the field of modifications and modeling of the Post-Quantum Cryptography (PQC) Commutative Supersingular Isogeny Diffie-Hellman (CSIDH) algorithm on non-cyclic supersingular Edwards curves and its predecessor Couveignes-Rostovtsev-Stolbunov (CRS) scheme on ordinary non-cyclic Edwards curves are reviewed. Lower estimates of the computational speed gains of the modified algorithms over the original ones are obtained. The most significant results were obtained by choosing classes of non-cyclic Edwards curves connected as quadratic twist pairs instead of cyclic complete Edwards curves, as well as the method of algorithm randomization as an alternative to “constant time CSIDH”. It is shown that in the CSIDH and Commutative Supersingular Isogeny Key Encapsulation (CSIKE) algorithms, there are two independent cryptosystems with the possibility of parallel computation, eliminating the threat of side-channel attacks. There are four such cryptosystems for the CRS scheme. Integral lower bound estimates of the performance gain of the modified CSIDH algorithm are obtained at 1.5 × 29, and for the CRS scheme are 3 × 29.

Efficiency of SIDH-based signatures (yes, SIDH)

Abstract In this note, we assess the efficiency of a supersingular isogeny Diffie-Hellman (SIDH)-based digital signature built on a weaker variant of a recent identification protocol proposed by Basso et al. Despite the devastating attacks against (the mathematical problem underlying) SIDH, this identification protocol remains secure, as its security is backed by a different (and more standard) isogeny-finding problem. We conduct our analysis by applying some known cryptographic techniques to decrease the signature size by about 70% for all parameter sets (obtaining signatures of approximately 21 kB for SIKE p 434 {\mathsf{SIKE}}{\mathsf{p}}434 ). Moreover, we propose a minor optimisation to compute many isogenies in parallel from the same starting curve. Our assessment confirms that determining the most efficient methods for isogeny-based signature schemes, including optimisations such as those presented in this paper, is still a open problem, with much more work to be done.

Faster Public-Key Compression of SIDH With Less Memory

In recent years, the isogeny-based protocol, namely supersingular isogeny Diffie-Hellman (SIDH) has become highly attractive for its small public key size. In addition, one can utilize several techniques to further compress the public key. However, compared to other post-quantum protocols, the computational cost of SIDH is relatively high, and so is that of its public-key compression. On the other hand, the storage for pairing computation and discrete logarithms to speed up the current implementation of the key compression is somewhat large. In this paper, we mainly improve the performance of public-key compression of SIDH, especially the efficiency and the storage of pairing computation involved. Our experimental results show that the memory requirement for pairing computation is reduced by a factor of about 1.5. Meanwhile, the instantiation of public-key compression of SIDH is 6.95%-10.44% faster than the current state-of-the-art. Although SIKE is broken now, the techniques in this paper may benefit other isogeny-based cryptosystems which are still secure.

Forward Secure Offline Assisted Group Key Exchange From Isogeny-Based Blinded Key Encapsulation Mechanism

<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Group key exchange</i> is a promising cryptographic protocol that has been studied extensively over the years. However, an overwhelming majority of them involve interaction among users. This makes them unsuitable in a cloud-based outsourced storage systems where users seek to store and share their files with their collaborators who stay offline until they want to access the file. To address this concern, Boyd et al. designed an <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">offline assisted group key exchange</i> (OAGKE) protocol that offers forward secrecy. The core component of their OAGKE protocol is a variant of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">key encapsulation mechanism</i> (KEM) called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">blinded</i> KEM (BKEM). However, their constructions of BKEM are susceptible to quantum attacks. This work proposes an <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">isogeny-based</i> BKEM and a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">forward secure</i> OAGKE that is secure against adversaries equipped with quantum computers. Our construction of BKEM is based on the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Commutative Supersingular Isogeny Diffie-Hellman</i> (CSIDH) cryptosystem. We provide a formal security proof demonstrating the security of our scheme. Furthermore, we manifest an instantiation of our BKEM from CSIDH-512 parameter set. Finally, we present our isogeny-based OAGKE protocol along with its rigorous security analysis.

Faster Key Generation of Supersingular Isogeny Diffie-Hellman

Supersingular isogeny Diffie-Hellman (SIDH) is attractive for its relatively small public key size, but it is still unsatisfactory due to its efficiency, compared to other post-quantum proposals. In this paper, we focus on the performance of SIDH when the starting curve is E6 : y2 = x3 + 6x2 + x, which is fixed in Round-3 SIKE implementation. Inspired by previous works [1], [2], we present several tricks to accelerate key generation of SIDH and each process of SIKE. Our experimental results show that the performance of this work is at least 6.09% faster than that of the SIKE implementation, and we can further improve the performance when large storage is available.

Optimizing the evaluation of ℓ-isogenous curve for isogeny-based cryptography

In ASIACRYPT 2017, Costello and Hisil proposed two methods of evaluating ℓ-isogenous curves: the usage of Vélu formulas and the recovery from special isogenous points. In isogeny-based cryptography, such as the supersingular isogeny Diffie–Hellman (SIDH)/supersingular isogeny key encapsulation protocol, small-degree isogenies are typically prioritized, because the costs of evaluating points and curves through isogenies using Vélu's formulas will increase with the increase of isogeny degrees. Compared with the use of Vélu formulas, the recovery from special isogenous points is independent from ℓ and runs in constant time under certain conditions. Therefore, it could be efficient in the evaluation of the ℓ-isogenous curve in some variants of SIDH (such as SIDH using twisted torsion (B-SIDH)). In this study, we optimize the evaluation of the ℓ-isogenous curve when three differential isogenous points are provided in advance. We also propose the optimized evaluation in projective coordinates on different elliptic curve models such as the Montgomery, Edwards, Jacobi, and Huff models. Finally, we propose an acceleration of B-SIDH by applying our new function to evaluate the ℓ-isogenous curve in the Montgomery model.

Batching CSIDH Group Actions using AVX-512

Commutative Supersingular Isogeny Diffie-Hellman (or CSIDH for short) is a recently-proposed post-quantum key establishment scheme that belongs to the family of isogeny-based cryptosystems. The CSIDH protocol is based on the action of an ideal class group on a set of supersingular elliptic curves and comes with some very attractive features, e.g. the ability to serve as a “drop-in” replacement for the standard elliptic curve Diffie-Hellman protocol. Unfortunately, the execution time of CSIDH is prohibitively high for many real-world applications, mainly due to the enormous computational cost of the underlying group action. Consequently, there is a strong demand for optimizations that increase the efficiency of the class group action evaluation, which is not only important for CSIDH, but also for related cryptosystems like the signature schemes CSI-FiSh and SeaSign. In this paper, we explore how the AVX-512 vector extensions (incl. AVX-512F and AVX-512IFMA) can be utilized to optimize constant-time evaluation of the CSIDH-512 class group action with the goal of, respectively, maximizing throughput and minimizing latency. We introduce different approaches for batching group actions and computing them in SIMD fashion on modern Intel processors. In particular, we present a hybrid batching technique that, when combined with optimized (8 × 1)-way prime-field arithmetic, increases the throughput by a factor of 3.64 compared to a state-of-the-art (non-vectorized) x64 implementation. On the other hand, vectorization in a 2-way fashion aimed to reduce latency makes our AVX-512 implementation of the group action evaluation about 1.54 times faster than the state-of-the-art. To the best of our knowledge, this paper is the first to demonstrate the high potential of using vector instructions to increase the throughput (resp. decrease the latency) of constant-time CSIDH.

Hardware Architecture for Supersingular Isogeny Diffie-Hellman and Key Encapsulation Using a Fast Montgomery Multiplier

Public key cryptography lies among the most important bases of security protocols. The classic instances of these cryptosystems are no longer secure when a large-scale quantum computer emerges. These cryptosystems must be replaced by post-quantum ones, such as isogeny-based cryptographic schemes. Supersingular isogeny Diffie-Hellman (SIDH) and key encapsulation (SIKE) are two of the most important such schemes. To improve the performance of these protocols, we have designed several modular multipliers. These multipliers have been implemented for all the prime fields used in SIKE round 3, on a Virtex-7 FPGA, showing a time and area-time product improvement of up to 60.1% and 64.5%, respectively. These multipliers are also suitable for applications such as RSA, as shown by implementations for 512-bit, 1024-bit, and 2048-bit generic moduli on a Virtex-7 FPGA. Our fastest multiplier has been used in the implementation of SIDH and SIKE round 3. Employing six instances of this multiplier, SIDH completes after 7.33, 8.93, 13.39, and 18.67 milliseconds and the encapsulation and the decapsulation of SIKE is performed in 7.13, 8.68, 13.08, and 18.16 milliseconds over p <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">434</sub> , p <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">503</sub> , p <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">610</sub> , p <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">751</sub> , respectively, which yields a least improvement factor of 1.23.

SIKE on GPU: Accelerating Supersingular Isogeny-Based Key Encapsulation Mechanism on Graphic Processing Units

Since the introduction of the Supersingular isogeny Diffie–Hellman (SIDH) key exchange protocol by Jao and de Feo in 2011, it and its variation (SIKE) have gained significant attention as a promising candidate for post-quantum cryptography (PQC). Until now, even though several implementations of the state-of-the-art SIKE mechanism were presented on CPUs and embedded MCUs, there was no consideration of implementing SIKE on parallel graphic processing units (GPUs). With the advent of the IoT era, a number of IT devices will communicate with application servers. Thus, developing efficient instance of SIKE on server sides is also important. GPUs have been considered as a promising candidate for a cryptographic accelerator. In this paper, we present an efficient implementation of Supersingular Isogeny Key Encapsulation (SIKE) mechanism on GPUs. Even though SIKE has fascinating advantages of much smaller key and ciphertext sizes compared with other NIST PQC candidates, its computational overhead is extremely high. Until now, a large amount of research has been conducted for enhancing the performance of SIKE with respect to software on typical CPU and embedded MCUs and hardware optimization on ASIC and FPGA. However, generic software optimization utilizing GPUs has not been considered yet. We target the GPU implementation of SIKEp503 security parameters which provides the security level 2 (At least as difficult to break as SHA256). For efficiency, we optimize the underlying field arithmetic, especially field multiplication and reduction over $p503=2^{250}3^{159}-1$ and take full advantage of the properties of GPU architecture including memory hierarchy. The proposed GPU software based on RTX2080Ti provides around 36376.61 KeyGens/s, 25603.72 Encaps/s, and 22211.61 Decaps/s. These are about 140.64, 157.66, and 146.81 times of improvements to the SIKE CPU Software on Intel i9-10900K CPU, respectively. As far as we know, this is the first efficient implementation of SIKE software on GPU side.

Towards Isogeny-Based Password-Authenticated Key Establishment

Abstract Password authenticated key establishment (PAKE) is a cryptographic primitive that allows two parties who share a low-entropy secret (a password) to securely establish cryptographic keys in the absence of public key infrastructure. We propose the first quantum-resistant password-authenticated key exchange scheme based on supersingular elliptic curve isogenies. The scheme is built upon supersingular isogeny Diffie-Hellman [15], and uses the password to generate permutations which obscure the auxiliary points. We include elements of a security proof, and discuss roadblocks to obtaining a proof in the BPR model [1]. We also include some performance results.

On oriented supersingular elliptic curves

We revisit theoretical background on OSIDH (Oriented Supersingular Isogeny Diffie-Hellman protocol), which is an isogeny-based key-exchange protocol proposed by Colò and Kohel at NutMiC 2019. We give a proof of a fundamental theorem for OSIDH. The theorem was stated by Colò and Kohel without proof. Furthermore, we consider parameters of OSIDH, give a sufficient condition on the parameters for the protocol to work, and estimate the size of the parameters for a certain security level.

Orienting supersingular isogeny graphs

AbstractWe introduce a category of 𝓞-oriented supersingular elliptic curves and derive properties of the associated oriented and nonoriented ℓ-isogeny supersingular isogeny graphs. As an application we introduce an oriented supersingular isogeny Diffie-Hellman protocol (OSIDH), analogous to the supersingular isogeny Diffie-Hellman (SIDH) protocol and generalizing the commutative supersingular isogeny Diffie-Hellman (CSIDH) protocol.

Optimal strategies for CSIDH

&lt;p style='text-indent:20px;'&gt;Since its proposal in Asiacrypt 2018, the commutative isogeny-based key exchange protocol (CSIDH) has spurred considerable attention to improving its performance and re-evaluating its classical and quantum security guarantees. In this paper we discuss how the optimal strategies employed by the Supersingular Isogeny Diffie-Hellman (SIDH) key agreement protocol can be naturally extended to CSIDH. Furthermore, we report a software library that achieves moderate but noticeable performance speedups when compared against state-of-the-art implementations of CSIDH-512, which is the most popular CSIDH instantiation. We also report an estimated number of field operations for larger instantiations of this protocol, namely, CSIDH-1024 and CSIDH-1792.&lt;/p&gt;

Optimized CSIDH Implementation Using a 2-Torsion Point

The implementation of isogeny-based cryptography mainly use Montgomery curves, as they offer fast elliptic curve arithmetic and isogeny computation. However, although Montgomery curves have efficient 3- and 4-isogeny formula, it becomes inefficient when recovering the coefficient of the image curve for large degree isogenies. Because the Commutative Supersingular Isogeny Diffie-Hellman (CSIDH) requires odd-degree isogenies up to at least 587, this inefficiency is the main bottleneck of using a Montgomery curve for CSIDH. In this paper, we present a new optimization method for faster CSIDH protocols entirely on Montgomery curves. To this end, we present a new parameter for CSIDH, in which the three rational two-torsion points exist. By using the proposed parameters, the CSIDH moves around the surface. The curve coefficient of the image curve can be recovered by a two-torsion point. We also proved that the CSIDH while using the proposed parameter guarantees a free and transitive group action. Additionally, we present the implementation result using our method. We demonstrated that our method is 6.4% faster than the original CSIDH. Our works show that quite higher performance of CSIDH is achieved while only using Montgomery curves.

New Techniques for SIDH-based NIKE

AbstractWe consider the problem of producing an efficient, practical, quantum-resistant non-interactive key exchange (NIKE) protocol based on Supersingular Isogeny Diffie-Hellman (SIDH). An attack of Galbraith, Petit, Shani and Ti rules out the use of naïve forms of the SIDH construction for this application, as they showed that an adversary can recover private key information when supplying an honest party with malformed public keys. Subsequently, Azarderakhsh, Jao and Leonardi presented a method for overcoming this attack using multiple instances of the SIDH protocol, but which increases the costs associated with performing a key exchange by factors of up to several thousand at typical security levels. In this paper, we present two new techniques to reduce the cost of SIDH-based NIKE, with various possible tradeoffs between key size and computational cost.

Implementation of Supersingular Isogeny-Based Diffie-Hellman and Key Encapsulation Using an Efficient Scheduling

Isogeny-based cryptography is one of the promising post-quantum candidates mainly because of its smaller public key length. Due to its high computational cost, efficient implementations are significantly important. In this paper, we have proposed a high-speed FPGA implementation of the supersingular isogeny Diffie-Hellman (SIDH) and key encapsulation (SIKE). To this end, we have adapted the algorithm of finding optimal large-degree isogeny computation strategy for hardware implementations. Using this algorithm, hardware-suited strategies (HSSs) can be devised. We have also developed a tool to schedule field arithmetic operations efficiently using constraint programming. This tool enables reducing the latency of SIDH and SIKE subroutines by up to 14% at NIST's highest security level, i.e., using the SIKEp751 parameter set. We have also improved the latency of field inversion, the most costly field operation in SIDH, by 23% using the Montgomery ladder technique. We have provided constant-time implementations of SIDH and SIKE on Virtex-7 using SIKEp751 utilizing 6 and 8 prime field multipliers to resemble the previous work. Experimental results show that using 8 multipliers SIDH and SIKE encapsulation and decapsulation can be performed in 24.66 ms and 24.10 ms, which is 1.37 and 1.12 times faster than the latest corresponding FPGA implementations, respectively.

High Performance Modular Multiplication for SIDH

The latest research indicates that quantum computers will be realized in the near future. In theory, the computation speed of a quantum computer is much faster than current computers, which will pose a serious threat to current cryptosystems. Post-quantum cryptography (PQC) is a class of cryptography based on underlying mathematical problems that are considered infeasible to crack even with access to a quantum computer. The supersingular isogeny Diffie–Hellman (SIDH) key exchange protocol is a new post-quantum cryptosystem, which offers advantages in reduced secret key length and attack resistance. SIDH is the basis of the supersingular isogeny key encapsulation (SIKE) protocol, which is in the second round of the U.S. National Institute of Standards and Technology (NIST) PQC standardization process. In this article, we propose a new modular multiplication algorithm and a new interleaved hardware architecture for SIDH. Performance results for the proposed modular multiplier using four parameter sets for the prime, $p$ that correspond to the SIKE Round 2 parameter sets show significant advantages in speed.

A Performance Analysis and Evaluation of SIDH Applied Several Implementation-Friendly Quadratic Extension Fields

It is well-known that quadratic extension fields (QEFs) based on optimal extension fields (OEFs) are typically used for supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol. On the other hand, there is a possibility of the performance improvement of SIDH by employing other attractive choices of QEFs with efficient performing arithmetics which are based on all-one polynomial extension fields (AOPFs) and extension fields with normal basis representation (EFNs). Thus, the authors confirm that the applicability of the new candidates of QEFs for SIDH and evaluate SIDH applied the possible choices of QEFs. As a result of the experiment, the authors found that the performances of SIDH applied the QEFs based on AOPF and EFN are comparable to that of the previous QEF. Moreover, one of the QEFs based on EFN result in a new efficient implementation of the SIDH with SIDH-friendly prime given as p= 2^{e_A}3^{e_B}f+1 where e_A, e_B and $f$ are positive integers.

The security of all private-key bits in isogeny-based schemes

We study the computational hardness of recovering single bits of the private key in the supersingular isogeny Diffie–Hellman (SIDH) key exchange and similar schemes. Our objective is to give a polynomial-time reduction between the problem of computing the private key in SIDH to the problem of computing any of its bits. The parties in the SIDH protocol work over elliptic curve torsion groups of different order N. Our results depend on the parity of N. Our main result shows that if N is odd, then each of the top and lower O(loglogN) bits of the private key is as hard to compute, with any noticeable advantage, as the entire key. A similar, but conditional, result holds for each of the middle bits. This condition can be checked, and heuristically holds almost always. The case of even N is a bit more challenging. We give several results, one of which is similar to the result for an odd N, under the assumption that one always succeeds to recover the designated bit. To achieve these results we extend the solution to the chosen-multiplier hidden number problem, for domains of a prime-power order, by studying the Fourier coefficients of single-bit functions over these domains.

Supersingular Isogeny Diffie-Hellman Key Exchange on 64-Bit ARM

We present an efficient implementation of the supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol on 64-bit ARMv8 processors for 125- and 160-bit post-quantum security levels. We analyze the use of both affine and projective SIDH formulas and provide a comprehensive analysis of both approaches based on the inversion-to-multiplication ratio. Implementation results show that regardless of security concerns, affine SIDH is competitive with the projective coordinates implementation, and even outperforms projective implementation in the final round of SIDH; however, projective SIDH shows better overall performance for the whole key exchange protocol. Notably, over larger finite fields, using optimized field multiplication leads to the much better performance of projective compared to affine formulas. We integrate our optimized software into the open quantum-safe OpenSSL library and compare our software with other available post-quantum primitives. The benchmark results on ARMv8 demonstrate speedup of up to 5X over the generic version of SIDH implementation which is available inside the OQS library for the same quantum security level. We observe that our highly-optimized implementation still suffers from a large number of operations for computing isogenies of elliptic curves. However, in terms of communication overhead, supersingular isogeny-based cryptosystem provides significantly smaller key size compared to its counterparts.