A New Isogeny Representation and Applications to Cryptography

Abstract

This paper focuses on isogeny representations, defined as ways to evaluate isogenies and verify membership to the language of isogenous supersingular curves (the set of triples D, E1, E2 with a cyclic isogeny of degree D between E1 and E2). The tasks of evaluating and verifying isogenies are fundamental for isogeny-based cryptography. Our main contribution is the design of the suborder representation, a new isogeny representation targetted at the case of (big) prime degree. The core of our new method is the revelation of endomorphisms of smooth norm inside a well-chosen suborder of the codomain's endomorphism ring. This new representation appears to be opening interesting prospects for isogeny-based cryptography under the hardness of a new computational problem: the SubOrder to Ideal Problem (SOIP). As an application, we introduce pSIDH, a new NIKE based on the suborder representation. Studying new assumption appears to be particularly crucial in the light of the recent attacks against isogeny-based cryptography. In order to manipulate efficiently the suborder representation, we develop several heuristic algorithmic tools to solve norm equations inside a new family of quaternion orders. These new algorithms may be of independent interest.

SCALLOP: Scaling the CSI-FiSh

“…Then, since we have the explicit isomorphism ρ 0 , we can compute ψ and evaluate ρ 0 (γ) over the L-torsion in O(poly(log(p)) (remember that the L-torsion is defined over F p 2 and L < p). Then, the computation of each ϕ i is in O(poly(log(pL 2 c)) and computing s i and checking the trace has O(poly(log(p)) complexity with the CheckTrace algorithm introduced in [41]. This proves the result.…”

“…Note that this problem is related to the SubOrder to Ideal Problem (SOIP) introduced by Leroux [41]. It is quite obvious that the problem we study here is harder than the SOIP since the SOIP provides to the attacker several effective orientations of different quadratic orders (instead of one in our case).…”

“…Since we chose deg(ϕ) = f to be a large prime, there is no hope to evaluate ϕ, Step 1, using standard algorithms such as Vélu's formulas, which have polynomial complexity in deg(ϕ). However, even if one managed to solve Step 1, it is not clear how to solve Step 2 (which is somewhat equivalent to the SOIP, see [41,Proposition 14]). Known algorithms to convert an isogeny into an ideal require working within the torsion subgroup E[deg(ϕ)].…”