A Note on the Security of CSIDH

Abstract

We propose an algorithm for computing an isogeny between two elliptic curves E1, E2 defined over a finite field such that there is an imaginary quadratic order O satisfying O ≃ End(Ei) for i = 1, 2. This concerns ordinary curves and supersingular curves defined over Fp (the latter used in the recent CSIDH proposal). Our algorithm has heuristic asymptotic run time e O √ log(|∆|) and requires polynomial quantum memory and e O √ log(|∆|) classical memory, where ∆ is the discriminant of O. This asymptotic complexity outperforms all other available method for computing isogenies. We also show that a variant of our method has asymptotic run time eÕ √ log(|∆|) while requesting only polynomial memory (both quantum and classical).

CSIDH: An Efficient Post-Quantum Commutative Group Action

“…Biasse, Iezzi, and Jacobson [4] work out some more details of the attack ideas mentioned above for Regev's algorithm. They focus on the class-groupcomputation part of the oracle and they work out how to represent random elements of the class group as a product of small prime ideals.…”

New Techniques for SIDH-based NIKE

“…Under the original parameter choices and security analysis in [5], CSIDH-based NIKE is both faster and more compact than SIDH-based NIKE for a given security level, even with our improvements. However, subsequent analyses [3,4] indicate that CSIDH may not be as secure as originally estimated. Hence, we believe our improvements are still worth proposing, since they could lead to further improvements which might make SIDH competitive in this setting.…”

“…Under a naive estimate, typically three of the shared secrets will be wrong, and the number of possible wrong answers for each shared secret is ℓ(ℓ + 1). The attacker then has to search through a space of Ω((ℓ(ℓ + 1)) 3 ) possibilities. If Alice has α public keys, the cost is therefore Ω((ℓ(ℓ + 1)) 3α…”

Verifiable Delay Functions from Supersingular Isogenies and Pairings

“…If the trapdoor is kept secret, one obtains a signature/identification protocol based on walks in isogeny graphs; if the trapdoor is made public, one obtains a VDF. 7 We will present our instantiations in Section 5.…”

“…The best known classical attacks, both for the F p and the F p 2 case, are in the square root of the graph size (respectively, O( 4 √ p) and O( √ p)). But key recovery is hard even for quantum computers: the best attack for the F p case is Kuperberg's algorithm for the Hidden Shift Problem [49,63,50,18,13,7,39,5], which finds φ in exp( log(p)) quantum operations; whereas in the F p 2 case quantum computers give a square-root speedup via Grover's algorithm at best [8]. Hence, both identification protocols have a security property similar to the quantum annoyance defined in Defintion 2: any forgery requires running a new instance of Shor's algorithm, while key recovery is infeasible on quantum computers.…”