CSIDH on the Surface

Abstract

For primes p ≡ 3 mod 4, we show that setting up CSIDH on the surface, i.e., using supersingular elliptic curves with endomorphism ring Z[(1 + √ −p)/2], amounts to just a few sign switches in the underlying arithmetic. If p ≡ 7 mod 8 then horizontal 2-isogenies can be used to help compute the class group action. The formulas we derive for these 2-isogenies are very efficient (they basically amount to a single exponentiation in Fp) and allow for a noticeable speed-up, e.g., our resulting CSURF-512 protocol runs about 5.68% faster than CSIDH-512. This improvement is completely orthogonal to all previous speed-ups, constanttime measures and construction of cryptographic primitives that have appeared in the literature so far. At the same time, moving to the surface gets rid of the redundant factor Z3 of the acting ideal-class group, which is present in the case of CSIDH and offers no extra security.

On the Performance Analysis for CSIDH-Based Cryptosystems

“…Let P − Q = (x P−Q , y P−Q ) be given. Then the x coordinates of their sum P + Q and the doubling of P, x [2]P can be computed as follows [14]:…”

“…Which can be computed in (6d − 2)M + 3S. For the isogeny evaluation and computing the curve coefficient of the image curve of a tweaked Montgomery curve M t a presented in [14], f (x) is now defined as:…”

“…So, the computational cost of odd-degree isogeny point evaluation on the tweaked Montgomery curve is (6d)M + 2S. Formula in [14] for computing the coefficient of the image curve a , is similar to the formula for Montgomery curve which is…”

“…In this section, we introduce the CSIDH key exchange and two main CSIDH-based algorithms-CSURF [14] and collision-free CSIDH proposed by Onuki and Takagi [13]-to compare the performance and security. As CSIDH made a noticeable improvement by exploiting supersingular elliptic curves to instantiate the CRS scheme, various methods began to propose in order to optimize the performance and improve the security.…”

“…We implement the CSIDH-based algorithms in the same environment for the exact performance comparison. More explicitly, we implement CSURF [13,14] in projective coordinates. The algorithm in [13] has not been previously implemented.…”