Fully Projective Radical Isogenies in Constant-Time

Abstract

At PQCrypto-2020, Castryck and Decru proposed CSURF (CSIDH on the surface) as an improvement to the CSIDH protocol. Soon after that, at Asiacrypt-2020, together with Vercauteren they introduced radical isogenies as a further improvement. The main improvement in these works is that both CSURF and radical isogenies require only one torsion point to initiate a chain of isogenies, in comparison to Vélu isogenies which require a torsion point per isogeny. Both works were implemented using non-constant-time techniques, however, in a realistic scenario, a constant-time implementation is necessary to mitigate risks of timing attacks. The analysis of constant-time CSURF and radical isogenies was left as an open problem by Castryck, Decru, and Vercauteren. In this work we analyze this problem. A straightforward constant-time implementation of CSURF and radical isogenies encounters too many issues to be cost effective, but we resolve some of these issues with new optimization techniques. We introduce projective radical isogenies to save costly inversions and present a hybrid strategy for integration of radical isogenies in CSIDH implementations. These improvements make radical isogenies almost twice as efficient in constant-time, in terms of finite field multiplications. Using these improvements, we then measure the algorithmic performance in a benchmark of CSIDH, CSURF and CRADS (an implementation using radical isogenies) for different prime sizes. Our implementation provides a more accurate comparison between CSIDH, CSURF and CRADS than the original benchmarks, by using state-ofthe-art techniques for all three implementations. Our experiments illustrate that the speed-up of constant-time CSURF-512 with radical isogenies is reduced to about 3% in comparison to the fastest state-of-the-art constant-time CSIDH-512 implementation. The performance is worse for larger primes, as radical isogenies scale worse than Vélu isogenies.

Practical Usage of Radical Isogenies for CSIDH

“…• In this paper, we optimize the radical isogeny formulae in affine and projective versions proposed in earlier studies [21], [30]. We can implement it more efficiently in C by rationalizing the denominator and tailoring the conversion between various curves.…”

“…In [30], it was noted that using projective curve coefficients for computing radical isogenies is more efficient because it can reduce inversions during the computation of a chain of isogenies. As this applies to radical isogeny of degrees 4, 5, and 7, we apply the optimized version of the following formulas.…”

“…The cost for computing one 4-isogeny in affine curve coefficients is 3M+2E. Using projective curve coefficients for computing radical isogenies is more efficient [30], as it can reduce inversions during the computation of a chain of isogenies. We let…”

“…The cost for computing one 5-isogeny is 5M+2E, and the cost for transforming a Weierstrass curve back into the Montgomery form is 18M+4E. Similar to the 4-isogeny, using the projective curve coefficient as in [30] can save one exponentiation. If α = X /Z , for X , Z ∈ F p , then b ′ can be expressed as b ′ = X ′ /Z ′ , where…”

“…The ℓ-isogeny refers to the computation of the one ℓ-isogeny, where ℓ ∈ {2, 3, 4, 5, 7}, and E_to_Mont refers to the transformation from the Weierstrass or Tate curve to the Montgomery curve for odd-degree isogenies and refers to the transformation from the Montgomery − curves to the Montgomery + curves for 2-and 4-isogenies. Table 3 compares the computational cost of radical isogenies in [30] and in this work. In Table 3, the 2-and 3isogenies refer to the computational cost of a radical isogeny using the affine curve coefficients.…”