Group Key Exchange from CSIDH and Its Application to Trusted Setup in Supersingular Isogeny Cryptosystems

Moriya, Tomoki; Takashima, Katsuyuki; Takagi, Tsuyoshi

doi:10.1007/978-3-030-42921-8_5

Cited by 5 publications

(2 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Harn and Lin [11], Harn and Hsu [12] proposed GKE protocols based on both the secret sharing scheme and the group Diffie-Hellman key exchange scheme. Moriya, Takashima, and Takagi [13] and Fan, Xu, and Li [14] proposed the GKE protocols based on Commutative Supersingular Isogeny Diffie-Hellman (CSIDH), which are the post-quantum Diffie-Hellman type key exchange protocols from commutative group action. Some of the literature in the GKE domain research on the security analysis of the GKE protocols.…”

Section: Related Workmentioning

confidence: 99%

Member Tampering Attack on Burmester-Desmedt Group Key Exchange Protocol and Its Countermeasure

Sun

Tian

2022

Mathematics

View full text Add to dashboard Cite

With the rapid development of cloud computing and mobile networks, more and more application scenarios require a secret group key for secure communication. Group Key Exchange (GKE) protocol provides a secret group key for three or more members. Burmester and Desmedt presented an influential GKE protocol, which has a broadcast version and a cyclic version. In this paper, we investigate the security weaknesses of the Burmester-Desmedt protocol. We report that both the broadcast version and the cyclic version of the Burmester-Desmedt protocol suffer member tampering attacks if the two members that belong to both group A and group B are corrupted. That is, two corrupted members can add some unknowing members of group A to group B and trick the legal members of group B to believe that these unknowing members share the secret group key with them after a protocol run. Furthermore, to defeat the member tampering attack, we propose digital signature-based improvements on the broadcast version and the cyclic version of the Burmester-Desmedt protocol. We hope our research results will encourage the development of more robust and effective GKE protocols that stand rigorous security analysis.

show abstract

Section: Related Workmentioning

confidence: 99%

Member Tampering Attack on Burmester-Desmedt Group Key Exchange Protocol and Its Countermeasure

Sun

Tian

2022

Mathematics

View full text Add to dashboard Cite

show abstract

“…Usually, the former uses ordinary curves, while the latter uses supersingular curves. For parameter settings in isogeny-based cryptosystems to select supersingular curves, recently a method to generate a supersingular curve in a way that nobody can know explicitly how the curve is generated is proposed as an application of secure multiparty computation [16]. In such a case, unless the protocol implementation is fully trustable, a supersingularity testing algorithm is needed for a user to be sure that the generated curve is indeed supersingular.…”

Section: Introductionmentioning

confidence: 99%

Efficient Supersingularity Testing of Elliptic Curves Using Legendre Curves

Hashimoto

Nuida

2023

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

There are two types of elliptic curves, ordinary elliptic curves and supersingular elliptic curves. In 2012, Sutherland proposed an efficient and almost deterministic algorithm for determining whether a given curve is ordinary or supersingular. Sutherland's algorithm is based on sequences of isogenies started from the input curve, and computation of each isogeny requires square root computations, which is the dominant cost of the algorithm. In this paper, we reduce this dominant cost of Sutherland's algorithm to approximately a half of the original. In contrast to Sutherland's algorithm using j-invariants and modular polynomials, our proposed algorithm is based on Legendre form of elliptic curves, which simplifies the expression of each isogeny. Moreover, by carefully selecting the type of isogenies to be computed, we succeeded in gathering square root computations at two consecutive steps of Sutherland's algorithm into just a single fourth root computation (with experimentally almost the same cost as a single square root computation). The results of our experiments using Magma are supporting our argument; for cases of characteristic p of 768-bit to 1024-bit lengths, our proposed algorithm for characteristic p ≡ 1 (mod 4) runs in about 61.5% of the time and for characteristic p ≡ 3 (mod 4) also runs in about 54.9% of the time compared to Sutherland's algorithm.

show abstract

Improved Supersingularity Testing of Elliptic Curves Using Legendre Form

Hashimoto

Nuida

2021

Computer Algebra in Scientific Computing

View full text Add to dashboard Cite

Group Key Exchange from CSIDH and Its Application to Trusted Setup in Supersingular Isogeny Cryptosystems

Cited by 5 publications

References 28 publications

Member Tampering Attack on Burmester-Desmedt Group Key Exchange Protocol and Its Countermeasure

Member Tampering Attack on Burmester-Desmedt Group Key Exchange Protocol and Its Countermeasure

Efficient Supersingularity Testing of Elliptic Curves Using Legendre Curves

Improved Supersingularity Testing of Elliptic Curves Using Legendre Form

Contact Info

Product

Resources

About