How to Construct CSIDH on Edwards Curves

Moriya, Tomoki; Onuki, Hiroshi; Takagi, Tsuyoshi

doi:10.1007/978-3-030-40186-3_22

Cited by 9 publications

(23 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…using different forms of elliptic curves, e.g. twisted Edwards curves [18,19] and Hessian curves [12,14]; adapting Vélu's formulae to only require O( √ ) operations in F p [1] instead of O( ); changing CSIDH into CSURF to allow the use of very efficient 2-isogenies [6],…”

Section: Introductionmentioning

confidence: 99%

Radical Isogenies

Castryck¹,

Decru²,

Vercauteren³

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

This paper introduces a new approach to computing isogenies called "radical isogenies" and a corresponding method to compute chains of N -isogenies that is very efficient for small N . The method is fully deterministic and completely avoids generating N -torsion points. It is based on explicit formulae for the coordinates of an N -torsion point P on the codomain of a cyclic N -isogeny ϕ : E → E , such that composing ϕ with E → E / P yields a cyclic N 2 -isogeny. These formulae are simple algebraic expressions in the coefficients of E, the coordinates of a generator P of ker ϕ, and an N th root N √ ρ , where the radicand ρ itself is given by an easily computable algebraic expression in the coefficients of E and the coordinates of P . The formulae can be iterated and are particularly useful when computing chains of N -isogenies over a finite field Fq with gcd(q − 1, N ) = 1, where taking an N th root is a simple exponentiation. Compared to the state-of-the-art, our method results in an order of magnitude speed-up for N ≤ 13; for larger N , the advantage disappears due to the increasing complexity of the formulae. When applied to CSIDH, we obtain a speed-up of about 19% over the implementation by Bernstein, De Feo, Leroux and Smith for the CSURF-512 parameters.

show abstract

Section: Introductionmentioning

confidence: 99%

Radical Isogenies

Castryck¹,

Decru²,

Vercauteren³

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…We heuristically found out that setting m n = 3 2 • 10 δ , tends to obtain better bound vectors. A Python-script implementation of the above greedy procedure found the following bounds, 10,11,11,12,13,12,14,15,16,16,16,20,23,21,23,23,23,23,23,23,23,22,20,19,22,22,22,22,22,22,21,21,20,18,15); 9,11,9,11,11,11,11,11,11,11,11,11,11,11,11,11,…”

Section: 4mentioning

confidence: 99%

“…Later, the CSIDH implementation of [17] was further improved by Onuki, Aikawa, Yamazaki, and Takagi in [22], by keeping track of two points to evaluate the action of an ideal: one in E(F p ), and one in E(F p 2 ) with its x-coordinate in F p . Moreover, Moriya, Onuki and Takagi [19], and Cervantes-Vázquez et al in [7], performed more efficient CSIDH isogeny computations using the twisted Edwards model of elliptic curves. The authors of [7] proposed a more computationally demanding dummyfree variant of CSIDH, which in exchange, is arguably better suited to resist attacks from stronger adversaries.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Optimal strategies for CSIDH

Chi-Domínguez¹,

Rodríguez-Henríquez²

2022

AMC

View full text Add to dashboard Cite

Since its proposal in Asiacrypt 2018, the commutative isogenybased key exchange protocol (CSIDH) has spurred considerable attention to improving its performance and re-evaluating its classical and quantum security guarantees. In this paper we discuss how the optimal strategies employed by the Supersingular Isogeny Diffie-Hellman (SIDH) key agreement protocol can be naturally extended to CSIDH. Furthermore, we report a software library that achieves moderate but noticeable performance speedups when compared against state-of-the-art implementations of CSIDH-512, which is the most popular CSIDH instantiation. We also report an estimated number of field operations for larger instantiations of this protocol, namely, CSIDH-1024 and CSIDH-1792.

show abstract

“…The reason for writing this article was the work of Japanese scientists [1]. Our attention was drawn to the title of this paper, which includes the keywords CSIDH (Commutative Supersingular Isogeny Diffie-Hellman [2]) and Edwards curves [3,4].…”

Section: Introductionmentioning

confidence: 99%

On correctness of conditions for the CSIDH algorithm implementation on Edwards curves

Bessalov¹

2022

View full text Add to dashboard Cite

Incorrect formulation and incorrect solution of the problem of the CSIDH algorithm implementation on Edwards curves was revealed in one of the famous works. The purpose of this paper is to present a detailed critique of such concept with a proof of its inconsistency. Specific properties of three non-isomorphic classes of super singular curves in the generalized Edwards form are considered: full, quadratic, and twisted Edwards curves. Conditions for existence of curves of all 3 classes with order of curves over a prime field are determined. The implementation of the CSIDH algorithm on isogenies of odd prime degrees is based on the use of quadratic twist pairs of elliptic curves. To this end, the CSIDH algorithm can be built both on complete Edwards curves with quadratic twist within this class, and on quadratic and twisted Edwards curves forming pairs of quadratic twist. In contrast to this, the authors of a well-known work are trying to prove theorems that state that there is a solution within one class of curves with a parameter which is a square. The critical analysis of theorems, lemmas, erroneous statements in this work is carried out. Theorem 2 on quadratic twist in classes of Edwards curves is proved. The CSIDH algorithm modification based on isogenies of quadratic and twisted Edwards curves is presented. To illustrate the correct solution of the problem, an example of Alice and Bob calculations in the secret sharing scheme according to the CSIDH algorithm is considered for.

show abstract

How to Construct CSIDH on Edwards Curves

Cited by 9 publications

References 21 publications

Radical Isogenies

Radical Isogenies

Optimal strategies for CSIDH

On correctness of conditions for the CSIDH algorithm implementation on Edwards curves

Contact Info

Product

Resources

About