On the Security of Supersingular Isogeny Cryptosystems

Abstract

We study cryptosystems based on supersingular isogenies. This is an active area of research in post-quantum cryptography. Our first contribution is to give a very powerful active attack on the supersingular isogeny encryption scheme. This attack can only be prevented by using a (relatively expensive) countermeasure. Our second contribution is to show that the security of all schemes of this type depends on the difficulty of computing the endomorphism ring of a supersingular elliptic curve. This result gives significant insight into the difficulty of the isogeny problem that underlies the security of these schemes. Our third contribution is to give a reduction that uses partial knowledge of shared keys to determine an entire shared key. This can be used to retrieve the secret key, given information leaked from a side-channel attack on the key exchange protocol. A corollary of this work is the first bit security result for the supersingular isogeny key exchange: Computing any component of the j-invariant is as hard as computing the whole j-invariant. Our paper therefore provides an improved understanding of the security of these cryptosystems. We stress that our work does not imply that these systems are insecure, or that they should not be used. However, it highlights that implementations of these schemes will need to take account of the risks associated with various active and side-channel attacks.

Identification Protocols and Signature Schemes Based on Supersingular Isogeny Problems

“…We stress that Problems 3 and 4 are potentially easier than Problems 1 and 2 because special primes are used and extra points are revealed. Furthermore, it is shown in Section 4 of [22] that if End(E) is known and one can find any isogeny from E to E then one can compute the specific isogeny of degree e 1 1 . The following problem, on the other hand, offers better foundations for cryptography based on supersingular isogeny problems.…”

“…The fastest classical attack on the first scheme has heuristic running time ofÕ( p 1/4 ) bit operations, and the fastest quantum attack (see Section 5.1 of [19]) has running time ofÕ( p 1/6 ). Galbraith, Petit, Shani and Ti [22] and Petit [36] showed that revealing auxiliary points may be dangerous in certain contexts. It is therefore highly advisable to build cryptographic schemes based on the most general, standard and potentially hardest isogeny problems.…”

“…This computational problem has heuristic classical complexity ofÕ( p 1/2 ) bit operations, and quantum complexityÕ( p 1/4 ). In particular, the second scheme does not involve sending auxiliary points and so avoids the attacks of [22,36]. The identification scheme is based on a sigma protocol that is very similar to the proof of graph isomorphism.…”

A Note on the Security of CSIDH

“…As pointed out in [15], the original SIDH key agreement protocol is not secure when using the same secret over multiple instances of the protocol. This can be fixed by a Fujisaki-Okamoto transform [2] at the cost of a drastic loss of performance, requiring additional points in the protocol, and loss of flexibility, for example, the inability to reuse keys.…”

Pre- and Post-quantum Diffie–Hellman from Groups, Actions, and Isogenies

“…In SIDH, however, a Diffie-Hellman oracle defines no binary operation on any set, let alone an interesting algebraic structure. This plurality of spaces makes it hard to adapt hidden-number-problemstyle arguments [21,5] for hardcore bits to the SIDH context in a natural way, though a valiant effort has been made by Galbraith, Petit, Shani, and Ti [68].…”