Optimal strategies for CSIDH

Chi-Domínguez, Jesús-Javier; Rodríguez-Henríquez, Francisco

doi:10.3934/amc.2020116

Cited by 15 publications

(25 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We report the first constant-time C-coded implementation of the CSIDH group action evaluation that uses the new fast isogeny algorithm of [6], as reported in [2]. The C-code implementation allows an easy application for any prime field, which requires the shortest differential addition chains (SDACs), the list of small odd primes (SOPs), and the optimal strategies presented in [15]; in particular, our C-code implementation is a direct application of the algorithm and Python-code presented in [2], and thus all the data framework required (for each different prime field) can be obtained from its corresponding Python-code version.…”

Section: Resultsmentioning

confidence: 99%

“…3 shows experimental results for all instantiations of CSIDH using exponent bounds ranging from m = 1 to m = 4. Each exponent bound is parameterized to reach the same security, meaning fewer i for larger m. In all cases we started from the global bound and then optimized for the bounds per individual small prime and evaluation strategies as in [15]. Note that some configurations of the 1024-and 1792bit primes do not have enough i 's to support the m = 1 and m = 2 bounds.…”

Section: Resultsmentioning

confidence: 99%

“…The final two columns give the lowest cost of attacking {AES,SHA} in depth at least as much as the minimum to break the associated CSIDH instance, based on [18,25,36]. Italics highlights where such a break exceeds the hardware limit bounds m i for each degreei isogeny construction to optimize the cost using the approach reported in [15]. Note that any increase in our classical memory budget w will imply a higher value of k, thus forcing us to re-parameterize the collection of k isogenies that must be processed.…”

Section: (B) (A) (D) (C) (F) (E)mentioning

confidence: 99%

“…. , n. For practical implementations of CSIDH, constructing and evaluating n degreei isogenies, plus up to n(n+1) 2 scalar multiplications by the prime factors i , dominate the computational cost [15].…”

mentioning

confidence: 99%

“….5 . For each interval, we apply the framework reported in [15] to select optimal bounds (different m i for each prime) and their corresponding optimal strategies. Starting from the Python-3 CSIDH library reported in [2], we present the first constant-time implementation of large CSIDH instantiations supporting the O( √ ) isogeny-evaluation algorithm from [6].…”

mentioning

confidence: 99%

See 4 more Smart Citations

The SQALE of CSIDH: sublinear Vélu quantum-resistant isogeny action with low exponents

et al. 2021

Self Cite

View full text Add to dashboard Cite

Recent independent analyses by Bonnetain–Schrottenloher and Peikert in Eurocrypt 2020 significantly reduced the estimated quantum security of the isogeny-based commutative group action key-exchange protocol CSIDH. This paper refines the estimates of a resource-constrained quantum collimation sieve attack to give a precise quantum security to CSIDH. Furthermore, we optimize large CSIDH parameters for performance while still achieving the NIST security levels 1, 2, and 3. Finally, we provide a C-code constant-time implementation of those CSIDH large instantiations using the square-root-complexity Vélu’s formulas recently proposed by Bernstein, De Feo, Leroux and Smith.

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Resultsmentioning

confidence: 99%

Section: (B) (A) (D) (C) (F) (E)mentioning

confidence: 99%

mentioning

confidence: 99%

mentioning

confidence: 99%

See 3 more Smart Citations

The SQALE of CSIDH: sublinear Vélu quantum-resistant isogeny action with low exponents

et al. 2021

Self Cite

View full text Add to dashboard Cite

show abstract

Radical Isogenies

Castryck¹,

Decru²,

Vercauteren³

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

This paper introduces a new approach to computing isogenies called "radical isogenies" and a corresponding method to compute chains of N -isogenies that is very efficient for small N . The method is fully deterministic and completely avoids generating N -torsion points. It is based on explicit formulae for the coordinates of an N -torsion point P on the codomain of a cyclic N -isogeny ϕ : E → E , such that composing ϕ with E → E / P yields a cyclic N 2 -isogeny. These formulae are simple algebraic expressions in the coefficients of E, the coordinates of a generator P of ker ϕ, and an N th root N √ ρ , where the radicand ρ itself is given by an easily computable algebraic expression in the coefficients of E and the coordinates of P . The formulae can be iterated and are particularly useful when computing chains of N -isogenies over a finite field Fq with gcd(q − 1, N ) = 1, where taking an N th root is a simple exponentiation. Compared to the state-of-the-art, our method results in an order of magnitude speed-up for N ≤ 13; for larger N , the advantage disappears due to the increasing complexity of the formulae. When applied to CSIDH, we obtain a speed-up of about 19% over the implementation by Bernstein, De Feo, Leroux and Smith for the CSURF-512 parameters.

show abstract

Fully Projective Radical Isogenies in Constant-Time

Chi-Domínguez

Reijnders

2022

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

At PQCrypto-2020, Castryck and Decru proposed CSURF (CSIDH on the surface) as an improvement to the CSIDH protocol. Soon after that, at Asiacrypt-2020, together with Vercauteren they introduced radical isogenies as a further improvement. The main improvement in these works is that both CSURF and radical isogenies require only one torsion point to initiate a chain of isogenies, in comparison to Vélu isogenies which require a torsion point per isogeny. Both works were implemented using non-constant-time techniques, however, in a realistic scenario, a constant-time implementation is necessary to mitigate risks of timing attacks. The analysis of constant-time CSURF and radical isogenies was left as an open problem by Castryck, Decru, and Vercauteren. In this work we analyze this problem. A straightforward constant-time implementation of CSURF and radical isogenies encounters too many issues to be cost effective, but we resolve some of these issues with new optimization techniques. We introduce projective radical isogenies to save costly inversions and present a hybrid strategy for integration of radical isogenies in CSIDH implementations. These improvements make radical isogenies almost twice as efficient in constant-time, in terms of finite field multiplications. Using these improvements, we then measure the algorithmic performance in a benchmark of CSIDH, CSURF and CRADS (an implementation using radical isogenies) for different prime sizes. Our implementation provides a more accurate comparison between CSIDH, CSURF and CRADS than the original benchmarks, by using state-ofthe-art techniques for all three implementations. Our experiments illustrate that the speed-up of constant-time CSURF-512 with radical isogenies is reduced to about 3% in comparison to the fastest state-of-the-art constant-time CSIDH-512 implementation. The performance is worse for larger primes, as radical isogenies scale worse than Vélu isogenies.

show abstract

Optimal strategies for CSIDH

Cited by 15 publications

References 15 publications

The SQALE of CSIDH: sublinear Vélu quantum-resistant isogeny action with low exponents

The SQALE of CSIDH: sublinear Vélu quantum-resistant isogeny action with low exponents

Radical Isogenies

Fully Projective Radical Isogenies in Constant-Time

Contact Info

Product

Resources

About