Quantum Circuits for the CSIDH: Optimizing Quantum Evaluation of Isogenies

Abstract

DOI to the publisher's website. • The final author version and the galley proof are versions of the publication after peer review. • The final published version features the final layout of the paper including the volume, issue and page numbers. Link to publication General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal. If the publication is distributed under the terms of Article 25fa of the Dutch Copyright Act, indicated by the "Taverne" license above, please follow below link for the End User Agreement:

Hilbert modular polynomials

“…Modular polynomials are rarely the most efficient option, although for some applications they do prove to be the best choice, e.g. [BLMP18,Appendix D].…”

Verifiable Delay Functions from Supersingular Isogenies and Pairings

“…The best known classical attacks, both for the F p and the F p 2 case, are in the square root of the graph size (respectively, O( 4 √ p) and O( √ p)). But key recovery is hard even for quantum computers: the best attack for the F p case is Kuperberg's algorithm for the Hidden Shift Problem [49,63,50,18,13,7,39,5], which finds φ in exp( log(p)) quantum operations; whereas in the F p 2 case quantum computers give a square-root speedup via Grover's algorithm at best [8]. Hence, both identification protocols have a security property similar to the quantum annoyance defined in Defintion 2: any forgery requires running a new instance of Shor's algorithm, while key recovery is infeasible on quantum computers.…”

A Constant-Time Algorithm of CSIDH Keeping Two Points

“…The constant-time implementation in [17] allows variance of the computational time of their implementation with randomness that does not relate to secret information. On the other hand, implementations which do not allow such variance are proposed by Bernstein, Lange, Martindale, and Panny [18] and Jalali, Azarderakhsh, Kermani, and Jao [19]. The implementation in [18] is for evaluating the performance of quantum attacks for CSIDH.…”

“…On the other hand, implementations which do not allow such variance are proposed by Bernstein, Lange, Martindale, and Panny [18] and Jalali, Azarderakhsh, Kermani, and Jao [19]. The implementation in [18] is for evaluating the performance of quantum attacks for CSIDH. It must not have branches in order to compute in superposition on quantum computers.…”

“…CSIDH, which was proposed by Bernstein, Lange, Martindale, and Panny [18]. Elligator enables us to generate xcoordinates of points in E[π−1] and E[π+1] simultaneously by computing only one Legendre symbol.…”