(Short Paper) A Faster Constant-Time Algorithm of CSIDH Keeping Two Points

Onuki, Hiroshi; Aikawa, Yusuke; Yamazaki, Tsutomu; Takagi, Tsuyoshi

doi:10.1007/978-3-030-26834-3_2

Cited by 32 publications

(77 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Still assuming that the attacker can perform only power consumption analysis and timing attacks, Onuki, Aikawa, Yamazaki and Takagi proposed a faster constant-time version of CSIDH in [26].…”

Section: The Onuki-aikawa-yamazaki-takagi Constant-time Algorithmmentioning

confidence: 99%

“…For naive CSIDH, evaluating the action of l ei i requires evaluating between 0 and m i isogenies, corresponding to either the ideal l i (for positive e i ) or l −1 i (for negative e i ). If we follow the approach of [26], then we must also compute m i − |e i | dummy ℓ i -isogenies to ensure a constant-time behaviour.…”

Section: Removing Dummy Operations For Fault-attack Resistancementioning

confidence: 99%

“…Hence, while at the moment this costly modification of CSIDH may seem overkill, we believe further research is necessary to try and bridge the efficiency gap between it and the other side-channel protected implementations of CSIDH. Tables 1 and 2 summarize our experimental results, and compare our algorithms with those of [6], [21], and [26]. Table 1 compares algorithms in terms of elementary field operations, while Table 2 compares cycle counts of C implementations.…”

Section: Derandomized Csidh Algorithmsmentioning

confidence: 99%

“…In this work we take a new look at side-channel protected implementations of CSIDH. We start by reviewing the implementations in [21] and [26]. We highlight a flaw that makes their constant-time claims disputable, and propose a fix for it.…”

Section: Introductionmentioning

confidence: 99%

“…In §2 we briefly recall ideas, algorithms and parameters from CSIDH [6]. In §3 we highlight a shortcoming in [21] and [26] and propose a way to fix it. In §4 we introduce new optimizations compatible with all previous versions of CSIDH.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Stronger and Faster Side-Channel Protections for CSIDH

Cervantes-Vázquez

Chenu

Chi-Domínguez

et al. 2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

CSIDH is a recent quantum-resistant primitive based on the difficulty of finding isogeny paths between supersingular curves. Recently, two constant-time versions of CSIDH have been proposed: first by Meyer, Campos and Reith, and then by Onuki, Aikawa, Yamazaki and Takagi. While both offer protection against timing attacks and simple power consumption analysis, they are vulnerable to more powerful attacks such as fault injections. In this work, we identify and repair two oversights in these algorithms that compromised their constant-time character. By exploiting Edwards arithmetic and optimal addition chains, we produce the fastest constant-time version of CSIDH to date. We then consider the stronger attack scenario of fault injection, which is relevant for the security of CSIDH static keys in embedded hardware. We propose and evaluate a dummy-free CSIDH algorithm. While these CSIDH variants are slower, their performance is still within a small constant factor of lessprotected variants. Finally, we discuss derandomized CSIDH algorithms.Note: A previous version of this article incorrectly claimed that a test in Algorithm 2 leaks information through the timing channel. We are grateful to Prof. Onuki for point out our mistake.

show abstract

Section: The Onuki-aikawa-yamazaki-takagi Constant-time Algorithmmentioning

confidence: 99%

Section: Removing Dummy Operations For Fault-attack Resistancementioning

confidence: 99%