Sieving for Twin Smooth Integers with Solutions to the Prouhet-Tarry-Escott Problem

Costello, Craig; Meyer, Michaël; Naehrig, Michael

doi:10.1007/978-3-030-77870-5_10

Cited by 8 publications

(2 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…If 2m + 1 is prime, we set p = 2m + 1. In [12] and [13], some methods to find such m's are proposed. The current most useful method is the method proposed in [13].…”

Section: B Using B-sidh Primes In M-sidhmentioning

confidence: 99%

See 1 more Smart Citation

M-SIDH and MD-SIDH: Countering SIDH Attacks by Masking Information

Fouotsa¹,

Moriya²,

Petit³

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The SIDH protocol is an isogeny-based key exchange protocol using supersingular isogenies, designed by Jao and De Feo in 2011. The protocol underlies the SIKE algorithm which advanced to the fourth round of NIST's post-quantum standardization project in May 2022. The algorithm was considered very promising: indeed the most significant attacks against SIDH were meet-in-the-middle variants with exponential complexity, and torsion point attacks which only applied to unbalanced parameters (and in particular, not to SIKE). This security picture dramatically changed in August 2022 with new attacks by Castryck-Decru, Maino-Martindale and Robert. Like prior attacks on unbalanced versions, these new attacks exploit torsion point information provided in the SIDH protocol. Crucially however, the new attacks embed the isogeny problem into a similar isogeny problem in a higher dimension to also affect the balanced parameters. As a result of these works, the SIKE algorithm is now fully broken both in theory and in practice. Given the considerable interest attracted by SIKE and related protocols in recent years, it is natural to seek countermeasures to the new attacks. In this paper, we introduce two such countermeasures based on partially hiding the isogeny degrees and torsion point information in the SIDH protocol. We present a preliminary analysis of the resulting schemes including non-trivial generalizations of prior attacks. Based on this analysis we suggest parameters for our M-SIDH variant with public key sizes of 4434, 7037 and 9750 bytes respectively for NIST security levels 1, 3, 5.

show abstract

“…If 2m + 1 is prime, we set p = 2m + 1. In [12] and [13], some methods to find such m's are proposed. The current most useful method is the method proposed in [13].…”

Section: B Using B-sidh Primes In M-sidhmentioning

confidence: 99%

“…In [12] and [13], some methods to find such m's are proposed. The current most useful method is the method proposed in [13]. The main idea of this method is to use already known solutions of the Prouhet-Tarry-Escott (PTE) problem, which provide pairs of integer coefficient polynomials a…”

Section: B Using B-sidh Primes In M-sidhmentioning

confidence: 99%

M-SIDH and MD-SIDH: Countering SIDH Attacks by Masking Information

Fouotsa¹,

Moriya²,

Petit³

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

Séta: Supersingular Encryption from Torsion Attacks

Feo

Guilhem

Fouotsa

et al. 2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We present Séta, 11 a new family of public-key encryption schemes with post-quantum security based on isogenies of supersingular elliptic curves. It is constructed from a new family of trapdoor one-way functions, where the inversion algorithm uses Petit's so called torsion attacks on SIDH to compute an isogeny between supersingular elliptic curves given an endomorphism of the starting curve and images of torsion points. We prove the OW-CPA security of Séta and present an IND-CCA variant using the post-quantum OAEP transformation. Several variants for key generation are explored together with their impact on the selection of parameters, such as the base prime of the scheme. We furthermore formalise an "uber" isogeny assumption framework which aims to generalize computational isogeny problems encountered in schemes including SIDH, CSDIH, OSIDH and ours. Finally, we carefully select parameters to achieve a balance between security and run-times and present experimental results from our implementation.

show abstract