Towards Optimized and Constant-Time CSIDH on Embedded Devices

Jalali, Amir; Azarderakhsh, Reza; Kermani, Mehran Mozaffari; Jao, David

doi:10.1007/978-3-030-16350-1_12

Cited by 28 publications

(21 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The authors in [CLM + 18] argued that a constant-time implementation can be obtained when adding certain "dummy" operations, which will not be considered nor affect the final output of the group action. The first constant-time implementations of Algorithm 1 are due to Bernstein, Lange, Martindale, Panny [BLMP19] and Jalali, Azarderakhsh, Kermani, Jao [JAKJ19], which add a large amount of dummy operations and have a probability of failure in the class group action computation.…”

Section: Optimization Techniques For Constant-time Csidhmentioning

confidence: 99%

Batching CSIDH Group Actions using AVX-512

Cheng

Fotiadis

Großschädl

et al. 2021

TCHES

View full text Add to dashboard Cite

Commutative Supersingular Isogeny Diffie-Hellman (or CSIDH for short) is a recently-proposed post-quantum key establishment scheme that belongs to the family of isogeny-based cryptosystems. The CSIDH protocol is based on the action of an ideal class group on a set of supersingular elliptic curves and comes with some very attractive features, e.g. the ability to serve as a “drop-in” replacement for the standard elliptic curve Diffie-Hellman protocol. Unfortunately, the execution time of CSIDH is prohibitively high for many real-world applications, mainly due to the enormous computational cost of the underlying group action. Consequently, there is a strong demand for optimizations that increase the efficiency of the class group action evaluation, which is not only important for CSIDH, but also for related cryptosystems like the signature schemes CSI-FiSh and SeaSign. In this paper, we explore how the AVX-512 vector extensions (incl. AVX-512F and AVX-512IFMA) can be utilized to optimize constant-time evaluation of the CSIDH-512 class group action with the goal of, respectively, maximizing throughput and minimizing latency. We introduce different approaches for batching group actions and computing them in SIMD fashion on modern Intel processors. In particular, we present a hybrid batching technique that, when combined with optimized (8 × 1)-way prime-field arithmetic, increases the throughput by a factor of 3.64 compared to a state-of-the-art (non-vectorized) x64 implementation. On the other hand, vectorization in a 2-way fashion aimed to reduce latency makes our AVX-512 implementation of the group action evaluation about 1.54 times faster than the state-of-the-art. To the best of our knowledge, this paper is the first to demonstrate the high potential of using vector instructions to increase the throughput (resp. decrease the latency) of constant-time CSIDH.

show abstract

Section: Optimization Techniques For Constant-time Csidhmentioning

confidence: 99%

Batching CSIDH Group Actions using AVX-512

Cheng

Fotiadis

Großschädl

et al. 2021

TCHES

View full text Add to dashboard Cite

show abstract

“…Therefore, their constant-time implementation has no branches (such as if branch). Jalali, Azarderakhsh, Kermani, and Jao [19] proposed a constant-time implementation for classical computers, which also has no branches. As a result of removing all branches, these implementations are slower than that of [17].…”

Section: Constant-time Implementations Based On Another Definitionmentioning

confidence: 99%

“…The constant-time implementation in [17] allows variance of the computational time of their implementation with randomness that does not relate to secret information. On the other hand, implementations which do not allow such variance are proposed by Bernstein, Lange, Martindale, and Panny [18] and Jalali, Azarderakhsh, Kermani, and Jao [19]. The implementation in [18] is for evaluating the performance of quantum attacks for CSIDH.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Constant-Time Algorithm of CSIDH Keeping Two Points

Onuki

Aikawa

Yamazaki

et al. 2020

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

Hiroshi ONUKI †a) , Yusuke AIKAWA † †b) , Tsutomu YAMAZAKI † † †c) , Nonmembers, and Tsuyoshi TAKAGI †d) , Member SUMMARY At ASIACRYPT 2018, Castryck, Lange, Martindale, Panny and Renes proposed CSIDH, which is a key-exchange protocol based on isogenies between elliptic curves, and a candidate for postquantum cryptography. However, the implementation by Castryck et al. is not constant-time. Specifically, a part of the secret key could be recovered by the side-channel attacks. Recently, Meyer, Campos, and Reith proposed a constant-time implementation of CSIDH by introducing dummy isogenies and taking secret exponents only from intervals of non-negative integers. Their non-negative intervals make the calculation cost of their implementation of CSIDH twice that of the worst case of the standard (variabletime) implementation of CSIDH. In this paper, we propose a more efficient constant-time algorithm that takes secret exponents from intervals symmetric with respect to the zero. For using these intervals, we need to keep two torsion points on an elliptic curve and calculation for these points. We evaluate the costs of our implementation and that of Meyer et al. in terms of the number of operations on a finite prime field. Our evaluation shows that our constant-time implementation of CSIDH reduces the calculation cost by 28% compared with the implementation by Mayer et al. We also implemented our algorithm by extending the implementation in C of Meyer et al. (originally from Castryck et al.). Then our implementation achieved 152 million clock cycles, which is about 29% faster than that of Meyer et al. and confirms the above reduction ratio in our cost evaluation.

show abstract

“…It has been used in [ 20 ] to devise the signature scheme SeaSign. CSIDH and SeaSign were further studied and their efficiency was improved in [ 22 , 26 , 35 , 36 ], the last two works published at PQCRYPTO 2019.…”

Section: Introductionmentioning

confidence: 99%

Quantum Security Analysis of CSIDH

Bonnetain

Schrottenloher

2020

Advances in Cryptology – EUROCRYPT 2020

View full text Add to dashboard Cite

CSIDH is a recent proposal for post-quantum non-interactive key-exchange, based on supersingular elliptic curve isogenies. It is similar in design to a previous scheme by Couveignes, Rostovtsev and Stolbunov, but aims at an improved balance between efficiency and security. In the proposal, the authors suggest concrete parameters in order to meet some desired levels of quantum security. These parameters are based on the hardness of recovering a hidden isogeny between two elliptic curves, using a quantum subexponential algorithm of Childs, Jao and Soukharev. This algorithm combines two building blocks: first, a quantum algorithm for recovering a hidden shift in a commutative group. Second, a computation in superposition of all isogenies originating from a given curve, which the algorithm calls as a black box. In this paper, we give a comprehensive security analysis of CSIDH. Our first step is to revisit three quantum algorithms for the abelian hidden shift problem from the perspective of non-asymptotic cost, with trade-offs between their quantum and classical complexities. Second, we complete the non-asymptotic study of the black box in the hidden shift algorithm. We give a quantum procedure that evaluates CSIDH-512 using less than 40 000 logical qubits. This allows us to show that the parameters proposed by the authors of CSIDH do not meet their expected quantum security.

show abstract

Towards Optimized and Constant-Time CSIDH on Embedded Devices

Cited by 28 publications

References 20 publications

Batching CSIDH Group Actions using AVX-512

Batching CSIDH Group Actions using AVX-512

A Constant-Time Algorithm of CSIDH Keeping Two Points

Quantum Security Analysis of CSIDH

Contact Info

Product

Resources

About