Towards Practical Key Exchange from Ordinary Isogeny Graphs

Abstract

We revisit the ordinary isogeny-graph based cryptosystems of Couveignes and Rostovtsev-Stolbunov, long dismissed as impractical. We give algorithmic improvements that accelerate key exchange in this framework, and explore the problem of generating suitable system parameters for contemporary pre-and post-quantum security that take advantage of these new algorithms. We also prove the session-key security of this key exchange in the Canetti-Krawczyk model, and the IND-CPA security of the related public-key encryption scheme, under reasonable assumptions on the hardness of computing isogeny walks. Our systems admit efficient key-validation techniques that yield CCA-secure encryption, thus providing an important step towards efficient post-quantum non-interactive key exchange (NIKE).

Stronger and Faster Side-Channel Protections for CSIDH

“…On the positive side, the resulting system would have much stronger quantum security. Indeed, the best known quantum attacks are exponential in the size of the key space (≈ 2 2λ here), but only subexponential in p (see [7,13,6]). Since our modification more than doubles the size of p without changing the size of the key space, quantum security is automatically increased.…”

Quantum Circuits for the CSIDH: Optimizing Quantum Evaluation of Isogenies

“…One technique suggested by De Feo, Kieffer, and Smith [42,23] to compute the CRS group action is to use the (classical) modular polynomials Φ (X, Y ), which vanish exactly on the pairs of j-invariants that are connected by a cyclicisogeny. For prime , the polynomial Φ (X, Y ) is symmetric and has degree + 1 in the two variables, hence fixing one of the variables to some j-invariant and finding the roots of the resulting univariate polynomial suffices to find neighbours in the -isogeny graph.…”

“…Switching from j-invariants to other geometric invariants does not solve this problem. This is already a problem for CRS, and is already solved in [42,23] using the Bostan-Morain-Salvy-Schost algorithm. The application of this algorithm in the CRS context is slightly simpler than the application explained above, since there is no need for isogeny verification: one knows that E B is -isogenous to E A , and the only question is whether the kernel is in the correct Frobenius eigenspace.…”

“…Like the original CRS [20,64,68] isogeny-based cryptosystem, CSIDH has public keys and ciphertexts only about twice as large as traditional elliptic-curve keys and ciphertexts for a similar security level against all known pre-quantum attacks. CRS was accelerated recently by De Feo, Kieffer, and Smith [23]; CSIDH builds upon this and chooses curves in a different way, obtaining much better speed.…”

A Note on the Security of CSIDH

“…Most recently, two independent works revisited isogeny-based cryptosystems by restricting themselves to cases where the subexponential attacks based on the action of Cl(O) was applicable. The scheme known as CSIDH by Castryck et al [10] uses supersingular curves and isogenies defined over F p , while the scheme of De Feo, Kieffer and Smith [14] uses ordinary curves with many practical optimizations. In both cases, the appeal of using commutative structures is to allow more functionalities, such as static-static key exchange protocols that are not possible with SIDH without an expensive Fujisaki-Okamoto transform [2].…”