Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies

Abstract

Abstract. We present new candidates for quantum-resistant public-key cryptosystems based on the conjectured difficulty of finding isogenies between supersingular elliptic curves. The main technical idea in our scheme is that we transmit the images of torsion bases under the isogeny in order to allow the two parties to arrive at a common shared key despite the noncommutativity of the endomorphism ring. Our work is motivated by the recent development of a subexponential-time quantum algorithm for constructing isogenies between ordinary elliptic curves. In the supersingular case, by contrast, the fastest known quantum attack remains exponential, since the noncommutativity of the endomorphism ring means that the approach used in the ordinary case does not apply. We give a precise formulation of the necessary computational assumption along with a discussion of its validity, and prove the security of our protocols under this assumption. In addition, we present implementation results showing that our protocols are multiple orders of magnitude faster than previous isogeny-based cryptosystems over ordinary curves.

Isogeny-Based Quantum-Resistant Undeniable Signatures

“…One early proposal by Stolbunov [29], based on isogenies between ordinary elliptic curves, was subsequently shown by Childs et al [8] to offer only subexponential difficulty against quantum computers. 3 Following these developments, De Feo et al [13,20] proposed a new collection of quantum-resistant public-key cryptographic protocols for entity authentication, key exchange, and public-key cryptography, based on the difficulty of…”

“…In analogy with [13,20], we define the following computational problems, which we assume are quantum-infeasible: …”

“…To prepare for the emergence of quantum computers, we aim to design cryptographic primitives for common operations such as encryption and authentication which resist quantum attacks. One family of such primitives, proposed by De Feo, Jao, and Plût [13,20], uses isogenies between supersingular elliptic curves to construct cryptographic protocols for public-key encryption, key exchange, and entity authentication which are believed to be quantumresistant. To date, however, this protocol family lacks comprehensive techniques for achieving data authentication, although certain limited capabilities, such as isogeny-based strong designated verifier signatures, are available [30].…”

“…For further details on the mathematical foundations of isogenies, we refer the reader to [13,20,28].…”

“…The kernel K of φ uniquely defines the isogeny φ up to isomorphism [28,III.4.12]; for this reason, we use the notation E 1 /K to denote the codomain E 2 of the isogeny φ. Methods for computing and evaluating isogenies are given in [5,13,20,21,32]. All the isogenies that we use have the property that the kernels are cyclic groups, and knowledge of the kernel, or any single generator of the kernel, allows for efficient evaluation of the isogeny (up to isomorphism); conversely, the ability to evaluate the isogeny via a black box allows for efficient determination of the kernel (cf.…”