Computing Isogenies between Montgomery Curves Using the Action of (0 - PowerPoint PPT Presentation

Computing Isogenies between Montgomery Curves Using the Action of (0 , 0) Joost Renes Radboud University, The Netherlands 9 April 2018 9 April 2018 1 / 11

Supersingular isogeny-based cryptography ◮ Proposed by Jao & De Feo [JF11] ◮ Submitted to NIST competition [Aza+17] ( on Wednesday ) ◮ SIDH (passive security) ◮ SIKE (active security) ◮ This talk: computing isogenies on curves with extra structure 9 April 2018 2 / 11

A graph-based protocol Alice Bob 9 April 2018 3 / 11

A graph-based protocol Alice Bob 9 April 2018 3 / 11

A graph-based protocol 24 Alice 24 Bob 9 April 2018 3 / 11

A graph-based protocol 24 Alice 24 Bob 9 April 2018 3 / 11

A graph-based protocol 24 Alice 66 41 24 Bob 9 April 2018 3 / 11

A graph-based protocol 24 Alice 66 41 24 Bob 9 April 2018 3 / 11

A graph-based protocol 41 24 Alice 66 41 24 Bob 66 9 April 2018 3 / 11

A graph-based protocol 41 24 Alice 66 41 24 Bob 66 9 April 2018 3 / 11

A graph-based protocol 41 24 Alice 66 48 41 24 Bob 66 48 9 April 2018 3 / 11

Constructing graphs and walks using isogenies 9 April 2018 4 / 11

Constructing graphs and walks using isogenies J 41 J 24 J 0 J 66 J 17 J 48 J 40 Classes of supersingular elliptic curves 9 April 2018 4 / 11

Constructing graphs and walks using isogenies J 41 J 24 J 0 J 66 J 17 J 48 J 40 ℓ -isogeny φ Classes of supersingular elliptic curves 9 April 2018 4 / 11

Constructing graphs and walks using isogenies J 0 J 17 J 48 J 40 ℓ -isogeny φ Classes of supersingular elliptic curves 9 April 2018 4 / 11

Constructing graphs and walks using isogenies Φ ℓ ( X , Y ) = X ℓ +1 + Y ℓ +1 + · · · (1) J 0 J 17 J 48 J 40 ℓ -isogeny φ Classes of supersingular elliptic curves 9 April 2018 4 / 11

Constructing graphs and walks using isogenies Φ ℓ ( X , Y ) = X ℓ +1 + Y ℓ +1 + · · · (1) E 0 E 17 E 48 E 40 ℓ -isogeny φ Supersingular elliptic curves 9 April 2018 4 / 11

Constructing graphs and walks using isogenies Φ ℓ ( X , Y ) = X ℓ +1 + Y ℓ +1 + · · · (1) (2) ℓ + 1 subgroups of order ℓ (V´ elu’s formulas) E 0 E 17 E 48 E 40 ℓ -isogeny φ Supersingular elliptic curves 9 April 2018 4 / 11

Constructing graphs and walks using isogenies Φ ℓ ( X , Y ) = X ℓ +1 + Y ℓ +1 + · · · (1) (2) ℓ + 1 subgroups of order ℓ (V´ elu’s formulas) M 0 M 17 M 48 M 40 ℓ -isogeny φ Supersingular Montgomery curves 9 April 2018 4 / 11

Constructing graphs and walks using isogenies Φ ℓ ( X , Y ) = X ℓ +1 + Y ℓ +1 + · · · (1) (2) ℓ + 1 subgroups of order ℓ (V´ elu’s formulas) (3) Costello–Hisil [CH17] for ℓ ≥ 3 M 0 M 17 M 48 M 40 ℓ -isogeny φ Supersingular Montgomery curves 9 April 2018 4 / 11

Constructing graphs and walks using isogenies Φ ℓ ( X , Y ) = X ℓ +1 + Y ℓ +1 + · · · (1) (2) ℓ + 1 subgroups of order ℓ (V´ elu’s formulas) (3) Costello–Hisil [CH17] for ℓ ≥ 3 (Q1) Where do these formulas come from? (Q2) What about ℓ = 2 ? M 0 M 17 M 48 M 40 ℓ -isogeny φ Supersingular Montgomery curves 9 April 2018 4 / 11

What is an isogeny.. (1) A morphism of curves φ M A ( x , y ) = 0 → M A ′ ( x , y ) = 0 − − − − − − − − − 9 April 2018 5 / 11

What is an isogeny.. (1) A morphism of curves � f ( x ) � g ( x ) , — φ = M A ( x , y ) = 0 → M A ′ ( x , y ) = 0 − − − − − − − − − 9 April 2018 5 / 11

What is an isogeny.. (1) A morphism of curves � f ( x ) � g ( x ) , — φ = M A ( x , y ) = 0 → M A ′ ( x , y ) = 0 − − − − − − − − − 9 April 2018 5 / 11

What is an isogeny.. (1) A morphism of curves � f ( x ) � g ( x ) , — φ = M A ( x , y ) = 0 → M A ′ ( x , y ) = 0 − − − − − − − − − (2) A homomorphism of groups ( x 0 , —) ( x 1 , —) = ( x 2 , —) ⊕ � � f ( x 0 ) g ( x 0 ) , — 9 April 2018 5 / 11

What is an isogeny.. (1) A morphism of curves � f ( x ) � g ( x ) , — φ = M A ( x , y ) = 0 → M A ′ ( x , y ) = 0 − − − − − − − − − (2) A homomorphism of groups ( x 0 , —) ( x 1 , —) = ( x 2 , —) ⊕ � � � � � � f ( x 0 ) f ( x 1 ) f ( x 2 ) = g ( x 0 ) , — g ( x 1 ) , — g ( x 2 ) , — ⊕ 9 April 2018 5 / 11

Describing f and g � � f ( x ) Given an isogeny φ ( x ) = g ( x ) , — (1) A point ∞ such that φ : ∞ �→ ∞ . Also 9 April 2018 6 / 11

Describing f and g � � f ( x ) Given an isogeny φ ( x ) = g ( x ) , — (1) A point ∞ such that φ : ∞ �→ ∞ . Also ( x T , —) �→ ∞ ⇐ ⇒ g ( x T ) = 0 9 April 2018 6 / 11

Describing f and g � � f ( x ) Given an isogeny φ ( x ) = g ( x ) , — (1) A point ∞ such that φ : ∞ �→ ∞ . Also ( x T , —) �→ ∞ ⇐ ⇒ g ( x T ) = 0 � = ⇒ g ( x ) ≈ ( x − x T ) T ∈ ker φ 9 April 2018 6 / 11

Describing f and g � � f ( x ) Given an isogeny φ ( x ) = g ( x ) , — (1) A point ∞ such that φ : ∞ �→ ∞ . Also ( x T , —) �→ ∞ ⇐ ⇒ g ( x T ) = 0 � = ⇒ g ( x ) ≈ ( x − x T ) T ∈ ker φ (2) A point Q ∈ M A such that f ( x Q ) = 0 9 April 2018 6 / 11

Describing f and g � � f ( x ) Given an isogeny φ ( x ) = g ( x ) , — (1) A point ∞ such that φ : ∞ �→ ∞ . Also ( x T , —) �→ ∞ ⇐ ⇒ g ( x T ) = 0 � = ⇒ g ( x ) ≈ ( x − x T ) T ∈ ker φ (2) A point Q ∈ M A such that f ( x Q ) = 0 = ⇒ f ( x T + Q ) = 0 for all T ∈ ker φ 9 April 2018 6 / 11

Describing f and g � � f ( x ) Given an isogeny φ ( x ) = g ( x ) , — (1) A point ∞ such that φ : ∞ �→ ∞ . Also ( x T , —) �→ ∞ ⇐ ⇒ g ( x T ) = 0 � = ⇒ g ( x ) ≈ ( x − x T ) T ∈ ker φ (2) A point Q ∈ M A such that f ( x Q ) = 0 = ⇒ f ( x T + Q ) = 0 for all T ∈ ker φ � = ⇒ f ( x ) ≈ ( x − x T + Q ) T ∈ ker φ 9 April 2018 6 / 11

Isogeny structure Theorem (sketch) Let G ⊂ M ( ¯ K ) be a subgroup, Q / ∈ G and � f ( x ) � φ = g ( x ) , — a separable isogeny such that ker φ = G and f ( x Q ) = 0 . Then � � f ( x ) = c f · ( x − x T + Q ) , g ( x ) = ( x − x T ) . T ∈ G T ∈ G \∞ 9 April 2018 7 / 11

Isogeny structure Theorem (sketch) Let G ⊂ M ( ¯ K ) be a subgroup, Q / ∈ G and � f ( x ) � φ = g ( x ) , — a separable isogeny such that ker φ = G and f ( x Q ) = 0 . Then � � f ( x ) = c f · ( x − x T + Q ) , g ( x ) = ( x − x T ) . T ∈ G T ∈ G \∞ ◮ Generalizes when Q does not map to (0 , —) 9 April 2018 7 / 11

Isogeny structure Theorem (sketch) Let G ⊂ M ( ¯ K ) be a subgroup, Q / ∈ G and � f ( x ) � φ = g ( x ) , — a separable isogeny such that ker φ = G and f ( x Q ) = 0 . Then � � f ( x ) = c f · ( x − x T + Q ) , g ( x ) = ( x − x T ) . T ∈ G T ∈ G \∞ ◮ Generalizes when Q does not map to (0 , —) ◮ Close connection between action of Q and isogeny! 9 April 2018 7 / 11

Application to Montgomery curves This works perfectly for Montgomery curves! (1) A distinguished point Q = (0 , 0) of order two � � 1 (2) A very simple action ( x T , —) + Q = x T , — 9 April 2018 8 / 11

Application to Montgomery curves This works perfectly for Montgomery curves! (1) A distinguished point Q = (0 , 0) of order two � � 1 (2) A very simple action ( x T , —) + Q = x T , —   x · x T − 1 � = ⇒ φ ( x ) =  x , —  x − x T T ∈ G \∞ 9 April 2018 8 / 11

Application to Montgomery curves This works perfectly for Montgomery curves! (1) A distinguished point Q = (0 , 0) of order two � � 1 (2) A very simple action ( x T , —) + Q = x T , —   x · x T − 1 � = ⇒ φ ( x ) =  x , —  x − x T T ∈ G \∞ and A ′ = π ( A − 3 σ ), where x T − 1 � � π = x T , σ = x T T ∈ G \∞ T ∈ G \∞ 9 April 2018 8 / 11

Application to Montgomery curves This works perfectly for Montgomery curves! (1) A distinguished point Q = (0 , 0) of order two � � 1 (2) A very simple action ( x T , —) + Q = x T , —   x · x T − 1 � = ⇒ φ ( x ) =  x , —  x − x T T ∈ G \∞ and A ′ = π ( A − 3 σ ), where x T − 1 � � π = x T , σ = x T T ∈ G \∞ T ∈ G \∞ for any subgroup not containing (0 , 0), generalizing [CH17] 9 April 2018 8 / 11

Isogenies of degree two.. A curve has three points of order two, one of which is (0 , 0) M 0 9 April 2018 9 / 11

Isogenies of degree two.. A curve has three points of order two, one of which is (0 , 0) M 0 ker = ( 0 , 0 ) 9 April 2018 9 / 11

Isogenies of degree two.. A curve has three points of order two, one of which is (0 , 0) M 0 9 April 2018 9 / 11

Isogenies of degree two.. A curve has three points of order two, one of which is (0 , 0) M 0 9 April 2018 9 / 11

Isogenies of degree two.. A curve has three points of order two, one of which is (0 , 0) M 0 M 1 9 April 2018 9 / 11

Isogenies of degree two.. A curve has three points of order two, one of which is (0 , 0) M 0 M 1 9 April 2018 9 / 11