CSI-FiSh: Efficient Isogeny based Signatures through Class Group - PowerPoint PPT Presentation

CSI-FiSh: Efficient Isogeny based Signatures through Class Group Computations Ward Beullens Thorsten Kleinjung Frederik Vercauteren imec - COSIC December 3, 2019

Introduction : CSIDH [Castryck et al.] 1/34 Take the supersingular elliptic curve E 0 : y 2 = x 3 + x mod p = 4 · 3 · 5 · . . . · 373 · 587 − 1 . Let O = End p ( E 0 ) ≃ Z ( √− p ) .

Introduction : CSIDH [Castryck et al.] 1/34 Take the supersingular elliptic curve E 0 : y 2 = x 3 + x mod p = 4 · 3 · 5 · . . . · 373 · 587 − 1 . Let O = End p ( E 0 ) ≃ Z ( √− p ) . The class group cl ( O ) acts freely and transitively on a set of supersingular elliptic curves X = E ℓℓ p ( O , π ) .

Introduction : CSIDH [Castryck et al.] 1/34 Take the supersingular elliptic curve E 0 : y 2 = x 3 + x mod p = 4 · 3 · 5 · . . . · 373 · 587 − 1 . Let O = End p ( E 0 ) ≃ Z ( √− p ) . The class group cl ( O ) acts freely and transitively on a set of supersingular elliptic curves X = E ℓℓ p ( O , π ) . 74 “simple” ideals whose action can be computed efficiently: l 1 = (3 , π − 1) , · · · , l 74 = (587 , π − 1)

Introduction : CSIDH [Castryck et al.] 1/34 Take the supersingular elliptic curve E 0 : y 2 = x 3 + x mod p = 4 · 3 · 5 · . . . · 373 · 587 − 1 . Let O = End p ( E 0 ) ≃ Z ( √− p ) . The class group cl ( O ) acts freely and transitively on a set of supersingular elliptic curves X = E ℓℓ p ( O , π ) . 74 “simple” ideals whose action can be computed efficiently: l 1 = (3 , π − 1) , · · · , l 74 = (587 , π − 1) CSIDH-512: Efficient Post-Quantum Diffie-Hellman protocol based on this action. Reasonably fast ( ± 80 ms) and very small keys.

Introduction : CSIDH [Castryck et al.] 1/34 Take the supersingular elliptic curve E 0 : y 2 = x 3 + x mod p = 4 · 3 · 5 · . . . · 373 · 587 − 1 . Let O = End p ( E 0 ) ≃ Z ( √− p ) . The class group cl ( O ) acts freely and transitively on a set of supersingular elliptic curves X = E ℓℓ p ( O , π ) . 74 “simple” ideals whose action can be computed efficiently: l 1 = (3 , π − 1) , · · · , l 74 = (587 , π − 1) CSIDH-512: Efficient Post-Quantum Diffie-Hellman protocol based on this action. Reasonably fast ( ± 80 ms) and very small keys. Can we do signatures ?

Introduction : Seasign [De Feo, Galbraith] 2/34 [Rostovstev]: FS signatures from Graph Isomorphism-like identification scheme.

Introduction : Seasign [De Feo, Galbraith] 2/34 [Rostovstev]: FS signatures from Graph Isomorphism-like identification scheme. problem: We cannot uniquely represent elements g = � 74 i =1 l e i i . ⇒ Signatures leak secret key.

Introduction : Seasign [De Feo, Galbraith] 2/34 [Rostovstev]: FS signatures from Graph Isomorphism-like identification scheme. problem: We cannot uniquely represent elements g = � 74 i =1 l e i i . ⇒ Signatures leak secret key. solution: [SeaSign] Rejection sampling to prevent leakage. ⇒ Slow signing and large signatures (e.g. 17 min and 12 KB).

Introduction : Seasign [De Feo, Galbraith] 2/34 [Rostovstev]: FS signatures from Graph Isomorphism-like identification scheme. problem: We cannot uniquely represent elements g = � 74 i =1 l e i i . ⇒ Signatures leak secret key. solution: [SeaSign] Rejection sampling to prevent leakage. ⇒ Slow signing and large signatures (e.g. 17 min and 12 KB). Can we do better ?

Introduction: CSI-FiSh 3/34 We compute the structure of cl ( O ) : It is cyclic of order N =3 · 37 · 1407181 · 51593604295295867744293584889 · 31599414504681995853008278745587832204909 and generated by g = l 1 = (3 , π − 1) . We can uniquely represent elements of cl ( O ) as g a with a ∈ Z /N Z . CSI-FiSh: Isogeny signatures without rejection sampling ⇒ Much more efficient (e.g. 335 ms min and 2 KB).

Outline of the talk 4/34 1 Some Isogeny-Based Crypto 2 Class group computation 3 CSI-FiSh

Outline 5/34 1 Some Isogeny-Based Crypto 2 Class group computation 3 CSI-FiSh

Elliptic curves and isogenies 6/34 Definition (Elliptic curve) Elliptic curves are curves defined by an equation of the form y 2 = x 3 + ax + b . Definition (Isogeny) → An isogeny of elliptic curves E, E ′ is a non-zero algebraic group morphism from E to E ′ .

Endomorphisms 7/34 Definition (Endomorphism) An isogeny from a curve E to itself is called an endomorphism Examples: multiplication by n : P �→ P + P + · · · + P (n times). In characteristic p : Frobenius π : ( x, y ) �→ ( x p , y p ) . Endomorphisms form a ring End ( E ) : pointwise addition: ( φ 1 + φ 2 )( P ) = φ 1 ( P ) + φ 2 ( P ) multiplication by composition : φ 1 · φ 2 = φ 1 ◦ φ 2 Endomorphisms defined over F p form a Commutative subring! If End p ( E ) = End ( E ) , then E is ordinary, otherwise E is supersingular.

Separable isogenies ↔ finite subgroups 8/34 Fact 1: An isogeny E → E ′ has a finite kernel. And conversely: Fact 2: For every finite subgroup H ⊂ E , there exists an isogeny φ : E → E ′ with kernel H . And this E ′ is unique (up to isomorphism).

Separable isogenies ↔ finite subgroups 8/34 Fact 1: An isogeny E → E ′ has a finite kernel. And conversely: Fact 2: For every finite subgroup H ⊂ E , there exists an isogeny φ : E → E ′ with kernel H . And this E ′ is unique (up to isomorphism). Moreover, if H and E are defined over F p , then φ and E ′ are defined over F p Notation Given, H ⊂ E , we write E ′ = E/H .

Class group action 9/34 Let E/ F p be a curve with End F p ( E ) = O and let the ideal class group of O ( denoted by cl ( O ) ) be the group of invertible fractional ideals modulo principal ideals. Then cl ( O ) acts on the set of elliptic curves defined over F p with F p -endomorphism ring O : �� � [ I ] ⋆ E = E/ ker α α ∈ I Well defined because: isogenous curves have same endomorphism ring principal ideals act trivially: [ � α � ] ⋆ E = E/ (ker α ) = E

Class group action for CSIDH-512 10/34 [Castryck, Lange, Martindale, Panny, Renes] Choose p = 4 · 3 · 5 · . . . · 376 · 587 − 1 (which is prime), then E 0 : y 2 = x 3 + x is a supersingular elliptic curve with End F p ( E ) = Z [ π ] ≈ Z [ √− p ] . Let X = { E | E is supersingular and End F q ( E ) = Z [ π ] } . Then cl ( Z [ π ]) acts freely and transitively on X . One can efficiently compute the action of ideal classes of the form [ ℓ 1 ] = [(3 , π − 1)] , · · · , [ ℓ 74 ] = [(587 , π − 1)] and their inverses. A priori, we only really have a group action from Z 74 on X .

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Example 11/34 Images stolen from Wouter Castryck

Vectorization and Paralellization 12/34 Vectorization problem ∼ DLOG given E, E ′ , hard to find [ a ] ∈ cl ( O ) such that [ a ] ⋆ X = Y . E ′ E ? Paralellization problem ∼ CDH given E, [ a ] ⋆ E, [ b ] ⋆ E , hard to compute [ ab ] ⋆ X . [ a ] ⋆ X [ a ] ⋆ [ a ] ⋆ X ? [ b ] ⋆ [ b ] ⋆ [ b ] ⋆ X

CSIDH key exchange 13/34 Trump chooses secret key [ a ] , Zelensky chooses secret key [ b ] . 74 74 � [ ℓ i ] b i � [ ℓ i ] a i [ b ] = [ a ] = i =1 i =1 E a =[ a ] ⋆E 0 − − − − − − − − − − → E b =[ b ] ⋆E 0 ← − − − − − − − − − − ↓ ↓ [ a ] ⋆ E b [ b ] ⋆ E a Eavesdropper learns [ a ] ⋆ E 0 and [ b ] ⋆ E 0 , but not [ ab ] ⋆ E 0

CSIDH and Seasign 14/34 CSIDH Advantages: CSIDH Disadvantages: non-interactive Speed: ∼ 35 ms CCA-security Subexponential quantum attack key size: 64 Bytes

CSIDH and Seasign 14/34 CSIDH Advantages: CSIDH Disadvantages: non-interactive Speed: ∼ 35 ms CCA-security Subexponential quantum attack key size: 64 Bytes Can we do authentication/signatures? Problem is Z 74 ↔ cl ( O ) . We can’t sample uniformly from cl ( O ) . We dont have a unique way to represent elements in cl ( O ) .

CSIDH and Seasign 14/34 CSIDH Advantages: CSIDH Disadvantages: non-interactive Speed: ∼ 35 ms CCA-security Subexponential quantum attack key size: 64 Bytes Can we do authentication/signatures? Problem is Z 74 ↔ cl ( O ) . We can’t sample uniformly from cl ( O ) . We dont have a unique way to represent elements in cl ( O ) . Seasign[DeFeo,Galbraith]+[Decru,Panny,Vercauteren]: Expensive workaround by using a very redundant representation of class group elements: Public key 16 KB, signatures 4 KB, 4 minutes.