Efficient compression of SIDH public keys Craig Costello 1 David Jao - PowerPoint PPT Presentation

Efficient compression of SIDH public keys Craig Costello 1 David Jao 2 Patrick Longa 1 Michael Naehrig 1 Joost Renes 3 David Urbanik 2 1 Microsoft Research, Redmond, USA 2 University of Waterloo, Ontario, Canada 3 Radboud University, Nijmegen, The Netherlands 1 May 2017 1 May 2017 1 / 14

Supersingular-isogeny Diffie-Hellman ◮ Post-quantum secure (ephemeral) key exchange [JF11] ◮ Based on hardness of finding large-degree isogenies ◮ Small keys ( ≈ 564 bytes public) ◮ Relatively slow compared to other PQ proposals ◮ Key compression ( ≈ 385 bytes), at very high cost [Aza+16] 1 May 2017 2 / 14

Supersingular-isogeny Diffie-Hellman ◮ Post-quantum secure (ephemeral) key exchange [JF11] ◮ Based on hardness of finding large-degree isogenies ◮ Small keys ( ≈ 564 bytes public) ◮ Relatively slow compared to other PQ proposals ◮ Key compression ( ≈ 385 bytes), at very high cost [Aza+16] This talk ◮ Key size reduced by 12 . 5% ( ≈ 330 bytes) ◮ Compression up to 66 × faster ◮ Decompression up to 15 × faster 1 May 2017 2 / 14

Isogeny graphs p = 2 3 · 3 2 − 1 , E / F p 2 : y 2 = x 3 + x , j ( E ) = 24 , ℓ = 2 41 24 66 17 0 48 40 1 May 2017 3 / 14

Isogeny graphs p = 2 3 · 3 2 − 1 , E / F p 2 : y 2 = x 3 + x , j ( E ) = 24 , ℓ = 2 41 2 2 24 2 66 17 0 48 3 40 1 May 2017 3 / 14

Isogeny graphs p = 2 3 · 3 2 − 1 , E / F p 2 : y 2 = x 3 + x , j ( E ) = 24 , ℓ = 2 41 24 66 17 0 48 40 1 May 2017 3 / 14

Isogeny graphs p = 2 3 · 3 2 − 1 , E / F p 2 : y 2 = x 3 + x , j ( E ) = 24 , ℓ = 3 41 3 24 2 2 2 66 17 0 2 48 2 2 2 40 1 May 2017 3 / 14

Key generation = private party A , = private party B , = public keys 41 2 2 24 2 66 17 0 48 3 40 1 May 2017 4 / 14

Key generation = private party A , = private party B , = public keys 41 3 24 2 2 2 66 17 0 2 48 2 2 2 40 1 May 2017 4 / 14

Supersingular-isogeny Diffie-Hellman [JF11] = private party A , = private party B , = public key ր ր ր = 2-graph walk, ց = 3-graph walk, ց ց E A φ A E φ B E B 1 May 2017 5 / 14

Supersingular-isogeny Diffie-Hellman [JF11] = private party A , = private party B , = public key ր ր ր = 2-graph walk, ց = 3-graph walk, ց ց E A [ ℓ e ] = � P , Q � E A φ A E AB E φ B E B 1 May 2017 5 / 14

Supersingular-isogeny Diffie-Hellman [JF11] = private party A , = private party B , = public key ր ր ր = 2-graph walk, ց ց ց = 3-graph walk, ∈ F 2 E A [ ℓ e ] = � P , Q � p 2 (= 4 log p bits) ∈ F p 2 (= 2 log p bits) E A φ A E AB E φ B E B 1 May 2017 5 / 14

Supersingular-isogeny Diffie-Hellman [JF11] = private party A , = private party B , = public key ր ր ր = 2-graph walk, ց ց ց = 3-graph walk, E A [ ℓ e ] = � R , S � ∈ F 2 E A [ ℓ e ] = � P , Q � p 2 (= 4 log p bits) ∈ F p 2 (= 2 log p bits) E A φ A E AB E φ B E B 1 May 2017 5 / 14

Supersingular-isogeny Diffie-Hellman [JF11] = private party A , = private party B , = public key ր ր ր = 2-graph walk, ց ց ց = 3-graph walk, E A [ ℓ e ] = � R , S � ∈ Z 4 ( α, β, γ, δ ) ℓ e ( ≈ 2 log p bits) ∈ F p 2 (= 2 log p bits) E A φ A E AB E φ B E B 1 May 2017 5 / 14

Public-key compression [Aza+16] Compression � R , S � � P , Q � ( α, β, γ, δ ) � α R + β S , γ R + δ S � Decompression � R , S � ( α, β, γ, δ ) � P , Q � ( α, β, γ, δ ) 1 May 2017 6 / 14

Public-key compression [Aza+16] Compression � R , S � Expensive � P , Q � ( α, β, γ, δ ) � α R + β S , γ R + δ S � Decompression � R , S � ( α, β, γ, δ ) � P , Q � ( α, β, γ, δ ) 1 May 2017 6 / 14

Public-key compression [Aza+16] Significantly improve efficiency (up to 66 × ) Compression � R , S � � P , Q � ( α, β, γ, δ ) � α R + β S , γ R + δ S � Decompression � R , S � ( α, β, γ, δ ) � P , Q � ( α, β, γ, δ ) Significantly improve efficiency (up to 15 × ) 1 May 2017 6 / 14

Finding a canonical basis Find R , S such that E [2 372 ] = � R , S � , where 2 372 3 239 � 2 . � # E ( F p 2 ) = 1 May 2017 7 / 14

Finding a canonical basis Find R , S such that E [2 372 ] = � R , S � , where 2 372 3 239 � 2 . � # E ( F p 2 ) = Finding an element of order 2 372 1 Deterministically pick R ∈ E ( F p 2 ) \ 2 E ( F p 2 ) 1 May 2017 7 / 14

Finding a canonical basis Find R , S such that E [2 372 ] = � R , S � , where 2 372 3 239 � 2 . � # E ( F p 2 ) = Finding an element of order 2 372 1 Deterministically pick R ∈ E ( F p 2 ) \ 2 E ( F p 2 ) For E : y 2 = x ( x − γ )( x − δ ), R ∈ 2 E ( F p 2 ) ⇐ ⇒ x R , x R − δ, x R − γ are squares 1 May 2017 7 / 14

Finding a canonical basis Find R , S such that E [2 372 ] = � R , S � , where 2 372 3 239 � 2 . � # E ( F p 2 ) = Finding an element of order 2 372 1 Deterministically pick a non-square x R ∈ F p 2 For E : y 2 = x ( x − γ )( x − δ ), R ∈ 2 E ( F p 2 ) ⇐ ⇒ x R , x R − δ, x R − γ are squares 1 May 2017 7 / 14

Finding a canonical basis Find R , S such that E [2 372 ] = � R , S � , where 2 372 3 239 � 2 . � # E ( F p 2 ) = Finding an element of order 2 372 1 Deterministically pick a non-square x R ∈ F p 2 2 If x 3 R + Ax 2 R + x R is not a square, goto 1 1 May 2017 7 / 14

Finding a canonical basis Find R , S such that E [2 372 ] = � R , S � , where 2 372 3 239 � 2 . � # E ( F p 2 ) = Finding an element of order 2 372 1 Deterministically pick a non-square x R ∈ F p 2 2 If x 3 R + Ax 2 R + x R is not a square, goto 1 � x 3 R + Ax 2 3 Set R ← ( x R , R + x R ) 1 May 2017 7 / 14

Finding a canonical basis Find R , S such that E [2 372 ] = � R , S � , where 2 372 3 239 � 2 . � # E ( F p 2 ) = Finding an element of order 2 372 1 Deterministically pick a non-square x R ∈ F p 2 2 If x 3 R + Ax 2 R + x R is not a square, goto 1 � x 3 R + Ax 2 3 Set R ← ( x R , R + x R ) 4 Set R ← [3 239 ] R 1 May 2017 7 / 14

Finding a canonical basis Find R , S such that E [2 372 ] = � R , S � , where 2 372 3 239 � 2 . � # E ( F p 2 ) = Finding an element of order 2 372 1 Deterministically pick a non-square x R ∈ F p 2 2 If x 3 R + Ax 2 R + x R is not a square, goto 1 � x 3 R + Ax 2 3 Set R ← ( x R , R + x R ) 4 Set R ← [3 239 ] R Finding a canonical basis of E [2 372 ] 1 Pick R ∈ E ( F p 2 ) of order 2 372 2 Pick S ∈ E ( F p 2 ) of order 2 372 3 If E [2 372 ] � = � R , S � , goto 2. 1 May 2017 7 / 14

Transferring to µ n via reduced Tate pairing Transfer the discrete logs to µ n e β = e ( R , P ) e δ = e ( R , Q ) e = e ( R , S ) e − α = e ( S , P ) e − γ = e ( S , Q ) such that P = α R + β S and Q = γ R + δ S 1 May 2017 8 / 14

Transferring to µ n via reduced Tate pairing Transfer the discrete logs to µ n e β = e ( R , P ) e δ = e ( R , Q ) e = e ( R , S ) e − α = e ( S , P ) e − γ = e ( S , Q ) such that P = α R + β S and Q = γ R + δ S e ( R , S ) e ( R , P ) e ( R , Q ) e ( S , P ) e ( S , Q ) f 0 ← f n , R f 0 ← f 0 ( S ) . . . 1 May 2017 8 / 14

Transferring to µ n via reduced Tate pairing Transfer the discrete logs to µ n e β = e ( R , P ) e δ = e ( R , Q ) e = e ( R , S ) e − α = e ( S , P ) e − γ = e ( S , Q ) such that P = α R + β S and Q = γ R + δ S e ( R , S ) e ( R , P ) e ( R , Q ) e ( S , P ) e ( S , Q ) f 0 ← f n , R f 1 ← f n , R f 0 ← f 0 ( S ) f 1 ← f 1 ( P ) . . . . . . 1 May 2017 8 / 14

Transferring to µ n via reduced Tate pairing Transfer the discrete logs to µ n e β = e ( R , P ) e δ = e ( R , Q ) e = e ( R , S ) e − α = e ( S , P ) e − γ = e ( S , Q ) such that P = α R + β S and Q = γ R + δ S e ( R , S ) e ( R , P ) e ( R , Q ) e ( S , P ) e ( S , Q ) f 0 ← f n , R f 0 ← f 0 ( S ) f 1 ← f 0 ( P ) . . . . . . 1 May 2017 8 / 14

Transferring to µ n via reduced Tate pairing Transfer the discrete logs to µ n e β = e ( R , P ) e δ = e ( R , Q ) e = e ( R , S ) e − α = e ( S , P ) e − γ = e ( S , Q ) such that P = α R + β S and Q = γ R + δ S e ( R , S ) e ( R , P ) e ( R , Q ) e ( S , P ) e ( S , Q ) f 0 ← f n , R f 2 ← f n , R f 0 ← f 0 ( S ) f 1 ← f 0 ( P ) f 2 ← f 2 ( Q ) . . . . . . . . . 1 May 2017 8 / 14

Transferring to µ n via reduced Tate pairing Transfer the discrete logs to µ n e β = e ( R , P ) e δ = e ( R , Q ) e = e ( R , S ) e − α = e ( S , P ) e − γ = e ( S , Q ) such that P = α R + β S and Q = γ R + δ S e ( R , S ) e ( R , P ) e ( R , Q ) e ( S , P ) e ( S , Q ) f 0 ← f n , R f 0 ← f 0 ( S ) f 1 ← f 0 ( P ) f 2 ← f 0 ( Q ) . . . . . . . . . 1 May 2017 8 / 14

Transferring to µ n via reduced Tate pairing Transfer the discrete logs to µ n e β = e ( R , P ) e δ = e ( R , Q ) e = e ( R , S ) e − α = e ( S , P ) e − γ = e ( S , Q ) such that P = α R + β S and Q = γ R + δ S e ( R , S ) e ( R , P ) e ( R , Q ) e ( S , P ) e ( S , Q ) f 0 ← f n , R f 3 ← f n , S f 0 ← f 0 ( S ) f 1 ← f 0 ( P ) f 2 ← f 0 ( Q ) f 3 ← f 3 ( P ) . . . . . . . . . . . . 1 May 2017 8 / 14