Faster Isogeny-Based Compressed Key Agreement Gustavo H. M. Zanon, Marcos A. Simplicio Jr, Geovandro C. C. F. Pereira , Javad Doliskani, and Paulo S. L. M. Barreto. 1
REVI EW : SI DH AND COMPRESSED KEYS 2
Isogeny-based Crypto n SIDH: proposed replacement for DH-based elliptic curves in a post-quantum world. n Smallest post-quantum public keys ( < 200 bytes) ¨ boosted by key compression techniques ¨ applications with low bandwidth requirements n Downside: ¨ ≈ 2 order of magnitude slower than Four ℚ -based DH or other fast post-quantum KEM schemes (NewHope/ NTRU). 3
SIDH Parameter Setting n ! = 2 $ ⋅ 3 ' − 1 for post-quantum sec. level ≈ 128 bits ¨ Previous: 751-bit prime for , = 372, / = 239 ¨ [ 2018] Adj et al. suggest ≈ 448 -bit primes are enough n 2 3 /5 6 7 ∶ 9: ; = < = + ?< ; + < a supersingular Montgomery curve of order p + 1 ; = 2 ;$ 3 ;' B , C B = 2(5 6 7 )[2 $ ] , A H , C H = 2(5 6 7 )[3 ' ] ¨ A n User private key: I ∈ K ℤ/ℓ N ℤ for ℓ ∈ 2,3 , O ∈ {,, /} n User public key: curve R S,T and points U V , U W . 4
SIDH Parameter Setting n ! = 2 $ ⋅ 3 ' − 1 for post-quantum sec. level ≈ 128 bits ¨ Previous: 751-bit prime for , = 372, / = 239 ¨ [ 2018] Adj et al. suggest ≈ 448 -bit primes are enough n 2 3 /5 6 7 ∶ 9: ; = < = + ?< ; + < a supersingular Montgomery curve of order p + 1 ; = 2 ;$ 3 ;' B , C B = 2(5 6 7 )[2 $ ] , A H , C H = 2(5 6 7 )[3 ' ] ¨ A n User private key: I ∈ K ℤ/ℓ N ℤ for ℓ ∈ 2,3 , O ∈ {,, /} n User public key: curve R S,T and points U V , U W . 5
SIDH Parameter Setting n ! = 2 $ ⋅ 3 ' − 1 for post-quantum sec. level ≈ 128 bits ¨ Previous: 751-bit prime for , = 372, / = 239 ¨ [ 2018] Adj et al. suggest ≈ 448 -bit primes are enough n 2 3 /5 6 7 ∶ 9: ; = < = + ?< ; + < a supersingular Montgomery curve of order p + 1 ; = 2 ;$ 3 ;' B , C B = 2(5 6 7 )[2 $ ] , A H , C H = 2(5 6 7 )[3 ' ] ¨ A n User private key: I ∈ K ℤ/ℓ N ℤ for ℓ ∈ 2,3 , O ∈ {,, /} n User public key: curve R S,T = U(2 3 ) and points V W , V X ∈ 2 B,H . 6
SIDH Public Key Compression n Goal: transmit public key {" #,% , & ' , &())} " #,% /- . / : 12 3 = 5 6 + 85 3 + 5 & ' , & ) ∈ E ;,< 7
SIDH Public Key Compression n [ 2011] Jao et al. ’s public key representation: !, # , $ % & , $ %(() ∈ + , - Pub. Key size: . /01 2 bits 3 4,5 /+ , - : #8 9 = ; < + !; 9 + ; % & , % ( ∈ E ?,@ 8
SIDH Public Key Compression n [ 2016] Azarderakhsh et al.’s key compression: '() *,+ ) ) *,+ /. / 0 : 23 4 = 6 7 + 96 4 + 6 ! " # ,% # ← '() *,+ ) : ; , : < ∈ E ?,@ isomorphic curve 9
SIDH Public Key Compression n [ 2016] Azarderakhsh et al.’s key compression: ! " #,% ∈ ' ( ) : * +,- . bits vs " #,% /' ( ) : 56 7 = 9 : + <9 7 + 9 #, % ∈ ' ( ) : / +,- . bits = > , = ? ∈ E A,B * 012 . bits saved 10
SIDH Public Key Compression n [ 2016] Azarderakhsh et al.’s key compression: :(< =,> ) < =,> /A B C : EF % = G H + IG % + G 4 5 , 4 8 ∈ / 0,1 There is a canonical basis {" # , " % } such that " # , " % = / 0,1 3 3 Idea: express 4 5 = 6 # " # + 6 % " % 4 8 = 9 # " # + 9 % " % 11
SIDH Public Key Compression n [ 2016] Azarderakhsh et al.’s key compression: :(< =,> ) < =,> /A B C : EF % = G H + IG % + G 4 5 , 4 8 ∈ / 0,1 There is a canonical basis {" # , " % } such that " # , " % = / 0,1 3 3 Linear algebra tasks - Build a basis Idea: express 4 5 = 6 # " # + 6 % " % - Internal product: pairing 4 8 = 9 # " # + 9 % " % - Coeff. extraction: DLOG 12
SIDH Public Key Compression n [ 2016] Azarderakhsh et al.’s key compression: %(' (,) ) ' (,) /. / 0 : 23 $ = 5 6 + 85 $ + 5 9 : = @ " ! " + @ $ ! $ 9 : , 9 ; ∈ = >,? 9 ; = A " ! " + A $ ! $ Find ! " , ! $ : Compression (1/ 3): Expensive scalar multiplications involved • find a basis {! " , ! $ } 13
SIDH Public Key Compression n [ 2016] Azarderakhsh et al.’s key compression: 7(9 :,; ) 9 :,; /> ? @ : BC ( = D E + FD ( + D ! " = $ % & % + $ ( & ( ! " , ! ) ∈ H I,J ! ) = * % & % + * ( & ( + = , - . / 0 , / 2 Compression (2/ 3): + 3 = , - . / 0 , 4 5 • prepare DLOG instances + 0 = , - . / 2 , 4 5 • Cost: 5 pairings + 2 = , - . / 0 , 4 6 + - = , - . / 2 , 4 6 21
SIDH Public Key Compression n [ 2016] Azarderakhsh et al.’s key compression: 9(; <,> ) ; <,> /A B C : EF ( = G H + IG ( + G ! " , ! ) ∈ K L,M ! " = $ % & % + $ ( & ( ! ) = * % & % + * ( & ( Compression (3/ 3): + , = − ./0 1 1 , + 2 = ./0 1 1 3 • Compute $ 6 ’s and * 6 ’s • Cost: 4 order 3 8 DLOGs 4 , = − ./0 1 1 5 (Pohlig-Hellman) 4 2 = ./0 1 1 2 22
SIDH Public Key Compression n [ 2016] Azarderakhsh et al.’s key compression: !(# $,& ) ( ) , ( * , + ) , + * ∈ ℤ . / # $,& /1 2 3 : 56 7 = 9 . + ;9 7 + 9 < = , < > ∈ ? @,A 23
SIDH Public Key Compression n [ 2016] Azarderakhsh et al.’s key compression: !(# $,& ) ( ) , ( * , + ) , + * ∈ ℤ . / 0 : * 123 4 bits Vs 5 6 7 , 5 6(8) ∈ 9 : ; : < 123 4 bits # $,& /A : ; : CD E = 5 . + H5 E + 5 I J , I K ∈ L M,N * =>? 4 bits saved 24
SIDH Public Key Compression n [ 2016] Azarderakhsh et al.’s key compression: 9(; <,= ) 3 4 , 3 6 , 8 4 , 8 6 ; <,= /@ A B : DE % = F G + HF % + F Decompression I J , I K ∈ ( ),+ • Compute ⟨" # , " % ⟩ = ( ) * ,+ * [3 . ] • Recover points: 0 1 ← 3 4 " # + 3 6 " % 0 7 ← 8 4 " # + 8 6 " % • Cost: 4 scalar muls. 25
SIDH Public Key Compression n [ 2016] Azarderakhsh et al.’s key compression: ! " #,% ∈ ' ( ) : * +,- . bits / 0 , / * , 1 0 , 1 * ∈ ℤ 3 4 : * +,- . bits vs #, % ∈ 5 ( ) : 6 +,- . bits 7 8(:) , 7 8 < : 6 +,- . bits Public key size: 6 =>? . bits Keys shrunk by 2× J • • Com pression tim e > 0C× KEX L 26
SIDH Public Key Compression n [ 2017] Costello et al. key compression: L(4 M,; ) N O , N P , Q O , Q P !/# $ % : '( ) = + , + .+ ) + + Further compression / 0 , / 2 ∈ 4 • Bob recovers 5 6 , 5 7 to compute the kernel 8 = ⟨5 6 + : ; 5 7 ⟩ = = > + : ; ? > )A > + (= ) +: ; ? > )A ) • wlog. assume = > is invertible CDE 3 G (otherwise ? > is), then H> A > + (= ) = > H> + J K ? ) = > H> 8 = H> )A ) = 8 = > 1 + J K ? > = > 27
SIDH Public Key Compression n [ 2017] Costello et al. key compression: L(4 M,; ) N O , N P , Q O , Q P !/# $ % : '( ) = + , + .+ ) + + Further compression / 0 , / 2 ∈ 4 • After recovering 5 6 , 5 7 , Bob computes the kernel 8 = ⟨5 6 + : ; 5 7 ⟩ = = > + : ; ? > )A > + (= ) +: ; ? > )A ) • wlog. assume = > is invertible CDE 3 G (otherwise ? > is), then H> A > + (= ) = > H> + J K ? ) = > H> 8 = H> )A ) = 8 = > 1 + J K ? > = > 28
SIDH Public Key Compression n [ 2017] Costello et al. key compression: L(4 M,; ) N O , N P , Q O , Q P !/# $ % : '( ) = + , + .+ ) + + Further compression / 0 , / 2 ∈ 4 • After recovering 5 6 , 5 7 , Bob computes the kernel 8 = ⟨5 6 + : ; 5 7 ⟩ = = > + : ; ? > )A > + (= ) +: ; ? > )A ) • wlog. assume = > is invertible CDE 3 G (otherwise ? > is), then H> A > + (= ) = > H> + J K ? ) = > H> 8 = H> )A ) = 8 = > 1 + J K ? > = > 29
SIDH Public Key Compression n [ 2017] Costello et al.’s key compression: >, ?, @ ∈ ℤ , 6 A : A/B CDE F bits !/# $ % : '( ) = + , + .+ ) + + / 0 , / 2 ∈ 4 3 elements in ℤ , 6 are enough: ;9 ∈ ℤ , 6 7 = 8 9 : 9 ;9 ∈ ℤ , 6 < = : ) : 9 ;9 ∈ ℤ , 6 = = 8 ) : 9 Plus 1 bit about invertibility of : 9 or 8 9 30
SIDH Public Key Compression n 2017, Costello et al.’s key compression: !/# $ % : '( ) = + , + .+ ) + + To compress / 0 , / 2 : / 0 , / 2 ∈ 4 generate basis 5 6 , 5 ) • • Optimizations on compute 5 pairings steps 1, 2 and 3 • NB: cost of 5-way Monty Inv.: 30 muls (report) of compression and compute 4 DLOGs, i.e., {8 6 , 8 ) , 9 6 , 9 ) } • on decompression. compute ;, <, = from the quadruple above • 31
SIDH Public Key Compression n 2017, Costello et al.’s key compression: !(#) ∈ & ' ( : ) *+, - bits ., 0, 1 ∈ ℤ 3 4 3 : 5/) *+, - bits 7/8 ' ( : :; < = > 3 + @> < + > A B , A C ∈ # Public key size: 5. E FGH - bits • Ex.: IJ = 328 bytes for I = 751 bits Compression time ≈ R× KEX and decompression ≈ T. U× KEX 32
SIDH Public Key Compression n Is the current (de)compression performance acceptable? 33
SIDH Public Key Compression n Is the current (de)compression performance acceptable? n Current state of classical elliptic curves: ¨ CHES’2 0 1 7 * : speed records for ECDH on embedded devices using curve Four ℚ . n Compression = free (similar to original SIDH, send one coordinate of the point) n Decompression = 0.04x key agreement * Liu Z, Longa P, Pereira G, Reparaz O, Seo H. FourQ on embedded devices with strong countermeasures against side-channel attacks. 34
Recommend
More recommend
