Isogeny Graphs in Cryptography Luca De Feo hand-drawings by Rachel - PowerPoint PPT Presentation

Isogeny Graphs in Cryptography Luca De Feo hand-drawings by Rachel Deyts Université de Versailles & Inria, Université Paris-Saclay May 31, 2018, Journées du Pré-GDR Sécurité, Paris

Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... R Q P P ✰ Q Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 2 / 44

✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 2 / 44

✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 2 / 44

✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 2 / 44

✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 2 / 44

✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 2 / 44

Elliptic curves Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 3 / 44

The QUANTHOM Menace Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 4 / 44

Post-quantum cryptographer? Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 5 / 44

Elliptic curves of the world, UNITE! QUOUSQUE QUANTUM? QUANTUM SUFFICIT! Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 6 / 44

And so, they found a way around the Quanthom... Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 7 / 44

And so, they found a way around the Quanthom... Public curve Public curve Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 7 / 44

And so, they found a way around the Quanthom... Public curve Shared secret Public curve Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 7 / 44

What’s an isogeny? Rebus: 1-3-7-3-8-6 Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 8 / 44

Isogenies Isogenies are just the right notion TM of morphism for elliptic curves Surjective group morphisms. Algebraic maps (i.e., defined by polynomials). (Separable) isogenies ✱ finite subgroups: ✦ E ✵ ✦ 0 ✣ 0 ✦ H ✦ E The kernel H determines the image curve E ✵ up to isomorphism def ❂ E ✵ ✿ E ❂ H Isogeny degree Neither of these definitions is quite correct, but they nearly are: The degree of ✣ is the cardinality of ❦❡r ✣ . (Bisson) the degree of ✣ is the time needed to compute it. Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 9 / 44

❋ ✄ ✼✦ Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x ✥ ✦ x 2 ✰ 1 y x 2 � 1 ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 10 / 44

❋ ✄ ✼✦ Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x ✥ ✦ x 2 ✰ 1 y x 2 � 1 ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 10 / 44

❋ ✄ ✼✦ Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x ✥ ✦ x 2 ✰ 1 y x 2 � 1 ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 10 / 44

❋ ✄ ✼✦ Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x Kernel generator in red. ✥ ✦ x 2 ✰ 1 y x 2 � 1 ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 10 / 44

❋ ✄ ✼✦ Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x Kernel generator in red. ✥ ✦ x 2 ✰ 1 y x 2 � 1 This is a degree 2 map. ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 10 / 44

Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x Kernel generator in red. ✥ ✦ x 2 ✰ 1 y x 2 � 1 This is a degree 2 map. ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Analogous to x ✼✦ x 2 in ❋ ✄ q . Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 10 / 44

Easy and hard problems In practice: an isogeny ✣ is just a pair of rational fractions x n ✰ ✁ ✁ ✁ ✰ n 1 x ✰ n 0 N ✭ x ✮ with n ❂ ❞❡❣ ✣❀ D ✭ x ✮ ❂ ✷ k ✭ x ✮ ❀ x n � 1 ✰ ✁ ✁ ✁ ✰ d 1 x ✰ d 0 and D ✭ x ✮ vanishes on ❦❡r ✣ . ⑦ Vélu’s formulas ❖ ✭ n ✮ Input: A generator of the kernel H of the isogeny. Output: The curve E ❂ H and the rational fraction N ❂ D . The explicit isogeny problem Input: The curves E and E ❂ H , the degree n . Output: The rational fraction N ❂ D . ⑦ Algorithms a Elkies’ algorithm (and variants); ❖ ✭ n ✮ ⑦ Couveignes’ algorithm (and variants). ❖ ✭ n 2 ✮ a Elkies 1998; Couveignes 1996. Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 11 / 44

Easy and hard problems Isogeny evaluation Input: A description of the isogeny ✣ , a point P ✷ E ✭ k ✮ . Output: The curve E ❂ H and ✣ ✭ P ✮ . Examples Input = rational fraction; O ✭ n ✮ ⑦ Input = composition of low degree isogenies; ❖ ✭❧♦❣ n ✮ The isogeny walk problem O ✭❄❄✮ Input: Isogenous curves E , E ✵ . Output: A path of low degree isogenies from E to E ✵ . Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 12 / 44

Easy and hard problems Isogeny evaluation Input: A description of the isogeny ✣ , a point P ✷ E ✭ k ✮ . Output: The curve E ❂ H and ✣ ✭ P ✮ . Examples Input = rational fraction; O ✭ n ✮ ⑦ Input = composition of low degree isogenies; ❖ ✭❧♦❣ n ✮ The isogeny walk problem O ✭❄❄✮ Input: Isogenous curves E , E ✵ . Output: A path of low degree isogenies from E to E ✵ . Exponential separation... Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 12 / 44

Easy and hard problems Isogeny evaluation Input: A description of the isogeny ✣ , a point P ✷ E ✭ k ✮ . Output: The curve E ❂ H and ✣ ✭ P ✮ . Examples Input = rational fraction; O ✭ n ✮ ⑦ Input = composition of low degree isogenies; ❖ ✭❧♦❣ n ✮ The isogeny walk problem O ✭❄❄✮ Input: Isogenous curves E , E ✵ . Output: A path of low degree isogenies from E to E ✵ . Exponential separation...Crypto happens! Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 12 / 44

Isogeny graphs ✣ We look at the graph of elliptic curves with E ✵ E isogenies up to isomorphism. We say two isogenies ✣❀ ✣ ✵ are isomorphic if: ❡ ✣ ✵ E ✵ Example: Finite field, ordinary case, graph of isogenies of degree 3 . Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 13 / 44

Structure of the graph 1 Theorem (Serre-Tate) Two curves are isogenous over a finite field k if and only if they have the same number of points on k . The graph of isogenies of prime degree ❵ ✻ ❂ p Ordinary case (isogeny volcanoes) Nodes can have degree 0 ❀ 1 ❀ 2 or ❵ ✰ 1 . ■ For ✘ 50 ✪ of the primes ❵ , graphs are just isolated points; ■ For other ✘ 50 ✪ , graphs are 2 -regular; ■ other cases only happen for finitely many ❵ ’s. Supersingular case (algebraic closure) The graph is ❵ ✰ 1 -regular. There is a unique (finite) connected component made of all supersingular curves with the same number of points. 1 Deuring 1941; Kohel 1996; Fouquet and Morain 2002. Luca De Feo (UVSQ & INRIA) Isogeny Graphs in Cryptography May 31, 2018, GDR Sécurité, Paris 14 / 44