Isogeny graphs in cryptography: the good, the bad and the ugly Luca - PowerPoint PPT Presentation

Isogeny graphs in cryptography: the good, the bad and the ugly Luca De Feo Université Paris Saclay – UVSQ May 13, 2019, Università di Roma 3, Roma Slides online at https://defeo.lu/docet/

Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... R Q P P ✰ Q Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 2 / 38

✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 2 / 38

✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 2 / 38

✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 2 / 38

✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 2 / 38

✰ Elliptic curves Let E ✿ y 2 ❂ x 3 ✰ ax ✰ b be an elliptic curve... Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 2 / 38

Elliptic curves I power 70% of WWW traffic! Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 3 / 38

The Q Menace Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 4 / 38

Post-quantum cryptographer? Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 5 / 38

Elliptic curves of the world, UNITE! QUOUSQUE QUANTUM? QUANTUM SUFFICIT! Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 6 / 38

And so, they found a way around the Q... Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 7 / 38

And so, they found a way around the Q... Public curve Public curve Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 7 / 38

And so, they found a way around the Q... Public curve Shared secret Public curve Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 7 / 38

✱ ✣ ✵ ✦ ✦ ✦ ✦ ✵ ✵ ✿ ❂ ❂ What’s scalar multiplication? ❬ n ❪ ✿ P ✼✦ P ✰ P ✰ ✁ ✁ ✁ ✰ P ⑤ ④③ ⑥ n times A map E ✦ E , a group morphism, with finite kernel (the torsion group E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 ), surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 8 / 38

✱ ✣ ✵ ✦ ✦ ✦ ✦ ✵ ✵ ✿ ❂ ❂ What’s/////// scalar////////////////// multiplication an isogeny? ❬ n ❪ ✿ P ✼✦ P ✰ P ✰ ✁ ✁ ✁ ✰ P ⑤ ④③ ⑥ n times A map E ✦ E , a group morphism, with finite kernel (the torsion group E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 ), surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 8 / 38

✱ ✣ ✵ ✦ ✦ ✦ ✦ ✵ ✵ ✿ ❂ ❂ What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ A map E ✦ E , a group morphism, with finite kernel (the torsion group E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 ), surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 8 / 38

✱ ✣ ✵ ✦ ✦ ✦ ✦ ✵ ✵ ✿ ❂ ❂ What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ // E ✵ , A map E ✦ E a group morphism, with finite kernel (the torsion group E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 ), surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 8 / 38

✱ ✣ ✵ ✦ ✦ ✦ ✦ ✵ ✵ ✿ ❂ ❂ What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ // E ✵ , A map E ✦ E a group morphism, with finite kernel E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 any finite subgroup H ✚ E ), (//// the///////// torsion//////// group ///////////////////// surjective (in the algebraic closure), given by rational maps of degree n 2 . Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 8 / 38

✱ ✣ ✵ ✦ ✦ ✦ ✦ ✵ ✵ ✿ ❂ ❂ What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ // E ✵ , A map E ✦ E a group morphism, with finite kernel E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 any finite subgroup H ✚ E ), (//// the///////// torsion//////// group ///////////////////// surjective (in the algebraic closure), n 2 ★ H . given by rational maps of degree/// Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 8 / 38

What’s/////// scalar////////////////// multiplication an isogeny? ✣ ✿ P ✼✦ ✣ ✭ P ✮ // E ✵ , A map E ✦ E a group morphism, with finite kernel E ❬ n ❪ ✬ ✭ ❩ ❂ n ❩ ✮ 2 any finite subgroup H ✚ E ), (//// the///////// torsion//////// group ///////////////////// surjective (in the algebraic closure), n 2 ★ H . given by rational maps of degree/// (Separable) isogenies ✱ finite subgroups: ✦ E ✵ ✦ 0 ✣ 0 ✦ H ✦ E The kernel H determines the image curve E ✵ up to isomorphism def ❂ E ✵ ✿ E ❂ H Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 8 / 38

✼✦ ❋ ✄ Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x ✥ ✦ x 2 ✰ 1 y x 2 � 1 ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 9 / 38

Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x Kernel generator in red. ✥ ✦ x 2 ✰ 1 y x 2 � 1 This is a degree 2 map. ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Analogous to x ✼✦ x 2 in ❋ ✄ q . Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 9 / 38

❵ ✚ ❵ ⑦ ❖ ✭ ❵ ✮ Computing Isogenies Vélu’s formulas Input: A subgroup H ✚ E , Output: The isogeny ✣ ✿ E ✦ E ❂ H . Complexity: O ✭ ❵ ✮ — Vélu 1971, ... Why? Evaluate isogeny on points P ✷ E ; Walk in isogeny graphs. Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 10 / 38

Computing Isogenies Vélu’s formulas Input: A subgroup H ✚ E , Output: The isogeny ✣ ✿ E ✦ E ❂ H . Complexity: O ✭ ❵ ✮ — Vélu 1971, ... Why? Evaluate isogeny on points P ✷ E ; Walk in isogeny graphs. Explicit Isogeny Problem Input: Curve E , (prime) integer ❵ Output: All subgroups H ✚ E of order ❵ . Complexity: ⑦ ❖ ✭ ❵ 2 ✮ — Elkies 1992 Why? List all isogenies of given degree; Count points of elliptic curves; Compute endomorphism rings of elliptic curves; Walk in isogeny graphs. Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 10 / 38

❀ ✵ ✣ ✿ ✦ ✵ Computing Isogenies Explicit Isogeny Problem (2) Input: Curves E ❀ E ✵ , isogenous of degree ❵ . Output: The isogeny ✣ ✿ E ✦ E ✵ of degree ❵ . Complexity: O ✭ ❵ 2 ✮ — Elkies 1992; Couveignes 1996; Lercier and Sirvent 2008; De Feo 2011; De Feo, Hugounenq, Plût, and Schost 2016; Lairez and Vaccon 2016, ... Why? Count points of elliptic curves. Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 11 / 38

Computing Isogenies Explicit Isogeny Problem (2) Input: Curves E ❀ E ✵ , isogenous of degree ❵ . Output: The isogeny ✣ ✿ E ✦ E ✵ of degree ❵ . Complexity: O ✭ ❵ 2 ✮ — Elkies 1992; Couveignes 1996; Lercier and Sirvent 2008; De Feo 2011; De Feo, Hugounenq, Plût, and Schost 2016; Lairez and Vaccon 2016, ... Why? Count points of elliptic curves. Isogeny Walk Problem Input: Isogenous curves E ❀ E ✵ . Output: An isogeny ✣ ✿ E ✦ E ✵ of smooth degree. Complexity: Generically hard — Galbraith, Hess, and Smart 2002, ... Why? Cryptanalysis (ECC); Foundational problem for isogeny-based cryptography. Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 11 / 38

History of isogeny-based cryptography 1996 Couveignes introduces Hard Homogeneous Spaces. His work stays unpublished for 10 years. 2006 Rostovtsev & Stolbunov independently rediscover Couveignes ideas, suggest isogeny-based Diffie–Hellman as a quantum-resistant primitive. 2006-2010 Other isogeny-based protocols by Teske and Charles, Goren & Lauter. 2011-2012 D., Jao & Plût introduce SIDH, an efficient post-quantum key exchange inspired by Couveignes, Rostovtsev, Stolbunov, Charles, Goren, Lauter. 2017 SIDH is submitted to the NIST competition (with the name SIKE, only isogeny-based candidate). 2018 D., Kieffer & Smith resurrect the Couveignes–Rostovtsev–Stolbunov protocol, Castryck, Lange, Martindale, Panny & Renes publish an efficient variant named CSIDH. Luca De Feo (UVSQ) Isogeny graphs in cryptography Roma Tre, May 13, 2019 12 / 38