Loop-abort faults on supersingular isogeny cryptosystems Alexandre - PowerPoint PPT Presentation

Loop-abort faults on supersingular isogeny cryptosystems Alexandre Gélin Benjamin Wesolowski Laboratoire d’Informatique de Paris 6 – Sorbonne Universités UPMC, France École Polytechnique Fédérale de Lausanne, EPFL IC LACAL, Switzerland PQCrypto 2017 – Utrecht 2017/06/26 Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Supersingular-Isogeny Public-key Cryptography Introduced by Jao, De Feo, and Plût in 2011 Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Supersingular-Isogeny Public-key Cryptography Introduced by Jao, De Feo, and Plût in 2011 Based on the same problem as the hash function of [CLG06] Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Supersingular-Isogeny Public-key Cryptography Introduced by Jao, De Feo, and Plût in 2011 Based on the same problem as the hash function of [CLG06] The isogeny graph of a supersingular elliptic curve: Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Supersingular-Isogeny Public-key Cryptography Introduced by Jao, De Feo, and Plût in 2011 Based on the same problem as the hash function of [CLG06] The isogeny graph of a supersingular elliptic curve: Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Supersingular elliptic curves Definition A supersingular elliptic curve is a curve E defined over F p k such that � � # E F p k = 1 mod p . Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Supersingular elliptic curves Definition A supersingular elliptic curve is a curve E defined over F p k such that � � # E F p k = 1 mod p . Interesting properties: All supersingular elliptic curves can be defined over F p 2 p About 12 supersingular elliptic curves, up to isomorphism Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Isogenies Definition An isogeny φ between two elliptic curves E 1 and E 2 is a surjective group homomorphism with a finite kernel. The degree is defined by deg φ = # Ker φ . Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Isogenies Definition An isogeny φ between two elliptic curves E 1 and E 2 is a surjective group homomorphism with a finite kernel. The degree is defined by deg φ = # Ker φ . Interesting properties: ⇒ a unique E 2 and φ such that G ⊂ E 1 = φ : E 1 → E 2 and Ker φ = G � � E 2 = E / G is obtained in O deg φ Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Key-Exchange Protocol A prime p such that p + 1 = ℓ n A ℓ m B Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Key-Exchange Protocol A prime p such that p + 1 = ℓ n A ℓ m B A supersingular elliptic curve E with ℓ n A ℓ m B points E Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Key-Exchange Protocol A prime p such that p + 1 = ℓ n A ℓ m B A supersingular elliptic curve E with ℓ n A ℓ m B points E � � ℓ n A point R A chosen randomly in E A Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Key-Exchange Protocol A prime p such that p + 1 = ℓ n A ℓ m B A supersingular elliptic curve E with ℓ n A ℓ m B points E � � ℓ n A point R A chosen randomly in E A A } 2 random, → ( m A , n A ) ∈ {1,..., ℓ n − � � ℓ n R A = m A P A + n A Q A for 〈 P A , Q A 〉 = E A Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Key-Exchange Protocol A prime p such that p + 1 = ℓ n A ℓ m B A supersingular elliptic curve E with ℓ n A ℓ m B points E � � ℓ n A point R A chosen randomly in E A φ A A } 2 random, → ( m A , n A ) ∈ {1,..., ℓ n − � � ℓ n R A = m A P A + n A Q A for 〈 P A , Q A 〉 = E A ⇒ the curve E A = E / 〈 R A 〉 and φ A : E → E A E A = Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Key-Exchange Protocol A prime p such that p + 1 = ℓ n A ℓ m B A supersingular elliptic curve E with ℓ n A ℓ m B points E � � ℓ n A point R A chosen randomly in E A φ A φ B A } 2 random, → ( m A , n A ) ∈ {1,..., ℓ n − � � ℓ n R A = m A P A + n A Q A for 〈 P A , Q A 〉 = E A ⇒ the curve E A = E / 〈 R A 〉 and φ A : E → E A E A E B = � � ℓ m A point R B = m B P B + n B Q B random in E = 〈 P B , Q B 〉 , B the curve E B = E / 〈 R B 〉 and φ B : E → E B Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Key-Exchange Protocol � � Bob sends E B , φ B ( P A ), φ B ( Q A ) E where 〈 φ B ( P A ), φ B ( Q A ) 〉 = E B [ ℓ n A ] φ A φ B E A E B Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Key-Exchange Protocol � � Bob sends E B , φ B ( P A ), φ B ( Q A ) E where 〈 φ B ( P A ), φ B ( Q A ) 〉 = E B [ ℓ n A ] φ A φ B Alice computes E AB = E B / 〈 m A φ B ( P A ) + n A φ B ( Q A ) 〉 E A E B E AB Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Key-Exchange Protocol � � Bob sends E B , φ B ( P A ), φ B ( Q A ) E where 〈 φ B ( P A ), φ B ( Q A ) 〉 = E B [ ℓ n A ] φ A φ B Alice computes E AB = E B / 〈 m A φ B ( P A ) + n A φ B ( Q A ) 〉 E A E B Bob computes E BA = E A / 〈 m B φ A ( P B ) + n B φ A ( Q B ) 〉 E AB Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Key-Exchange Protocol � � Bob sends E B , φ B ( P A ), φ B ( Q A ) E where 〈 φ B ( P A ), φ B ( Q A ) 〉 = E B [ ℓ n A ] φ A φ B Alice computes E AB = E B / 〈 m A φ B ( P A ) + n A φ B ( Q A ) 〉 E A E B Bob computes E BA = E A / 〈 m B φ A ( P B ) + n B φ A ( Q B ) 〉 E AB ≃ E / 〈 R A , R B 〉 ≃ E BA so j ( E AB ) = j ( E BA ) E AB Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Key-Exchange Protocol � � Bob sends E B , φ B ( P A ), φ B ( Q A ) E where 〈 φ B ( P A ), φ B ( Q A ) 〉 = E B [ ℓ n A ] φ A φ B Alice computes E AB = E B / 〈 m A φ B ( P A ) + n A φ B ( Q A ) 〉 E A E B Bob computes E BA = E A / 〈 m B φ A ( P B ) + n B φ A ( Q B ) 〉 E AB ≃ E / 〈 R A , R B 〉 ≃ E BA so j ( E AB ) = j ( E BA ) � ⇒ j ( E AB ) secret shared by Alice and Bob = E AB Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Position of the problem Path-finding problem Given two isogenous curves E 1 and E 2 , find an isogeny between them of degree ℓ n A . Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Position of the problem Path-finding problem Given two isogenous curves E 1 and E 2 , find an isogeny between them of degree ℓ n A . Equivalent to find a path of fixed length in the isogeny graph Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Position of the problem Path-finding problem Given two isogenous curves E 1 and E 2 , find an isogeny between them of degree ℓ n A . Equivalent to find a path of fixed length in the isogeny graph � � � � p � ℓ n Brute-force attack in O ≈ O A Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Position of the problem Path-finding problem Given two isogenous curves E 1 and E 2 , find an isogeny between them of degree ℓ n A . Equivalent to find a path of fixed length in the isogeny graph � � � � p � ℓ n Brute-force attack in O ≈ O A � � � � n � p Claw finding: Find a collision in O 2 ℓ ≈ O 4 A Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Attack framework Alice uses a static private key ( m A , n A ) E φ A φ B E A E B E AB Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Attack framework Alice uses a static private key ( m A , n A ) E ⇒ E A and φ A can be precomputed = φ A φ B E A E B E AB Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Attack framework Alice uses a static private key ( m A , n A ) E ⇒ E A and φ A can be precomputed = φ A φ B The attacker plays the role of Bob E A E B E AB Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems

Attack framework Alice uses a static private key ( m A , n A ) E ⇒ E A and φ A can be precomputed = φ A φ B The attacker plays the role of Bob Focus on the isogeny from E B to E B / 〈 m A P ′ A + n A Q ′ A 〉 , E A E B where P ′ A = φ B ( P A ) and Q ′ A = φ B ( Q A ) E AB Alexandre Gélin, Benjamin Wesolowski Loop-abort faults on supersingular isogeny cryptosystems