Side channel protections for CSIDH Luca De Feo IBM Research Zürich October 16, 2019, PHISIC, Gardanne based on joint work with D. Cervantes-Vázquez, M. Chenu, J.J. Chi-Domínguez, F. Rodríguez-Henríquez, B. Smith Slides online at https://defeo.lu/docet
Why isogenies? Six families still in NIST post-quantum competition: Lattices 9 encryption 3 signature Codes 7 encryption Multivariate 4 signature Isogenies 1 encryption Hash-based 1 signature MPC 1 signature Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 2 / 19 https://defeo.lu/docet
Why isogenies? Codes 1 – 300 KB Six families still in NIST post-quantum competition: Lattices 0.5 – 10 KB Lattices 9 encryption 3 signature Isogenies Codes 7 encryption 209 B Multivariate 4 signature Isogenies 1 encryption Public key size Hash-based 1 signature NIST-1 level (AES128) MPC 1 signature (not to scale) Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 2 / 19 https://defeo.lu/docet
Why isogenies? Isogenies 190 Mcycles Six families still in NIST post-quantum competition: Lattices Lattices 9 encryption 3 signature 0.5 – 5 Codes Codes 7 encryption Mcycles 1 Mcycles Multivariate 4 signature Isogenies 1 encryption Encryption performance Hash-based 1 signature NIST-1 level (AES128) MPC 1 signature (not to scale) Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 2 / 19 https://defeo.lu/docet
✣ ✭ ✰ ✮ ❂ ✣ ✭ ✮ ✰ ✣ ✭ ✮❀ ✒ ✭ ✮ ✥ ✓ ✵ ✦ ✭ ✮ ✣ ✭ ❀ ✮ ❂ ✭ ✮ ❀ ❀ ✭ ✮ ❂ ❂ ✙ Iso-what?! Keywords An isogeny is a map between two elliptic curves; Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 3 / 19 https://defeo.lu/docet
✒ ✭ ✮ ✥ ✓ ✵ ✦ ✭ ✮ ✣ ✭ ❀ ✮ ❂ ✭ ✮ ❀ ❀ ✭ ✮ ❂ ❂ ✙ Iso-what?! Keywords An isogeny is a map between two elliptic curves; It is a group morphism: ✣ ✭ P ✰ Q ✮ ❂ ✣ ✭ P ✮ ✰ ✣ ✭ Q ✮❀ Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 3 / 19 https://defeo.lu/docet
❂ ❂ ✙ Iso-what?! Keywords An isogeny is a map between two elliptic curves; It is a group morphism: ✣ ✭ P ✰ Q ✮ ❂ ✣ ✭ P ✮ ✰ ✣ ✭ Q ✮❀ It is an algebraic map: ✥ ✓ ✵ ✦ g ✭ x ✮ ✒ g ✭ x ✮ ✣ ✭ x ❀ y ✮ ❂ h ✭ x ✮ ❀ y ❀ h ✭ x ✮ Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 3 / 19 https://defeo.lu/docet
❂ ❂ ✙ Iso-what?! Keywords An isogeny is a map between two elliptic curves; It is a group morphism: ✣ ✭ P ✰ Q ✮ ❂ ✣ ✭ P ✮ ✰ ✣ ✭ Q ✮❀ It is an algebraic map: ✥ ✓ ✵ ✦ g ✭ x ✮ ✒ g ✭ x ✮ ✣ ✭ x ❀ y ✮ ❂ h ✭ x ✮ ❀ y ❀ h ✭ x ✮ It is entirely determined by its kernel (i.e., by a single point); Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 3 / 19 https://defeo.lu/docet
Iso-what?! Keywords An isogeny is a map between two elliptic curves; It is a group morphism: ✣ ✭ P ✰ Q ✮ ❂ ✣ ✭ P ✮ ✰ ✣ ✭ Q ✮❀ It is an algebraic map: ✥ ✓ ✵ ✦ g ✭ x ✮ ✒ g ✭ x ✮ ✣ ✭ x ❀ y ✮ ❂ h ✭ x ✮ ❀ y ❀ h ✭ x ✮ It is entirely determined by its kernel (i.e., by a single point); Isogeny degree ❂ size of the kernel ❂ order of kernel generator ✙ size of the polynomials; Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 3 / 19 https://defeo.lu/docet
✼✦ ❋ ✄ Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x x 2 ✰ 1 y x 2 � 1 ✥ ✦ ✣ ✭ x ❀ y ✮ ❂ ❀ x 2 x Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 4 / 19 https://defeo.lu/docet
Isogenies: an example over ❋ 11 E ✿ y 2 ❂ x 3 ✰ x E ✵ ✿ y 2 ❂ x 3 � 4 x Kernel generator in red. x 2 ✰ 1 y x 2 � 1 ✥ ✦ ✣ ✭ x ❀ y ✮ ❂ ❀ This is a degree 2 map. x 2 x Analogous to x ✼✦ x 2 in ❋ ✄ q . Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 4 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ Isogeny graphs R Q P P ✰ Q y 2 ❂ x 3 ✰ ax ✰ b 4 a 3 j ✑ 1728 � ✦ 4 a 3 ✰ 27 b 2 Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs R Q P P ✰ Q Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ❂ ✰ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✣ ❂ ✰ ❂ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✰ ❂ ✰ ✰ � ✦ ✑ ✰ ✣ ❂ Isogeny graphs j ❂ 1728 Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✰ ❂ ✰ ✰ � ✦ ✑ ✰ Isogeny graphs ✣ j ❂ 1728 j ❂ 287496 Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
✰ ❂ ✰ ✰ � ✦ ✑ ✰ ✣ Isogeny graphs j ❂ 1728 j ❂ 287496 Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 5 / 19 https://defeo.lu/docet
The beauty and the beast (credit: Lorenz Panny) Components of particular isogeny graphs look like this: Which of these is good for crypto? Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 6 / 19 https://defeo.lu/docet
The beauty and the beast (credit: Lorenz Panny) Components of particular isogeny graphs look like this: Which of these is good for crypto? Both. Luca De Feo (IBM Research Zürich) Side channel protections for CSIDH PHISIC 2019 6 / 19 https://defeo.lu/docet
Recommend
More recommend