Stronger and Faster Side-Channel Protections for CSIDH azquez 1 - PowerPoint PPT Presentation

Stronger and Faster Side-Channel Protections for CSIDH azquez 1 Mathilde Chenu 2,3 Daniel Cervantes-V´ ınguez 1 and Luca De Feo 4 and Jes´ us-Javier Chi-Dom´ ıquez 1 and Benjamin Smith 2,3 Francisco Rodr´ ıguez-Henr´ 1 Computer Science Department, Cinvestav - IPN, Mexico City, Mexico 2 ´ Ecole polytechnique, Institut Polytechnique de Paris, Palaiseau, France 3 Inria, ´ equipe-projet GRACE, Universit´ e Paris–Saclay, France 4 Universit´ e Paris Saclay – UVSQ, Versailles, France October 2, 2019 1/25

Overview 1 CSIDH overview 2 Constant-time CSIDH algorithm 3 Improvements to constant-time CSIDH algorithm Fixing random point selection Twisted Edwards or Montgomery curves? Addition chains for a faster scalar multiplication Removing dummy operations 4 Experimental results 5 Conclusions 1/25

Outline 1 CSIDH overview 2 Constant-time CSIDH algorithm 3 Improvements to constant-time CSIDH algorithm Fixing random point selection Twisted Edwards or Montgomery curves? Addition chains for a faster scalar multiplication Removing dummy operations 4 Experimental results 5 Conclusions 1/25

Timeline of CSIDH 6 0 8 9 0 1 1 1 0 0 0 0 2 2 2 2 Before CSIDH (ordinary curves): • Alexander Rostovtsev and Anton Stolbunov [10]; • Jean-Marc Couveignes [4]; 2/25

Timeline of CSIDH 6 0 8 9 0 1 1 1 0 0 0 0 2 2 2 2 Before CSIDH (ordinary curves): • Alexander Rostovtsev and Anton Stolbunov [10]; • Jean-Marc Couveignes [4]; • Anton Stolbunov [11]; 2/25

Timeline of CSIDH 6 0 8 9 0 1 1 1 0 0 0 0 2 2 2 2 Before CSIDH (ordinary curves): • Alexander Rostovtsev and Anton Stolbunov [10]; • Jean-Marc Couveignes [4]; • Anton Stolbunov [11]; • Luca De Feo, Jean Kieffer, and Benjamin Smith [5]; 2/25

Timeline of CSIDH 6 0 8 9 0 1 1 1 0 0 0 0 2 2 2 2 CSIDH (supersingular curves): • April: Castryck, Lange, Martindale, Panny, and Renes proposed CSIDH [3]; 2/25

Timeline of CSIDH 6 0 8 9 0 1 1 1 0 0 0 0 2 2 2 2 CSIDH (supersingular curves): • April: Castryck, Lange, Martindale, Panny, and Renes proposed CSIDH [3]; • August: Meyer and Reith [8]; 2/25

Timeline of CSIDH 6 0 8 9 0 1 1 1 0 0 0 0 2 2 2 2 CSIDH (supersingular curves): • April: Castryck, Lange, Martindale, Panny, and Renes proposed CSIDH [3]; • August: Meyer and Reith [8]; • Constant-time implementations: • August: Jalali et al. [6]; 2/25

Timeline of CSIDH 6 0 8 9 0 1 1 1 0 0 0 0 2 2 2 2 CSIDH (supersingular curves): • April: Castryck, Lange, Martindale, Panny, and Renes proposed CSIDH [3]; • August: Meyer and Reith [8]; • Constant-time implementations: • August: Jalali et al. [6]; • October: Bernstein, Lange, Martindale, and Panny [2]; 2/25

Timeline of CSIDH 6 0 8 9 0 1 1 1 0 0 0 0 2 2 2 2 CSIDH (supersingular curves): • April: Castryck, Lange, Martindale, Panny, and Renes proposed CSIDH [3]; • August: Meyer and Reith [8]; • Constant-time implementations: • August: Jalali et al. [6]; • October: Bernstein, Lange, Martindale, and Panny [2]; • December: Meyer, Campos, and Reith [7]; 2/25

Timeline of CSIDH 6 0 8 9 0 1 1 1 0 0 0 0 2 2 2 2 CSIDH (supersingular curves): • April: Castryck, Lange, Martindale, Panny, and Renes proposed CSIDH [3]; • August: Meyer and Reith [8]; • Constant-time implementations: • August: Jalali et al. [6]; • October: Bernstein, Lange, Martindale, and Panny [2]; • December: Meyer, Campos, and Reith [7]; • April: Onuki, Aikawa, Yamazaki, and Takagi [9]; 2/25

Timeline of CSIDH 6 0 8 9 0 1 1 1 0 0 0 0 2 2 2 2 CSIDH (supersingular curves): • April: Castryck, Lange, Martindale, Panny, and Renes proposed CSIDH [3]; • August: Meyer and Reith [8]; • Constant-time implementations: • August: Jalali et al. [6]; • October: Bernstein, Lange, Martindale, and Panny [2]; • December: Meyer, Campos, and Reith [7]; • April: Onuki, Aikawa, Yamazaki, and Takagi [9]; • July: This work. 2/25

CSIDH implementations • Castryck et al. [3]: The original CSIDH works on Montgomery curves; • Jalali et al. [6] keep using Montgomery curves; • Meyer and Reith [8]: Propose an hybrid CSIDH by using isogeny construction formulas but on Twisted Edwards curves, and then mapping into Montgomery form; • Meyer–Campos–Reith [7], and Onuki et al. [9]: They keep using the hybrid CSIDH as in [8]; 3/25

Our contributions 1) A fully Twisted Edwards version of CSIDH; 2) An efficient projective elligator; 3) The use of Shortest Differential Addition Chains (SDACs) in the CSIDH algorithm, which are cheaper than Classical Mont- gomery Ladders. 4) A stronger constant-time CSIDH algorithm without dummy op- erations. 4/25

CSIDH overview CSIDH framework [3]: • Small odd primes numbers ℓ i such that p = 4 � n i =1 ℓ i − 1 is prime number; • Supersingular elliptic curves in Montgomery form E A / F p : y 2 = x 3 + Ax 2 + x with # E ( F p ) = p + 1; and • Positive integer m . General description CSIDH: a E A a ∗ E A a ∗ E A The shared secret key is ( a · b ) ∗ E A . b b The security is given by the hardness E A of computing a (or b ) given the data ∗ b b ∗ E A ( a · b ) ∗ E A a colored in red ink. 5/25

CSIDH overview CSIDH framework [3]: • Small odd primes numbers ℓ i such that p = 4 � n i =1 ℓ i − 1 is prime number; • Supersingular elliptic curves in Montgomery form E A / F p : y 2 = x 3 + Ax 2 + x with # E ( F p ) = p + 1; and • Positive integer m . General description CSIDH: a E A a ∗ E A a ∗ E A The shared secret key is ( a · b ) ∗ E A . b b The security is given by the hardness E A of computing a (or b ) given the data ∗ b b ∗ E A ( a · b ) ∗ E A a colored in red ink. Each ℓ i is required e i times for evaluating the action a ∗ E A (similarly for b ∗ E A ). Formally, this is written as a = l e 1 1 · · · l e n n . 5/25

CSIDH overview The action a ∗ E A defines a path on the isogeny graph over F p , and is determined by an integer vector ( e 1 , . . . , e n ) ∈ � − m , m � n : 1) Nodes are supersingular el- liptic curves over F p in Montgomery form; 2) Edges are degree- ℓ i isoge- nies. Figure 1: Isogeny graph over F p with p = 4 · (5 · 13 · 61) − 1. Nodes are supersingular curves and edges marked with orange, green , and vi- olet inks denote isogenies of degree 5, 13 and 61, respectively. 6/25

CSIDH overview The action a ∗ E A defines a path on the isogeny graph over F p , and is determined by an integer vector ( e 1 , . . . , e n ) ∈ � − m , m � n : 1) Nodes are supersingular el- liptic curves over F p in Montgomery form; 2) Edges are degree- ℓ i isoge- nies. Two types of edges: isogeny with kernel gener- ated by Figure 1: Isogeny graph over F p 2.a) ( x , y ) ∈ E A [ ℓ i , π − 1], or with p = 4 · (5 · 13 · 61) − 1. Nodes 2.b) ( x , iy ) ∈ E A [ ℓ i , π + 1]. are supersingular curves and edges marked with orange, green , and vi- Here, x , y ∈ F p , π : ( X , Y ) �→ olet inks denote isogenies of degree ( X p , Y p ) is the Frobenius map, i = √− 1 and thus i p = − i . 5, 13 and 61, respectively. 6/25

CSIDH overview Figure 2: Action evaluation over F p with p = 4 · (5 · 13 · 61) − 1. Secret integer vector ( − 1 , 2 , 1) ∈ � − 2 , 2 � 3 : E 0 7/25

CSIDH overview Figure 2: Action evaluation over F p with p = 4 · (5 · 13 · 61) − 1. Secret integer vector ( − 1 , 2 , 1) ∈ � − 2 , 2 � 3 : E 0 → E 0x3A7D 7/25

CSIDH overview Figure 2: Action evaluation over F p with p = 4 · (5 · 13 · 61) − 1. Secret integer vector ( − 1 , 2 , 1) ∈ � − 2 , 2 � 3 : E 0 → E 0x3A7D → E 0x2BF7 7/25

CSIDH overview Figure 2: Action evaluation over F p with p = 4 · (5 · 13 · 61) − 1. Secret integer vector ( − 1 , 2 , 1) ∈ � − 2 , 2 � 3 : E 0 → E 0x3A7D → E 0x2BF7 → E 0x1404 7/25

CSIDH overview Figure 2: Action evaluation over F p with p = 4 · (5 · 13 · 61) − 1. Secret integer vector ( − 1 , 2 , 1) ∈ � − 2 , 2 � 3 : E 0 → E 0x3A7D → E 0x2BF7 → E 0x1404 → E 0x5EB 7/25

CSIDH overview Figure 2: Action evaluation over F p with p = 4 · (5 · 13 · 61) − 1. In general, the atcion evaluation is commutative . Secret integer vector ( − 1 , 2 , 1) ∈ � − 2 , 2 � 3 : E 0 → E 0x7A0 → E 0x8EC → E 0x25B3 → E 0x5EB 7/25

CSIDH overview Figure 2: Action evaluation over F p with p = 4 · (5 · 13 · 61) − 1. Secret integer vector (1 , − 2 , − 1) ∈ � − 2 , 2 � 3 has inverse ( − 1 , 2 , 1) ∈ � − 2 , 2 � 3 : E 0x5EB → E 0x1D50 → E 0x8EC → E 0x56D → E 0 7/25

CSIDH overview Figure 2: Action evaluation over F p with p = 4 · (5 · 13 · 61) − 1. Secret integer vector (1 , − 2 , − 1) ∈ � − 2 , 2 � 3 has inverse ( − 1 , 2 , 1) ∈ � − 2 , 2 � 3 : E 0x5EB → E 0x1D50 → E 0x8EC → E 0x56D → E 0 7/25

CSIDH overview Figure 2: Action evaluation over F p with p = 4 · (5 · 13 · 61) − 1. Secret integer vector (1 , − 2 , − 1) ∈ � − 2 , 2 � 3 has inverse ( − 1 , 2 , 1) ∈ � − 2 , 2 � 3 : E 0x5EB → E 0x1D50 → E 0x8EC → E 0x56D → E 0 7/25