Supersingular Isogeny Key Encapsulation Reza Azarderakhsh, Matthew - PowerPoint PPT Presentation

Supersingular Isogeny Key Encapsulation Reza Azarderakhsh, Matthew Campagna, Craig Costello, Luca De Feo, Basil Hess, Brian Koziel, Brian LaMacchia, Patrick Longa, Michael Naehrig, Joost Renes, Vladimir Soukharev November 14 ECC 2017 Nijmegen, The Netherlands

Supersingular Isogeny Key Encapsulation Reza Azarderakhsh, Matthew Campagna, Craig Costello, Luca De Feo, Basil Hess, Brian Koziel, Brian LaMacchia, Patrick Longa, Michael Naehrig, Joost Renes, Vladimir Soukharev November 14 ECC 2017 Nijmegen, The Netherlands

Part 1: Quick re-motivation Part 2: Quick tutorial recap Part 3: SIKE

Quantum computers ↔ Cryptopocalypse • Quantum computers break elliptic curves, finite fields, factoring, everything currently used for PKC • NIST calls for quantum-secure key exchange and signatures. Deadline Nov 30, 2017.

Diffie-Hellman instantiations 𝑕 𝑏 mod 𝑟 ℤ 𝑟 ℤ 𝑟 𝑕 𝑐 mod 𝑟 𝑏 𝑄 𝑐 𝑄 𝜚 𝐵 (𝐹) 𝜚 𝐶 (𝐹)

Diffie-Hellman instantiations DH DH ECDH SIDH Elem ements ents integers 𝑕 modulo points 𝑄 in curve curves 𝐹 in prime group isogeny class Secr crets ets exponents 𝑦 scalars 𝑙 isogenies 𝜚 co comp mputatio ions ns 𝑕, 𝑦 ↦ 𝑕 𝑦 𝑙, 𝑄 ↦ 𝑙 𝑄 𝜚, 𝐹 ↦ 𝜚(𝐹) hard d pr probl blem given 𝑕, 𝑕 𝑦 given 𝑄, 𝑙 𝑄 given 𝐹, 𝜚(𝐹) find 𝑦 find 𝑙 find 𝜚

Part 1: Quick re-motivation Part 2: Quick tutorial recap Part 3: SIKE

W. Castryck (GIF): ”Elliptic curves are dead: long live elliptic curves” https://www.esat.kuleuven.be/cosic/?p=7404

Supersingular isogeny graph for ℓ = 2 : 𝑌(𝑇 241 2 ,2) Credit to Fre Vercauteren for example and pictures…

Supersingular isogeny graph for ℓ = 3 : 𝑌(𝑇 241 2 ,3) Credit to Fre Vercauteren for example and pictures…

SIDH: in a nutshell params public private 𝜚 𝐵 𝐹 𝐵 = 𝐹 0 /〈𝐵〉 𝐹 0 𝐹 ’s are isogenous curves 𝑄 ’s, 𝑅 ’s, 𝑆 ’s, 𝑇 ’s are points ′ 𝜚 𝐶 𝜚 𝐶 𝜚 𝐵 ′ 𝐹 𝐵𝐶 = 𝐹 0 /〈𝐵, 𝐶〉 𝐹 0 /〈𝐶〉 = 𝐹 𝐶

SIDH: in a nutshell params public private 𝜚 𝐵 𝐹 𝐵 = 𝐹 0 /〈𝑄 𝐵 + 𝑡 𝐵 𝑅 𝐵 〉 𝐹 0 𝐹 ’s are isogenous curves 𝑄 ’s, 𝑅 ’s, 𝑆 ’s, 𝑇 ’s are points (𝑆 𝐵 , 𝑇 𝐵 ) = (𝜚 𝐵 (𝑄 𝐶 ), 𝜚 𝐵 (𝑅 𝐶 )) ′ 𝜚 𝐶 𝜚 𝐶 𝜚 𝐵 ′ 𝐹 𝐵𝐶 = 𝐹 0 /〈𝐵, 𝐶〉 𝐹 0 /〈𝑄 𝐶 + 𝑡 𝐶 𝑅 𝐶 〉 = 𝐹 𝐶 (𝜚 𝐶 (𝑄 𝐵 ), 𝜚 𝐶 (𝑅 𝐵 )) = (𝑆 𝐶 , 𝑇 𝐶 ) Key: : Alice sends her isogeny evaluated at Bob’s generators, and vice versa 𝐹 𝐵 /〈𝑆 𝐵 + 𝑡 𝐶 𝑇 𝐵 〉 ≅ 𝐹 0 /〈𝑄 𝐵 + 𝑡 𝐵 𝑅 𝐵 , 𝑄 𝐶 + 𝑡 𝐶 𝑅 𝐶 〉 ≅ 𝐹 𝐶 /〈𝑆 𝐶 + 𝑡 𝐵 𝑇 𝐶 〉

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel 𝑄 0 ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 1 𝐹 2 𝐹 6 = 𝐹 0 /⟨𝑄 0 ⟩ 𝐹 3 𝐹 4 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel 𝑄 0 ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 1 [2]𝑄 0 𝐹 2 𝐹 5 = 𝐹 0 /⟨[2]𝑄 0 ⟩ 𝐹 3 𝐹 4 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel 𝑄 0 ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 1 𝐹 2 𝐹 4 = 𝐹 0 /⟨[4]𝑄 0 ⟩ [4]𝑄 0 𝐹 3 𝐹 4 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel 𝑄 0 ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 1 𝐹 2 𝐹 3 = 𝐹 0 /⟨[8]𝑄 0 ⟩ 𝐹 3 [8]𝑄 0 𝐹 4 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel 𝑄 0 ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 1 𝐹 2 𝐹 2 = 𝐹 0 /⟨[16]𝑄 0 ⟩ 𝐹 3 𝐹 4 [16]𝑄 0 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel 𝑄 0 ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 1 𝐹 2 𝐹 1 = 𝐹 0 /⟨[32]𝑄 0 ⟩ = 𝜚 0 (𝐹 0 ) 𝐹 3 𝐹 4 𝐹 5 [32]𝑄 0 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel 𝑄 0 ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝑄 1 𝐹 2 𝐹 1 = 𝐹 0 /⟨[32]𝑄 0 ⟩ = 𝜚 0 (𝐹 0 ) 𝐹 3 𝑄 1 = 𝜚 0 (𝑄 0 ) 𝐹 4 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝑄 1 𝐹 2 𝐹 6 = 𝐹 1 /⟨𝑄 1 ⟩ 𝐹 3 𝐹 4 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝑄 1 𝐹 2 𝐹 5 = 𝐹 1 /⟨[2]𝑄 1 ⟩ [2]𝑄 𝐹 3 1 𝐹 4 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝑄 1 𝐹 2 𝐹 4 = 𝐹 1 /⟨[4]𝑄 1 ⟩ 𝐹 3 𝐹 4 [4]𝑄 1 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝑄 1 𝐹 2 𝐹 3 = 𝐹 1 /⟨[8]𝑄 1 ⟩ 𝐹 3 𝐹 4 [8]𝑄 𝐹 5 1 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝑄 1 𝐹 2 𝐹 2 = 𝐹 1 /⟨[16]𝑄 1 ⟩ = 𝜚 1 (𝐹 1 ) 𝐹 3 𝐹 4 𝐹 5 [16]𝑄 𝐹 6 1

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝑄 1 𝐹 2 𝜚 1 𝐹 2 = 𝐹 1 /⟨[16]𝑄 1 ⟩ = 𝜚 1 (𝐹 1 ) 𝑄 𝐹 3 2 𝑄 2 = 𝜚 1 (𝑄 1 ) 𝐹 4 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝐹 2 𝜚 1 𝐹 6 = 𝐹 2 /⟨𝑄 2 ⟩ 𝑄 𝐹 3 2 𝐹 4 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝐹 2 𝜚 1 𝐹 5 = 𝐹 2 /⟨[2]𝑄 2 ⟩ 𝑄 𝐹 3 2 [2]𝑄 𝐹 4 2 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝐹 2 𝜚 1 𝐹 4 = 𝐹 2 /⟨[4]𝑄 2 ⟩ 𝑄 𝐹 3 2 𝐹 4 [4]𝑄 𝐹 5 2 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝐹 2 𝜚 1 𝐹 3 = 𝐹 2 /⟨[8]𝑄 2 ⟩ = 𝜚 2 (𝐹 2 ) 𝑄 𝐹 3 2 𝐹 4 𝐹 5 [8]𝑄 2 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝐹 2 𝜚 1 𝐹 3 = 𝐹 2 /⟨[8]𝑄 2 ⟩ = 𝜚 2 (𝐹 2 ) 𝑄 𝐹 3 2 𝜚 2 𝑄 3 = 𝜚 2 (𝑄 2 ) 𝑄 𝐹 4 3 𝐹 5 [8]𝑄 2 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝐹 2 𝜚 1 𝐹 6 = 𝐹 3 /⟨𝑄 3 ⟩ 𝐹 3 𝜚 2 𝑄 𝐹 4 3 𝐹 5 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝐹 2 𝜚 1 𝐹 5 = 𝐹 3 /⟨[2]𝑄 3 ⟩ 𝐹 3 𝜚 2 𝑄 𝐹 4 3 [2]𝑄 𝐹 5 3 𝐹 6

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝐹 2 𝜚 1 𝐹 4 = 𝐹 3 /⟨[4]𝑄 3 ⟩ 𝐹 3 𝜚 2 𝑄 𝐹 4 3 𝐹 5 [4]𝑄 𝐹 6 3

Computing ℓ 𝑓 degree isogenies (suppose ℓ = 2 and 𝑓 = 6 ) 𝐹 0 6 is degree 64 𝜚 ∶ 𝐹 0 → 𝐹 64 elements in its kernel ker 𝜚 = ⟨𝑄 0 ⟩ 𝐹 𝜚 0 1 𝐹 2 𝜚 1 𝐹 4 = 𝐹 3 /⟨[4]𝑄 3 ⟩ 𝐹 3 𝜚 2 𝑄 4 = 𝜚 3 (𝑄 3 ) 𝑄 𝐹 4 3 𝜚 3 𝑄 𝐹 5 4 [4]𝑄 𝐹 6 3