Verifiable Delay Functions from Isogenies and Pairings Luca De Feo - PowerPoint PPT Presentation

Verifiable Delay Functions from Isogenies and Pairings Luca De Feo joint work with J. Burdges, S. Masson, C. Petit, A. Sanso Université Paris Saclay – UVSQ, France July 13, 2019, SIAM AG, Bern Slides online at https://defeo.lu/docet

Tired of *SIDH? Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 2 / 12

Tired of *SIDH? Enough quantum FUD? Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 2 / 12

Tired of *SIDH? Enough quantum FUD? Ready for a new buzzword? Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 2 / 12

❂ ✭ ❀ ✿ ✿ ✿ ❀ ✮ Distributed lottery Participants A, B, ..., Z want to agree on a random winning ticket. Flawed protocol Each participant x broadcasts a random string s x ; Winning ticket is H ✭ s A ❀ ✿ ✿ ✿ ❀ s Z ✮ . Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 4 / 12

❂ ✭ ❀ ✿ ✿ ✿ ❀ ✮ Distributed lottery Participants A, B, ..., Z want to agree on a random winning ticket. Flawed protocol Each participant x broadcasts a random string s x ; Winning ticket is H ✭ s A ❀ ✿ ✿ ✿ ❀ s Z ✮ . Fixes Make the hash function sloooooooooooooooooooooooooooow ; Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 4 / 12

Distributed lottery Participants A, B, ..., Z want to agree on a random winning ticket. Flawed protocol Each participant x broadcasts a random string s x ; Winning ticket is H ✭ s A ❀ ✿ ✿ ✿ ❀ s Z ✮ . Fixes Make the hash function sloooooooooooooooooooooooooooow ; Make it possible to verify w ❂ H ✭ s A ❀ ✿ ✿ ✿ ❀ s Z ✮ fast . Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 4 / 12

Verifiable Delay Functions (Boneh, Bonneau, Bünz, Fisch 2018) Wanted Function (family) f ✿ X ✦ Y s.t.: Evaluating f ✭ x ✮ takes long time: ■ uniformly long time, ■ on almost all random inputs x , ■ even afer having seen many values of f ✭ x ✵ ✮ , ■ even given massive number of processors; Verifying y ❂ f ✭ x ✮ is efficient: ■ ideally, exponential separation between evaluation and verification. Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 5 / 12

Verifiable Delay Functions (Boneh, Bonneau, Bünz, Fisch 2018) Wanted Function (family) f ✿ X ✦ Y s.t.: Evaluating f ✭ x ✮ takes long time: ■ uniformly long time, ■ on almost all random inputs x , ■ even afer having seen many values of f ✭ x ✵ ✮ , ■ even given massive number of processors; Verifying y ❂ f ✭ x ✮ is efficient: ■ ideally, exponential separation between evaluation and verification. Exercise Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 5 / 12

Verifiable Delay Functions (Boneh, Bonneau, Bünz, Fisch 2018) Wanted Function (family) f ✿ X ✦ Y s.t.: Evaluating f ✭ x ✮ takes long time: ■ uniformly long time, ■ on almost all random inputs x , ■ even afer having seen many values of f ✭ x ✵ ✮ , ■ even given massive number of processors; Verifying y ❂ f ✭ x ✮ is efficient: ■ ideally, exponential separation between evaluation and verification. Exercise Think of a function you like with these properties Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 5 / 12

Verifiable Delay Functions (Boneh, Bonneau, Bünz, Fisch 2018) Wanted Function (family) f ✿ X ✦ Y s.t.: Evaluating f ✭ x ✮ takes long time: ■ uniformly long time, ■ on almost all random inputs x , ■ even afer having seen many values of f ✭ x ✵ ✮ , ■ even given massive number of processors; Verifying y ❂ f ✭ x ✮ is efficient: ■ ideally, exponential separation between evaluation and verification. Exercise Think of a function you like with these properties Got it? Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 5 / 12

Verifiable Delay Functions (Boneh, Bonneau, Bünz, Fisch 2018) Wanted Function (family) f ✿ X ✦ Y s.t.: Evaluating f ✭ x ✮ takes long time: ■ uniformly long time, ■ on almost all random inputs x , ■ even afer having seen many values of f ✭ x ✵ ✮ , ■ even given massive number of processors; Verifying y ❂ f ✭ x ✮ is efficient: ■ ideally, exponential separation between evaluation and verification. Exercise Think of a function you like with these properties Got it? You’re probably wrong! Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 5 / 12

Sequentiality Ideal functionality: y ❂ f ✭ x ✮ ❂ H ✭ H ✭ ✁ ✁ ✁ ✭ H ✭ x ✮✮✮✮ ⑤ ④③ ⑥ T times Sequential assuming hash output “unpredictability”, but how do you verify? Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 6 / 12

VDFs from groups of unknown order Setup A group of unknown order, e.g.: ❩ ❂ N ❩ with N ❂ pq an RSA modulus, p ❀ q unknown (e.g., generated by some trusted authority), Class group of imaginary quadratic order. Evaluation With delay parameter T : f ✿ G � ✦ G ✦ x 2 T x ✼� Conjecturally, fastest algorithm is repeated squaring. Verification (Wesolowski 2019, Pietrzak 2019) Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 7 / 12

VDFs from groups of unknown order Setup A group of unknown order, e.g.: ❩ ❂ N ❩ with N ❂ pq an RSA modulus, p ❀ q unknown (e.g., generated by some trusted authority), Class group of imaginary quadratic order. Evaluation With delay parameter T : f ✿ G � ✦ G ✦ x 2 T x ✼� Conjecturally, fastest algorithm is repeated squaring. Verification (Wesolowski 2019, Pietrzak 2019) Aha! Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 7 / 12

Isogeny <3 Pairing Let ✣ ✿ E ✦ E ✵ , let P ✷ E ❬ N ❪ and Q ✷ E ✵ ❬ N ❪ . Then e N ✭ P ❀ ❫ ✣ ✭ Q ✮✮ ❂ e N ✭ ✣ ✭ P ✮ ❀ Q ✮ ✣ ✂ 1 X 1 ✂ X 2 X 1 ✂ X 2 1 ✂ ❫ e N ✣ X 1 ✂ X 2 ❋ p k e N Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 8 / 12

Isogeny <3 Pairing Let ✣ ✿ E ✦ E ✵ , let P ✷ E ❬ N ❪ and Q ✷ E ✵ ❬ N ❪ . Then e N ✭ P ❀ ❫ ✣ ✭ Q ✮✮ ❂ e N ✭ ✣ ✭ P ✮ ❀ Q ✮ ✣ ✂ 1 X 1 ✂ X 2 X 1 ✂ X 2 1 ✂ ❫ e N ✣ X 1 ✂ X 2 ❋ p k e N Idea #1 Use the equation for a BLS-like signature scheme: US patent 8,250,367 (Broker, Charles, Lauter). Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 8 / 12

Isogeny VDF Assume ❞❡❣ ✣ ❂ 2 T e N ✭ ✣ ✭ P ✮ ❀ ✣ ✭ Q ✮✮ ❂ e N ✭ P ❀ Q ✮ 2 T 2 T ♠♦❞ p k � 1 ; Right side: known group structure: 2 T ✦ Lef side: can evaluate ✣ in less than T steps? Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 9 / 12

Isogeny VDF ( ❋ p -version) Setup Pairing friendly supersingular curve E ❂ ❋ p Isogeny ✣ ✿ E ✦ E ✵ of degree 2 T , Point P ✷ E ❬✭ N ❀ ✙ � 1 ✮❪ , image ✣ ✭ P ✮ . Evaluation Input: random Q ✷ E ✵ ❬✭ N ❀ ✙ ✰ 1 ✮❪ , Output: ❫ ✣ ✭ Q ✮ . Verification e N ✭ P ❀ ❫ ❄ ✣ ✭ Q ✮✮ ❂ e N ✭ ✣ ✭ P ✮ ❀ Q ✮ ✿ Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 10 / 12

Isogeny VDF ( ❋ p -version) Trusted Setup Pairing friendly supersingular curve E ❂ ❋ p with unknown endomorphism ring!!! Isogeny ✣ ✿ E ✦ E ✵ of degree 2 T , Point P ✷ E ❬✭ N ❀ ✙ � 1 ✮❪ , image ✣ ✭ P ✮ . Evaluation Input: random Q ✷ E ✵ ❬✭ N ❀ ✙ ✰ 1 ✮❪ , Output: ❫ ✣ ✭ Q ✮ . Verification e N ✭ P ❀ ❫ ❄ ✣ ✭ Q ✮✮ ❂ e N ✭ ✣ ✭ P ✮ ❀ Q ✮ ✿ Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 10 / 12

Sequentiality? Wesolowski, Pietrzak: ✦ x 2 x ✼� ✦ x x ☛ i � 1 Isogenies: x ✼� x � ☛ i No speedup? Even with unlimited parallelism? Really? See Bernstein, Sorenson. Modular exponentiation via the explicit Chinese remainder theorem. Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 11 / 12

Thank you https://defeo.lu/ @luca_defeo Luca De Feo (UVSQ) VDFs from Isogenies and Pairings SIAM AG 2019 12 / 12