New New Directions in Cryptography

(1)

New New Directions in Cryptography

Nick Egbert

Student Colloquium Talk

20 Februrary 2019

(2)

Overview

1

Cryptography overview The general problem Classical Diffie-Hellman

2

Elliptic curve basics Definition Group structure

3

Elliptic curves in cryptography How they’re used today

Advantages and potential doom

4

Post-quantum cryptography

Supersingular elliptic curves

Isogenies

(3)

The problem

Alice Bob

Message

Eve Secure channel

Unsecure channel Trusted courier

Very inefficient

(4)

The problem

Alice Bob

Message

Eve Secure channel

Unsecure channel Trusted courier

Very inefficient

(5)

The problem

Alice Bob

Message

Eve

Secure channel

Unsecure channel Trusted courier

Very inefficient

(6)

The problem

Alice Bob

Message

Eve Secure channel

Unsecure channel

Trusted courier

Very inefficient

(7)

The problem

Alice Bob

Message

Eve Secure channel

Unsecure channel Trusted courier

Very inefficient

(8)

The problem

Alice Bob

Message

Secure channel

Unsecure channel Trusted courier

Very inefficient

(9)

The solution

There are two basic types of encryption: symmetric and asymmetric.

In symmetric encryption, both parties have the same key for encrypting and decrypting.

Asymmetric encryption is not symmetric.

Asymmetric encryption is generally used to establish a shared key.

(10)

The solution

There are two basic types of encryption: symmetric and asymmetric.

In symmetric encryption, both parties have the same key for encrypting and decrypting.

Asymmetric encryption is not symmetric.

Asymmetric encryption is generally used to establish a shared key.

(11)

The solution

There are two basic types of encryption: symmetric and asymmetric.

In symmetric encryption, both parties have the same key for encrypting and decrypting.

Asymmetric encryption is not symmetric.

Asymmetric encryption is generally used to establish a shared key.

(12)

The solution

There are two basic types of encryption: symmetric and asymmetric.

In symmetric encryption, both parties have the same key for encrypting and decrypting.

Asymmetric encryption is not symmetric.

Asymmetric encryption is generally used to establish a shared key.

(13)

The solution

Alice Bob

Secure channel

Unsecure channel

Trusted courier

(14)

The solution

Alice Bob

Secure channel

Unsecure channel

Trusted courier

(15)

Discrete log problem (DLP)

Let p be a prime number, and let a, b ∈ Z such that a, b 6≡ 0 mod p.

Suppose we know there exists k ∈ Z such that a

^k

≡ b (mod p).

The (classical) discrete log problem is to find k.

More generally, if G is a group and a, b ∈ G , and given a

^k

= b,

the discrete log problem is to find k.

(16)

Discrete log problem (DLP)

Let p be a prime number, and let a, b ∈ Z such that a, b 6≡ 0 mod p.

Suppose we know there exists k ∈ Z such that a

^k

≡ b (mod p).

The (classical) discrete log problem is to find k.

More generally, if G is a group and a, b ∈ G , and given a

^k

= b,

the discrete log problem is to find k.

(17)

Diffie-Hellman Key Exchange (1976)

Alice and Bob publicly agree upon a prime p and a generator g ∈ G = F

^×p

.

Alice picks a random integer a ∈ {2, . . . , p − 2} and computes A = g

^a

mod p.

Bob picks a random integer b ∈ {2, . . . , p − 2} and computes B = g

^b

mod p.

The integers a, b are kept secret, and Alice and Bob transmit A and B publicly.

They compute a shared secret K = B

^a

= g

^ba

= g

^ab

= A

^b

.

Security relies upon the DLP.

(18)

Diffie-Hellman Key Exchange (1976)

Alice and Bob publicly agree upon a prime p and a generator g ∈ G = F

^×p

.

Alice picks a random integer a ∈ {2, . . . , p − 2} and computes A = g

^a

mod p.

Bob picks a random integer b ∈ {2, . . . , p − 2} and computes B = g

^b

mod p.

The integers a, b are kept secret, and Alice and Bob transmit A and B publicly.

They compute a shared secret K = B

^a

= g

^ba

= g

^ab

= A

^b

.

Security relies upon the DLP.

(19)

Diffie-Hellman Key Exchange (1976)

Alice and Bob publicly agree upon a prime p and a generator g ∈ G = F

^×p

.

Alice picks a random integer a ∈ {2, . . . , p − 2} and computes A = g

^a

mod p.

Bob picks a random integer b ∈ {2, . . . , p − 2} and computes B = g

^b

mod p.

The integers a, b are kept secret, and Alice and Bob transmit A and B publicly.

They compute a shared secret K = B

^a

= g

^ba

= g

^ab

= A

^b

.

Security relies upon the DLP.

(20)

Diffie-Hellman Key Exchange (1976)

Alice and Bob publicly agree upon a prime p and a generator g ∈ G = F

^×p

.

Alice picks a random integer a ∈ {2, . . . , p − 2} and computes A = g

^a

mod p.

Bob picks a random integer b ∈ {2, . . . , p − 2} and computes B = g

^b

mod p.

The integers a, b are kept secret, and Alice and Bob transmit A and B publicly.

They compute a shared secret K = B

^a

= g

^ba

= g

^ab

= A

^b

.

Security relies upon the DLP.

(21)

Diffie-Hellman Key Exchange (1976)

Public parameters:

g, p Alice

a ∈

_R

{2, . . . , p − 2}

A = g

^a

mod p

K = B

^a

= g

^ba

Bob

b ∈

_R

{2, . . . , p − 2}

B = g

^b

mod p

K = A

^b

= g

^ab

A

B

(22)

Issues with DH

When G = F

^×q

, the DLP can be solved in subexponential time.

This requires larger keys.

In the 1980s, Victor Miller and Neal Koblitz independently suggested

using elliptic curves for cryptography.

(23)

What is an elliptic curve?

An elliptic curve E is the graph of an equation of the form y

²

+ a

₁

xy + a

₃

y = x

³

+ a

₂

x

²

+ a

₄

x + a

₆

with coefficients in some field K .

If charK 6= 2, 3, then via a change of variables, we may assume E has the form

y

²

= x

³

+ Ax + B.

To be considered an elliptic curve, we require that 4A

³

+ 27B

²

6= 0,

so that x

³

+ Ax + B does not have any repeated roots.

(24)

What is an elliptic curve?

An elliptic curve E is the graph of an equation of the form y

²

+ a

₁

xy + a

₃

y = x

³

+ a

₂

x

²

+ a

₄

x + a

₆

with coefficients in some field K .

If charK 6= 2, 3, then via a change of variables, we may assume E has the form

y

²

= x

³

+ Ax + B.

To be considered an elliptic curve, we require that 4A

³

+ 27B

²

6= 0,

so that x

³

+ Ax + B does not have any repeated roots.

(25)

What is an elliptic curve?

An elliptic curve E is the graph of an equation of the form y

²

+ a

₁

xy + a

₃

y = x

³

+ a

₂

x

²

+ a

₄

x + a

₆

with coefficients in some field K .

If charK 6= 2, 3, then via a change of variables, we may assume E has the form

y

²

= x

³

+ Ax + B.

To be considered an elliptic curve, we require that 4A

³

+ 27B

²

6= 0,

so that x

³

+ Ax + B does not have any repeated roots.

(26)

Examples

E 1 : y

²

= x

³

− x E

₂

: y

²

= x

³

+ x

(27)

Examples

E

₁

: y

²

= x

³

− x (mod 683)

(28)

Examples

E

₁

: y

²

= x

³

− x (mod 683)

(29)

Group structure

E (K ) = {(x , y ) ∈ K × K | y

²

= x

³

+ Ax + B} ∪ {∞}

Rational points plus the point at infinity form a group, where addition

law is given by “chord-and-tangent” method

(30)

Adding points

E : y

²

= x

³

− 24003 ∗ x + 1296702

(31)

Assumptions

For q = p

ⁿ

, where p is prime, we consider only E (F

q

).

We will assume that charK 6= 2, 3 and that E : y

²

= x

³

+ Ax + B.

Later, we will want to write E in the form y

²

= x

³

+ Ax

²

+ x , referred to as a Montgomery curve.

We define the j -invariant of E to be

j (E ) = 1728 4A

³

4A

³

+ 27B

²

Fact: E

₁

, E

₂

are isomorphic over F

q

if and only if j (E

₁

) = j (E

₂

).

(32)

Assumptions

For q = p

ⁿ

, where p is prime, we consider only E (F

q

).

We will assume that charK 6= 2, 3 and that E : y

²

= x

³

+ Ax + B.

Later, we will want to write E in the form y

²

= x

³

+ Ax

²

+ x , referred to as a Montgomery curve.

We define the j -invariant of E to be

j (E ) = 1728 4A

³

4A

³

+ 27B

²

Fact: E

₁

, E

₂

are isomorphic over F

q

if and only if j (E

₁

) = j (E

₂

).

(33)

Assumptions

For q = p

ⁿ

, where p is prime, we consider only E (F

q

).

We will assume that charK 6= 2, 3 and that E : y

²

= x

³

+ Ax + B.

Later, we will want to write E in the form y

²

= x

³

+ Ax

²

+ x , referred to as a Montgomery curve.

We define the j -invariant of E to be

j (E ) = 1728 4A

³

4A

³

+ 27B

²

Fact: E

₁

, E

₂

are isomorphic over F

q

if and only if j (E

₁

) = j (E

₂

).

(34)

Assumptions

For q = p

ⁿ

, where p is prime, we consider only E (F

q

).

We will assume that charK 6= 2, 3 and that E : y

²

= x

³

+ Ax + B.

Later, we will want to write E in the form y

²

= x

³

+ Ax

²

+ x , referred to as a Montgomery curve.

We define the j -invariant of E to be j (E ) = 1728 4A

³

4A

³

+ 27B

²

Fact: E

₁

, E

₂

are isomorphic over F

q

if and only if j (E

₁

) = j (E

₂

).

(35)

Assumptions

For q = p

ⁿ

, where p is prime, we consider only E (F

q

).

We will assume that charK 6= 2, 3 and that E : y

²

= x

³

+ Ax + B.

Later, we will want to write E in the form y

²

= x

³

+ Ax

²

+ x , referred to as a Montgomery curve.

We define the j -invariant of E to be j (E ) = 1728 4A

³

4A

³

+ 27B

²

Fact: E

₁

, E

₂

are isomorphic over F

q

if and only if j (E

₁

) = j (E

₂

).

(36)

ECDH

ECDH = “Elliptic Curve Diffie-Hellman”

Alice and Bob agree on an elliptic curve E and a field F

q

such that the DLP is hard for E (F

q

).

They agree on a point P ∈ E (F

q

) of large (usually prime) order.

(37)

ECDH

Public parameters:

E (F

q

), P Alice

a ∈

R

Z P

_a

= aP

K = aP

_b

= abP

Bob b ∈

R

Z P

_b

= bP

K = bP

_a

= baP

(38)

Advantages of ECDH

Using elliptic curves allows for much smaller key sizes: an RSA 4096-bit key provides the same level of security as a 313-bit EC key.

The group law for elliptic curves can be performed efficiently.

(39)

Post-quantum cryptography

In 1994, Peter Shor published an algorithm that solves the DLP (and factoring large numbers) in polynomial time.

This effectively breaks any cryptosystem based on the hardness of these two problems.

Is cryptography broken in a post-quantum world?

Fear not.

There have been several major developments in the past ten years. Many of them use isogeny graphs of supersingular elliptic curves.

(40)

Post-quantum cryptography

In 1994, Peter Shor published an algorithm that solves the DLP (and factoring large numbers) in polynomial time.

This effectively breaks any cryptosystem based on the hardness of these two problems.

Is cryptography broken in a post-quantum world?

Fear not.

There have been several major developments in the past ten years. Many of them use isogeny graphs of supersingular elliptic curves.

(41)

Post-quantum cryptography

In 1994, Peter Shor published an algorithm that solves the DLP (and factoring large numbers) in polynomial time.

This effectively breaks any cryptosystem based on the hardness of these two problems.

Is cryptography broken in a post-quantum world?

Fear not.

There have been several major developments in the past ten years.

Many of them use isogeny graphs of supersingular elliptic curves.

(42)

Post-quantum cryptography

In 1994, Peter Shor published an algorithm that solves the DLP (and factoring large numbers) in polynomial time.

This effectively breaks any cryptosystem based on the hardness of these two problems.

Is cryptography broken in a post-quantum world?

Fear not.

There have been several major developments in the past ten years.

Many of them use isogeny graphs of supersingular elliptic curves.

(43)

Supersingular elliptic curves

Definition

Let E be an elliptic curve over F

q

. We define the n-torsion subgroup to be E [n] = {P ∈ E (F

q

) | nP = ∞}.

Remark

E [n] is a subgroup of E (F

q

). In general, we can’t expect that E [n] ⊂ E (F

q

).

Theorem

Let p = char F

q

. If p does not divide n, then

E [n] ∼ = Z

n

⊕ Z

n

.

(44)

Supersingular elliptic curves

Definition

Let E be an elliptic curve over F

q

. We define the n-torsion subgroup to be E [n] = {P ∈ E (F

q

) | nP = ∞}.

Remark

E [n] is a subgroup of E (F

q

). In general, we can’t expect that E [n] ⊂ E (F

q

).

Theorem

Let p = char F

q

. If p does not divide n, then

E [n] ∼ = Z

n

⊕ Z

n

.

(45)

Supersingular elliptic curves

Definition

Let E be an elliptic curve over F

q

. We define the n-torsion subgroup to be E [n] = {P ∈ E (F

q

) | nP = ∞}.

Remark

E [n] is a subgroup of E (F

q

). In general, we can’t expect that E [n] ⊂ E (F

q

).

Theorem

Let p = char F

q

. If p does not divide n, then

E [n] ∼ = Z

n

⊕ Z

n

.

(46)

Supersingular elliptic curves

Definition

An elliptic curve E /F

q

is called supersingular if E [p] = {∞}, where p is the characteristic of F

q

.

Theorem

Let E /F

q

be an elliptic curve, where q = p

ⁿ

. Let t = q + 1 − #E (F

q

).

Then E is supersingular if and only if

t ≡ 0 (mod p).

(47)

Isogenies

Definition

Let E

1

, E

2

be elliptic curves over F

q

. An isogeny from E

1

to E

2

is a nonconstant homomorphism

α : E

1

(F

q

) → E

2

(F

q

) given by rational maps.

Definition

We may write α(x , y ) = (r

₁

(x ), yr

₂

(x )), where r

₁

, r

₂

are rational functions.

Writing r

1

(x ) =

^{p(x )}_{q(x )}

, the degree of α is

deg α = max(deg p, deg q).

(48)

Endomorphisms of elliptic curves

Definition

An endomorphism of E is an isogeny from E to itself.

Example

The multiplication by n map:

[n] : E → E (x , y ) 7→ n(x , y )

Example

The Frobenius endomorphism:

π : E → E

(x , y ) 7→ (x

^p

, y

^p

)

(49)

Endomorphisms of elliptic curves

Definition

An endomorphism of E is an isogeny from E to itself.

Example

The multiplication by n map:

[n] : E → E (x , y ) 7→ n(x , y )

Example

The Frobenius endomorphism:

π : E → E

(x , y ) 7→ (x

^p

, y

^p

)

(50)

Endomorphisms of elliptic curves

Definition

An endomorphism of E is an isogeny from E to itself.

Example

The multiplication by n map:

[n] : E → E (x , y ) 7→ n(x , y )

Example

The Frobenius endomorphism:

π : E → E

(51)

Quick aside on ANT

Let K = Q( √

−p). Let O

_K

denote the ring of integers of K , i.e.,

α ∈ K | f (α) = 0 for some monic f ∈ Z[x] .

An order O ∈ K is a ring such that Z ( O ⊆ O

K

.

A fractional ideal of O is of the form αa, where α ∈ K

^×

and a is an O-ideal. A principal fractional ideal is of the form αO.

We say a fractional ideal a is invertible if ∃b such that ab = O.

(52)

Quick aside on ANT

Let K = Q( √

−p). Let O

_K

denote the ring of integers of K , i.e.,

α ∈ K | f (α) = 0 for some monic f ∈ Z[x] .

An order O ∈ K is a ring such that Z ( O ⊆ O

K

.

A fractional ideal of O is of the form αa, where α ∈ K

^×

and a is an O-ideal. A principal fractional ideal is of the form αO.

We say a fractional ideal a is invertible if ∃b such that ab = O.

(53)

Quick aside on ANT

Let K = Q( √

−p). Let O

_K

denote the ring of integers of K , i.e.,

α ∈ K | f (α) = 0 for some monic f ∈ Z[x] .

An order O ∈ K is a ring such that Z ( O ⊆ O

K

.

A fractional ideal of O is of the form αa, where α ∈ K

^×

and a is an O-ideal. A principal fractional ideal is of the form αO.

We say a fractional ideal a is invertible if ∃b such that ab = O.

(54)

Quick aside on ANT

Let K = Q( √

−p). Let O

_K

denote the ring of integers of K , i.e.,

α ∈ K | f (α) = 0 for some monic f ∈ Z[x] .

An order O ∈ K is a ring such that Z ( O ⊆ O

K

.

A fractional ideal of O is of the form αa, where α ∈ K

^×

and a is an O-ideal. A principal fractional ideal is of the form αO.

We say a fractional ideal a is invertible if ∃b such that ab = O.

(55)

Ideal class group

By construction, the set of invertible fractional ideals I (O) forms an abelian group under multiplication of ideals.

The set of principal ideals P(O) is a (normal) subgroup, so we may consider the ideal class group of O

cl(O) = I (O)/P(O).

Let E /F

p

be a supersingular elliptic curve. Then End

_F_p

(E ) ∼ = O,

where O is an order in an imaginary quadratic field.

(56)

Ideal class group

By construction, the set of invertible fractional ideals I (O) forms an abelian group under multiplication of ideals.

The set of principal ideals P(O) is a (normal) subgroup, so we may consider the ideal class group of O

cl(O) = I (O)/P(O).

Let E /F

p

be a supersingular elliptic curve. Then End

_F_p

(E ) ∼ = O,

where O is an order in an imaginary quadratic field.

(57)

Ideal class group

By construction, the set of invertible fractional ideals I (O) forms an abelian group under multiplication of ideals.

The set of principal ideals P(O) is a (normal) subgroup, so we may consider the ideal class group of O

cl(O) = I (O)/P(O).

Let E /F

p

be a supersingular elliptic curve. Then End

_F_p

(E ) ∼ = O,

where O is an order in an imaginary quadratic field.

(58)

Class group action

Let E /F

p

be an elliptic curve. Define E [a] =

n

P ∈ E (F

p

) | α(P) = 0 ∀α ∈ a o

.

We can define the action of the O-ideal a on E as the image E

⁰

under the isogeny

φ : E → E

⁰

whose kernel is E [a]. We denote E

⁰

= a ∗ E .

Fact: an isogeny is uniquely determined by its kernel (up to

isomorphism).

(59)

Class group action

Let E /F

p

be an elliptic curve. Define E [a] =

n

P ∈ E (F

p

) | α(P) = 0 ∀α ∈ a o

.

We can define the action of the O-ideal a on E as the image E

⁰

under the isogeny

φ : E → E

⁰

whose kernel is E [a]. We denote E

⁰

= a ∗ E .

Fact: an isogeny is uniquely determined by its kernel (up to

isomorphism).

(60)

Class group action

Let E /F

p

be an elliptic curve. Define E [a] =

n

P ∈ E (F

p

) | α(P) = 0 ∀α ∈ a o

.

We can define the action of the O-ideal a on E as the image E

⁰

under the isogeny

φ : E → E

⁰

whose kernel is E [a]. We denote E

⁰

= a ∗ E .

Fact: an isogeny is uniquely determined by its kernel (up to

isomorphism).

(61)

Class group action

Let S be the set of supersingular elliptic curves

E

_A

/F

p

: y

²

= x

³

+ Ax

²

+ x , where p ≥ 5 and p ≡ 3 (mod 8).

In this case, End

_F_p

(E

_A

) ∼ = Z[ √

−p].

a ∗ E

_A

is an `-isogeny if and only if a = h[`], π ± 1i

(62)

Class group action

Let S be the set of supersingular elliptic curves

E

_A

/F

p

: y

²

= x

³

+ Ax

²

+ x , where p ≥ 5 and p ≡ 3 (mod 8).

In this case, End

_F_p

(E

_A

) ∼ = Z[ √

−p].

a ∗ E

_A

is an `-isogeny if and only if a = h[`], π ± 1i

(63)

Class group action

Let S be the set of supersingular elliptic curves

E

_A

/F

p

: y

²

= x

³

+ Ax

²

+ x , where p ≥ 5 and p ≡ 3 (mod 8).

In this case, End

_F_p

(E

_A

) ∼ = Z[ √

−p].

a ∗ E

_A

is an `-isogeny if and only if a = h[`], π ± 1i

(64)

CSIDH

In November 2018, Castryck, Lange, Martindale, Panny and Renes published a paper on their algorithm CSIDH, which stands for Commutative Supersingular Isogeny Diffie-Hellman.

CSIDH is thought to be a suitable post-quantum replacement for ECDH.

Key sizes are extremely small.

(65)

CSIDH

In November 2018, Castryck, Lange, Martindale, Panny and Renes published a paper on their algorithm CSIDH, which stands for Commutative Supersingular Isogeny Diffie-Hellman.

CSIDH is thought to be a suitable post-quantum replacement for ECDH.

Key sizes are extremely small.

(66)

CSIDH

In November 2018, Castryck, Lange, Martindale, Panny and Renes published a paper on their algorithm CSIDH, which stands for Commutative Supersingular Isogeny Diffie-Hellman.

CSIDH is thought to be a suitable post-quantum replacement for ECDH.

Key sizes are extremely small.

(67)

Isogeny graphs

Let p, ` be distinct primes. The isogeny graph G

_`

over F

p

has

Vertices: Elliptic curves E_A ∈ S with End(E_A) ∼= Z[√

−p]

Edges: (E_A, E_B), where there is an `-isogeny between E_A and E_B

For illustration we will fix p = 419.

In general, the CSIDH authors pick p = 4`

1

· · · `

_n

− 1, where

`

₁

, . . . , `

_n

are distinct odd primes.

(68)

Isogeny graphs

Let p, ` be distinct primes. The isogeny graph G

_`

over F

p

has

−p]

For illustration we will fix p = 419.

In general, the CSIDH authors pick p = 4`

1

· · · `

_n

− 1, where

`

₁

, . . . , `

_n

are distinct odd primes.

(69)

Isogeny graphs

Let p, ` be distinct primes. The isogeny graph G

_`

over F

p

has

−p]

For illustration we will fix p = 419.

In general, the CSIDH authors pick p = 4`

1

· · · `

_n

− 1, where

`

₁

, . . . , `

_n

are distinct odd primes.

(70)

Isogeny graph G

₃

E

₀

E

158

E

₄₁₀

E

368

E

₄₀₄

E

₇₅

E

144

E

191

E

174

E

₄₁₃

E

₃₇₉

E

₁₂₄

E E E

₂₉₅

E

₄₀

E

₆

E

245

E

228

E

275

E

₃₄₄

E

₁₅

E

51

E

₉

E

261

(71)

Isogeny graph G

₅

E

₀

E

158

E

₄₁₀

E

368

E

₄₀₄

E

₇₅

E

144

E

191

E

174

E

₄₁₃

E

₃₇₉

E

₁₂₄

E

₁₉₉

E

₃₉₀

E

₂₉

E

₂₂₀

E

₂₉₅

E

₄₀

E

₆

E

245

E

228

E

275

E

₃₄₄

E

₁₅

E

51

E

₉

E

261

(72)

Isogeny graph G

₅

E

₀

E

158

E

₄₁₀

E

368

E

₄₀₄

E

₇₅

E

144

E

191

E

174

E

₄₁₃

E

₃₇₉

E

₁₂₄

E E E

₂₉₅

E

₄₀

E

₆

E

245

E

228

E

275

E

₃₄₄

E

₁₅

E

51

E

₉

E

261

(73)

Isogeny graph G

₅

E

₀

E

158

E

₄₁₀

E

368

E

₄₀₄

E

₇₅

E

144

E

191

E

174

E

₄₁₃

E

₃₇₉

E

₁₂₄

E

₁₉₉

E

₃₉₀

E

₂₉

E

₂₂₀

E

₂₉₅

E

₄₀

E

₆

E

245

E

228

E

275

E

₃₄₄

E

₁₅

E

51

E

₉

E

261

(74)

Isogeny graph G

₅

E

₀

E

158

E

₄₁₀

E

368

E

₄₀₄

E

₇₅

E

144

E

191

E

174

E

₄₁₃

E

₃₇₉

E

₁₂₄

E E E

₂₉₅

E

₄₀

E

₆

E

245

E

228

E

275

E

₃₄₄

E

₁₅

E

51

E

₉

E

261

(75)

Isogeny graph G

₇

E

₀

E

158

E

₄₁₀

E

368

E

₄₀₄

E

₇₅

E

144

E

191

E

174

E

₄₁₃

E

₃₇₉

E

₁₂₄

E

₁₉₉

E

₃₉₀

E

₂₉

E

₂₂₀

E

₂₉₅

E

₄₀

E

₆

E

245

E

228

E

275

E

₃₄₄

E

₁₅

E

51

E

₉

E

261

(76)

CSIDH

CSIDH stands for Commutative Supersingular Isogeny Diffie-Hellman.

It is proposed as a post-quantum drop-in replacement for (EC)DH.

They use the action of the ideal class group and the supersingular

isogeny graph to establish keys.

(77)

Isogeny graph used in CSIDH

E

₀

E

158

E

410

E

368

E

₄₀₄

E

₇₅

E

₁₄₄

E

₁₉₁

E

174

E

₄₁₃

E

₃₇₉

E

₁₂₄

E

₁₉₉

E

₃₉₀

E

₂₉

E

₂₂₀

E

₂₉₅

E

₄₀

E

₆

E

245

E

₂₂₈

E

₂₇₅

E

₃₄₄

E

₁₅

E

51

E

9

E

261

∪ G

₅

∪ G

₇

(78)

Isogeny graph used in CSIDH

E

₀

E

158

E

410

E

368

E

₄₀₄

E

₇₅

E

₁₄₄

E

₁₉₁

E

174

E

₄₁₃

E

₃₇₉

E

₁₂₄

E

₁₉₉

E

₃₉₀

E

₂₉

E

₂₂₀

E

₂₉₅

E

₄₀

E

₆

E

245

E

₂₂₈

E

₂₇₅

E

₃₄₄

E

₁₅

E

51

E

9

E

261

∪ G

₇

(79)

Isogeny graph used in CSIDH

E

₀

E

158

E

410

E

368

E

₄₀₄

E

₇₅

E

₁₄₄

E

₁₉₁

E

174

E

₄₁₃

E

₃₇₉

E

₁₂₄

E

₁₉₉

E

₃₉₀

E

₂₉

E

₂₂₀

E

₂₉₅

E

₄₀

E

₆

E

245

E

₂₂₈

E

₂₇₅

E

₃₄₄

E

₁₅

E

51

E

9

E

261

(80)

Diffie-Hellman with CSIDH

Alice Bob

a = [+, −, +, −] b = [+, +, +, −]

E0 E₁₅₈ E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9

E₂₆₁ E₁₅₈ E0

E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9 E₂₆₁

(81)

Diffie-Hellman with CSIDH

Alice Bob

a = [+

↑

, −, +, −] b = [+

↑

, +, +, −]

E0 E₁₅₈ E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9

E₂₆₁ E₁₅₈ E0

E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9 E₂₆₁

(82)

Diffie-Hellman with CSIDH

Alice Bob

a = [+, −

↑

, +, −] b = [+, +

↑

, +, −]

E0 E₁₅₈ E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9

E₂₆₁ E₁₅₈ E0

E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9 E₂₆₁

(83)

Diffie-Hellman with CSIDH

Alice Bob

a = [+, −, +

↑

, −] b = [+, +, +

↑

, −]

E0 E₁₅₈ E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9

E₂₆₁ E₁₅₈ E0

E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9 E₂₆₁

(84)

Diffie-Hellman with CSIDH

Alice Bob

a = [+, −, +, −

↑

] b = [+, +, +, −

↑

]

E0 E₁₅₈ E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9

E₂₆₁ E₁₅₈ E0

E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9 E₂₆₁

(85)

Diffie-Hellman with CSIDH

Alice Bob

a = [+, −, +, −] b = [+, +, +, −]

E₀ E₁₅₈ E₄₁₀ E₃₆₈ E₄₀₄ E₇₅ E₁₄₄ E191 E₁₇₄

E413 E₃₇₉

E124 E₁₉₉

E₃₉₀ E₂₉ E₂₂₀ E295

E₄₀ E6

E₂₄₅ E228 E₂₇₅ E₃₄₄ E₁₅ E₅₁ E₉

E₂₆₁ E₁₅₈ E₀

E₄₁₀ E₃₆₈ E₄₀₄ E₇₅ E₁₄₄ E191 E₁₇₄

E413 E₃₇₉

E124 E₁₉₉

E₃₉₀ E₂₉ E₂₂₀ E295

E₄₀ E6

E₂₄₅ E228 E₂₇₅ E₃₄₄ E₁₅ E₅₁ E₉ E₂₆₁

(86)

Diffie-Hellman with CSIDH

Alice Bob

a = [+

↑

, −, +, −] b = [+

↑

, +, +, −]

E0 E₁₅₈ E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9

E₂₆₁ E₁₅₈ E0

E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9 E₂₆₁

(87)

Diffie-Hellman with CSIDH

Alice Bob

a = [+, −

↑

, +, −] b = [+, +

↑

, +, −]

E0 E₁₅₈ E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9

E₂₆₁ E₁₅₈ E0

E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9 E₂₆₁

(88)

Diffie-Hellman with CSIDH

Alice Bob

a = [+, −, +

↑

, −] b = [+, +, +

↑

, −]

E0 E₁₅₈ E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9

E₂₆₁ E₁₅₈ E0

E410 E₃₆₈ E404 E₇₅ E144 E₁₉₁ E174

E₄₁₃ E₃₇₉

E₁₂₄

E199 E₃₉₀ E₂₉ E220 E₂₉₅

E₄₀ E₆

E245 E₂₂₈ E275 E₃₄₄ E15 E₅₁ E9 E₂₆₁