A Constant-Time Algorithm of CSIDH Keeping Two Points

Abstract

Hiroshi ONUKI †a) , Yusuke AIKAWA † †b) , Tsutomu YAMAZAKI † † †c) , Nonmembers, and Tsuyoshi TAKAGI †d) , Member SUMMARY At ASIACRYPT 2018, Castryck, Lange, Martindale, Panny and Renes proposed CSIDH, which is a key-exchange protocol based on isogenies between elliptic curves, and a candidate for postquantum cryptography. However, the implementation by Castryck et al. is not constant-time. Specifically, a part of the secret key could be recovered by the side-channel attacks. Recently, Meyer, Campos, and Reith proposed a constant-time implementation of CSIDH by introducing dummy isogenies and taking secret exponents only from intervals of non-negative integers. Their non-negative intervals make the calculation cost of their implementation of CSIDH twice that of the worst case of the standard (variabletime) implementation of CSIDH. In this paper, we propose a more efficient constant-time algorithm that takes secret exponents from intervals symmetric with respect to the zero. For using these intervals, we need to keep two torsion points on an elliptic curve and calculation for these points. We evaluate the costs of our implementation and that of Meyer et al. in terms of the number of operations on a finite prime field. Our evaluation shows that our constant-time implementation of CSIDH reduces the calculation cost by 28% compared with the implementation by Mayer et al. We also implemented our algorithm by extending the implementation in C of Meyer et al. (originally from Castryck et al.). Then our implementation achieved 152 million clock cycles, which is about 29% faster than that of Meyer et al. and confirms the above reduction ratio in our cost evaluation.

Practical Usage of Radical Isogenies for CSIDH

“…The meet-in-the-middle type of attack is the best-known classical attack; thus, based on the complexity of this attack, the number of primes to be used varies according to the maximum value of the private key exponent. For example, for a constant-time CSIDH using the method in [19], if the maximum value of the private key exponent is 5, then we can use the 64 smallest primes. If the maximum value of the private key exponent is 1, then we can use the 139 smallest primes.…”

“…If the maximum value of the private key exponent is 1, then we can use the 139 smallest primes. The group action of CSIDH-4096 using the method in [19] takes approximately 23 gigacycles. For details on the quantum analysis, please refer to [5].…”