A Faster Software Implementation of the Supersingular Isogeny Diffie-Hellman Key Exchange Protocol

Faz-Hernández, Armando; López, Julio; Ochoa-Jiménez, Eduardo; Rodríguez-Henríquez, Francisco

doi:10.1109/tc.2017.2771535

Cited by 71 publications

(47 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Based on this analysis, we choose Montgomery multiplication to implement SIDHfriendly modular arithmetic, following [CLN16,BF17,FHLOJRH17]. Moreover, we further reduce the complexity of modular multiplication by employing the unified ARM/NEON approach.…”

Section: Modular Multiplication For Sidhmentioning

confidence: 99%

SIDH on ARM: Faster Modular Multiplications for Faster Post-Quantum Supersingular Isogeny Key Exchange

Seo

Liu

Longa

et al. 2018

TCHES

View full text Add to dashboard Cite

We present high-speed implementations of the post-quantum supersingular isogeny Diffie-Hellman key exchange (SIDH) and the supersingular isogeny key encapsulation (SIKE) protocols for 32-bit ARMv7-A processors with NEON support. The high performance of our implementations is mainly due to carefully optimized multiprecision and modular arithmetic that finely integrates both ARM and NEON instructions in order to reduce the number of pipeline stalls and memory accesses, and a new Montgomery reduction technique that combines the use of the UMAAL instruction with a variant of the hybrid-scanning approach. In addition, we present efficient implementations of SIDH and SIKE for 64-bit ARMv8-A processors, based on a high-speed Montgomery multiplication that leverages the power of 64-bit instructions. Our experimental results consolidate the practicality of supersingular isogeny-based protocols for many real-world applications. For example, a full key-exchange execution of SIDHp503 is performed in about 176 million cycles on an ARM Cortex-A15 from the ARMv7-A family (i.e., 88 milliseconds @2.0GHz). On an ARM Cortex-A72 from the ARMv8-A family, the same operation can be carried out in about 90 million cycles (i.e., 45 milliseconds @1.992GHz). All our software is protected against timing and cache attacks. The techniques for modular multiplication presented in this work have broad applications to other cryptographic schemes.

show abstract

Section: Modular Multiplication For Sidhmentioning

confidence: 99%

SIDH on ARM: Faster Modular Multiplications for Faster Post-Quantum Supersingular Isogeny Key Exchange

Seo

Liu

Longa

et al. 2018

TCHES

View full text Add to dashboard Cite

show abstract

“…The first competitive public implementation was due to Costello, Longa, and Naehrig [41]. A lot of effort has since been put into improving the algorithmic and space efficiency of SIDH [40,39,58], and optimizing arithmetic in its specialized finite fields [25,24]. One particlarly nice feature of SIDH in comparison to commutative isogeny DH is that the isogenies in SIDH all have degree either ℓ A or ℓ B ; both are fixed, and typically tiny, so computing the individual isogeny steps is much faster in the supersingular protocol, and requires much less code and precomputation.…”

Section: Supersingular Isogeny Diffie-hellmanmentioning

confidence: 99%

Pre- and Post-quantum Diffie–Hellman from Groups, Actions, and Isogenies

Smith¹

2018

Arithmetic of Finite Fields

View full text Add to dashboard Cite

Diffie-Hellman key exchange is at the foundations of publickey cryptography, but conventional group-based Diffie-Hellman is vulnerable to Shor's quantum algorithm. A range of "post-quantum Diffie-Hellman" protocols have been proposed to mitigate this threat, including the Couveignes, Rostovtsev-Stolbunov, SIDH, and CSIDH schemes, all based on the combinatorial and number-theoretic structures formed by isogenies of elliptic curves. Pre-and post-quantum Diffie-Hellman schemes resemble each other at the highest level, but the further down we dive, the more differences emerge-differences that are critical when we use Diffie-Hellman as a basic component in more complicated constructions. In this survey we compare and contrast pre-and post-quantum Diffie-Hellman algorithms, highlighting some important subtleties.

show abstract

“…Secondly, in the understanding of the concrete security of the computational assumptions [23]. Finally, in the implementation methods for such protocols [15,3,19].…”

Section: Introductionmentioning

confidence: 99%

Semi-commutative Masking: A Framework for Isogeny-Based Protocols, with an Application to Fully Secure Two-Round Isogeny-Based OT

Guilhem

Orsini

Petit

et al. 2020

Cryptology and Network Security

View full text Add to dashboard Cite

We define semi-commutative invertible masking structures which aim to capture the methodology of exponentiation-only protocol design (such as discrete logarithm and isogeny-based cryptography). We give an instantiation based on the semi-commutative action of isogenies of supersingular elliptic curves, in the style of the SIDH key-exchange protocol. We then construct an oblivious transfer protocol using this new structure and prove that it UC-securely realises the oblivious transfer functionality in the random-oracle-hybrid model against passive adversaries with static corruptions. Moreover, we show that it satisfies the security properties required by the compiler of Döttling et al. (Eurocrypt 2020), achieving the first fully UC-secure two-round OT protocol based on supersingular isogenies.

show abstract

A Faster Software Implementation of the Supersingular Isogeny Diffie-Hellman Key Exchange Protocol

Cited by 71 publications

References 18 publications

SIDH on ARM: Faster Modular Multiplications for Faster Post-Quantum Supersingular Isogeny Key Exchange

SIDH on ARM: Faster Modular Multiplications for Faster Post-Quantum Supersingular Isogeny Key Exchange

Pre- and Post-quantum Diffie–Hellman from Groups, Actions, and Isogenies

Semi-commutative Masking: A Framework for Isogeny-Based Protocols, with an Application to Fully Secure Two-Round Isogeny-Based OT

Contact Info

Product

Resources

About