Disorientation Faults in CSIDH

Abstract

We investigate a new class of fault-injection attacks against the CSIDH family of cryptographic group actions. Our disorientation attacks effectively flip the direction of some isogeny steps. We achieve this by faulting a specific subroutine, connected to the Legendre symbol or Elligator computations performed during the evaluation of the group action. These subroutines are present in almost all known CSIDH implementations. Post-processing a set of faulty samples allows us to infer constraints on the secret key. The details are implementation specific, but we show that in many cases, it is possible to recover the full secret key with only a modest number of successful fault injections and modest computational resources. We provide full details for attacking the original CSIDH proof-of-concept software as well as the CTIDH constant-time * Author list in alphabetical order; see https://ams.org/profession/leaders/ CultureStatement04.pdf.

Towards a Quantum-Resistant Weak Verifiable Delay Function

“…In protocols such as CSIDH, this is typically done by using x-only arithmetic as described here, followed by a square check for the y-coordinate to see on which curve the point is. Given that a square check is much more expensive over F p k than over F p for large k, one can instead opt to use the Elligator point sampling method (see for example [38,3]). Indeed, as our protocol does not need to differentiate between the ℓ-torsion point on the curve and the one on the twist, we can simply compute both simultaneously.…”