Faulty isogenies: a new kind of leakage

Abstract

In SIDH and SIKE protocols, public keys are defined over quadratic extensions of prime fields. We present in this work a projective invariant property characterizing affine Montgomery curves defined over prime fields. We then force a secret 3-isogeny chain to repeatedly pass through a curve defined over a prime field in order to exploit the new property and inject zeros in the A-coefficient of an intermediate curve to successfully recover the isogeny chain one step at a time. Our results introduce a new kind of fault attacks applicable to SIDH and SIKE.

Torsion point attacks on ‘SIDH‐like’ cryptosystems

“…Recently, there have been further advances in side-channel attacks (and protection) against implementations of SIDH. The reader is referred to [1,17,28,43] for more information.…”