Further Optimizations of CSIDH: A Systematic Approach to Efficient Strategies, Permutations, and Bound Vectors

Hutchinson, Aaron; LeGrow, Jason T.; Koziel, Brian; Azarderakhsh, Reza

doi:10.1007/978-3-030-57808-4_24

Cited by 19 publications

(46 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We downloaded the original CSIDH software [CLM + 18], all the OAYT-style and dummyfree-style constant-time CSIDH software including [OAYT19], [CCC + 19], [CR20] and [HLKA20]. All the source codes are publicly available.…”

Section: Resultsmentioning

confidence: 99%

“…All the source codes are publicly available. In particular, the source code of [CLM + 18] is available at CSIDH website 12 , while the authors of [CCC + 19], [CR20] and [HLKA20] provided their source code links in their articles. In addition, although the authors of [OAYT19] did not give the link of their source code in the article, we found the source code repository of the implementation in [OAYT19] on GitHub 13 .…”

Section: Resultsmentioning

confidence: 99%

“…Recall from Section 2.2 that the to-date fastest constant-time CSIDH implementations are the two OAYT-style variants of [HLKA20] and [CR20]. According to our measurements of their group action evaluation (see Table 3), the former is 1% faster than the latter.…”

Section: Methods For Batching Csidh Group Actionsmentioning

confidence: 97%

“…Their new algorithms do not rely on the SIMBA approach and provide an improvement of 12.09%, 3.36%, and 10.58% compared to the MCR-, OAYT-, and dummy-free-style implementations of [CCC + 19], respectively. The OAYT-style algorithm of [HLKA20], the MCR-and dummy-free-style algorithms of [CR20] are to date the most efficient constant-time implementations of CSIDH in the literature. These algorithms are further optimized by Adj, Chi-Domínguez, and Rodríguez-Henríquez [ACR20] when applying certain tricks that reduce the computational cost of new Vélu formulae of [BDLS20].…”

Section: Optimization Techniques For Constant-time Csidhmentioning

confidence: 99%

“…However, the downside of CSIDH is that the computation of group actions is very costly, which makes CSIDH extremely slow, not only in relation to X25519 [Ber06] and other pre-quantum ECDH variants, but also when compared to SIKE. For example, while an Intel Skylake processor can execute a variable-base scalar multiplication on Curve25519 in less than 100 k cycles [NS20] and a SIKEp434 encapsulation or decapsulation in about 10 M cycles [JAC + 20], the to-date best constant-time implementation of a CSIDH-512 group action evaluation and key validation requires close to 240 M clock cycles [HLKA20].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Batching CSIDH Group Actions using AVX-512

Cheng

Fotiadis

Großschädl

et al. 2021

TCHES

View full text Add to dashboard Cite

Commutative Supersingular Isogeny Diffie-Hellman (or CSIDH for short) is a recently-proposed post-quantum key establishment scheme that belongs to the family of isogeny-based cryptosystems. The CSIDH protocol is based on the action of an ideal class group on a set of supersingular elliptic curves and comes with some very attractive features, e.g. the ability to serve as a “drop-in” replacement for the standard elliptic curve Diffie-Hellman protocol. Unfortunately, the execution time of CSIDH is prohibitively high for many real-world applications, mainly due to the enormous computational cost of the underlying group action. Consequently, there is a strong demand for optimizations that increase the efficiency of the class group action evaluation, which is not only important for CSIDH, but also for related cryptosystems like the signature schemes CSI-FiSh and SeaSign. In this paper, we explore how the AVX-512 vector extensions (incl. AVX-512F and AVX-512IFMA) can be utilized to optimize constant-time evaluation of the CSIDH-512 class group action with the goal of, respectively, maximizing throughput and minimizing latency. We introduce different approaches for batching group actions and computing them in SIMD fashion on modern Intel processors. In particular, we present a hybrid batching technique that, when combined with optimized (8 × 1)-way prime-field arithmetic, increases the throughput by a factor of 3.64 compared to a state-of-the-art (non-vectorized) x64 implementation. On the other hand, vectorization in a 2-way fashion aimed to reduce latency makes our AVX-512 implementation of the group action evaluation about 1.54 times faster than the state-of-the-art. To the best of our knowledge, this paper is the first to demonstrate the high potential of using vector instructions to increase the throughput (resp. decrease the latency) of constant-time CSIDH.

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Resultsmentioning

confidence: 99%

Section: Methods For Batching Csidh Group Actionsmentioning

confidence: 97%

Section: Optimization Techniques For Constant-time Csidhmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Batching CSIDH Group Actions using AVX-512

Cheng

Fotiadis

Großschädl

et al. 2021

TCHES

View full text Add to dashboard Cite

show abstract

CSIDH on the Surface

Castryck

Decru

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

For primes p ≡ 3 mod 4, we show that setting up CSIDH on the surface, i.e., using supersingular elliptic curves with endomorphism ring Z[(1 + √ −p)/2], amounts to just a few sign switches in the underlying arithmetic. If p ≡ 7 mod 8 then horizontal 2-isogenies can be used to help compute the class group action. The formulas we derive for these 2-isogenies are very efficient (they basically amount to a single exponentiation in Fp) and allow for a noticeable speed-up, e.g., our resulting CSURF-512 protocol runs about 5.68% faster than CSIDH-512. This improvement is completely orthogonal to all previous speed-ups, constanttime measures and construction of cryptographic primitives that have appeared in the literature so far. At the same time, moving to the surface gets rid of the redundant factor Z3 of the acting ideal-class group, which is present in the case of CSIDH and offers no extra security.

show abstract

(Short Paper) Analysis of a Strong Fault Attack on Static/Ephemeral CSIDH

LeGrow

Hutchinson

2021

Advances in Information and Computer Security

View full text Add to dashboard Cite

Further Optimizations of CSIDH: A Systematic Approach to Efficient Strategies, Permutations, and Bound Vectors

Cited by 19 publications

References 12 publications

Batching CSIDH Group Actions using AVX-512

Batching CSIDH Group Actions using AVX-512

CSIDH on the Surface

(Short Paper) Analysis of a Strong Fault Attack on Static/Ephemeral CSIDH

Contact Info

Product

Resources

About