Karatsuba-based square-root Vélu’s formulas applied to two isogeny-based protocols

Adj, Gora; Chi-Domínguez, Jesús-Javier; Rodríguez-Henríquez, Francisco

doi:10.1007/s13389-022-00293-y

Cited by 11 publications

(32 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Loop-abort faults on the SIDH cryptosystem [25], discussed for CSIDH in [10], lead to leakage of an intermediate value of the computation rather than the final result. Replacing torsion points with other points in SIDH [36,37] can be used to recover the secret keys; faulting intermediate curves in SIDH [2] to learn if secret isogeny paths lead over subfield curves can also leak information on secret keys. But the two latter attacks cannot be mounted against CSIDH due to the structural and mathematical differences between SIDH and CSIDH.…”

Section: Related Workmentioning

confidence: 99%

“…Hence, s = 1 when z is a square and s = −1 when z is not a square. Many implementations simply compute s ← z p−1 2 . A successful fault injection in the computation z ← x 3 + Ax 2 + x, by skipping an instruction or changing the value randomly, ensures random input to IsSquare and so in about half of the cases the output will be flipped by s → −s.…”

Section: Square Checkmentioning

confidence: 99%

“…i * E t , where S t ⊂ S r,+ is determined by the order of P t . As P t is a randomly sampled point, it has probability ℓi−1 ℓi that its order is divisible by ℓ i , and so probability 1 ℓi that its order is not divisible by ℓ i . This gives us directly the probability to end up at E t : the order of the point P t should be divisible by all ℓ i for i ∈ S t , but not by those ℓ i for i ∈ S r,+ \ S t .…”

Section: Round-r Faulty Curvesmentioning

confidence: 99%

“…In this section, we discuss some of the other implementations of CSIDH: all of these use IsSquare checks in the process of point sampling and are vulnerable to our attack. We analyze SIMBA [30], dummy-free implementations [1,16,18], and SQALE [17]. SIMBA.…”

Section: Other Variants Of Csidhmentioning

confidence: 99%

See 3 more Smart Citations

Disorientation Faults in CSIDH

Banegas

Krämer

Lange

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We investigate a new class of fault-injection attacks against the CSIDH family of cryptographic group actions. Our disorientation attacks effectively flip the direction of some isogeny steps. We achieve this by faulting a specific subroutine, connected to the Legendre symbol or Elligator computations performed during the evaluation of the group action. These subroutines are present in almost all known CSIDH implementations. Post-processing a set of faulty samples allows us to infer constraints on the secret key. The details are implementation specific, but we show that in many cases, it is possible to recover the full secret key with only a modest number of successful fault injections and modest computational resources. We provide full details for attacking the original CSIDH proof-of-concept software as well as the CTIDH constant-time * Author list in alphabetical order; see https://ams.org/profession/leaders/ CultureStatement04.pdf.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Square Checkmentioning

confidence: 99%

Section: Round-r Faulty Curvesmentioning

confidence: 99%

Section: Other Variants Of Csidhmentioning

confidence: 99%

See 2 more Smart Citations

Disorientation Faults in CSIDH

Banegas

Krämer

Lange

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…√ élu's formula Bernsterin et al first proposed efficiently methods for calculating high-degree isogenies using the resultants, called √ élu's formula [6]. Example 4.4] (see also [12]).…”

Section: 3mentioning

confidence: 99%

Explicit construction of the square-root Vélu's formula on Edwards curves

2022

View full text Add to dashboard Cite

The square-root Vélu's formula ( √ élu's formula) is known to be effective way to speed up the computations of higher-degree isogeny used for isogeny-based cryptosystems such as CSIDH and B-SIDH. The original formula was proposed using Montgomery curves, and Moriya et al. then extended it to Edwards curves without specific construction method. In this study, we explicitly show how to construct √ élu's formula on Edwards curves. In particular, we provide a method for adjusting for the differences between two resultants. We also compare the computational complexity with the original √ élu's formula and find that it is up to 8% faster.

show abstract

Fully Projective Radical Isogenies in Constant-Time

Chi-Domínguez

Reijnders

2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

At PQCrypto-2020, Castryck and Decru proposed CSURF (CSIDH on the surface) as an improvement to the CSIDH protocol. Soon after that, at Asiacrypt-2020, together with Vercauteren they introduced radical isogenies as a further improvement. The main improvement in these works is that both CSURF and radical isogenies require only one torsion point to initiate a chain of isogenies, in comparison to Vélu isogenies which require a torsion point per isogeny. Both works were implemented using non-constant-time techniques, however, in a realistic scenario, a constant-time implementation is necessary to mitigate risks of timing attacks. The analysis of constant-time CSURF and radical isogenies was left as an open problem by Castryck, Decru, and Vercauteren. In this work we analyze this problem. A straightforward constant-time implementation of CSURF and radical isogenies encounters too many issues to be cost effective, but we resolve some of these issues with new optimization techniques. We introduce projective radical isogenies to save costly inversions and present a hybrid strategy for integration of radical isogenies in CSIDH implementations. These improvements make radical isogenies almost twice as efficient in constant-time, in terms of finite field multiplications. Using these improvements, we then measure the algorithmic performance in a benchmark of CSIDH, CSURF and CRADS (an implementation using radical isogenies) for different prime sizes. Our implementation provides a more accurate comparison between CSIDH, CSURF and CRADS than the original benchmarks, by using state-ofthe-art techniques for all three implementations. Our experiments illustrate that the speed-up of constant-time CSURF-512 with radical isogenies is reduced to about 3% in comparison to the fastest state-of-the-art constant-time CSIDH-512 implementation. The performance is worse for larger primes, as radical isogenies scale worse than Vélu isogenies.

show abstract

Karatsuba-based square-root Vélu’s formulas applied to two isogeny-based protocols

Cited by 11 publications

References 26 publications

Disorientation Faults in CSIDH

Disorientation Faults in CSIDH

Explicit construction of the square-root Vélu's formula on Edwards curves

Fully Projective Radical Isogenies in Constant-Time

Contact Info

Product

Resources

About