On the Isogeny Problem with Torsion Point Information

Fouotsa, Tako Boris; Kutas, Péter; Merz, Simon-Philipp; Ti, Yan Bo

doi:10.1007/978-3-030-97121-2_6

Cited by 18 publications

(16 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…On one hand, we have the problem of computing endomorphism rings of supersingular elliptic curves. It is of foundational importance to the field, as its presumed hardness is necessary for the security of essentially all isogeny-based cryptosystems [7,16,17]. Oriented versions of this Endomorphism Ring Problem were introduced in [31].…”

Section: Applications and Implicationsmentioning

confidence: 99%

“…This endomorphism ring problem is of foundational importance to isogeny-based cryptography: it is presumed to be hard, and this hardness is necessary (and sometimes sufficient) for the security of essentially all isogeny-based protocols [7,16,17]. It does not, however, capture well the notion of orientation, which plays an important role in many protocols.…”

Section: The Supersingular Endomorphism Ring Problemmentioning

confidence: 99%

See 1 more Smart Citation

On the decisional Diffie–Hellman problem for class group actions on oriented elliptic curves

et al. 2022

View full text Add to dashboard Cite

We show how the Weil pairing can be used to evaluate the assigned characters of an imaginary quadratic order $${\mathcal {O}}$$ O in an unknown ideal class $$[{\mathfrak {a}}] \in {{\,\textrm{cl}\,}}({\mathcal {O}})$$ [ a ] ∈ cl ( O ) that connects two given $${\mathcal {O}}$$ O -oriented elliptic curves $$(E, \iota )$$ ( E , ι ) and $$(E', \iota ') = [{\mathfrak {a}}](E, \iota )$$ ( E ′ , ι ′ ) = [ a ] ( E , ι ) . When specialized to ordinary elliptic curves over finite fields, our method is conceptually simpler and often somewhat faster than a recent approach due to Castryck, Sotáková and Vercauteren, who rely on the Tate pairing instead. The main implication of our work is that it breaks the decisional Diffie–Hellman problem for practically all oriented elliptic curves that are acted upon by an even-order class group. It can also be used to better handle the worst cases in Wesolowski’s recent reduction from the vectorization problem for oriented elliptic curves to the endomorphism ring problem, leading to a method that always works in sub-exponential time.

show abstract

Section: Applications and Implicationsmentioning

confidence: 99%

Section: The Supersingular Endomorphism Ring Problemmentioning

confidence: 99%

On the decisional Diffie–Hellman problem for class group actions on oriented elliptic curves

et al. 2022

View full text Add to dashboard Cite

show abstract

“…The main idea of Ref. [38] is that one can exploit the torsion information provided to generalise the attack from Ref. [8] to a wide variety of parameters.…”

Section: Reduction To the Endomorphism Ring Computation Problemmentioning

confidence: 99%

“…Using the torsion information provided, one can determine x i modulo B by solving a system of linear equations (we omit several technical difficulties here for which the reader is referred to Ref. [38]). Why is this information useful?…”

Section: Reduction To the Endomorphism Ring Computation Problemmentioning

confidence: 99%

See 1 more Smart Citation

Torsion point attacks on ‘SIDH‐like’ cryptosystems

Kutas

Petit

2022

IET Information Security

View full text Add to dashboard Cite

Isogeny-based cryptography is a promising approach for postquantum cryptography. The best-known protocol following that approach is the supersingular isogeny Diffie-Hellman protocol (SIDH); this protocol was turned into the CCA-secure key encapsulation mechanism SIKE, which was submitted to and remains in the third round of NIST's post-quantum standardization process as an "alternate" candidate. Isogeny-based cryptography generally relies on the conjectured hardness of computing an isogeny between two isogenous elliptic curves, and most cryptanalytic work referenced on SIKE's webpage exclusively focuses on that problem. Interestingly, the hardness of this problem is sufficient for neither SIDH nor SIKE. In particular, these protocols reveal additional information on the secret isogeny, in the form of images of specific torsion points through the isogeny. This paper surveys existing cryptanalysis approaches exploiting this often called "torsion point information", summarizes their current impact on SIKE and related algorithms, and suggests some research directions that might lead to further impact.

show abstract

Improved Torsion-Point Attacks on SIDH Variants

Quehen¹,

Kutas

Leonardi³

et al. 2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Where a licence is displayed above, please note the terms and conditions of the licence govern your use of this document.When citing, please reference the published version. Take down policy While the University of Birmingham exercises care and attention in making items available there are rare occasions when an item has been uploaded in error or has been deemed to be commercially or otherwise sensitive.

show abstract

On the Isogeny Problem with Torsion Point Information

Cited by 18 publications

References 22 publications

On the decisional Diffie–Hellman problem for class group actions on oriented elliptic curves

On the decisional Diffie–Hellman problem for class group actions on oriented elliptic curves

Torsion point attacks on ‘SIDH‐like’ cryptosystems

Improved Torsion-Point Attacks on SIDH Variants

Contact Info

Product

Resources

About