On the Security of OSIDH

Dartois, Pierrick; Feo, Luca De

doi:10.1007/978-3-030-97121-2_3

Cited by 8 publications

(8 citation statements)

References 39 publications

(60 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other related work includes [9,20]. In [2], the authors of the present article show that appropriately defined closed walks of the isogeny graph are in bijection with the rims of oriented isogeny volcanoes, giving a class number sum for their number.…”

Section: Related Workmentioning

confidence: 77%

“…The study of orientations provides some structure to the supersingular isogeny graph, which has recently been exploited [15,20,43]. In particular, the -isogeny graph of oriented supersingular elliptic curves over F p has a volcano structure familiar from the ordinary case: Each connected component consists of a single cycle, called a rim, of vertices connected by horizontal edges, and descending edges connecting the rim the non-rim vertices at lower altitudes of the volcano.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Orienteering with One Endomorphism

et al. 2023

View full text Add to dashboard Cite

In supersingular isogeny-based cryptography, the path-finding problem reduces to the endomorphism ring problem. Can path-finding be reduced to knowing just one endomorphism? It is known that a small degree endomorphism enables polynomial-time path-finding and endomorphism ring computation (in: Love and Boneh, ANTS XIV-Proceedings of the Fourteenth Algorithmic Number Theory Symposium, volume 4 of Open Book Ser. Math. Sci. Publ., Berkeley, 2020). An endomorphism gives an explicit orientation of a supersingular elliptic curve. In this paper, we use the volcano structure of the oriented supersingular isogeny graph to take ascending/descending/horizontal steps on the graph and deduce path-finding algorithms to an initial curve. Each altitude of the volcano corresponds to a unique quadratic order, called the primitive order. We introduce a new hard problem of computing the primitive order given an arbitrary endomorphism on the curve, and we also provide a sub-exponential quantum algorithm for solving it. In concurrent work (in: Wesolowski, Advances in cryptology-EUROCRYPT 2022, volume 13277 of Lecture Notes in Computer Science. Springer, Cham, 2022), it was shown that the endomorphism ring problem in the presence of one endomorphism with known primitive order reduces to a vectorization problem, implying path-finding algorithms. Our path-finding algorithms are more general in the sense that we don’t assume the knowledge of the primitive order associated with the endomorphism.

show abstract

Section: Related Workmentioning

confidence: 77%

Section: Introductionmentioning

confidence: 99%

Orienteering with One Endomorphism

et al. 2023

View full text Add to dashboard Cite

show abstract

“…OSIDH provides a convenient unifying framework for CRS and CSIDH, but also contains many new families of potential cryptographic interest. While the original Colò-Kohel proposal does not seem viable [14], a more recent proposal [15] looks promising.…”

Section: Introductionmentioning

confidence: 99%

Weak Instances of Class Group Action Based Cryptography via Self-pairings

Castryck,

Houben,

Merz

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this paper we study non-trivial self-pairings with cyclic domains that are compatible with isogenies between elliptic curves oriented by an imaginary quadratic order O. We prove that the order m of such a self-pairing necessarily satisfies m | ∆O (and even 2m | ∆O if 4 | ∆O and 4m | ∆O if 8 | ∆O) and is not a multiple of the field characteristic. Conversely, for each m satisfying these necessary conditions, we construct a family of non-trivial cyclic self-pairings of order m that are compatible with oriented isogenies, based on generalized Weil and Tate pairings.As an application, we identify weak instances of class group actions on elliptic curves assuming the degree of the secret isogeny is known. More in detail, we show that if m 2 | ∆O for some prime power m then given two primitively O-oriented elliptic curves (E, ι) and (E ′ , ι ′ ) = [a](E, ι) connected by an unknown invertible ideal a ⊆ O, we can recover a essentially at the cost of a discrete logarithm computation in a group of order m 2 , assuming the norm of a is given and is smaller than m 2 . We give concrete instances, involving ordinary elliptic curves over finite fields, where this turns into a polynomial time attack. Finally, we show that these self-pairings simplify known results on the decisional Diffie-Hellman problem for class group actions on oriented elliptic curves.

show abstract

“…More generally oriented supersingular elliptic curves made their first cryptographic appearance in the OSIDH protocol due to Colò and Kohel [10]. To date, this protocol remains largely theoretical, but it has attracted a good amount of recent interest, see e.g., [13,22,31].…”

Section: Introductionmentioning

confidence: 99%

On the decisional Diffie–Hellman problem for class group actions on oriented elliptic curves

et al. 2022

View full text Add to dashboard Cite

We show how the Weil pairing can be used to evaluate the assigned characters of an imaginary quadratic order $${\mathcal {O}}$$ O in an unknown ideal class $$[{\mathfrak {a}}] \in {{\,\textrm{cl}\,}}({\mathcal {O}})$$ [ a ] ∈ cl ( O ) that connects two given $${\mathcal {O}}$$ O -oriented elliptic curves $$(E, \iota )$$ ( E , ι ) and $$(E', \iota ') = [{\mathfrak {a}}](E, \iota )$$ ( E ′ , ι ′ ) = [ a ] ( E , ι ) . When specialized to ordinary elliptic curves over finite fields, our method is conceptually simpler and often somewhat faster than a recent approach due to Castryck, Sotáková and Vercauteren, who rely on the Tate pairing instead. The main implication of our work is that it breaks the decisional Diffie–Hellman problem for practically all oriented elliptic curves that are acted upon by an even-order class group. It can also be used to better handle the worst cases in Wesolowski’s recent reduction from the vectorization problem for oriented elliptic curves to the endomorphism ring problem, leading to a method that always works in sub-exponential time.

show abstract

On the Security of OSIDH

Cited by 8 publications

References 39 publications

Orienteering with One Endomorphism

Orienteering with One Endomorphism

Weak Instances of Class Group Action Based Cryptography via Self-pairings

On the decisional Diffie–Hellman problem for class group actions on oriented elliptic curves

Contact Info

Product

Resources

About