Optimized CSIDH Implementation Using a 2-Torsion Point

Abstract

The implementation of isogeny-based cryptography mainly use Montgomery curves, as they offer fast elliptic curve arithmetic and isogeny computation. However, although Montgomery curves have efficient 3- and 4-isogeny formula, it becomes inefficient when recovering the coefficient of the image curve for large degree isogenies. Because the Commutative Supersingular Isogeny Diffie-Hellman (CSIDH) requires odd-degree isogenies up to at least 587, this inefficiency is the main bottleneck of using a Montgomery curve for CSIDH. In this paper, we present a new optimization method for faster CSIDH protocols entirely on Montgomery curves. To this end, we present a new parameter for CSIDH, in which the three rational two-torsion points exist. By using the proposed parameters, the CSIDH moves around the surface. The curve coefficient of the image curve can be recovered by a two-torsion point. We also proved that the CSIDH while using the proposed parameter guarantees a free and transitive group action. Additionally, we present the implementation result using our method. We demonstrated that our method is 6.4% faster than the original CSIDH. Our works show that quite higher performance of CSIDH is achieved while only using Montgomery curves.

On the Performance Analysis for CSIDH-Based Cryptosystems

“…The first prime p 1 ≡ 3 mod 8, presented in [6], will be used to compare the original CSIDH and Onuki's CSIDH. The second prime p 2 ≡ 7 mod 8, presented in [11], will be used to compare the original CSIDH and CSURF.…”

“…Note that a ± 2 are both square in F p if a ∈ S + p,2 , and a ± 2 are not both square in F p if a ∈ S + p,1 by Theorem 2 in [11]. Assume that we apply above former 4-isogeny.…”

“…Note that the prime p 1 and the initial curve y 2 = x 3 + x are used for implementing the original CSIDH and Onuki's CSIDH, and the prime p 2 and the initial curve y 2 = x 3 − x are used for implementing CSURF. When implementing CSIDH over p 2 , as a rational 2-torsion point exist, the 2-torsion method in [11,16] is used for the implementation. Therefore, for CSIDH over p 2 , the curve y 2 = x 3 + ax 2 + x is used as the initial curve, where a of the initial curve is presented in [11].…”

“…When implementing CSIDH over p 2 , as a rational 2-torsion point exist, the 2-torsion method in [11,16] is used for the implementation. Therefore, for CSIDH over p 2 , the curve y 2 = x 3 + ax 2 + x is used as the initial curve, where a of the initial curve is presented in [11]. We also implement Meyer's hybrid method for a fair comparison.…”