Quantum Security Analysis of CSIDH

Abstract

CSIDH is a recent proposal for post-quantum non-interactive key-exchange, based on supersingular elliptic curve isogenies. It is similar in design to a previous scheme by Couveignes, Rostovtsev and Stolbunov, but aims at an improved balance between efficiency and security. In the proposal, the authors suggest concrete parameters in order to meet some desired levels of quantum security. These parameters are based on the hardness of recovering a hidden isogeny between two elliptic curves, using a quantum subexponential algorithm of Childs, Jao and Soukharev. This algorithm combines two building blocks: first, a quantum algorithm for recovering a hidden shift in a commutative group. Second, a computation in superposition of all isogenies originating from a given curve, which the algorithm calls as a black box. In this paper, we give a comprehensive security analysis of CSIDH. Our first step is to revisit three quantum algorithms for the abelian hidden shift problem from the perspective of non-asymptotic cost, with trade-offs between their quantum and classical complexities. Second, we complete the non-asymptotic study of the black box in the hidden shift algorithm. We give a quantum procedure that evaluates CSIDH-512 using less than 40 000 logical qubits. This allows us to show that the parameters proposed by the authors of CSIDH do not meet their expected quantum security.

One-Way Functions and Malleability Oracles: Hidden Shift Attacks on Isogeny-Based Protocols

“…Let F q be a finite field of characteristic p. In the following we assume p ≥ 3 and therefore an elliptic curve E over F q can be defined by its short Weierstrass form 3 . The set of points on an elliptic curve is an abelian group under the "chord and tangent rule" with O E being the identity element.…”

“…There have been multiple proposals to attack concrete parameter suggestions for CSIDH with quantum algorithms. Peikert [25] uses Kuperberg's collimation sieve algorithm to solve the hidden shift instance with quantum accessible classical memory and subexponential quantum time, a strategy independently also explored by Bonnetain-Schrottenloher [3].…”

“…We describe our new attack as a special instance of a general framework. This allows us to unify other quantum attacks on isogeny-based schemes such as the one due to Childs, Jao and Soukharev [7] constructing isogenies between ordinary curves or a similar application of Kuperberg's hidden shift algorithm to CSIDH [5], which has recently been improved by Bonnetain-Schrottenloher [3] and by Peikert [25].…”

Cryptographic Group Actions and Applications

“…While it is clear that the approach taken by CSI-FiSh to build a full-fledged cryptographic group action greatly extends the capabilities of isogeny-based cryptography, recent results [Pei20,BS20] showed quantum attacks against CSIDH for certain choices of parameters. Unfortunately, computing the group structure of a significantly larger class group seems out of reach today, owing to the subexponential complexity of the classical algorithms available.…”

On the Performance Analysis for CSIDH-Based Cryptosystems

“…In this case, we must choose the prime having those factors. The advantage of this method is that we can expect that CSIDH protocols to have a certain level of the resistance for subexponential quantum attack [2,17,18] by expanding the size of the base field.…”