Semi-commutative Masking: A Framework for Isogeny-Based Protocols, with an Application to Fully Secure Two-Round Isogeny-Based OT

Abstract

We define semi-commutative invertible masking structures which aim to capture the methodology of exponentiation-only protocol design (such as discrete logarithm and isogeny-based cryptography). We give an instantiation based on the semi-commutative action of isogenies of supersingular elliptic curves, in the style of the SIDH key-exchange protocol. We then construct an oblivious transfer protocol using this new structure and prove that it UC-securely realises the oblivious transfer functionality in the random-oracle-hybrid model against passive adversaries with static corruptions. Moreover, we show that it satisfies the security properties required by the compiler of Döttling et al. (Eurocrypt 2020), achieving the first fully UC-secure two-round OT protocol based on supersingular isogenies.

Simple Two-Message OT in the Explicit Isogeny Model

“…In [DOPS20], the authors introduce the concept of masking, which generalizes the one of hard homogeneous spaces. The paper contains two passively secure OT protocols, one with two rounds, derived from the Shamir-3-Pass key transportation scheme, and the other with three rounds derived from the CO protocol.…”

“…As mentioned before, the protocols are based on masking assumptions, ParallelEither, ParallelBoth and ParallelDouble, that can be instantiated with isogeny-based assumptions. The ParallelEither asks for either g ab or g a/b given g a , g b ; the ParallelBoth asks for g ba0/a1 or g ba1/a0 given g a0 , g a1 , g b ; the ParallelDouble asks for g ac and g bc given g a , g b , g c and a one-time access to an oracle that exponentiates by c. We refer to [DOPS20] for additional details.…”

On the Security of OSIDH

“…The invention of CSIDH 3 [13], the first efficient post-quantum group action, spurred a wave of interest on the topic. Among the many applications of CSIDH, we may cite the signature scheme CSI-FiSh [7], threshold [21] and ring [6] signatures, oblivious transfer [22,33], oblivious PRFs [8] and hash proof systems [2]. As of today, all known post-quantum group actions are obtained from isogenies of elliptic curves, either ordinary or supersingular, and are all understood as instances of the celebrated theory of complex multiplication.…”