Stronger and Faster Side-Channel Protections for CSIDH

Cervantes-Vázquez, Daniel; Chenu, Mathilde; Chi-Domínguez, Jesús-Javier; Feo, Luca De; Rodríguez-Henríquez, Francisco; Smith, Benjamin

doi:10.1007/978-3-030-30530-7_9

Cited by 37 publications

(72 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We stress that this improvement is totally orthogonal to all previous speed-ups, constant-time measures (see e.g. [9,15]) and cryptographic applications (see e.g. [7,4,11]) that have appeared in the literature so far.…”

Section: Contributionsmentioning

confidence: 61%

CSIDH on the Surface

Castryck

Decru

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

For primes p ≡ 3 mod 4, we show that setting up CSIDH on the surface, i.e., using supersingular elliptic curves with endomorphism ring Z[(1 + √ −p)/2], amounts to just a few sign switches in the underlying arithmetic. If p ≡ 7 mod 8 then horizontal 2-isogenies can be used to help compute the class group action. The formulas we derive for these 2-isogenies are very efficient (they basically amount to a single exponentiation in Fp) and allow for a noticeable speed-up, e.g., our resulting CSURF-512 protocol runs about 5.68% faster than CSIDH-512. This improvement is completely orthogonal to all previous speed-ups, constanttime measures and construction of cryptographic primitives that have appeared in the literature so far. At the same time, moving to the surface gets rid of the redundant factor Z3 of the acting ideal-class group, which is present in the case of CSIDH and offers no extra security.

show abstract

Section: Contributionsmentioning

confidence: 61%

CSIDH on the Surface

Castryck

Decru

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…For future work, we plan to study a potential attack against CSIDH-based algorithms with the collisions presented in this paper. Additionally, we plan to implement an optimized algorithm for each form of base primes and to provide more obvious standards for parameter selection by applying the various optimization methods as in [19][20][21].…”

Section: Discussionmentioning

confidence: 99%

“…We do not apply other technical optimization methods like SIMBA [19], new addition chains for a scalar multiplication [20], and Velusqrt algorithm [21]. This is because we intend to present the comparison results of primitive algorithms as possible.…”

Section: Remarkmentioning

confidence: 99%

On the Performance Analysis for CSIDH-Based Cryptosystems

et al. 2020

View full text Add to dashboard Cite

In this paper, we present the performance and security analysis for various commutative SIDH (CSIDH)-based algorithms. As CSIDH offers a smaller key size than SIDH and provides a relatively efficient signature scheme, numerous CSIDH-based key exchange algorithms have been proposed to optimize the CSIDH. In CSIDH, the private key is an ideal class in a class group, which can be represented by an integer vector. As the number of ideal classes represented by these vectors determines the security level of CSIDH, it is important to analyze whether the different vectors induce the same public key. In this regard, we generalize the existence of a collision for a base prime p≡7mod8. Based on our result, we present a new interval for the private key to have a similar security level for the various CSIDH-based algorithms for a fair comparison of the performance. Deduced from the implementation result, we conclude that for a prime p≡7mod8, CSIDH on the surface using the Montgomery curves is the most likely to be efficient. For a prime p≡3mod8, CSIDH on the floor using the hybrid method with Onuki’s collision-free method is the most likely to be efficient and secure.

show abstract

“…Recently, Cervantes-Vázquez, Chenu, Chi-Domínguez, De Feo, Rodríguez-Henríquez, and Smith [20] proposed a new constant-time CSIDH resistant against a fault injection attack, which uses our method that keeps two torsion points. Furtheremore, they proposed speedup techniques for CSIDH and reported that the cost of our algorithm can be reduced by about 12% by using their speedup techniques.…”

Section: Related Workmentioning

confidence: 99%

“…Cervantes-Vázquez et al [20] pointed out that the implementation of Elligator in [17] is not correct in the sense of constant-time, since it does not use randomness. However, this can be easily fixed.…”

Section: Remarkmentioning

confidence: 99%

A Constant-Time Algorithm of CSIDH Keeping Two Points

Onuki

Aikawa

Yamazaki

et al. 2020

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

Hiroshi ONUKI †a) , Yusuke AIKAWA † †b) , Tsutomu YAMAZAKI † † †c) , Nonmembers, and Tsuyoshi TAKAGI †d) , Member SUMMARY At ASIACRYPT 2018, Castryck, Lange, Martindale, Panny and Renes proposed CSIDH, which is a key-exchange protocol based on isogenies between elliptic curves, and a candidate for postquantum cryptography. However, the implementation by Castryck et al. is not constant-time. Specifically, a part of the secret key could be recovered by the side-channel attacks. Recently, Meyer, Campos, and Reith proposed a constant-time implementation of CSIDH by introducing dummy isogenies and taking secret exponents only from intervals of non-negative integers. Their non-negative intervals make the calculation cost of their implementation of CSIDH twice that of the worst case of the standard (variabletime) implementation of CSIDH. In this paper, we propose a more efficient constant-time algorithm that takes secret exponents from intervals symmetric with respect to the zero. For using these intervals, we need to keep two torsion points on an elliptic curve and calculation for these points. We evaluate the costs of our implementation and that of Meyer et al. in terms of the number of operations on a finite prime field. Our evaluation shows that our constant-time implementation of CSIDH reduces the calculation cost by 28% compared with the implementation by Mayer et al. We also implemented our algorithm by extending the implementation in C of Meyer et al. (originally from Castryck et al.). Then our implementation achieved 152 million clock cycles, which is about 29% faster than that of Meyer et al. and confirms the above reduction ratio in our cost evaluation.

show abstract

Stronger and Faster Side-Channel Protections for CSIDH

Cited by 37 publications

References 24 publications

CSIDH on the Surface

CSIDH on the Surface

On the Performance Analysis for CSIDH-Based Cryptosystems

A Constant-Time Algorithm of CSIDH Keeping Two Points

Contact Info

Product

Resources

About