Verifiable Delay Functions from Supersingular Isogenies and Pairings

Feo, Luca De; Masson, Simon; Petit, Christophe; Sanso, Antonio

doi:10.1007/978-3-030-34578-5_10

Cited by 78 publications

(50 citation statements)

References 54 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[9,15]) and cryptographic applications (see e.g. [7,4,11]) that have appeared in the literature so far.…”

Section: Contributionsmentioning

confidence: 99%

“…The main appeal of hard homogeneous spaces lies in their potential for post-quantum cryptography: while exponentiation-based Diffie-Hellman succumbs to Shor's polynomial-time quantum algorithm [22], in this more general setting the best attack available is Kuperberg's subexponential-time algorithm for finding hidden shifts [16]. This line of research has led to a number of efficient post-quantum cryptographic primitives, such as non-interactive key exchange [7] and digital signatures [4], which stand out in terms of bandwidth requirements, and verifiable delay functions [11].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

CSIDH on the Surface

Castryck

Decru

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

For primes p ≡ 3 mod 4, we show that setting up CSIDH on the surface, i.e., using supersingular elliptic curves with endomorphism ring Z[(1 + √ −p)/2], amounts to just a few sign switches in the underlying arithmetic. If p ≡ 7 mod 8 then horizontal 2-isogenies can be used to help compute the class group action. The formulas we derive for these 2-isogenies are very efficient (they basically amount to a single exponentiation in Fp) and allow for a noticeable speed-up, e.g., our resulting CSURF-512 protocol runs about 5.68% faster than CSIDH-512. This improvement is completely orthogonal to all previous speed-ups, constanttime measures and construction of cryptographic primitives that have appeared in the literature so far. At the same time, moving to the surface gets rid of the redundant factor Z3 of the acting ideal-class group, which is present in the case of CSIDH and offers no extra security.

show abstract

“…[9,15]) and cryptographic applications (see e.g. [7,4,11]) that have appeared in the literature so far.…”

Section: Contributionsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

CSIDH on the Surface

Castryck

Decru

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…VDFs were first introduced by Boneh et al [6] in 2018, and have since received increased attention from other researchers (see, e.g., [6], [46], [39], [7], [20], [32], [44], [25], [24], [34]). As introduced by Boneh et al [6], [7], a VDF is a function f : X → Y which maps every input x ∈ X to an unique output y ∈ Y. Computing the VDF is sequential in the sense that it takes a prescribed amount of time, whether or not it is executed on multiple processors.…”

Section: A Backgroundmentioning

confidence: 99%

RandRunner: Distributed Randomness from Trapdoor VDFs with Strong Uniqueness

Schindler

Judmayer

Hittmeir

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Generating randomness collectively has been a long standing problem in distributed computing. It plays a critical role not only in the design of state-of-the-art Byzantine faulttolerant (BFT) and blockchain protocols, but also for a range of applications far beyond this field. We present RandRunner, a random beacon protocol with a unique set of guarantees that targets a realistic system model. Our design avoids the necessity of a (BFT) consensus protocol and its accompanying high complexity and communication overhead. We achieve this by introducing a novel extension to verifiable delay functions (VDFs) in the RSA setting that does not require a trusted dealer or distributed key generation (DKG) and only relies on well studied cryptographic assumptions. This design allows RandRunner to tolerate adversarial or failed leaders while guaranteeing safety and liveness of the protocol despite possible periods of asynchrony.

show abstract

“…Known constructions not related to group actions include primitives such as public-key encryption [JD11,AKC + 17], ephemeral key exchange [JD11], (efficient) interactive zero-knowledge protocols and signatures [DJP14,YAJ + 17,GPS17], collision-resistant hash functions [CLG09], multi-round UC-secure oblivious transfer against passive corruptions [BOB18,dOPS18,Vit19], and verifiable delay functions [DMPS19].…”

Section: Isogeny-based Cryptographymentioning

confidence: 99%