Optimal strategies for computation of degree $\ell^n$ isogenies for SIDH

Authors

Abstract

This article presents methods and algorithms for the computation of isogenies of degree $\ell^n$. Some of these methods are obtained using recurrence equations and generating functions. A standard multiplication based algorithm for computation of isogeny of degree $\ell^n$ has time complexity equal to $O(n^2 M \left(n \log{n} \right) )$, where $M(N)$ denotes the cost of integers of size $N$ multiplication. The memory complexity of this algorithm is equal to $O\left( n \log{\left( n \log{(n)} \right)} \right)$. In this article are presented algorithms for:\begin{itemize}\item determination of optimal strategy for computation of degree $\ell^n$ isogeny,\item determination of cost of optimal strategy of computation of $\ell^n$ isogeny using solutions of recurrence equations,\item determination of cost of optimal strategy of computation of $\ell^n$ isogeny using recurrence equations,\end{itemize}where optimality in this context means that, for the given parameters, no other strategy exists that requires fewer operations for faster computation of isogeny. Also this article presents a method using generating functions for obtaining the solutions of sequences $\left( u_m \right)$ and $\left( c_m \right)$ where $c_m$ denotes the cost of computations of isogeny of degree $\ell^{u_m}$ computations for given costs $p,q$ of $\ell$-isogeny computation and $\ell$-isogeny evaluation. These solutions are also used in the construction of the algorithms presented in this article.

References

@InProceedings{Cos16,

author="Costello, Craig

and Longa, Patrick

and Naehrig, Michael",

editor="Robshaw, Matthew

and Katz, Jonathan",

title="Efficient Algorithms for Supersingular Isogeny Diffie-Hellman",

booktitle="Advances in Cryptology -- CRYPTO 2016",

year="2016",

publisher="Springer Berlin Heidelberg",

address="Berlin, Heidelberg",

pages="572--601",

abstract="We propose a new suite of algorithms that significantly improve the performance of supersingular isogeny Diffie-Hellman (SIDH) key exchange. Subsequently, we present a full-fledged implementation of SIDH that is geared towards the 128-bit quantum and 192-bit classical security levels. Our library is the first constant-time SIDH implementation and is up to 2.9 times faster than the previous best (non-constant-time) SIDH software. The high speeds in this paper are driven by compact, inversion-free point and isogeny arithmetic and fast SIDH-tailored field arithmetic: on an Intel Haswell processor, generating ephemeral public keys takes 46 million cycles for Alice and 52 million cycles for Bob, while computing the shared secret takes 44 million and 50 million cycles, respectively. The size of public keys is only 564 bytes, which is significantly smaller than most of the popular post-quantum key exchange alternatives. Ultimately, the size and speed of our software illustrates the strong potential of SIDH as a post-quantum key exchange candidate and we hope that these results encourage a wider cryptanalytic effort.",

isbn="978-3-662-53018-4"

}

@misc{Feo11,

author = {Luca De Feo and David Jao and Jérôme Plût},

title = {Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies},

howpublished = {Cryptology ePrint Archive, Report 2011/506},

year = {2011},

note = {url{https://eprint.iacr.org/2011/506}},

}

@InProceedings{Cos17,

author="Costello, Craig

and Hisil, Huseyin",

editor="Takagi, Tsuyoshi

and Peyrin, Thomas",

title="A Simple and Compact Algorithm for SIDH with Arbitrary Degree Isogenies",

booktitle="Advances in Cryptology -- ASIACRYPT 2017",

year="2017",

publisher="Springer International Publishing",

address="Cham",

pages="303--329",

abstract="We derive a new formula for computing arbitrary odd-degree isogenies between elliptic curves in Montgomery form. The formula lends itself to a simple and compact algorithm that can efficiently compute any low odd-degree isogenies inside the supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol. Our implementation of this algorithm shows that, beyond the commonly used 3-isogenies, there is a moderate degradation in relative performance of {$}{$}(2d+1){$}{$}(2d+1)-isogenies as d grows, but that larger values of d can now be used in practical SIDH implementations.",

isbn="978-3-319-70697-9"

}

Downloads

Published

2024-04-19

Issue

Section

Cryptography and Cybersecurity