Supersingular isogeny key exchange

Supersingular isogeny Diffie–Hellman key exchange (SIDH) is a post-quantum cryptographic algorithm used to establish a secret key between two parties over an otherwise insecure communications channel. It is a form of the Diffie–Hellman key exchange, but is designed to resist cryptanalytic attack by an adversary in possession of a quantum computer. SIDH uses the smallest key sizes among all post-quantum cryptosystems; with compression, SIDH uses 3072-bit public keys at a 128-bit quantum security level. SIDH also distinguishes itself from similar systems such as NTRU and Ring-LWE by supporting perfect forward secrecy, a property that prevents compromised long-term keys from compromising the confidentiality of old communication sessions. These properties make SIDH a natural candidate to replace Diffie-Hellman (DHE) and elliptic curve Diffie-Hellman (ECDHE), which are widely used in Internet communication.

Introduction

For certain classes of problems, algorithms running on quantum computers are naturally capable of achieving lower time complexity than on classical computers. That is, quantum algorithms can solve certain problems faster than the most efficient algorithm running on a traditional computer. For example, Shor's algorithm can factor an integer N in polynomial time, while the best-known factoring classic algorithm, the general number field sieve, operates in sub-exponential time. This is significant to public key cryptography because the security of RSA is dependent on the infeasibility of factoring integers, the integer factorization problem. Shor's algorithm can also efficiently solve the discrete logarithm problem, which is the basis for the security of Diffie–Hellman, elliptic curve Diffie–Hellman, elliptic curve DSA, Curve25519, ed25519, and ElGamal. Although quantum computers are currently in their infancy, the ongoing development of quantum computers and their theoretical ability to compromise modern cryptographic protocols (such as TLS/SSL) has prompted the development of post-quantum cryptography.^[1]

SIDH was created in 2011 by De Feo, Jao, and Plut.^[2] It uses conventional elliptic curve operations and is not patented.^[3] SIDH provides perfect forward secrecy and thus does not rely on the security of long-term private keys. Forward secrecy improves the long-term security of encrypted communications, helps defend against mass surveillance, and reduces the impact of vulnerabilities like Heartbleed.^[4][5]

Background

The supersingular isogeny Diffie-Hellman method works with the set of supersingular elliptic curves E over F_p², where the number of points on any such curve will be (p ± 1)². An isogeny of an elliptic curve E is a rational map from E to another elliptic curve E' such that the number of points on both curves is the same. For supersingular elliptic curves, isogenies are equivalently defined by points inside their kernel.

The SIDH method works with a prime of the form p = (w_A)^e_A(w_B)^e_B(f) ± 1 where w_A and w_B are small primes and an elliptic curve E defined by the equation: y² = x³ + ax + b. SIDH builds an isogeny map from a single elliptic curve point which is taken as the generator for the isogeny's kernel. This point is chosen to be a random linear combination to two fixed points chosen to be in the kernel of the isogeny.

The j-invariant of an elliptic curve E is a fixed function of a set of isomorphic curves. It is computed from the parameters that define the curve. For an elliptic curve E defined by the equation: y² = x³ + ax + b the j-invariant of the curve E is:

$j(E) = 1728 \frac{4a^3}{4a^3+27b^2}.$

Security

The set of isogenies of a supersingular elliptic curve together with operation of composition form a non-abelian group and the security of the SIDH is dependent on this non-abelian structure.^[2] The security of SIDH is closely related to the problem of finding the isogeny mapping between two supersingular elliptic curves with the same number of points. De Feo, Jao and Plut suggest that the security of SIDH will be O(p^1/4) for classical computers and O(p^1/6) for quantum computers. This suggests that SIDH with a 768-bit prime (p) will have a 128-bit security level.^[2] A 2014 study of the isogeny mappying problem by Delfs and Galbraith confirmed the O(p^1/4) security analysis for classical computers.^[6]

Efficiency

During a key exchange entities A and B will each transmit information 2 (mod p²) coefficients defining an elliptic curve and 2 elliptic curve points. Each elliptic curve coefficient requires log₂p² bits. Each elliptic curve point can be transmitted in log₂p²+1 bits, hence the transmission is 8log₂p + 2 bits. This is 6144 bits for a 768-bit modulus p (128-bit security) but this can be reduced in half to 3072 bits (384 bytes) using a technique discovered by Azarderakhsh and colleagues, far smaller than any other post-quantum cryptosystem. With this compression technique, SIDH has an identical bandwidth requirement to traditional 3072-bit RSA signatures or Diffie-Hellman key exchanges. This small space requirement makes SIDH applicable to context that have a strict space requirement, such as Bitcoin or Tor. Tor's data cells must be less than 517 bytes in length, so they can hold 384-byte SIDH keys. By contrast, NTRUEncrypt must exchange approximately 600 bytes to achieve a 128-bit security and cannot be used within Tor without increasing the cell size.^[7]

In 2014, researchers at the University of Waterloo developed a software implementation of SIDH. They ran their partially optimized code on an x86-64 processor running at 2.4 GHz. For a 768-bit modulus they were able to complete the key exchange computations in 200 milliseconds thus demonstrating that the SIDH is computationally practical.^[8]

The supersingular isogeny Diffie-Hellman method

While several steps of SIDH involve complex isogeny calculations, the overall flow of SIDH for parties A and B is straightforward for those familiar with a Diffie-Hellman key exchange or its elliptic curve variant.

Setup

These are public parameters that can be shared by everyone in the network, or they can be negotiated by parties A and B at the beginning of a session.

1. A prime of the form $p = w_A^{e_A}\cdot w_B^{e_B}\cdot f \pm 1.$
2. A supersingular elliptic curve E over $\mathbb{F}_{p^2}$.
3. Fixed elliptic points $P_A, Q_A, P_B, Q_B \text{ on } E.$
4. The order of $P_A$ and $Q_A$ is $(w_A)^{e_A}.$ The order of $P_B$ and $Q_B$ is $(w_B)^{e_B}$.

Key exchange

In the key exchange, parties A and B will each create an isogeny from a common elliptic curve E. They each will do this by creating a random point in what will be the kernel of their isogeny. The kernel of their isogeny will be spanned by the pairs of points $P_A$, $Q_A$ and $P_B$, $Q_B$ respectively. The different pairs of points used ensure that parties A and B create different, non-communting, isogenies. A random point ($R_A$, or $R_B$) in the kernel of the isogenies is created as a random linear combination of the points $P_A$, $Q_A$ and $P_B$, $Q_B$.

Using $R_A$, or $R_B$, parties A and B then use Velu's formulas for creating isogenies $\phi_A$ and $\phi_B$ respectively. From this they compute the image of the pairs of points $P_A$, $Q_A$ or $P_B$, $Q_B$ under the $\phi_A$ and $\phi_B$ isogenies respectively.

As a result, A and B will now have two pairs of points $\phi_B(P_A)$, $\phi_B(Q_A)$ and $\phi_A(P_B)$, $\phi_A(Q_B)$ respectively. A and B now exchange these pairs of points over a communications channel.

A and B now use the pair of points they receive as the basis for the kernel of a new isogeny. They use the same linear coefficients they used above with the points they received to form a point in the kernel of an isogeny that they will create. They each compute points $S_{BA}$ and $S_{AB}$ and use Velu's formulas to construct new isogenies.

To complete the key exchange, A and B compute the coefficients of two new elliptic curves under these two new isogenies. They then compute the j-invariant of these curves. Unless there were errors in transmission, the j-invariant of the curve created by A will equal to the j-invariant of the curve created by B.

Notationally, the SIDH key exchange between parties A and B works as follows:

1A. A generates two random integers m_A, n_A < (w_A)^eA

2A. A generates $R_A := m_A \cdot (P_A)+ n_A\cdot (Q_A).$

3A. A uses the point $R_A$ to create an isogeny mapping $\phi_A: E\rightarrow E_A$ and curve $E_A$ isogenous to $E.$

4A. A applies $\phi_A$ to $P_B$ and $Q_B$ to form two points on $E_A: \phi_A(P_B)$ and $\phi_A(Q_B).$

5A. A sends to B $E_A, \phi_A(P_B)$, and $\phi_A(Q_B).$

1B - 4B: Same as A1 through A4, but with A and B subscripts swapped.

5B. B sends to A $E_B,\phi_B(P_A)$, and $\phi_B(Q_A).$

7A. A has $m_A, n_A, \phi_B(P_A)$, and $\phi_B(Q_A)$ and forms $S_{BA} := m_A(\phi_B(P_A)) + n_A(\phi_B(Q_A)).$

8A. A uses $S_{BA}$ to create an isogeny mapping $\psi_{BA}$.

9A. A uses $\psi_{BA}$ to create an elliptic curve $E_{BA}$ which is isogenous to E.

10A. A computes $K := \text{ j-invariant } (j_{BA})$ of the curve $E_{BA}$.

7B. Similarly, B has $m_B, n_B, \phi_A(P_B)$, and $\phi_A(Q_B)$ and forms $S_{AB} = m_B (\phi_A(P_B)) + n_B(\phi_A(Q_B))$.

8B. B uses $S_{AB}$ to create an isogeny mapping $\psi_{AB}$.

9B. B uses $\psi_{AB}$ to create an elliptic curve $E_{AB}$ which is isogenous to E.

10B. B computes K = j-invariant ($j_{AB})$ of the curve $E_{AB}$.

The curves $E_{AB}$ and $E_{BA}$ will be guaranteed to both will have the same j-invariant. A function of K is used as the shared key.^[2]

Sample parameters

The following parameters were taken as an example by Defeo et al.:^[2]

p = prime for the key exchange with w_A = 2, w_B = 3, e_A = 63, e_B = 41, and f = 11. Thus p = (2⁶³·3⁴¹·11) - 1.

E₀ = the base (starting) curve for the key exchange = y² = x³ + x

Luca Defeo, one of the authors of the paper defining the key exchange has posted software that implements the key exchange for these and other parameters.^[9]

Similar systems, signatures, and uses

A predecessor to the SIDH was published in 2006 by Rostovtsev and Stolbunov. They created the first Diffie-Hellman replacement based on elliptic curve isogenies. Unlike the method of De Feo, Jao, and Plut, the method of Rostovtsev and Stolbunov used ordinary elliptic curves^[10] and was found to have a subexponential quantum attack.^[11]

In March 2014, researchers at the Chinese State Key Lab for Integrated Service Networks and Xidian University extended the security of the SIDH to a form of digital signature with strong designated verifier.^[12] In October 2014, well known elliptic curve researchers Jao and Soukharev from the University of Waterloo presented an alternative method of creating undeniable signatures with designated verifier using elliptic curve isogenies^[13].

References

1. Utsler, Jim (2013). "Quantum Computing Might Be Closer Than Previously Thought". IBM. Retrieved 27 May 2013.
2. De Feo, Luca; Jao, Plut. "Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies" (PDF). PQCrypto 2011. Springer. Retrieved 4 May 2014.
3. "PATENTSCOPE". www.wipo.int. World Intellectual Property Organization. Retrieved 14 June 2014.
4. Higgins, Parker. "Long Term Privacy with Forward Secrecy". Electronic Frontier Foundation. Retrieved 4 May 2014.
5. Zhu, Yan. "Why the Web Needs Perfect Forward Secrecy More Than Ever". Electronic Frontier Foundation. Retrieved 4 May 2014.
6. Delfs, Christina; Galbraith (29 Oct 2013). "Computing isogenies between supersingular elliptic curves over F_p". arXiv.org. arXiv.org. Retrieved 20 June 2014.
7. "Cryptology ePrint Archive: Report 2016/229". eprint.iacr.org. Retrieved 2016-03-02.
8. Fishbein, Dieter (30 April 2014). "Machine-Level Software Optimization of Cryptographic Protocols". University of Waterloo Library - Electronic Theses. University of Waterloo. Retrieved 21 June 2014.
9. "defeo/ss-isogeny-software". GitHub. Retrieved 2015-05-29.
10. Rostovtsev, Alexander; Stolbunov (2006). "PUBLIC-KEY CRYPTOSYSTEM BASED ON ISOGENIES". Springer. Archived from the original (PDF) on 29 May 2006. Retrieved 10 May 2014.
11. Childs, Andrew M; Jao, Soukharev. "Constructing elliptic curve isogenies in quantum subexponential time". Journal of Mathematical Cryptology. De Gruyter. Retrieved 4 May 2014.
12. Sun, Xi; Tian (2 March 2014). "Toward quantum-resistant strong designated verifier signature". International Journal of Grid and Utility Computing. doi:10.1504/IJGUC.2014.060187. Retrieved 21 June 2014.
13. Jao, David; Soukharev, Vladimir (3 October 2014). "Isogeny-based quantum-resistant undeniable signatures" (PDF). doi:10.1007/978-3-319-11659-4_10. Retrieved 28 April 2016.