Loop-abort faults on supersingular isogeny cryptosystems

58 Pages·2017·0.44 MB·English

Loop-abort faults on
supersingular isogeny cryptosystems
Alexandre Gélin Benjamin Wesolowski
Laboratoired’InformatiquedeParis6–SorbonneUniversitésUPMC,France
ÉcolePolytechniqueFédéraledeLausanne,EPFLICLACAL,Switzerland
PQCrypto 2017 – Utrecht
2017/06/26
AlexandreGélin,BenjaminWesolowski Loop-abortfaultsonsupersingularisogenycryptosystems
Based on the same problem as the hash function of [CLG06]
The isogeny graph of a supersingular elliptic curve:
Supersingular-Isogeny Public-key Cryptography
Introduced by Jao, De Feo, and Plût in 2011
AlexandreGélin,BenjaminWesolowski Loop-abortfaultsonsupersingularisogenycryptosystems
The isogeny graph of a supersingular elliptic curve:
Supersingular-Isogeny Public-key Cryptography
Introduced by Jao, De Feo, and Plût in 2011
Based on the same problem as the hash function of [CLG06]
AlexandreGélin,BenjaminWesolowski Loop-abortfaultsonsupersingularisogenycryptosystems
Supersingular-Isogeny Public-key Cryptography
Introduced by Jao, De Feo, and Plût in 2011
Based on the same problem as the hash function of [CLG06]
The isogeny graph of a supersingular elliptic curve:
AlexandreGélin,BenjaminWesolowski Loop-abortfaultsonsupersingularisogenycryptosystems
Supersingular-Isogeny Public-key Cryptography
Introduced by Jao, De Feo, and Plût in 2011
Based on the same problem as the hash function of [CLG06]
The isogeny graph of a supersingular elliptic curve:
AlexandreGélin,BenjaminWesolowski Loop-abortfaultsonsupersingularisogenycryptosystems
Interesting properties:
All supersingular elliptic curves can be defined over F
p2
About p supersingular elliptic curves, up to isomorphism
12
Supersingular elliptic curves
Definition
A supersingular elliptic curve is a curve E defined over F such that
pk
(cid:179) (cid:180)
#E F =1modp.
pk
AlexandreGélin,BenjaminWesolowski Loop-abortfaultsonsupersingularisogenycryptosystems
Supersingular elliptic curves
Definition
A supersingular elliptic curve is a curve E defined over F such that
pk
(cid:179) (cid:180)
#E F =1modp.
pk
Interesting properties:
All supersingular elliptic curves can be defined over F
p2
About p supersingular elliptic curves, up to isomorphism
12
AlexandreGélin,BenjaminWesolowski Loop-abortfaultsonsupersingularisogenycryptosystems
Interesting properties:
G⊂E =⇒ a unique E and φ such that
1 2
φ:E →E and Ker φ=G
1 2
E =E/G is obtained in O(cid:161)degφ(cid:162)
2
Isogenies
Definition
An isogeny φ between two elliptic curves E and E is a surjective group homomorphism
1 2
with a finite kernel. The degree is defined by
degφ=#Ker φ.
AlexandreGélin,BenjaminWesolowski Loop-abortfaultsonsupersingularisogenycryptosystems
Isogenies
Definition
An isogeny φ between two elliptic curves E and E is a surjective group homomorphism
1 2
with a finite kernel. The degree is defined by
degφ=#Ker φ.
Interesting properties:
G⊂E =⇒ a unique E and φ such that
1 2
φ:E →E and Ker φ=G
1 2
E =E/G is obtained in O(cid:161)degφ(cid:162)
2
AlexandreGélin,BenjaminWesolowski Loop-abortfaultsonsupersingularisogenycryptosystems
−→(m ,n )∈{1,...,(cid:96)n}2 random,
A A A
R =m P +n Q for 〈P ,Q 〉=E(cid:163)(cid:96)n(cid:164)
A A A A A A A A
=⇒ the curve E =E/〈R 〉 and φ :E→E
A A A A
A supersingular elliptic curve E with (cid:96)n(cid:96)m points
A B
E
A point R chosen randomly in E(cid:163)(cid:96)n(cid:164)
A A φ φ
A B
E E
A B
A point R =m P +n Q random in E(cid:163)(cid:96)m(cid:164)=〈P ,Q 〉,
B B B B B B B B
the curve E =E/〈R 〉 and φ :E→E
B B B B
Key-Exchange Protocol
A prime p such that p+1=(cid:96)n(cid:96)m
A B
AlexandreGélin,BenjaminWesolowski Loop-abortfaultsonsupersingularisogenycryptosystems