90
Deirdre Connolly @durumcrustulum Supersingular Isogeny Diffie-Hellman

Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

  • Upload
    others

  • View
    9

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Deirdre Connolly@durumcrustulum

Supersingular Isogeny Diffie-Hellman

Page 2: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 3: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Shor’s Algorithm

Page 4: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Diffie-Hellman Key Exchange

Page 5: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Diffie-Hellman Key Exchange

Page 6: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Diffie-Hellman Key Exchange

Page 7: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Diffie-Hellman Key Exchange

Page 8: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Diffie-Hellman Key Exchange

Page 9: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Diffie-Hellman Key Exchange

Page 10: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Diffie-Hellman Key Exchange

Page 11: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Originally FFDH: key = gab mod p

Exchange integers

Diffie-Hellman Key Exchange

Page 12: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Originally FFDH: key = gab mod p

Exchange integers

Then ECDH: key = abP mod p

Exchange points on curve

Diffie-Hellman Key Exchange

Page 13: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 14: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 15: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 16: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 17: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 18: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 19: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 20: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 21: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 22: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Originally FFDH: key = gab mod p

Exchange integers

Diffie-Hellman Key Exchange

Page 23: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Originally FFDH: key = gab mod p

Exchange integers

Then ECDH: key = abP mod p

Exchange points on curve

Diffie-Hellman Key Exchange

Page 24: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Originally FFDH: key = gab mod p

Exchange integers

Then ECDH: key = abP mod p

Exchange points on curve

Diffie-Hellman Key Exchange

Page 25: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Originally FFDH: key = gab mod p

Exchange integers

Then ECDH: key = abP mod p

Exchange points on curve

Diffie-Hellman Key Exchange

Page 26: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Originally FFDH: key = gab mod p

Exchange integers

Then ECDH: key = abP mod p

Exchange points on curve

Now SIDH:

key = ϕ′a(ϕb(E)) = ϕ′B(ϕA(E))

Exchange whole curves

Diffie-Hellman Key Exchange

Page 27: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 28: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 29: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 30: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 31: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 32: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 33: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 34: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 35: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 36: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 37: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 38: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 39: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 40: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 41: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 42: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 43: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 44: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Grover’s Algorithm

Page 45: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Best known attacks

Classical:

Quantum:

Page 46: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice Bob

Page 47: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice Bob

Page 48: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice Bob

Page 49: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice Bob

Page 50: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice Bob

Page 51: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice Bob

Page 52: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice Bob

Page 53: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice Bob

Page 54: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 55: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 56: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 57: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 58: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 59: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 60: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 61: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 62: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 63: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 64: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 65: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 66: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 67: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 68: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 69: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 70: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 71: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 72: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 73: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 74: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 75: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Alice

Page 76: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 77: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 78: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 79: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 80: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 81: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 82: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

2.9X!

Page 83: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 84: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 85: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 86: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 87: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 88: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Towards quantum-resistant cryptosystems from supersingular elliptic curve isogeniesLuca De Feo and David Jao and Jérôme Plût, 2011

Efficient algorithms for supersingular isogeny Diffie-HellmanCraig Costello and Patrick Longa and Michael Naehrig, 2016

On the Security of Supersingular Isogeny CryptosystemsSteven D. Galbraith and Christophe Petit and Barak Shani and Yan Bo Ti, 2016

Page 89: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =
Page 90: Supersingular Isogeny Diffie-Hellman · Originally FFDH: key = gab mod p Exchange integers Then ECDH: key = abP mod p Exchange points on curve Now SIDH: key = ϕ′ a (ϕ b (E)) =

Deirdre Connolly@durumcrustulum

Supersingular Isogeny Diffie-Hellman