Mathematical preliminaries for isogeny-based cryptography

For more info about our services contact : help@bestpfe.com

Table of contents

1 Introduction 
1.1 Landscape of cryptology
1.2 Computationally hard problems
1.3 Original Diffie–Hellman
1.4 Quantum revolution
1.5 Isogeny history
1.6 Problematic
1.7 Overview
I Preliminaries 
2 Mathematical preliminaries for isogeny-based cryptography 
2.1 Quadratic imaginary order and class groups
2.1.1 Quadratic fields, orders and ideals
2.1.2 Fractional ideals
2.1.3 Ideal class group
2.2 Algebraic plane curves
2.2.1 Affine plane curves
2.2.2 Projective plane curves
2.2.3 Function field
2.2.4 Smooth algebraic plane curves
2.2.5 Morphisms of plane curves
2.2.6 Divisor of a function
2.2.7 Divisor class group
2.2.8 Genus
2.3 Elliptic curves
2.3.1 Representation of elliptic curves
2.3.2 Algebraic group
2.3.3 Torsion
2.3.4 Invariant differential
2.4 Isogenies
2.4.1 Definitions
2.4.2 V´elu’s formulae
2.4.3 Example
2.4.4 Modular curves
2.5 Endomorphisms and curve classification
2.5.1 The endomorphism ring
2.5.2 Supersingular and ordinary cases
2.6 Deuring correspondence and the action of the ideal class group
2.6.1 Action of the ideal class group on elliptic curves
2.6.2 Deuring correspondence
2.7 Isogeny graphs
2.7.1 Ordinary case
2.7.2 Supersingular case over Fp
2.7.3 Supersingular over Fp2
3 Isogeny-based key exchange protocols 
3.1 Ordinary case (CRS)
3.1.1 Security of the scheme and parameter sizes
3.1.2 Couveignes key exchange protocol
3.1.3 Rostovstev–Stolbunov key exchange protocol
3.1.4 Computation
3.2 Supersingular case over Fp2 (SIDH and SIKE)
3.2.1 Commutative diagram
3.2.2 SIDH key exchange protocol
3.2.3 Underlying security problems
3.2.4 From SIDH to SIKE
3.3 Supersingular case over Fp (CSIDH)
3.3.1 The ideal class group action
3.3.2 CSIDH key exchange protocol
3.3.3 Security of the scheme
3.3.4 Computation
3.4 Key validation
3.5 Comparison of CRS, SIDH, SIKE and CSIDH
II CSIDH implementation 
4 Protecting CSIDH against side-channel attacks 
4.1 Preliminaries: side-channel attacks
4.1.1 Timing attacks
4.1.2 Power consumption analysis
4.1.3 Fault injection
4.1.4 Constant-time and dummy-free algorithms
4.2 Previous constant-time implementations
4.2.1 Meyer–Campos–Reith
4.2.2 Onuki–Aikawa–Yamazaki–Takagi
4.3 Contribution: Fault-attack resistance
4.4 Contribution: Derandomized CSIDH
4.4.1 Flawed pseudorandom number generators
4.4.2 Derandomized CSIDH with dummies
4.4.3 Derandomized dummy-free CSIDH
4.5 Following constant-time implementations
III CSIDH generalization: higher-degree supersingular group actions 
5 (d, �)-structures 
5.1 Curves with a d-isogeny to their conjugate
5.1.1 Galois conjugates
5.1.2 (d, �)-structures
5.1.3 Isogenies of (d, �)-structures
5.1.4 Twisting
5.1.5 Involutions
5.1.6 Supersingular (d, �)-structures
5.1.7 Curves with non-integer d2-endomorphisms
5.2 Action on supersingular (d, �)-structures
5.2.1 Preliminaries on orientations
5.2.2 Action on primitive O-oriented curves
5.2.3 Natural orientation for supersingular (d, �)-structures
5.2.4 Link between natural and induced orientation
5.2.5 Free and transitive class group action
5.3 The (d, �)-supersingular isogeny graph
5.3.1 General structure
5.3.2 Examples
5.3.3 Involutions
5.3.4 Automorphism of order 3
5.4 Crossroads: curves with multiple (d, �)-structures
5.5 Map from (d, �)-structures to modular curves
5.6 Parametrization
5.6.1 Representing (2, �)-structures
5.6.2 Representing (3, �)-structures
5.6.3 Representing (5, �)-structures
5.6.4 Representing (7, �)-structures
6 HD CSIDH: Higher degree commutative supersingular Diffie–nHellman 
6.1 HD CSIDH: Higher degree CSIDH
6.1.1 Hard problems
6.1.2 HD CSIDH
6.2 Practical computation
6.2.1 V´elu approach
6.2.2 Modular approach
6.3 Example
6.4 Public key compression
6.4.1 Key compression with modular curves
6.4.2 Key compression with parametrization
6.5 Public key validation
6.5.1 CSIDH versus HD CSIDH
6.5.2 Checking (d, �)-structures
6.5.3 Checking supersingularity: Sutherland’s algorithm
6.5.4 Adaptation of Sutherland algorithm
6.5.5 Determining the level
6.5.6 Validation algorithm for HD CSIDH
6.5.7 CSIDH and HD CSIDH validation comparison
IV Cryptanalysis 
7 Cryptanalysis for SIDH 
7.1 The Delfs–Galbraith algorithm
7.1.1 The general supersingular isogeny problem
7.2 Generalization
7.2.1 Generalized Delfs–Galbraith algorithm
7.2.2 Choosing the set D
7.2.3 Comparisons
7.3 Application to SIDH/SIKE cryptanalysis
7.3.1 Specific case: weak public keys in SIKEp434
7.3.2 General case: SIDH, shortcut
Perspectives
Bibliography