Optimized CSIDH Implementation Using a 2-Torsion Point

• Main Authors: Donghoe Heo, Suhri Kim, Kisoon Yoon, Young-Ho Park, Seokhie Hong
• Format: Article
• Language: English
• Published: MDPI AG 2020-07-01
• Series: Cryptography
• Subjects: post-quantum cryptography; isogeny; Montgomery curves; two-torsion points; Commutative Supersingular Isogeny Diffie-Hellman (CSIDH)
• Online Access: https://www.mdpi.com/2410-387X/4/3/20

The implementation of isogeny-based cryptography mainly use Montgomery curves, as they offer fast elliptic curve arithmetic and isogeny computation. However, although Montgomery curves have efficient 3- and 4-isogeny formula, it becomes inefficient when recovering the coefficient of the image curve for large degree isogenies. Because the Commutative Supersingular Isogeny Diffie-Hellman (CSIDH) requires odd-degree isogenies up to at least 587, this inefficiency is the main bottleneck of using a Montgomery curve for CSIDH. In this paper, we present a new optimization method for faster CSIDH protocols entirely on Montgomery curves. To this end, we present a new parameter for CSIDH, in which the three rational two-torsion points exist. By using the proposed parameters, the CSIDH moves around the surface. The curve coefficient of the image curve can be recovered by a two-torsion point. We also proved that the CSIDH while using the proposed parameter guarantees a free and transitive group action. Additionally, we present the implementation result using our method. We demonstrated that our method is 6.4% faster than the original CSIDH. Our works show that quite higher performance of CSIDH is achieved while only using Montgomery curves.