Optimized CSIDH Implementation Using a 2-Torsion Point
The implementation of isogeny-based cryptography mainly use Montgomery curves, as they offer fast elliptic curve arithmetic and isogeny computation. However, although Montgomery curves have efficient 3- and 4-isogeny formula, it becomes inefficient when recovering the coefficient of the image curve...
Main Authors: | , , , , |
---|---|
Format: | Article |
Language: | English |
Published: |
MDPI AG
2020-07-01
|
Series: | Cryptography |
Subjects: | |
Online Access: | https://www.mdpi.com/2410-387X/4/3/20 |
id |
doaj-f64ca773f4f045f7ab214ec314851f13 |
---|---|
record_format |
Article |
spelling |
doaj-f64ca773f4f045f7ab214ec314851f132020-11-25T03:43:03ZengMDPI AGCryptography2410-387X2020-07-014202010.3390/cryptography4030020Optimized CSIDH Implementation Using a 2-Torsion PointDonghoe Heo0Suhri Kim1Kisoon Yoon2Young-Ho Park3Seokhie Hong4Graduate School of Information Security, Institute of Cyber Security and Privacy (ICSP), Korea University, Seoul 02841, KoreaGraduate School of Information Security, Institute of Cyber Security and Privacy (ICSP), Korea University, Seoul 02841, KoreaNSHC Inc., Seoul 08502, KoreaDepartment of Information Security, Graduate School of Information Security, Sejong Cyber University, Seoul 05000, KoreaGraduate School of Information Security, Institute of Cyber Security and Privacy (ICSP), Korea University, Seoul 02841, KoreaThe implementation of isogeny-based cryptography mainly use Montgomery curves, as they offer fast elliptic curve arithmetic and isogeny computation. However, although Montgomery curves have efficient 3- and 4-isogeny formula, it becomes inefficient when recovering the coefficient of the image curve for large degree isogenies. Because the Commutative Supersingular Isogeny Diffie-Hellman (CSIDH) requires odd-degree isogenies up to at least 587, this inefficiency is the main bottleneck of using a Montgomery curve for CSIDH. In this paper, we present a new optimization method for faster CSIDH protocols entirely on Montgomery curves. To this end, we present a new parameter for CSIDH, in which the three rational two-torsion points exist. By using the proposed parameters, the CSIDH moves around the surface. The curve coefficient of the image curve can be recovered by a two-torsion point. We also proved that the CSIDH while using the proposed parameter guarantees a free and transitive group action. Additionally, we present the implementation result using our method. We demonstrated that our method is 6.4% faster than the original CSIDH. Our works show that quite higher performance of CSIDH is achieved while only using Montgomery curves.https://www.mdpi.com/2410-387X/4/3/20post-quantum cryptographyisogenyMontgomery curvestwo-torsion pointsCommutative Supersingular Isogeny Diffie-Hellman (CSIDH) |
collection |
DOAJ |
language |
English |
format |
Article |
sources |
DOAJ |
author |
Donghoe Heo Suhri Kim Kisoon Yoon Young-Ho Park Seokhie Hong |
spellingShingle |
Donghoe Heo Suhri Kim Kisoon Yoon Young-Ho Park Seokhie Hong Optimized CSIDH Implementation Using a 2-Torsion Point Cryptography post-quantum cryptography isogeny Montgomery curves two-torsion points Commutative Supersingular Isogeny Diffie-Hellman (CSIDH) |
author_facet |
Donghoe Heo Suhri Kim Kisoon Yoon Young-Ho Park Seokhie Hong |
author_sort |
Donghoe Heo |
title |
Optimized CSIDH Implementation Using a 2-Torsion Point |
title_short |
Optimized CSIDH Implementation Using a 2-Torsion Point |
title_full |
Optimized CSIDH Implementation Using a 2-Torsion Point |
title_fullStr |
Optimized CSIDH Implementation Using a 2-Torsion Point |
title_full_unstemmed |
Optimized CSIDH Implementation Using a 2-Torsion Point |
title_sort |
optimized csidh implementation using a 2-torsion point |
publisher |
MDPI AG |
series |
Cryptography |
issn |
2410-387X |
publishDate |
2020-07-01 |
description |
The implementation of isogeny-based cryptography mainly use Montgomery curves, as they offer fast elliptic curve arithmetic and isogeny computation. However, although Montgomery curves have efficient 3- and 4-isogeny formula, it becomes inefficient when recovering the coefficient of the image curve for large degree isogenies. Because the Commutative Supersingular Isogeny Diffie-Hellman (CSIDH) requires odd-degree isogenies up to at least 587, this inefficiency is the main bottleneck of using a Montgomery curve for CSIDH. In this paper, we present a new optimization method for faster CSIDH protocols entirely on Montgomery curves. To this end, we present a new parameter for CSIDH, in which the three rational two-torsion points exist. By using the proposed parameters, the CSIDH moves around the surface. The curve coefficient of the image curve can be recovered by a two-torsion point. We also proved that the CSIDH while using the proposed parameter guarantees a free and transitive group action. Additionally, we present the implementation result using our method. We demonstrated that our method is 6.4% faster than the original CSIDH. Our works show that quite higher performance of CSIDH is achieved while only using Montgomery curves. |
topic |
post-quantum cryptography isogeny Montgomery curves two-torsion points Commutative Supersingular Isogeny Diffie-Hellman (CSIDH) |
url |
https://www.mdpi.com/2410-387X/4/3/20 |
work_keys_str_mv |
AT donghoeheo optimizedcsidhimplementationusinga2torsionpoint AT suhrikim optimizedcsidhimplementationusinga2torsionpoint AT kisoonyoon optimizedcsidhimplementationusinga2torsionpoint AT younghopark optimizedcsidhimplementationusinga2torsionpoint AT seokhiehong optimizedcsidhimplementationusinga2torsionpoint |
_version_ |
1724521650013077504 |