For existing ECDH, I understand that there are recommended Elliptic Curve Domain Parameters. May I know if there are such similar considerations in SIDH? Any recommended Curve Domain Parameters?
$\begingroup$
$\endgroup$
1
-
4$\begingroup$ The only public optimized implementation of SIDH (here) fixes a set of parameters. The same parameters have been submitted to the NIST call for post-quantum secure cryptography, so I suppose one could consider them a de facto standard. $\endgroup$– yyyyyyyCommented Feb 6, 2018 at 10:31
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
0
All 'good' implementations so far have used the same curve, but there is now variation in the underlying finite field, which affects the other base parameters of the public points for each party and the range of values for the secret scalars. The best reference as yyyyyyy mentioned is the NIST PQC submission for SIKE, which includes valid options for SIDH with some extra protocol stuff on top. The parameter sets in there are p503, p751 (the most studied one) and p964.
