I want to know what security level is provided by an elliptic curve used in Supersingular isogeny Diffie–Hellman key exchange (SIDH). Is there any mathematical convention to follow or by looking at different parameters we can find the security level?

For instance, what security is provided by the type a and type d curves which are included in the Charm crypto library?

I know the type a curve SS512 and SS1024 have a prime field of 512 and 1024 bits respectively. Can anyone tell me what security is provided by them?

  • $\begingroup$ @SEJPM Many thanks for your reply. Just a clarification this means the supersingular curves SS512 and SS1024 provides 256 and 512 bit-security respectively. $\endgroup$ – Aisha Dec 4 '17 at 15:43
  • $\begingroup$ Wikipedia article linked indicates security bounds of $\mathcal{O}(p^{\frac{1}{4}})$, so if your $p$ is 512 bits $\approx 2^{512}$ that would mean you're getting no more than around $\approx 128$ bits security, not 256 as your comment implies.. $\endgroup$ – puzzlepalace Dec 5 '17 at 4:21
  • $\begingroup$ @puzzlepalace Many thanks for your reply. One more question, is the key size same as the order of prime field i.e. in this case 512 bits? $\endgroup$ – Aisha Dec 5 '17 at 10:02
  • $\begingroup$ @Aisha No. Uncompressed SIDH public keys are about $6\log_2p$ bits and private keys are something like $\frac12\log_2p$ bits. $\endgroup$ – yyyyyyy Dec 5 '17 at 21:58
  • $\begingroup$ eprint.iacr.org/2016/859 $\endgroup$ – Vadym Fedyukovych Dec 6 '17 at 1:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.