Supersingular isogeny Diffie–Hellman key exchange (SIDH) Library Support AES-256?

Question

In the version 3.0 of the SIDH library, it implements SIDH/SIKEp503 (AES-128) and SIDH/SIKEp751 (AES-192) only.

Are there plans to incorporate AES-256?

Nathan Aw

Answer 1

Neither implementation actually incorporates or uses AES of any keysize, rather the primes used provide a security about 1/6 of their bit size, resulting in a security level of 83 bits for SIDH/SIKEp503 and 125 bits for SIDH/SIKEp751 against quantum attacks, and 126 bits and 188 bits against classical attacks, respectively.

Because of this, you are not limited to the recommended cipher bit size, or even to AES. You can use any secure block cipher with an appropriate security level and mode.

Since AES provides a post-quantum security of half its key size, AES-256 is actually better matched to SIDH/SIKEp751. Against classical attacks, this results in 188 bits of security, and against quantum attacks, 125 bits.