Questions tagged [isogeny]

Elliptic curve isogenies are structure-preserving maps between elliptic curves which have been proposed as a foundation of post-quantum cryptosystems.

41 questions
Filter by
Sorted by
Tagged with
529 views

Supersingular Isogeny Key Exchange broken?

Found this report detailing a quantum algorithm for computing isogenies between supersingular elliptic curves. https://cacr.uwaterloo.ca/techreports/2014/cacr2014-24.pdf with the quote "...
89 views

CSIDH - l ideal generators

I am trying to study the CSIDH algorithm. I have some beginner background in elliptic curves and I have been following Andrew Sutherland's lectures (https://math.mit.edu/classes/18.783/2019/lectures....
414 views

How to get an optimal strategy in computing isogenies for SIDH/SIKE

How to get a strategy $(s_1,...,s_{t-1})$ as mentioned in section 1.3.7 of SIKE spec? If possible, can anyone give me an example? And why do we need to compute all leaf point? I though we just need ...
443 views

Finding the subgroup in isogeny-based cryptography

Isogeny-based cryptography is one of the newest post-quantum cryptography. Hardness of this system is based on finding isogeny between two elliptic curves. Also this is theorem: Elliptic curves are ...
166 views

SIKE: choice of n

The "Supersingular Isogeny Key Encapsulation" proposal submited to PQC-NIST (PDF) defines the value $n$ to be from set $\{192,256,320\}$ (see point 1.4). Does anybody have an idea to what it ...
851 views

Can Microsoft's SIDH (Supersingular Isogeny) keypairs be reused for encryption? If not, why?

I was considering using Microsoft's SIDH implementation for post-quantum public-key encryption because of its relatively small key size. I realized however, thanks to Issue #4, that it might not be as ...
298 views

Any Supersingular Isogeny-based Diffie-Hellman (SIDH) key exchange recommended Curve Domain Parameters?

For existing ECDH, I understand that there are recommended Elliptic Curve Domain Parameters. May I know if there are such similar considerations in SIDH? Any recommended Curve Domain Parameters?
204 views

Parameter choice Supersingular Isogeny DH

In “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies” by DeFeo, Jao and Plut (PDF), the public parameters are defined as: Supersingular curve $E$, and bases $P, Q$ ...
274 views

How does the key size in supersingular isogeny schemes relate to their security level?

I'm looking at the De Feo, Jao, and Plût 2014 paper: Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. My understanding of section 3.2 Key Exchange, is that Alice'...
690 views

Elliptic Curve Isogenies, Frobenius endomorphism relation to characteristic equation

In Schoof's 1995 paper, Counting points on elliptic curves over finite fields, page 236, Proposition 6.1(i) states: Let $\mathbb{E}$ be an elliptic curve over $\mathbb{F}_p$. Suppose that its $j$-...
324 views

How can I calculate the security level provided by a supersingular Elliptic Curve?

I want to know what security level is provided by an elliptic curve used in Supersingular isogeny Diffie–Hellman key exchange (SIDH). Is there any mathematical convention to follow or by looking at ...
473 views

PQ Key Exchange based on Elliptic Curve Isogenies

I was reading the Wikipedia article on Post Quantum Cryptography and was interested in opinions as to whether the Supersingular Elliptic Curve Isogeny Diffie-Hellman listed there would be a good Post ...
138 views

Why are computations (isogeny) in SIDH done in an extended prime field?

While reading the SIDH key exchange protocol, I noticed that all the isogeny computations and curves are defined over the extended prime field $\mathbb{F}_{p^2}$. Does it make the problem ...
143 views

572 views

How to compute a smooth-degree isogeny given a generator point of its kernel?

I need to compute an isogeny from $E: y^2 = x^3 + ax + b$, given a generator point for its kernel subgroup, using Python. The point has smooth order. I need both the parameters for the curve and ...
138 views

How could you find the preimage of an isogeny function?

How do you know if an isogeny is surjective or not, and how do you tell how many points on E maps to E'? Does the answer lie in the degree of the isogeny function?
70 views

Independent parameters basis for torsion-groups in SIDH: Is the Weil-pairing necessary?

In the original SIDH paper by De Feo, Jao and Plût, the basis points $P_A$ and $Q_A$ are supposed to be independent points in $E(\mathbb{F}_{p^2})$ of order $\ell_A^{e_A}$ for some small prime $\ell_A$...
161 views

How to Sample from Frobenius Eigenspace?

So I was implementing the $2$-point method described here, which requires to samples two points $P_0, P_1$ in the Frobenius eigenspace initially. It uses a method called Elligator, which seems to ...
149 views

Supersingular isogeny Diffie–Hellman key exchange (SIDH) Library Support AES-256?

In the version 3.0 of the SIDH library, it implements SIDH/SIKEp503 (AES-128) and SIDH/SIKEp751 (AES-192) only. Are there plans to incorporate AES-256? Nathan Aw
78 views

Cryptographic invariant maps

In [BGK+18] in section 4, Boneh et al. write that: For any choice of ideal classes $\mathfrak{a}_1,\dots,\mathfrak{a}_n,\mathfrak{a}_1',\dots,\mathfrak{a}_n'$ in ${Cl}(\mathcal{O})$, the abelian ...
78 views

For this question I'm referring to the ed25519 algorithm In blockchain one project (Monero) shot itself in the foot a while back by having senders derive public keys from an ed25519 pair, by ...
Let $E$ be a supersingular elliptic curve over $\mathbb{F}_{p^2}$, where $p = \ell_A^{e_A} \ell_B^{e_B} f \pm 1$ for some primes $\ell_A, \ell_B$. Let $R \in E[\ell_A^{e_A}]$ be a point of order $\... 1answer 94 views Has Burdges and De Feo's concept of Delayed Encryption ever been implemented? In mid 2020 Jeffrey Burdges and Luca De Feo published a paper proposing a trapdoor-less time-lock puzzle called Delay Encryption. Has a prototype of this ever been made? 2answers 113 views SIKE as Diffie-Hellman exchange SIKE involves a Diffie-Hellman like construction using isogenies between elliptic curves. Is it possible to express it as an instance of Diffie-Hellman? I.e. what is the underlying group if so, and ... 2answers 143 views SIDH cryptosystem question I'm trying to understand the SIDH cryptosystem and got confused at this point: Alice fixes base$\{P_A,Q_A\}$so that it generates$E_0[l_A^{e_A}]$. Then she chooses secret parameters$m_A,n_A$and ... 1answer 237 views Exactly what part of SIDH is proven to be NP-hard? SIDH is quantum secure, why is it quantum secure? Exactly which part of the algorithm is proven to be NP-hard? Computing the isogeny function? 1answer 333 views What basic knowledge is required to understand SIKE? I'm interested in learning about Supersingular Isogeny based Key Encapsulation mechanism. Currently, I only know all the basic knowledge about how standard Elliptic Curve Cryptography, works, using ... 0answers 77 views How to Reduce a Quaternion Ideal into Power Smoothness? (TL;DR) How exactly do we reduce a quaternion ideal into another powersmooth one? Given a supersingular elliptic curve, it is known that its endomorphism ring is non-commutative. Specifically, there ... 0answers 64 views What does the absence of Abelian group actions on supersingular isogenies implicate? There are no Abelian group actions on supersingular isogenies. Why does this make them secure? - motivated by De Feo's Paper on mathematics of IBS 1answer 270 views Quantum bit level security of Supersingular Isogeny based Diffie Hellman scheme I'm a newbie in studying and learning how SIDH works. I have a simple doubt. So my question is in the SIKE submission present in this link (https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/... 1answer 75 views Public points in SIDH I was going through a presentation titled "SIKE in Hardware" by professor Reza Azarderakhsh. On the page$10$of the presentation he introduces a variable$w$. Could you please explain what the ... 1answer 83 views Characteristics of an isogeny between super-singular elliptic curves I believe I've read this before, but I can't find it despite hours of searching on Google. I've know the common definition of isogeny in elliptic curves, as$\phi:E_1 \rightarrow E_2$a nonconstant ... 1answer 156 views Using Microsoft SIDH library for messages signing SIDH library looks good but lacks documentation and samples. The only signature-related code was found at http://github.com/yhyoo93/isogenysignature/blob/master/tests/kex_tests.c appeared not able to ... 1answer 78 views Theorem of the dual isogeny in SIDH Zk proof In the proof of soundness for the SIDH ZK proof protocol (section 6.2 in DJP11) the authors refer to the "Theorem of the dual isogeny". What do they mean by this? In particular, I don't ... 1answer 116 views SIKE algorithm 2 I was recently reading this paper on SIKE and there on page 20 I encountered algorithm 2. I understanding line 14 of algorithm 2 in sike but I don't understanding line 17 of algorithm 2.$h (s || (c_0,...
Consider the following variants of the CSIDH squaring problem. P1. Given $sE, E$ where $s$ is a random ideal class and $E$ is a random curve (reachable from initial $E_0$), find $s^2E$ P2. Given $sE_0$...