Abstract
We present an attack on SIDH utilising isogenies between polarized products of two supersingular elliptic curves. In the case of arbitrary starting curve, our attack (discovered independently from [8]) has subexponential complexity, thus significantly reducing the security of SIDH and SIKE. When the endomorphism ring of the starting curve is known, our attack (here derived from [8]) has polynomial-time complexity assuming the generalised Riemann hypothesis. Our attack applies to any isogeny-based cryptosystem that publishes the images of points under the secret isogeny, for example Séta [13] and B-SIDH [11]. It does not apply to CSIDH [9], CSI-FiSh [3], or SQISign [14].
Author list in alphabetical order; see https://ams.org/profession/leaders/CultureStatement04.pdf. This paper is a merge of [24] by Maino and Martindale, which gives an attack on SIDH, and [39] by Wesolowski, which constitutes the proof of the main result in this paper. The implementation and algorithmic details of the implementation were contributed by Panny and Pope. This research was funded in part by the UK Engineering and Physical Sciences Research Council (EPSRC) Centre for Doctoral Training (CDT) in Trust, Identity, Privacy and Security in Large-scale Infrastructures (TIPS-at-Scale) at the Universities of Bristol and Bath, the Academia Sinica Investigator Award AS-IA-109-M01, the Agence Nationale de la Recherche under grant ANR MELODIA (ANR-20-CE40-0013), and the France 2030 program under grant agreement No. ANR-22-PETQ-0008 PQ-TLS.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
Maino had been working together with Castryck and Decru on a tangentially related project using similar underlying ideas.
- 2.
Together with the computation of the image of one point under said isogeny.
- 3.
In practice, the attacker computes \(\widehat{\varphi }_f\) and deduces \(\varphi _f\) from this.
References
Bernstein, D.J., De Feo, L., Leroux, A., Smith, B.: Faster computation of isogenies of large prime degree. In: Galbraith, S. (ed.) ANTS XIV: Proceedings of the Fourteenth Algorithmic Number Theory Symposium, pp. 39–55. Mathematical Sciences Publishers (2020). https://iac.r/2020/341
Bernstein, D.J., Lange, T., Martindale, C., Panny, L.: Quantum circuits for the CSIDH: optimizing quantum evaluation of isogenies. In: Ishai, Y., Rijmen, V. (eds.) EUROCRYPT 2019. LNCS, vol. 11477, pp. 409–441. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-17656-3_15
Beullens, W., Kleinjung, T., Vercauteren, F.: CSI-FiSh: efficient isogeny based signatures through class group computations. In: Galbraith, S.D., Moriai, S. (eds.) ASIACRYPT 2019. LNCS, vol. 11921, pp. 227–247. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-34578-5_9
Bisson, G., Cosset, R., Robert, D.: AVIsogenies (abelian varieties and isogenies). MAGMA package. https://gitlab.inria.fr/roberdam/avisogenies
Bottinelli, P., de Quehen, V., Leonardi, C., Mosunov, A., Pawlega, F., Sheth, M.: The Dark SIDH of Isogenies. Preprint (2019). https://ia.cr/2019/1333
Bröker, R., Howe, E.W., Lauter, K.E., Stevenhagen, P.: Genus-2 curves and Jacobians with a given number of points. LMS J. Comput. Math. 18(1), 170–197 (2015). https://doi.org/10.1112/S1461157014000461
Castel, P.: Solving quadratic equations in dimension 5 or more without factoring. Open Book Ser. 1(1), 213–233 (2013)
Castryck, W., Decru, T.: An efficient key recovery attack on SIDH (preliminary version). Preprint (2022). https://ia.cr/2022/975
Castryck, W., Lange, T., Martindale, C., Panny, L., Renes, J.: CSIDH: an efficient post-quantum commutative group action. In: Peyrin, T., Galbraith, S. (eds.) ASIACRYPT 2018. LNCS, vol. 11274, pp. 395–427. Springer, Cham (2018). https://doi.org/10.1007/978-3-030-03332-3_15
Cohen, H.: Number Theory: Volume I: Tools and Diophantine Equations, vol. 239. Springer, New York (2008). https://doi.org/10.1007/978-0-387-49923-9
Costello, C.: B-SIDH: supersingular isogeny Diffie-Hellman using twisted torsion. In: Moriai, S., Wang, H. (eds.) ASIACRYPT 2020. LNCS, vol. 12492, pp. 440–463. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-64834-3_15
Costello, C.: The case for SIKE: a decade of the supersingular isogeny problem. In: The NIST 3rd Post-Quantum Cryptography Standardization Conference (2021). https://ia.cr/2021/543
De Feo, L., et al.: Séta: supersingular encryption from torsion attacks. In: ASIACRYPT (4). LNCS, vol. 13093, pp. 249–278. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-92068-5_9
De Feo, L., Kohel, D., Leroux, A., Petit, C., Wesolowski, B.: SQISign: compact post-quantum signatures from quaternions and isogenies. In: Moriai, S., Wang, H. (eds.) ASIACRYPT 2020. LNCS, vol. 12491, pp. 64–93. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-64837-4_3
Eriksen, J.K., Panny, L., Sotáková, J., Veroni, M.: Deuring for the People: Supersingular Elliptic Curves with Prescribed Endomorphism Ring in General Characteristic. Preprint (2023). https://ia.cr/2023/106
Fouotsa, T.B., Kutas, P., Merz, S., Ti, Y.B.: On the isogeny problem with torsion point information. In: Hanaoka, G., Shikata, J., Watanabe, Y. (eds.) Public Key Cryptography (1). LNCS, vol. 13177, pp. 142–161. Springer, Cham (2022). https://doi.org/10.1007/978-3-030-97121-2_6
von zur Gathen, J., Gerhard, J.: Modern Computer Algebra, 3rd edn. Cambridge University Press, Cambridge (2013)
Jao, D., et al.: Supersingular Isogeny Key Encapsulation. Submission to [27] (2017, 2019, 2020). https://sike.org
Jao, D., De Feo, L.: Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. In: Yang, B.-Y. (ed.) PQCrypto 2011. LNCS, vol. 7071, pp. 19–34. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-25405-5_2
Kani, E.: The number of curves of genus two with elliptic differentials (1997). https://doi.org/10.1515/crll.1997.485.93
Kunzweiler, S.: Efficient Computation of \({(2^n,2^n)}\)-Isogenies. Preprint (2022). https://ia.cr/2022/990
Lubicz, D., Robert, D.: Fast change of level and applications to isogenies. In: ANTS XV: Proceedings of the Fifteenth Algorithmic Number Theory Symposium (2022). https://doi.org/10.1007/s40993-022-00407-9
Lubicz, D., Somoza, A.: AVIsogenies SageMath package. https://gitlab.inria.fr/roberdam/avisogenies/-/tree/sage
Maino, L., Martindale, C.: An attack on SIDH with arbitrary starting curve. Preprint (2022). Version 2: https://eprint.iacr.org/archive/2022/1026/20220825:192029
Maino, L., Martindale, C.: An attack on SIDH with arbitrary starting curve. Preprint (2022). Version 1: https://eprint.iacr.org/archive/2022/1026/20220808:211318
Milne, J.S.: Abelian varieties. In: Cornell, G., Silverman, J.H. (eds.) Arithmetic Geometry, pp. 103–150. Springer, New York (1986). https://doi.org/10.1007/978-1-4613-8655-1_5
National Institute of Standards and Technology: Post-Quantum Cryptography Standardization, December 2016. https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Post-Quantum-Cryptography-Standardization
Oudompheng, R., Panny, L., Pope, G., et al.: SageMath Reimplementation of the SIDH key recovery attack (2022). https://github.com/jack4818/Castryck-Decru-SageMath
Oudompheng, R., Pope, G.: A note on Reimplementing the Castryck-Decru attack and lessons learned for SageMath. Preprint (2022). https://ia.cr/2022/1283
Petit, C.: Faster algorithms for isogeny problems using torsion point images. In: Takagi, T., Peyrin, T. (eds.) ASIACRYPT 2017. LNCS, vol. 10625, pp. 330–353. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-70697-9_12
de Quehen, V., et al.: Improved torsion-point attacks on SIDH variants. In: Malkin, T., Peikert, C. (eds.) CRYPTO 2021. LNCS, vol. 12827, pp. 432–470. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-84252-9_15
Robert, D.: Breaking SIDH in polynomial time. Preprint (2022). https://ia.cr/2022/1038
Shoup, V.: Fast construction of irreducible polynomials over finite fields. J. Symb. Comput. 17(5), 371–391 (1994). https://doi.org/10.1006/jsco.1994.1025
Silverman, J.H.: The Arithmetic of Elliptic Curves, vol. 106. Springer, New York (2009). https://doi.org/10.1007/978-0-387-09494-6
Smith, B.: Explicit endomorphisms and correspondences. Ph.D. thesis, University of Sydney (2005)
The Sage Developers: SageMath, the Sage Mathematics Software System (Version 9.6) (2022). https://sagemath.org
Ti, Y.B.: Isogenies of Abelian Varieties in Cryptography. Ph.D. thesis, University of Auckland (2019)
Wesolowski, B.: The supersingular isogeny path and endomorphism ring problems are equivalent. In: 62nd IEEE Annual Symposium on Foundations of Computer Science, FOCS 2021, Denver, CO, USA, 7–10 February 2022, pp. 1100–1111. IEEE (2021). https://doi.org/10.1109/FOCS52979.2021.00109
Wesolowski, B.: Understanding and improving the Castryck-Decru attack on SIDH. Preprint (2022)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 International Association for Cryptologic Research
About this paper
Cite this paper
Maino, L., Martindale, C., Panny, L., Pope, G., Wesolowski, B. (2023). A Direct Key Recovery Attack on SIDH. In: Hazay, C., Stam, M. (eds) Advances in Cryptology – EUROCRYPT 2023. EUROCRYPT 2023. Lecture Notes in Computer Science, vol 14008. Springer, Cham. https://doi.org/10.1007/978-3-031-30589-4_16
Download citation
DOI: https://doi.org/10.1007/978-3-031-30589-4_16
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-30588-7
Online ISBN: 978-3-031-30589-4
eBook Packages: Computer ScienceComputer Science (R0)
