An Exposure Model for Supersingular Isogeny Diffie-Hellman Key Exchange
In this work, we present an exposure model for the isogeny computation in the quantum-resistant supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol. Notably, we propose this exposure model to characterize the severity of new attacks that force an SIDH user to divulge certain intermediate values. In our model, we show how an attacker can break SIDH by discovering an intermediate kernel point and its corresponding curve. To strengthen an SIDH-user against the exposure of intermediate values, we propose a random curve isomorphism that is performed just before the large-degree isogeny. We show that this countermeasure is computationally inexpensive compared to the whole of SIDH and can still operate with the Kirkwood et al. validation model that allows a static-key user to ensure the first round of the other party was performed honestly. The goal of this paper is to present an additional protection against future attacks for implementations of SIDH.
KeywordsPost-quantum cryptography Isogeny-based cryptography Exposure model
The authors would like to thank the reviewers for their comments. Also, the authors would like to thank Dr. Luca De Feo for discussion and feedback. This work is supported in part by the grants NIST-60NANB17D184, NIST-60NANB16D246, ARO W911NF-17-1-0311, and NSF CNS-1661557, as well as CryptoWorks21, Public Works and Government Services Canada, Canada First Research Excellence Fund, and an RBC Fellowship.
- 1.Azarderakhsh, R., Fishbein, D., Jao, D.: Efficient implementations of a quantum-resistant key-exchange protocol on embedded systems. Technical report, University of Waterloo (2014)Google Scholar
- 2.Azarderakhsh, R., Jao, D., Kalach, K., Koziel, B., Leonardi, C.: Key compression for isogeny-based cryptosystems. In: Proceedings of the 3rd ACM International Workshop on ASIA Public-Key Cryptography, AsiaPKC 2016, pp. 1–10. ACM (2016)Google Scholar
- 4.Chen, L., Jordan, S.: Report on Post-Quantum Cryptography. NIST IR 8105 (2016)Google Scholar
- 16.Kirkwood, D., Lackey, B.C., McVey, J., Motley, M., Solinas, J.A., Tuller, D.: Failure is not an option: standardization issues for post-quantum key agreement. Technical report, Workshop on Cybersecurity in a Post-Quantum World (2015)Google Scholar
- 18.Koziel, B., Azarderakhsh, R., Mozaffari-Kermani, M.: Fast hardware architectures for supersingular isogeny Diffie-Hellman key exchange on FPGA. In: Dunkelman, O., Sanadhya, S.K. (eds.) INDOCRYPT 2016. LNCS, vol. 10095, pp. 191–206. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-49890-4_11 CrossRefGoogle Scholar
- 20.Koziel, B., Jalali, A., Azarderakhsh, R., Jao, D., Mozaffari-Kermani, M.: NEON-SIDH: efficient implementation of supersingular isogeny Diffie-Hellman key exchange protocol on ARM. In: Foresti, S., Persiano, G. (eds.) CANS 2016. LNCS, vol. 10052, pp. 88–103. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-48965-0_6 CrossRefGoogle Scholar