Loop-Abort Faults on Supersingular Isogeny Cryptosystems

Abstract

Cryptographic schemes based on supersingular isogenies have become an active area of research in the field of post-quantum cryptography. We investigate the resistance of these cryptosystems to fault injection attacks. It appears that the iterative structure of the secret isogeny computation renders these schemes vulnerable to loop-abort attacks. Loop-abort faults allow to perform a full key recovery, bypassing all the previously introduced validation methods. Therefore implementing additional countermeasures seems unavoidable for applications where physical attacks are relevant.

A When P and Q Are Not a Basis of the Torsion

The implementation proposed by [5, 15] uses a pair of points P and Q in $E[\ell ^k]$ that does not generate the full group $E[\ell ^k]$, in order to achieve better compression. The point P is chosen to be a point of order $\ell ^k$, and Q is set as the image of P by the distortion map $(x,y) \mapsto (-x,iy)$ (where $i^2 = -1$).

They prove that because of this construction, when $\ell = 2$, the sum $P+Q$ has order $2^{k-1}$ (instead of the expected $2^k$). Thus every point of the form $P+[a]Q$ for a even has order $2^k$. Caution is required when applying to P and Q results that are meant to be applied to a basis of $E[2^k]$. It appears for instance in [9, Lemma 3.2], where the factor $2^{k-1}$ should be replaced by $2^{k-2}$ when using this pair (P, Q).

Also, if a is generated following the guidelines of [5] (as $a = 2m$ for $m\in \{1,2,\dots ,2^{k-1}\}$), then its most significant bit is superfluous. Indeed, the kernel of the first isogeny is necessarily the group generated by $[2^{k-1}] P = - [2^{k-1}] Q$. Then, the image of $P+[a]Q$ under this isogeny is the same as the image of $P+[a+2^{k-1}]Q$. It follows that the secret a leads to the same shared secret as its reduction $a \bmod 2^{k-1}$. Therefore the secret $a = 2m$ could be chosen with $m < 2^{k-2}$.