A Faster Software Implementation of the Supersingular Isogeny Diffie-Hellman Key Exchange Protocol

In this work, we present a high-performance and scalable architecture for isogeny-based cryptosystems. In particular, we use the architecture in a fast, constant-time FPGA implementation of the quantum-resistant supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol. On a Virtex-7 FPGA, we show that our architecture is scalable by implementing at 83, 124, 168, and 252-bit quantum security levels. This is the first SIDH implementation at close to the 256-bit quantum security level to appear in literature. Further, our implementation completes the SIDH protocol 2 times faster than performance-optimized software implementations and 1.34 times faster than the previous best FPGA implementation, both running a similar set of formulas. Our implementation employs inversion-free projective isogeny formulas. By replicating multipliers and utilizing an efficient scheduling methodology, we can heavily parallelize quadratic extension field arithmetic and the isogeny evaluation stage of the large-degree isogeny computation. For a constant-time implementation of 124-bit quantum security SIDH on a Virtex-7 FPGA, we generate ephemeral public keys in 8.0 and 8.6 ms and generate the shared secret key in 7.1 and 7.9 ms for Alice and Bob, respectively. Finally, we show that this architecture could also be used to efficiently generate undeniable and digital signatures based on supersingular isogenies.

Recent progress in quantum physics shows that quantum computers may be a reality in the not too distant future. Post-quantum cryptography (PQC) refers to cryptographic schemes that are based on hard problems which are believed to be resistant to attacks from quantum computers. The supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol shows promising security properties among various post-quantum cryptosystems that have been proposed. In this paper, we propose two efficient modular multiplication algorithms with special primes that can be used in SIDH key exchange protocol. Hardware architectures for the two proposed algorithms are also proposed. The hardware implementations are provided and compared with the original modular multiplication algorithm. The results show that the proposed finite field multiplier is over 6.79 times faster than the original multiplier in hardware. Moreover, the SIDH hardware/software codesign implementation using the proposed FFM2 hardware is over 31 percent faster than the best SIDH software implementation.

In this work, we present an exposure model for the isogeny computation in the quantum-resistant supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol. Notably, we propose this exposure model to characterize the severity of new attacks that force an SIDH user to divulge certain intermediate values. In our model, we show how an attacker can break SIDH by discovering an intermediate kernel point and its corresponding curve. To strengthen an SIDH-user against the exposure of intermediate values, we propose a random curve isomorphism that is performed just before the large-degree isogeny. We show that this countermeasure is computationally inexpensive compared to the whole of SIDH and can still operate with the Kirkwood et al. validation model that allows a static-key user to ensure the first round of the other party was performed honestly. The goal of this paper is to present an additional protection against future attacks for implementations of SIDH.

Recent progress on quantum physics shows that quantum computers may be a reality in the not too distant future. Based on new mathematical hard problems, post-quantum cryptography (PQC) has been studied to make sure the attacks from quantum computers can be resistant. The latest supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol shows promising security properties among various post-quantum cryptosystems. In this paper, we propose an improved modular multiplication algorithm with special primes that can be used in SIDH key exchange protocol. Both software and hardware implementations are provided and compared with original modular multiplication algorithm. The results show that the software results of improved algorithm can be 24% faster than the original software implementation, while the hardware implementation based on the proposed hardware architecture can be 6 times faster than previous hardware implementation.

In cryptography, the key exchange protocol is very important before starting secure communication. Both parties will use an asymmetric key algorithm to exchange their keys for encryption and decryption. One of the methods to securely exchange the keys is Diffie-Hellman Key Exchange (DHKE) protocol. DHKE allows both parties to exchange their keys over the insecure public channel safely. However, DHKE protocol does not authenticate the message, making it easily exposed to third-party interruptions like Man-in-the-Middle (MitM) attack. Therefore, Station to Station (STS) protocols was introduced after modifying the DHKE protocol and adding authentication elements. Thus, this paper proposes to provide the authentication of the STS protocol by using Lamport Digital Signature Scheme. Lamport Digital Signature Scheme, also known as Lamport one-time signature scheme, gives very strong security because it can be built from any cryptographically secure one-way function and usually uses a cryptographic hash function. The results from the study are STS protocol algorithms that provide a verification scheme using the Lamport Digital Signature Scheme. As a result, both parties will obtain a common key for encryption and decryption, in which both parties play a role by using their respective digital signature for verification within the STS of this protocol

Modern key exchange protocols are usually based on the Diffie–Hellman (DH) primitive. The beauty of this primitive, among other things, is its potential reusage of key shares: DH shares can be either used a single time or in multiple runs. Since DH-based protocols are insecure against quantum adversaries, alternative solutions have to be found when moving to the post-quantum setting. However, most post-quantum candidates, including schemes based on lattices and even supersingular isogeny DH, are not known to be secure under key reuse. In particular, this means that they cannot be necessarily deployed as an immediate DH substitute in protocols.In this paper, we introduce the notion of a split key encapsulation mechanism (split KEM) to translate the desired key-reusability of a DH-based protocol to a KEM-based flow. We provide the relevant security notions of split KEMs and show how the formalism lends itself to lifting Signal’s \(\mathsf {X3DH}\) handshake to the post-quantum KEM setting without additional message flows.Although the proposed framework conceptually solves the raised issues, instantiating it securely from post-quantum assumptions proved to be non-trivial. We give passively secure instantiations from \(\mathsf {(R)LWE}\), yet overcoming the above-mentioned insecurities under key reuse in the presence of active adversaries remains an open problem. Approaching one-sided key reuse, we provide a split KEM instantiation that allows such reuse based on the KEM introduced by Kiltz (PKC 2007), which may serve as a post-quantum blueprint if the underlying hardness assumption (gap hashed Diffie–Hellman) holds for the commutative group action of CSIDH (Asiacrypt 2018).The intention of this paper hence is to raise awareness of the challenges arising when moving to KEM-based key exchange protocols with key-reusability, and to propose split KEMs as a specific target for instantiation in future research.KeywordsPost-quantumKey encapsulation mechanismsKey exchangeSignal protocolX3DH

To the best of our knowledge, we present the first hardware implementation of isogeny-based cryptography available in the literature. Particularly, we present the first implementation of the supersingular isogeny Diffie-Hellman (SIDH) key exchange, which features quantum-resistance. We optimize this design for speed by creating a high throughput multiplier unit, taking advantage of parallelization of arithmetic in Fp2, and minimizing pipeline stalls with optimal scheduling. Consequently, our results are also faster than software libraries running affine SIDH even on Intel Haswell processors. For our implementation at 85-bit quantum security and 128-bit classical security, we generate ephemeral public keys in 1.655 million cycles for Alice and 1.490 million cycles for Bob. We generate the shared secret in an additional 1.510 million cycles for Alice and 1.312 million cycles for Bob. On a Virtex-7, these results are approximately 1.5 times faster than known software implementations running the same 512-bit SIDH. Our results and observations show that the isogeny-based schemes can be implemented with high efficiency on reconfigurable hardware.

key exchange primitive is a fundamental pillar in public key cryptography. Diffie-Hellman is an example of a keyexchange protocol, which enables the establishment of shared secret key over an insecure public channel between two parties. Different instantiations of Diffie-Hellman can be found based on the underlying group/set where the computations required for establishing the shared key are carried out. In this paper, three different implementations of Diffie-Hellman protocol will be reviewed and compared: the core Diffie-Hellman (DH) protocol, Elliptic Curve Diffie-Hellman (ECDH) as examples of secure protocols in a pre-quantum world, and Supersingular Isogeny Diffie-Hellman (SIDH) as an example of a quantum-safe protocol for key establishment. The steps of establishing the shared key in each instantiation will be shown, security analysis will be discussed for the different implementations in both pre- and post-quantum world, and finally, a brief comparison of the three instantiations will be drawn.

In this paper, we first give an overview of security architecture of mobile WiMAX network. Then, we investigate man-in-the-middle attacks and Denial of Service (DoS) attacks toward 802.16e-based Mobile WiMAX network. We find the initial network procedure is not effectively secured that makes Man-in-the-middle and Dos attacks possible. In addition, we find the resource saving and handover procedure is not secured enough to resist DoS attacks. Focusing on these two kinds of attacks, we propose Secure Initial Network Entry Protocol (SINEP) based on Diffie-Hellman (DH) key exchange protocol to enhance the security level during network initial. We modify DH key exchange protocol to fit it into mobile WiMAX network as well as to eliminate existing weakness in original DH key exchange protocol.

Many authentication and key exchange protocols are built using an accepted set of standard concepts such as Diffie-Hellman key exchange, nonces to avoid replay, certificates from an accepted authority, and encrypted or signed messages. We introduce a basic framework for deriving security protocols from such simple components. As a case study, we examine the structure of a family of key exchange protocols that includes station-to-station (STS), ISO-9798-3, just fast keying (JFK), IKE and related protocols, deriving all members of the family from two basic protocols using a small set of refinements and protocol transformations. As initial steps toward associating logical derivations with protocol derivations, we extend a previous security protocol logic with preconditions and temporal assertions. Using this logic, we prove the security properties of the standard signature based challenge-response protocol and the Diffie-Hellman key exchange protocol. The ISO-9798-3 protocol is then proved correct by composing the correctness proofs of these two simple protocols.

Diffie-Hellman (D-H) key exchange protocol, first published in 1976 is one of the most distinguished and widely used secured key exchange protocols. The protocol makes it possible to exchange a symmetric key between two parties over an unsecured communication channel without pre-agreement of any shared secret. The D-H key exchange protocol however requires a pre-set public parameters P (a large prime) and g a generator of ℤp to be public i.e. known to all users of the system. This paper proposes a key exchange mechanism without any public parameter. Unlike D-H key exchange mechanism our scheme uses encryption to transmit intermediate data during key exchange stage, thus it is non-vulnerable to man-in-the-middle attach.

The analysis of real-world protocols, in particular key exchange protocols and protocols building on these protocols, is a very complex, error-prone, and tedious task. Besides the complexity of the protocols itself, one important reason for this is that the security of the protocols has to be reduced to the security of the underlying cryptographic primitives for every protocol time and again. We would therefore like to get rid of reduction proofs for real-world key exchange protocols as much as possible and in many cases altogether, also for higher-level protocols which use the exchanged keys. So far some first steps have been taken in this direction. But existing work is still quite limited, and, for example, does not support Diffie-Hellman (DH) key exchange, a prevalent cryptographic primitive for real-world protocols. In this paper, building on work by Kusters and Tuengerthal, we provide an ideal functionality in the universal composability setting which supports several common cryptographic primitives, including DH key exchange. This functionality helps to avoid reduction proofs in the analysis of real-world protocols and often eliminates them completely. We also propose a new general ideal key exchange functionality which allows higherlevel protocols to use exchanged keys in an ideal way. As a proof of concept, we apply our framework to three practical DH key exchange protocols, namely ISO 9798-3, SIGMA, and OPTLS.

In this paper, we revisit multi-party Diffie-Hellman key exchange (DHKE) protocols by using multi-linear mappings and Weil pairings over elliptic curves. We show how to construct a 4-linear Weil pairing and illustrate the approach by examples. Finally, we present several necessary conditions to find a distortion map for a 5-party DHKE protocol.

Dynamic conferencing refers to a scenario wherein any subset of users in a universe of users form a conference for sharing confidential information among themselves. The key distribution (KD) problem in dynamic conferencing is to compute a shared secret key for such a dynamically formed conference. In literature, the KD schemes for dynamic conferencing either are computationally unscalable or require communication among users, which is undesirable. The extended symmetric polynomial based dynamic conferencing scheme (ESPDCS) is one such KD scheme which has a high computational complexity that is universe size dependent. In this paper we present an enhancement to the ESPDCS scheme to develop a KD scheme called universe-independent SPDCS (UI-SPDCS) such that its complexity is independent of the universe size. However, the UI-SPDCS scheme does not scale with the conference size. We propose a relatively scalable KD scheme termed as DH-SPDCS that uses the UI-SPDCS scheme and the tree-based group Diffie-Hellman (TGDH) key exchange protocol. The proposed DH-SPDCS scheme provides a configurable trade-off between computation and communication complexity of the scheme.

One of the earliest examples of public key cryptography is the Diffie-Hellman key exchange protocol, which is based on the discrete logarithm problem. In 2000, Ko, Lee et al. modified the Diffie-Hellman protocol by using braid groups as platform where the security of the protocol lies on the conjugacy search problem. In this paper, we propose two key exchange protocols that use two well known classes of nonassociative Moufang loops as potential platforms.