An Exposure Model for Supersingular Isogeny Diffie-Hellman Key Exchange

Since its introduction by Jao and De Feo in 2011, the supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol has positioned itself as a promising candidate for post-quantum cryptography. One salient feature of the SIDH protocol is that it requires exceptionally short key sizes. However, the latency associated to SIDH is higher than the ones reported for other post-quantum cryptosystem proposals. Aiming to accelerate the SIDH runtime performance, we present in this work several algorithmic optimizations targeting both elliptic-curve and field arithmetic operations. We introduce in the context of the SIDH protocol a more efficient approach for calculating the elliptic curve operation <inline-formula><tex-math notation="LaTeX">$P+[k]Q$</tex-math></inline-formula> . Our strategy achieves a factor 1.4 speedup compared with the popular variable-three-point ladder algorithm regularly used in the SIDH shared secret phase. Moreover, profiting from pre-computation techniques our algorithm yields a factor 1.7 acceleration for the computation of this operation in the SIDH key generation phase. We also present an optimized evaluation of the point tripling formula, and discuss several algorithmic and implementation techniques that lead to faster field arithmetic computations. A software implementation of the above improvements on an Intel Skylake Core i7-6700 processor gives a factor 1.33 speedup against the state-of-the-art software implementation of the SIDH protocol reported by Costello-Longa-Naehrig in CRYPTO 2016.

In this work, we present a high-performance and scalable architecture for isogeny-based cryptosystems. In particular, we use the architecture in a fast, constant-time FPGA implementation of the quantum-resistant supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol. On a Virtex-7 FPGA, we show that our architecture is scalable by implementing at 83, 124, 168, and 252-bit quantum security levels. This is the first SIDH implementation at close to the 256-bit quantum security level to appear in literature. Further, our implementation completes the SIDH protocol 2 times faster than performance-optimized software implementations and 1.34 times faster than the previous best FPGA implementation, both running a similar set of formulas. Our implementation employs inversion-free projective isogeny formulas. By replicating multipliers and utilizing an efficient scheduling methodology, we can heavily parallelize quadratic extension field arithmetic and the isogeny evaluation stage of the large-degree isogeny computation. For a constant-time implementation of 124-bit quantum security SIDH on a Virtex-7 FPGA, we generate ephemeral public keys in 8.0 and 8.6 ms and generate the shared secret key in 7.1 and 7.9 ms for Alice and Bob, respectively. Finally, we show that this architecture could also be used to efficiently generate undeniable and digital signatures based on supersingular isogenies.

Recent progress in quantum physics shows that quantum computers may be a reality in the not too distant future. Post-quantum cryptography (PQC) refers to cryptographic schemes that are based on hard problems which are believed to be resistant to attacks from quantum computers. The supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol shows promising security properties among various post-quantum cryptosystems that have been proposed. In this paper, we propose two efficient modular multiplication algorithms with special primes that can be used in SIDH key exchange protocol. Hardware architectures for the two proposed algorithms are also proposed. The hardware implementations are provided and compared with the original modular multiplication algorithm. The results show that the proposed finite field multiplier is over 6.79 times faster than the original multiplier in hardware. Moreover, the SIDH hardware/software codesign implementation using the proposed FFM2 hardware is over 31 percent faster than the best SIDH software implementation.

Recent progress on quantum physics shows that quantum computers may be a reality in the not too distant future. Based on new mathematical hard problems, post-quantum cryptography (PQC) has been studied to make sure the attacks from quantum computers can be resistant. The latest supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol shows promising security properties among various post-quantum cryptosystems. In this paper, we propose an improved modular multiplication algorithm with special primes that can be used in SIDH key exchange protocol. Both software and hardware implementations are provided and compared with original modular multiplication algorithm. The results show that the software results of improved algorithm can be 24% faster than the original software implementation, while the hardware implementation based on the proposed hardware architecture can be 6 times faster than previous hardware implementation.

In cryptography, the key exchange protocol is very important before starting secure communication. Both parties will use an asymmetric key algorithm to exchange their keys for encryption and decryption. One of the methods to securely exchange the keys is Diffie-Hellman Key Exchange (DHKE) protocol. DHKE allows both parties to exchange their keys over the insecure public channel safely. However, DHKE protocol does not authenticate the message, making it easily exposed to third-party interruptions like Man-in-the-Middle (MitM) attack. Therefore, Station to Station (STS) protocols was introduced after modifying the DHKE protocol and adding authentication elements. Thus, this paper proposes to provide the authentication of the STS protocol by using Lamport Digital Signature Scheme. Lamport Digital Signature Scheme, also known as Lamport one-time signature scheme, gives very strong security because it can be built from any cryptographically secure one-way function and usually uses a cryptographic hash function. The results from the study are STS protocol algorithms that provide a verification scheme using the Lamport Digital Signature Scheme. As a result, both parties will obtain a common key for encryption and decryption, in which both parties play a role by using their respective digital signature for verification within the STS of this protocol

Modern key exchange protocols are usually based on the Diffie–Hellman (DH) primitive. The beauty of this primitive, among other things, is its potential reusage of key shares: DH shares can be either used a single time or in multiple runs. Since DH-based protocols are insecure against quantum adversaries, alternative solutions have to be found when moving to the post-quantum setting. However, most post-quantum candidates, including schemes based on lattices and even supersingular isogeny DH, are not known to be secure under key reuse. In particular, this means that they cannot be necessarily deployed as an immediate DH substitute in protocols.In this paper, we introduce the notion of a split key encapsulation mechanism (split KEM) to translate the desired key-reusability of a DH-based protocol to a KEM-based flow. We provide the relevant security notions of split KEMs and show how the formalism lends itself to lifting Signal’s \(\mathsf {X3DH}\) handshake to the post-quantum KEM setting without additional message flows.Although the proposed framework conceptually solves the raised issues, instantiating it securely from post-quantum assumptions proved to be non-trivial. We give passively secure instantiations from \(\mathsf {(R)LWE}\), yet overcoming the above-mentioned insecurities under key reuse in the presence of active adversaries remains an open problem. Approaching one-sided key reuse, we provide a split KEM instantiation that allows such reuse based on the KEM introduced by Kiltz (PKC 2007), which may serve as a post-quantum blueprint if the underlying hardness assumption (gap hashed Diffie–Hellman) holds for the commutative group action of CSIDH (Asiacrypt 2018).The intention of this paper hence is to raise awareness of the challenges arising when moving to KEM-based key exchange protocols with key-reusability, and to propose split KEMs as a specific target for instantiation in future research.KeywordsPost-quantumKey encapsulation mechanismsKey exchangeSignal protocolX3DH

Supersingular Isogeny Diffie-Hellman (SIDH) is a key exchange scheme that is believed to be quantum-resistant. It is based on the difficulty of finding a certain isogeny between given elliptic curves. Over the last nine years, optimizations have been proposed that significantly increased the performance of its implementations. Today, SIDH is a promising candidate in the US National Institute for Standards and Technology’s (NIST’s) post-quantum cryptography standardization process. This work is a self-contained introduction to the active research on SIDH from a high-level, algorithmic lens. After an introduction to elliptic curves and SIDH itself, we describe the mathematical and algorithmic building blocks of the fastest known implementations. Regarding elliptic curves, we describe which algorithms, data structures and trade-offs regard- ing elliptic curve arithmetic and isogeny computations exist and quantify their runtime cost in field operations. These findings are then tailored to the situation of SIDH. As a result, we give efficient algorithms for the performance-critical parts of the protocol.

key exchange primitive is a fundamental pillar in public key cryptography. Diffie-Hellman is an example of a keyexchange protocol, which enables the establishment of shared secret key over an insecure public channel between two parties. Different instantiations of Diffie-Hellman can be found based on the underlying group/set where the computations required for establishing the shared key are carried out. In this paper, three different implementations of Diffie-Hellman protocol will be reviewed and compared: the core Diffie-Hellman (DH) protocol, Elliptic Curve Diffie-Hellman (ECDH) as examples of secure protocols in a pre-quantum world, and Supersingular Isogeny Diffie-Hellman (SIDH) as an example of a quantum-safe protocol for key establishment. The steps of establishing the shared key in each instantiation will be shown, security analysis will be discussed for the different implementations in both pre- and post-quantum world, and finally, a brief comparison of the three instantiations will be drawn.

In this paper, we first give an overview of security architecture of mobile WiMAX network. Then, we investigate man-in-the-middle attacks and Denial of Service (DoS) attacks toward 802.16e-based Mobile WiMAX network. We find the initial network procedure is not effectively secured that makes Man-in-the-middle and Dos attacks possible. In addition, we find the resource saving and handover procedure is not secured enough to resist DoS attacks. Focusing on these two kinds of attacks, we propose Secure Initial Network Entry Protocol (SINEP) based on Diffie-Hellman (DH) key exchange protocol to enhance the security level during network initial. We modify DH key exchange protocol to fit it into mobile WiMAX network as well as to eliminate existing weakness in original DH key exchange protocol.

To the best of our knowledge, we present the first hardware implementation of isogeny-based cryptography available in the literature. Particularly, we present the first implementation of the supersingular isogeny Diffie-Hellman (SIDH) key exchange, which features quantum-resistance. We optimize this design for speed by creating a high throughput multiplier unit, taking advantage of parallelization of arithmetic in Fp2, and minimizing pipeline stalls with optimal scheduling. Consequently, our results are also faster than software libraries running affine SIDH even on Intel Haswell processors. For our implementation at 85-bit quantum security and 128-bit classical security, we generate ephemeral public keys in 1.655 million cycles for Alice and 1.490 million cycles for Bob. We generate the shared secret in an additional 1.510 million cycles for Alice and 1.312 million cycles for Bob. On a Virtex-7, these results are approximately 1.5 times faster than known software implementations running the same 512-bit SIDH. Our results and observations show that the isogeny-based schemes can be implemented with high efficiency on reconfigurable hardware.

Many authentication and key exchange protocols are built using an accepted set of standard concepts such as Diffie-Hellman key exchange, nonces to avoid replay, certificates from an accepted authority, and encrypted or signed messages. We introduce a basic framework for deriving security protocols from such simple components. As a case study, we examine the structure of a family of key exchange protocols that includes station-to-station (STS), ISO-9798-3, just fast keying (JFK), IKE and related protocols, deriving all members of the family from two basic protocols using a small set of refinements and protocol transformations. As initial steps toward associating logical derivations with protocol derivations, we extend a previous security protocol logic with preconditions and temporal assertions. Using this logic, we prove the security properties of the standard signature based challenge-response protocol and the Diffie-Hellman key exchange protocol. The ISO-9798-3 protocol is then proved correct by composing the correctness proofs of these two simple protocols.

Diffie-Hellman (D-H) key exchange protocol, first published in 1976 is one of the most distinguished and widely used secured key exchange protocols. The protocol makes it possible to exchange a symmetric key between two parties over an unsecured communication channel without pre-agreement of any shared secret. The D-H key exchange protocol however requires a pre-set public parameters P (a large prime) and g a generator of ℤp to be public i.e. known to all users of the system. This paper proposes a key exchange mechanism without any public parameter. Unlike D-H key exchange mechanism our scheme uses encryption to transmit intermediate data during key exchange stage, thus it is non-vulnerable to man-in-the-middle attach.

The analysis of real-world protocols, in particular key exchange protocols and protocols building on these protocols, is a very complex, error-prone, and tedious task. Besides the complexity of the protocols itself, one important reason for this is that the security of the protocols has to be reduced to the security of the underlying cryptographic primitives for every protocol time and again. We would therefore like to get rid of reduction proofs for real-world key exchange protocols as much as possible and in many cases altogether, also for higher-level protocols which use the exchanged keys. So far some first steps have been taken in this direction. But existing work is still quite limited, and, for example, does not support Diffie-Hellman (DH) key exchange, a prevalent cryptographic primitive for real-world protocols. In this paper, building on work by Kusters and Tuengerthal, we provide an ideal functionality in the universal composability setting which supports several common cryptographic primitives, including DH key exchange. This functionality helps to avoid reduction proofs in the analysis of real-world protocols and often eliminates them completely. We also propose a new general ideal key exchange functionality which allows higherlevel protocols to use exchanged keys in an ideal way. As a proof of concept, we apply our framework to three practical DH key exchange protocols, namely ISO 9798-3, SIGMA, and OPTLS.

This chapter explains the elements of key exchange, specifically the steps in a key exchange protocol, the parties that are involved and the messages which may be sent. It details key exchange security models and protocols, considering first the simpler case of unauthenticated key exchange before turning to authenticated protocols. The chapter deals with key exchange protocols designed to be secure against a passive adversary. It examines that unauthenticated protocols may be used as building blocks for authenticated key exchange protocols. Key exchange protocols that allow parties to verify the identity of other participating parties are called authenticated key exchange protocols. Key exchange has a long history and a vast literature, yet remains a very active research area with significant practical impact. It is inevitable that as new computational assumptions emerge as the basis for cryptographic security, so will their use in key exchange be relevant.

We introduce models of computation that enable direct comparisons between classical and quantum algorithms. Incorporating previous work on quantum computation and error correction, we justify the use of the gate-count and depth-times-width cost metrics for quantum circuits. We demonstrate the relevance of these models to cryptanalysis by revisiting, and increasing, the security estimates for the Supersingular Isogeny Diffie–Hellman (SIDH) and Supersingular Isogeny Key Encapsulation (SIKE) schemes. Our models, analyses, and physical justifications have applications to a number of memory intensive quantum algorithms.