Post-Quantum Cryptography on FPGA Based on Isogenies on Elliptic Curves

Supersingular Isogeny Diffie-Hellman (SIDH) is a key exchange scheme that is believed to be quantum-resistant. It is based on the difficulty of finding a certain isogeny between given elliptic curves. Over the last nine years, optimizations have been proposed that significantly increased the performance of its implementations. Today, SIDH is a promising candidate in the US National Institute for Standards and Technology’s (NIST’s) post-quantum cryptography standardization process. This work is a self-contained introduction to the active research on SIDH from a high-level, algorithmic lens. After an introduction to elliptic curves and SIDH itself, we describe the mathematical and algorithmic building blocks of the fastest known implementations. Regarding elliptic curves, we describe which algorithms, data structures and trade-offs regard- ing elliptic curve arithmetic and isogeny computations exist and quantify their runtime cost in field operations. These findings are then tailored to the situation of SIDH. As a result, we give efficient algorithms for the performance-critical parts of the protocol.

Recent progress in quantum physics shows that quantum computers may be a reality in the not too distant future. Post-quantum cryptography (PQC) refers to cryptographic schemes that are based on hard problems which are believed to be resistant to attacks from quantum computers. The supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol shows promising security properties among various post-quantum cryptosystems that have been proposed. In this paper, we propose two efficient modular multiplication algorithms with special primes that can be used in SIDH key exchange protocol. Hardware architectures for the two proposed algorithms are also proposed. The hardware implementations are provided and compared with the original modular multiplication algorithm. The results show that the proposed finite field multiplier is over 6.79 times faster than the original multiplier in hardware. Moreover, the SIDH hardware/software codesign implementation using the proposed FFM2 hardware is over 31 percent faster than the best SIDH software implementation.

Since its introduction by Jao and De Feo in 2011, the supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol has positioned itself as a promising candidate for post-quantum cryptography. One salient feature of the SIDH protocol is that it requires exceptionally short key sizes. However, the latency associated to SIDH is higher than the ones reported for other post-quantum cryptosystem proposals. Aiming to accelerate the SIDH runtime performance, we present in this work several algorithmic optimizations targeting both elliptic-curve and field arithmetic operations. We introduce in the context of the SIDH protocol a more efficient approach for calculating the elliptic curve operation <inline-formula><tex-math notation="LaTeX">$P+[k]Q$</tex-math></inline-formula> . Our strategy achieves a factor 1.4 speedup compared with the popular variable-three-point ladder algorithm regularly used in the SIDH shared secret phase. Moreover, profiting from pre-computation techniques our algorithm yields a factor 1.7 acceleration for the computation of this operation in the SIDH key generation phase. We also present an optimized evaluation of the point tripling formula, and discuss several algorithmic and implementation techniques that lead to faster field arithmetic computations. A software implementation of the above improvements on an Intel Skylake Core i7-6700 processor gives a factor 1.33 speedup against the state-of-the-art software implementation of the SIDH protocol reported by Costello-Longa-Naehrig in CRYPTO 2016.

In this work, we present a high-performance and scalable architecture for isogeny-based cryptosystems. In particular, we use the architecture in a fast, constant-time FPGA implementation of the quantum-resistant supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol. On a Virtex-7 FPGA, we show that our architecture is scalable by implementing at 83, 124, 168, and 252-bit quantum security levels. This is the first SIDH implementation at close to the 256-bit quantum security level to appear in literature. Further, our implementation completes the SIDH protocol 2 times faster than performance-optimized software implementations and 1.34 times faster than the previous best FPGA implementation, both running a similar set of formulas. Our implementation employs inversion-free projective isogeny formulas. By replicating multipliers and utilizing an efficient scheduling methodology, we can heavily parallelize quadratic extension field arithmetic and the isogeny evaluation stage of the large-degree isogeny computation. For a constant-time implementation of 124-bit quantum security SIDH on a Virtex-7 FPGA, we generate ephemeral public keys in 8.0 and 8.6 ms and generate the shared secret key in 7.1 and 7.9 ms for Alice and Bob, respectively. Finally, we show that this architecture could also be used to efficiently generate undeniable and digital signatures based on supersingular isogenies.

Recent progress on quantum physics shows that quantum computers may be a reality in the not too distant future. Based on new mathematical hard problems, post-quantum cryptography (PQC) has been studied to make sure the attacks from quantum computers can be resistant. The latest supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol shows promising security properties among various post-quantum cryptosystems. In this paper, we propose an improved modular multiplication algorithm with special primes that can be used in SIDH key exchange protocol. Both software and hardware implementations are provided and compared with original modular multiplication algorithm. The results show that the software results of improved algorithm can be 24% faster than the original software implementation, while the hardware implementation based on the proposed hardware architecture can be 6 times faster than previous hardware implementation.

key exchange primitive is a fundamental pillar in public key cryptography. Diffie-Hellman is an example of a keyexchange protocol, which enables the establishment of shared secret key over an insecure public channel between two parties. Different instantiations of Diffie-Hellman can be found based on the underlying group/set where the computations required for establishing the shared key are carried out. In this paper, three different implementations of Diffie-Hellman protocol will be reviewed and compared: the core Diffie-Hellman (DH) protocol, Elliptic Curve Diffie-Hellman (ECDH) as examples of secure protocols in a pre-quantum world, and Supersingular Isogeny Diffie-Hellman (SIDH) as an example of a quantum-safe protocol for key establishment. The steps of establishing the shared key in each instantiation will be shown, security analysis will be discussed for the different implementations in both pre- and post-quantum world, and finally, a brief comparison of the three instantiations will be drawn.

In this work, we present an exposure model for the isogeny computation in the quantum-resistant supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol. Notably, we propose this exposure model to characterize the severity of new attacks that force an SIDH user to divulge certain intermediate values. In our model, we show how an attacker can break SIDH by discovering an intermediate kernel point and its corresponding curve. To strengthen an SIDH-user against the exposure of intermediate values, we propose a random curve isomorphism that is performed just before the large-degree isogeny. We show that this countermeasure is computationally inexpensive compared to the whole of SIDH and can still operate with the Kirkwood et al. validation model that allows a static-key user to ensure the first round of the other party was performed honestly. The goal of this paper is to present an additional protection against future attacks for implementations of SIDH.

Modern key exchange protocols are usually based on the Diffie–Hellman (DH) primitive. The beauty of this primitive, among other things, is its potential reusage of key shares: DH shares can be either used a single time or in multiple runs. Since DH-based protocols are insecure against quantum adversaries, alternative solutions have to be found when moving to the post-quantum setting. However, most post-quantum candidates, including schemes based on lattices and even supersingular isogeny DH, are not known to be secure under key reuse. In particular, this means that they cannot be necessarily deployed as an immediate DH substitute in protocols.In this paper, we introduce the notion of a split key encapsulation mechanism (split KEM) to translate the desired key-reusability of a DH-based protocol to a KEM-based flow. We provide the relevant security notions of split KEMs and show how the formalism lends itself to lifting Signal’s \(\mathsf {X3DH}\) handshake to the post-quantum KEM setting without additional message flows.Although the proposed framework conceptually solves the raised issues, instantiating it securely from post-quantum assumptions proved to be non-trivial. We give passively secure instantiations from \(\mathsf {(R)LWE}\), yet overcoming the above-mentioned insecurities under key reuse in the presence of active adversaries remains an open problem. Approaching one-sided key reuse, we provide a split KEM instantiation that allows such reuse based on the KEM introduced by Kiltz (PKC 2007), which may serve as a post-quantum blueprint if the underlying hardness assumption (gap hashed Diffie–Hellman) holds for the commutative group action of CSIDH (Asiacrypt 2018).The intention of this paper hence is to raise awareness of the challenges arising when moving to KEM-based key exchange protocols with key-reusability, and to propose split KEMs as a specific target for instantiation in future research.KeywordsPost-quantumKey encapsulation mechanismsKey exchangeSignal protocolX3DH

After going through past research, it is observed that the security of data depends on five important key features such as authentication, data Integrity, mutual authentication between two parties, non-repudiation, and key exchange algorithm. Even if one of these features fail then it may breach security in real-world scenarios. The Diffie-Hellman Key Exchange (DHKE) algorithm allows securing one feature called key exchange in the cryptography field. However, this key exchange algorithm is unable to provide authentication. As a result, this key exchange scheme is prone to a hostile attack named as Man-In-The-Middle Attack (MITM). To solve this type of attack, a novel algorithm has been proposed called modification of the DHKE algorithm. In this algorithm, they claim that the MITM attack on classical DHKE can be prevented by applying the necessary functionalities like encryption and Zero-Knowledge Proof (ZKP). Although, after going through result analysis and working techniques, it is observed that the modified DHKE algorithm is still suffering from MITM attack. In this paper, the main objective is to develop an algorithm for finding out this type of security flaw in the existing modified DH algorithm which includes the concept of required authentication and encryption functions and able to perform the MITM attack on the existing modified DHKE algorithm.

The analysis of real-world protocols, in particular key exchange protocols and protocols building on these protocols, is a very complex, error-prone, and tedious task. Besides the complexity of the protocols itself, one important reason for this is that the security of the protocols has to be reduced to the security of the underlying cryptographic primitives for every protocol time and again. We would therefore like to get rid of reduction proofs for real-world key exchange protocols as much as possible and in many cases altogether, also for higher-level protocols which use the exchanged keys. So far some first steps have been taken in this direction. But existing work is still quite limited, and, for example, does not support Diffie-Hellman (DH) key exchange, a prevalent cryptographic primitive for real-world protocols. In this paper, building on work by Kusters and Tuengerthal, we provide an ideal functionality in the universal composability setting which supports several common cryptographic primitives, including DH key exchange. This functionality helps to avoid reduction proofs in the analysis of real-world protocols and often eliminates them completely. We also propose a new general ideal key exchange functionality which allows higherlevel protocols to use exchanged keys in an ideal way. As a proof of concept, we apply our framework to three practical DH key exchange protocols, namely ISO 9798-3, SIGMA, and OPTLS.

We introduce models of computation that enable direct comparisons between classical and quantum algorithms. Incorporating previous work on quantum computation and error correction, we justify the use of the gate-count and depth-times-width cost metrics for quantum circuits. We demonstrate the relevance of these models to cryptanalysis by revisiting, and increasing, the security estimates for the Supersingular Isogeny Diffie–Hellman (SIDH) and Supersingular Isogeny Key Encapsulation (SIKE) schemes. Our models, analyses, and physical justifications have applications to a number of memory intensive quantum algorithms.

The Rivest–Shamir–Adleman (RSA) and the Diffie-Hellman (DH) key exchange are famous methods for encryption. These methods depended on selecting the primes p and q in order to be secure enough . This paper shows that the named methods used the primes which are found by some arithmetical function .In the other sense, no need to think about getting primes p and q and how they are secure enough, since the arithmetical function enable to build the primes in such complicated way to be secure. Moreover, this article gives new construction of the RSA algorithm and DH key exchange using the&#x0D; primes p,qfrom areal number x.

In recent years, the isogeny-based protocol, namely supersingular isogeny Diffie-Hellman (SIDH) has become highly attractive for its small public key size. In addition, one can utilize several techniques to further compress the public key. However, compared to other post-quantum protocols, the computational cost of SIDH is relatively high, and so is that of its public-key compression. On the other hand, the storage for pairing computation and discrete logarithms to speed up the current implementation of the key compression is somewhat large. In this paper, we mainly improve the performance of public-key compression of SIDH, especially the efficiency and the storage of pairing computation involved. Our experimental results show that the memory requirement for pairing computation is reduced by a factor of about 1.5. Meanwhile, the instantiation of public-key compression of SIDH is 6.95%-10.44% faster than the current state-of-the-art. Although SIKE is broken now, the techniques in this paper may benefit other isogeny-based cryptosystems which are still secure.

Cryptographic algorithms are crucial for secure communication in the Internet of Things (IoT). Quantum computers threaten public key cryptography algorithms like RSA (Rivest, Shamir, Adleman) and Diffie-Hellman (DH) key exchange schemes, which are widely in use today. As cryptographic algorithms are the foundation of secure internet communication, the development of Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) is essential to protect transactions over the internet. However, solutions like Quantum Key Distribution require heavy infrastructure. So, it is not feasible for the Internet of Things with fewer resources in computing power and form factor. Post-Quantum Cryptography is helpful on these devices. But, it needs further developments and improvements. This paper analyzes cryptography algorithms and protocols of IoT with different categories. Integrated PQC of National Institute of Standards and Technology (NIST) third level finalists on Raspberry Pi 4 (RPI4) board with Linux operating system. The performance of Post-Quantum Cryptography schemes for IoT has been evaluated. Finally, a Post-Quantum Cryptography scheme has been suggested for the Internet of Things based on the performance analysis.

Consortium blockchain has been widely used in many application scenarios, where there is the demand for a universal user authentication and key exchange mechanism for all the application users in the system like Know Your Customer. Since current solutions heavily rely on traditional public-key cryptosystems that are vulnerable to attacks from quantum computers, we design and implement the first post-quantum (PQ) user authentication and key exchange system for consortium blockchain, which is integrated with all the PQ public-key (i.e., signature and encryption/KEM) algorithms in the current round of NIST call for national standard. Furthermore, we also provide chaincodes, related APIs together with client codes for further development. Last but not least, we perform a systematic evaluation on the performance of the system including the consumed time of chaincodes execution and the needed on-chain storage space. Based on the experiment results, we discuss the implications of our findings, which are helpful for the PQ blockchain-based application developers, the undergoing NIST call and the developers of the PQ algorithms.