A Direct Key Recovery Attack on SIDH
WESOLOWSKI, Benjamin
Centre National de la Recherche Scientifique [CNRS]
Lithe and fast algorithmic number theory [LFANT]
Unité de Mathématiques Pures et Appliquées [UMPA-ENSL]
Analyse cryptographique et arithmétique [CANARI]
< Reduce
Centre National de la Recherche Scientifique [CNRS]
Lithe and fast algorithmic number theory [LFANT]
Unité de Mathématiques Pures et Appliquées [UMPA-ENSL]
Analyse cryptographique et arithmétique [CANARI]
Language
en
Communication dans un congrès
This item was published in
Advances in Cryptology – EUROCRYPT 2023, 2023, Lyon. 2023-04-16, vol. 14008, p. 448-471
Springer Nature Switzerland
English Abstract
We present an attack on SIDH utilising isogenies between polarized products of two supersingular elliptic curves. In the case of arbitrary starting curve, our attack (discovered independently from [8]) has subexponential ...Read more >
We present an attack on SIDH utilising isogenies between polarized products of two supersingular elliptic curves. In the case of arbitrary starting curve, our attack (discovered independently from [8]) has subexponential complexity, thus significantly reducing the security of SIDH and SIKE. When the endomorphism ring of the starting curve is known, our attack (here derived from [8]) has polynomial-time complexity assuming the generalised Riemann hypothesis. Our attack applies to any isogeny-based cryptosystem that publishes the images of points under the secret isogeny, for example Séta and B-SIDH. It does not apply to CSIDH, CSI-FiSh, or SQISign.Read less <
English Keywords
SIDH
Elliptic curve
Isogeny
Cryptanalysis
ANR Project
Méthodes pour les variétés abéliennes de petite dimension - ANR-20-CE40-0013
Post-quantum padlock for web browser - ANR-22-PETQ-0008
Post-quantum padlock for web browser - ANR-22-PETQ-0008
Origin
Hal imported