International Association for Cryptologic Research (IACR)
Abstract
At a combined computational expense of about 6ℓ field operations, Vélu\u27s formulas are used to construct and evaluate degree-ℓ isogenies in the vast majority of isogeny-based cryptographic schemes. By adapting to Vélu\u27s formulas a baby-step giant-step approach, Bernstein, De Feo, Leroux, and Smith presented a procedure that can computes isogeny operations at a reduced cost of just O~(ℓ) field operations. In this paper, we present a concrete computational analysis of these novel procedure along with several algorithmic tricks that helped us to further decrease its computational cost.
We also report an optimized Python3-code implementation of several instantiations of two isogeny-based key-exchange protocols, namely, CSIDH and B-SIDH. Our software library uses a combination of the modified Vélu\u27s formulas and an adaptation of the optimal strategies commonly used in the SIDH/SIKE protocols to produce significant speedups.
Compared to a traditional Vélu constant-time implementation of CSIDH, our experimental results report a saving of
5.357\%, 13.68\% and 25.938\% base field operations for CSIDH-512, CSIDH-1024, and CSIDH-1792, respectively.
Additionally, we present the first optimized implementation of B-SIDH ever reported in the open literature