We construct a new post-quantum cryptosystem which consists of enhancing CSIDH and similar cryptosystems by adding a full level $N$ structure. We discuss the size of the isogeny graph in this new cryptosystem which consists of components which are acted on by the ray class group for the modulus $N$. We conclude by showing that, if we can efficiently find rational isogenies between elliptic curves, then we can efficiently find rational isogenies that preserve the level structure. We show that one can reduce the group action problem for the ray class group to the group action problem for the ideal class group. This reduces the security of this new cryptosystem to that of the original on

Derek Perrin

José Felipe Voloch

Steven D. Galbraith

Cryptology ePrint Archive

CSIDH WITH LEVEL STRUCTURESTEVEN D. GALBRAITH, DEREK PERRIN, AND JOSÉ FELIPE VOLOCHAbstractWe construct a new post-quantum cryptosystem which consists of enhancing CSIDH and similarcryptosystems by adding a full level N structure. We discuss the size of the isogeny graph in this newcryptosystem which consists of components which are acted on by the ray class group for the modulusN . We conclude by showing that, if we can efficiently find rational isogenies between elliptic curves, thenwe can efficiently find rational isogenies that preserve the level structure. We show that one can reducethe group action problem for the ray class group to the group action problem for the ideal class group.This reduces the security of this new cryptosystem to that of the original one.1. IntroductionGroup actions are a promising direction in post-quantum cryptography. In 1997, Couveignesproposed the first isogeny-based group action cryptosystem [4] which used ordinary elliptic curvesover a finite field Fq and whose difficulty relied on the isogeny problem. This cryptosystem waslater independently rediscovered by Rostovtsev and Stolbunov [7]. In 2018, the CSIDH [2]cryptosystem was proposed. It was based on the Couveignes-Rostovtsev-Stolbunov (CRS) keyexchange but constructed using supersingular curves over Fp instead of ordinary curves overFq. The authors chose supersingular curves for various efficiency reasons which are explainedin detail in [2]. When CSIDH was initially proposed, the authors claimed the key exchangewas over 2000 times faster than the state-of-the-art CRS implementation at the time. However,even with this speedup, a drawback of CSIDH is that it is still considered to be inefficient whencompared to other post-quantum algorithms.In 2011, De Feo, Jao, and Plût proposed an alternative isogeny-based scheme, supersingularisogeny Diffie-Hellman (SIDH), which was based on the path finding problem in the full isogenygraph of supersingular curves[5]. The scheme involved publishing images of torsion points tocreate a Diffie-Hellman type protocol to overcome the non-commutativity of the endomorphismrings. These image points turned out to be problematic and this scheme was later shown to beinsecure[1]. Our proposal also uses torsion points, but in a different way from SIDH.In this paper, we will construct a modification of CSIDH which involves adding a level Nstructure. The hope is to gain additional security by choosing appropriate N which in turnwould allow us to reduce the size of prime field we work over and thus speed up computations.We will then show if we can solve the isogeny problem presented in CRS and CSIDH that wecan solve this new problem efficiently and give an algorithm for doing so.1.1. Preliminaries. We begin by briefly recalling the CSIDH cryptographic primitive and referthe reader to [2] for the full details.For a supersingular elliptic curve E/Fp, we will let Endp(E) ⊆ End(E) denote the subringof End(E) that consists of Fp-rational endomorphisms of E. Although End(E) is an order in aquaternion algebra, this subring is in fact isomorphic to an order O in an imaginary quadraticfield K.Department of Mathematics, The University of Auckland, Auckland, New ZealandSchool of Mathematics and Statistics, University of Canterbury, Private Bag 4800, Christchurch8140, New ZealandSchool of Mathematics and Statistics, University of Canterbury, Private Bag 4800, Christchurch8140, New ZealandE-mail addresses: s.galbraith@auckland.ac.nz, derek.perrin@pg.canterbury.ac.nz,felipe.voloch@canterbury.ac.nz.The authors acknowledge support from MBIE.12 CSIDH WITH LEVEL STRUCTUREE0 EaEb Eabφaφ′bφ′aφbFigure 1. A commutative diagram of CRS-like key exchange protocols.For an ordinary elliptic curve E/Fq, where q = pk for some k ∈ Z, the whole endomorphismring End(E) is an order O in an imaginary quadratic field K.For a given order O, we are interested in EllO(Fp) the set of supersingular elliptic curveswhose Fp-rational endomorphism rings are O.It is a well-known fact that the class group Cl(O) acts simply transitively on EllO(Fp)[9,Corollary II.1.2]. The CSIDH key exchange is similar to the CRS cryptosystem [4, 7]: Alicesamples an element [a] ∈ Cl(O), computes [a] ∗ E0 = Ea, for some starting curve E0 and sendsEa to Bob. Bob does the same but with an element [b] ∈ Cl(O) and their shared secret is[a][b]E0 = Eab = Eba = [b][a]E0. This key exchange works due to the commutativity of theaction of Cl(O) as shown in Figure 1.2. CSIDH with Level StructureIn this section, we will discuss modifying CSIDH by adding a level structure. Our motivationis to obtain a larger group action than standard CSIDH which would allow us to with a smallerprime. Recall the security of CSIDH is dependent on #Cl(O) which is asymptotically knownto be #Cl(O) ≈√|∆| [8] where ∆ = t2 − 4p and t ∈ Z is the trace of Frobenius. Since we areworking with supersingular curves over Fp, t = 0 and so the size of the class group is determinedby our choice of p.Definition 2.1. Consider an elliptic curve E and a prime N with (p,N) = 1. Then a Γ(N)-structure on E is a pair of points (P,Q) that is a basis for E[N ].When considering the isogeny graph of EllO(Fp), we can add level structure to the graph asfollows:Definition 2.2. Let N be a prime with (p,N) = 1 andV = {(E,P,Q) | E ∈ EllO(Fp), P,Q a basis for E[N ]} / ∼be a set of vertices modulo the equivalence relation (E,P,Q) ∼ (E′, P ′, Q′) if there exists anisomorphism f : E → E′ with f(P ) = P ′ and f(Q) = Q′. There is an edge between vertices(E,P,Q), (E′, P ′, Q′) if there is an isogeny φ : E → E′ with φ(P ) = P ′ and φ(Q) = Q′. We saythis graph has Γ(N)-structure or full level N structure.If we consider the isogeny graph G with vertex set V = EllO(Fp), we can add a Γ(N) structureto it to obtain a new graph G(N). It is clear that #G(N) > #G. In fact, it can be shown(1) #G(N) = #G(N2 −N)(N2 − 1)2.As such, we have a group larger than the usual class group acting on this set. We can observethis by considering the multiplication-by-m map where (m,N) = 1. For a curve E on G, we have[m] : E 7→ E while for the triple (E,P,Q) on G(N) we have [m] : (E,P,Q) 7→ (E,mP,mQ).Definition 2.3. LetK be an imaginary quadratic field, O ⊆ K an order, and m ⊆ O a modulus.We let Im denote the group of fractional ideals which are coprime to m, and Pm,1 ⊆ Im denotethe subgroup generated by principal ideals (α) where α ≡ 1 mod m. The ray class group forthe modulus m is the quotientClm(O) = Im/Pm,1.CSIDH WITH LEVEL STRUCTURE 3There exists an algorithm [3] to compute Clm(O) and its size hm.Proposition 2.4. Let O be an order in an imaginary quadratic field K, and m a modulus forK. The class number hm := #Clm(O) is finite and given byhm(O) =#(O/m)×h(O)[O× : O×m ]where h(O) = #Cl(O) and O×m is the group of units O× congruent to 1 modulo m.Proof. See [3, Corollary 3.2.4]. □Setting m = (N), the group action we have on G(N) comes from Clm(O). The cardinality hmof Clm(O) is at most (N2 − 1)h(O) while equation (1) gives #G(N) = (N2−1)(N2−N)h(O)2 , andso G(N) is disconnected.We will now consider a slight modification of the CSIDH key exchange whereby we add alevel structure to EllO(Fp). We choose a prime N with (p,N) = 1, along with a basis P0, Q0of E0[N ]. As in the original scheme, sample an element [a] ∈ Clm(O) with (N(a), N) = 1 andcompute the isogeny φa induced by [a]. This time, however, in addition to sending Ea to Bob,she also sends a basis Pa, Qa of Ea[N ] where φa(P0) = Pa, φa(Q0) = Qa, and similarly for Bob.The shared secret is then (Eab, Pab, Qab) where Pab = Pba by the commutativity of Figure 1.In terms of security of such a scheme, consider the following. Suppose there is a secret isogenyφ : E0 → E1 with φ(P0) = P1 and φ(Q0) = Q1 where (Pi, Qi) is a basis for Ei[N ], and we canfind an isogeny ψ : E0 → E1 but with ψ(P0) = P,ψ(Q0) = Q for (P,Q) a basis for E1[N ].Any additional security of this scheme would come from the fact that the isogeny graph isdisconnected and the ability to solve standard CSIDH (i.e. given E0, E1, find φ : E0 → E1) maynot imply we could find an isogeny mapping the N -torsion points correctly. This leads to thenatural question: does there exist an endomorphism α = a+ bπ such that the following systemα(P ) = aP + bπP = P1,α(Q) = aQ+ bπQ = Q1is consistent? Recall we are interested in endomorphisms of the form α = a + bπ since we areworking with curves whose Fp endomorphism rings are of the form O = Z[π] and the action ofthe class group corresponds to Fp-rational isogenies.If we consider adding a Γ(N)-structure to the isogeny graph, then the vertices (E0, P0, Q0),(E1, P1, Q1), and (E1, P,Q) are certainly all on the same component. Further, we notice not allprincipal ideals act trivially on these vertices.Proposition 2.5. Let G(N) be an isogeny graph with Γ(N)-structure and vertex set V as inDefinition 2.2. Then the subgroup of I(N) that acts trivially on V is given byPN,±1 = {(α) = αO|(α) ≡ ±1 mod (N)} .Proof. Consider linearly independent P,Q ∈ E[N ]. Suppose (α) ≡ 1 mod (N). Then (α) =1 + βN for some β ∈ O. It follows that αP = P and αQ = Q since [N ]P = [N ]Q = OE . Nowsuppose α ∈ O such that α |E[N ]= 1. For α ̸= 1, there exist P ∈ E such that αP ̸= P. Thenα − 1 is an isogeny. We have that E[N ] ⊆ ker(α − 1), and so there exists an isogeny φ suchthat α− 1 = φ ◦ [N ] =⇒ α ≡ 1 mod (N). Similarly for α ≡ −1 mod (N) by the equivalencerelation in Definition 2.2, (E,P,Q) ∼ (E,−P,−Q) with isomorphism [−1]. □We now give the main result of this paper. We will restrict ourselves to the CSIDH problemwith elliptic curves E0, E1 with Fp-rational endomorphism rings O = Z[π].Theorem 2.6. Let N be prime with N | p+ 1 and {P0, Q0} , {P1, Q1} be bases of E0[N ], E1[N ]respectively along with an isogeny φ : E0 → E1 such that φ(P0) = P1, φ(Q0) = Q1. Suppose wecan find an isogeny ψ : E0 → E1 with degψ = m coprime to N and ψ(P0) = P,ψ(Q0) = Q.Then there exists an endomorphism α : E1 → E1 of the form α = a + bπ such that α(P ) =P1, α(Q) = Q1.4 CSIDH WITH LEVEL STRUCTUREE0 E1ψφψ̂Figure 2. Vertices connected by an edge on an isogeny graph with no level structure.(E1, P1, Q1) (E1,mP1,mP2)(E0, P0, Q0)(E1, P,Q) (E0,mP0,mQ0)ψφψ̂φ[m′]αFigure 3. A subgraph of a Γ(N) graph with degψ = m.Proof. Consider the map φ ◦ ψ̂ where ψ̂ is the dual isogeny of ψ. This is certainly an endo-morphism of E1. In the isogeny graph with level structure, this map corresponds to the walkE1 → E0 → E1 as seen in Figure 2. However, this is not the case when level structure is addedas can be seen in Figure 3. We then haveφ ◦ ψ̂(P ) = φ ◦ ψ̂ ◦ ψ(P0)= φ ◦ [m](P0)= [m]φ(P0)= [m](P1)where [m] is the multiplication-by-m map. Since (N,m) = 1, there exists an m′ such thatmm′ ≡ 1 (mod N). Then we have α = [m′] ◦ φ ◦ ψ̂ and α(P ) = P1, α(Q) = Q1. To see α is ofthe form a+ bπ with a, b ∈ Z, we observe that [m′], φ, and ψ̂ are all rational and so α must alsobe rational. □Remark 2.7. When working with ordinary curves as in [4, 7], the endomorphism α will notnecessarily be of the form α = a+ bπ since we may not have O = Z[π].We emphasise the above only shows the existence of such an endomorphism and does not sayanything about the difficulty in computing such an endomorphism. The problem of computingα is similar to the discrete log problem, but where the coefficient ring is O/(N) instead of theusual Z/NZ.Definition 2.8. Let E/K be an elliptic curve with char(K) = p and N a positive integer with(N, p) = 1. The Weil pairing is a bilinear formeN : E[N ]× E[N ]→ µNwhere µN denotes the multiplicative group of Nth roots of unity in K.Proposition 2.9. The Weil pairing eN satisfies the following properties.(1) Bilinear: For P,Q,R ∈ E[N ], eN (P + Q,R) = eN (P,R)eN (Q,R) and eN (P,Q + R) =eN (P,Q)eN (P,R).(2) Alternating: For P,Q ∈ E[N ], eN (P,Q) = eN (Q,P )−1 and eN (P, P ) = 1.(3) Non-degenerate: For P ∈ E[N ], if eN (P,Q) = 1 for all Q ∈ E[N ], then P = O.CSIDH WITH LEVEL STRUCTURE 5(4) Galois-invariant: If E is defined over K, then for all σ ∈ GalK/K, eN (σ(P ), σ(Q)) =σ(eN (P,Q)).(5) Compatible: If P ∈ E[NN ′] and Q ∈ E[N ], then eNN ′(P,Q) = eN ([N ′]P,Q).Proof. See [10, Proposition III.8.1]. □An application of the Weil pairing is the MOV attack [6] which reduces the discrete logproblem (DLP) on an elliptic curve E to the DLP in a multiplicative group in the field whichE is defined over. The following algorithm is from [6] and E is defined over Fq. Observe thatAlgorithm 1 ([6, Algorithm 2])Input: An element P ∈ E[N ] and R ∈ ⟨P ⟩ .Output: An integer r such that R = rP.Find k ∈ Z such that E[N ] ⊆ E(Fqk).Find Q ∈ E[N ] such that eN (P,Q) is a primitive Nth root of unity.Compute s = eN (R,Q).Compute the discrete log of s to the base eN (P,Q) in Fqk .s = eN (R,Q) = eN (rP,Q) = eN (P,Q)r. The authors of [6] remark that Algorithm 1 does notprovide a method for finding Q as required. As we will see below, this does not apply to oursituation since N is prime and no extra points need to be computed. The idea is to pre-computeeN (P, πP ) then apply Algorithm 1 once with input P1, πP and again with P1, P to recover a, brespectively.For a given basis P,Q of E1[N ], we will assume P is not an eigenvector of π. If it is, we swapP and Q. This ensures that the Weil pairing eN (P, πP ) will be an Nth root of unity. We knowthere exists an α as above by Theorem 2.6, and so we can find α by solving the DLPeN (P1, πP ) = eN (aP + bπP, πP )= eN (P, πP )afor the integer a. Similarly, we can solveeN (P, P1) = eN (P, aP + bπP )= eN (P, πP )bfor b and set α = a+ bπ.It is possible for both basis points to be eigenvectors of π. Since we have chosen N such thatN | p+ 1, we see the characteristic polynomial p(X) of π modulo N is given byp(X) = X2 − 1 (mod N)and so there exist eigenvectors of π in E[N ] with eigenvalues ±1. Assume P,Q are such eigen-vectors with πP = P and πQ = −Q. We want to find a, b in the systemP1 = aP + bP = (a+ b)PQ1 = aP − bP = (a− b)P.If we let c = a+ b, we can apply use the MOV algorithm on P1 = cP to solve for c. We use thesame method to find d = a− b where Q1 = dQ and use linear algebra to find a, b.6 CSIDH WITH LEVEL STRUCTUREWe will conclude by giving an algorithm of the above attack.Algorithm 2 Solving CSIDH with Γ(N) structure.Input: N ∈ Z and Γ(N) structures (E0, P0, Q0), (E1, P1, Q1)Output: Ideal a such that [a] ∗ (E0, P0, Q0) = (E1, P1, Q1).Find an ideal b such that φb : E0 → E1.Set P ← ϕb(P0), Q← φb(Q0).Solve for b in eN (P, P1) = eN (P, πP )b where eN is the Weil pairing.Solve for a in eN (P1, πP ) = eN (P, πP )a.Set a← (a+ bπ)breturn aReferences[1] Wouter Castryck and Thomas Decru. An efficient key recovery attack on sidh. Cryptology ePrint Archive,Paper 2022/975, 2022. https://eprint.iacr.org/2022/975.[2] Wouter Castryck, Tanja Lange, Chloe Martindale, Lorenz Panny, and Joost Renes. Csidh: an efficientpost-quantum commutative group action. In Advances in Cryptology–ASIACRYPT 2018: 24th InternationalConference on the Theory and Application of Cryptology and Information Security, Brisbane, QLD, Australia,December 2–6, 2018, Proceedings, Part III 24, pages 395–427. Springer, 2018.[3] Henri Cohen. Advanced topics in computational number theory, volume 193. Springer Science & BusinessMedia, 2012.[4] Jean-Marc Couveignes. Hard homogeneous spaces. Cryptology ePrint Archive, 2006.[5] David Jao and Luca De Feo. Towards quantum-resistant cryptosystems from supersingular elliptic curveisogenies. In Post-Quantum Cryptography: 4th International Workshop, PQCrypto 2011, Taipei, Taiwan,November 29–December 2, 2011. Proceedings 4, pages 19–34. Springer, 2011.[6] Alfred Menezes, Scott Vanstone, and Tatsuaki Okamoto. Reducing elliptic curve logarithms to logarithmsin a finite field. In Proceedings of the twenty-third annual ACM symposium on Theory of computing, pages80–89, 1991.[7] Alexander Rostovtsev and Anton Stolbunov. Public-key cryptosystem based on isogenies. Cryptology ePrintArchive, 2006.[8] Carl Siegel. Über die classenzahl quadratischer zahlkörper. Acta Arithmetica, 1(1):83–86, 1935.[9] Joseph H Silverman. Advanced topics in the arithmetic of elliptic curves, volume 151. Springer Science &Business Media, 1994.[10] Joseph H Silverman. The arithmetic of elliptic curves, volume 106. Springer, 2009.

CSIDH with Level Structure

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive