Isara Corporation

Victoria De Quehen

Shane Daniel Kelly

Gustav Michael Gutoski

Edward William Eaton

Christopher Leonardi

In some aspects, a key establishment protocol is executed to generate a shared secret. A first entity calculates a first image curve Erepresenting an image of an elliptic curve E under a first isogeny &#x3d5;; calculates the shared secret based on the first image curve E; receives a second image curve Eand a first pair of elliptic curve points {&#x3d5;(P), &#x3d5;(Q)} and from a second entity; obtains a basis {R, S}; calculates a third image curve Erepresenting an image of the second image curve Eunder a second isogeny &#x3c8;; calculates a third pair of elliptic curve points {&#x3c8;(R), &#x3c8;(S)}; and sends the third image curve Eand the third pair of elliptic curve points {&#x3c8;(R), &#x3c8;(S)} to the second entity, wherein the third image curve Eand the third pair of elliptic curve points {&#x3c8;(R), &#x3c8;(S)} enable the second entity to compute the shared secret.

Broadcasting in supersingular isogeny-based cryptosystems

In a general aspect, a supersingular isogeny-based cryptography process is performed. In some aspects, a cryptographic element is generated by executing a supersingular isogeny-based cryptography protocol. A generator of a first isogeny kernel is computed. A pre-determined tree topology is traversed. The tree topology includes nodes coupled by edges. The edges of the pre-determined tree topology include a first set of edges representing scalar multiplications and a second set of edges representing point evaluations. A plurality of isogeny kernels corresponding to respective nodes in the tree topology and having a lower order than the first isogeny kernel is computed by traversing a zigzag path through the tree topology. The zigzag path includes a series of scalar multiplications or a series of the point evaluations (or both) that terminates at a node above a leaf node in the tree topology.

Traversing a zigzag path tree topology in a supersingular isogeny-based cryptosystem

In a general aspect, a supersingular isogeny-based cryptography process is performed. In some aspects, a cryptographic element is generated by executing a supersingular isogeny-based cryptography protocol. A generator of a first isogeny kernel is computed. A pre-determined tree topology is traversed. The tree topology includes nodes coupled by edges. The edges of the pre-determined tree topology include a first set of edges representing scalar multiplications and a second set of edges representing point evaluations. A plurality of isogeny kernels corresponding to respective nodes in the tree topology and having a lower order than the first isogeny kernel is computed by executing batches of operations using a plurality of cryptographic co-processors. At least one of the batches includes two or more of the scalar multiplications represented in the tree topology.

Using cryptographic co-processors in a supersingular isogeny-based cryptosystem

In a general aspect, a supersingular isogeny-based cryptography process is performed. In some aspects, a cryptographic element is generated by executing a supersingular isogeny-based cryptography protocol. A generator of a first isogeny kernel is computed. A pre-determined tree topology is traversed. The tree topology includes nodes coupled by edges. A first set of edges represent scalar multiplications, and a second set of edges represent point evaluations. A plurality of isogeny kernels corresponding to respective nodes in the tree topology are computed by executing batches of operations. At least one of the batches includes a first point evaluation represented in the tree topology having a first domain and a first range, and a second point evaluation represented in the tree topology having a second domain and a second range. The first domain, the first range, the second domain and the second range are non-isomorphic elliptic curves.

Processing batches of point evaluations in a supersingular isogeny-based cryptosystem

In some aspects, a key establishment protocol is executed to generate a shared secret. A first entity calculates a first image curve Erepresenting an image of an elliptic curve E under a first isogeny &#x3d5;; calculates a first pair of elliptic curve points {&#x3d5;(P), &#x3d5;(Q)}; calculates secret integers {c, d}; sends the first image curve Eand the first pair of elliptic curve points {&#x3d5;(P), &#x3d5;(Q)} to a second entity; receives a second image curve Eand a third pair of elliptic curve points {&#x3c8;(R), &#x3c8;(S)} from the second entity; calculates a third image curve Erepresenting an image of the second image curve Eunder a second isogeny {tilde over (&#x3d5;)}, wherein the second isogeny {tilde over (&#x3d5;)}is identified based on the secret integers {c, d} and the third pair of elliptic curve points {&#x3c8;(R), &#x3c8;(S)}; and calculates the shared secret based on the third image curve E.

Obtaining keys from broadcasters in supersingular isogeny-based cryptosystems

In a general aspect, a cryptography process performs modular operations, where the modulus is a non-Mersenne prime. In some aspects, an integer is obtained during execution of a cryptography protocol defined by a cryptosystem. A prime modulus is defined by the cryptosystem in terms of a set of constants. The set of constants includes at least a first constant and a second, distinct constant. A set of block coefficients is computed to represent the integer in a block form. The plurality of block coefficients includes a first block coefficient obtained by a first modular reduction modulo the first constant, and a second block coefficient obtained by a second modular reduction modulo the second constant. A reduced representation of the integer is computed based on the plurality of block coefficients, such that the reduced representation is less than the prime modulus.

Growing community of inventors

Waterloo, Canada

Victoria De Quehen