TY - GEN
T1 - Strongly secure authenticated key exchange from supersingular isogenies
AU - Xu, Xiu
AU - Xue, Haiyang
AU - Wang, Kunpeng
AU - Au, Man Ho
AU - Tian, Song
N1 - Funding Information:
Haiyang Xue is supported by the National Natural Science Foundation of China (No. 61602473, No. 61672019), and the National Cryptography Development FundMMJJ20170116. Xiu Xu is supported by the National Natural Science Foundation of China (No.61872442). Man Ho Au is supported by the Research Grant Council of Hong Kong (Grant No. 25206317).Song Tian is supported by the National Natural Science Foundation of China (No. 61802401).
Funding Information:
Acknowledgements. Haiyang Xue is supported by the National Natural Science Foundation of China (No. 61602473, No. 61672019), and the National Cryptography Development Fund MMJJ20170116. Xiu Xu is supported by the National Natural Science Foundation of China (No.61872442). Man Ho Au is supported by the Research Grant Council of Hong Kong (Grant No. 25206317). Song Tian is supported by the National Natural Science Foundation of China (No. 61802401).
Publisher Copyright:
© International Association for Cryptologic Research 2019.
PY - 2019
Y1 - 2019
N2 - This paper aims to address the open problem, namely, to find new techniques to design and prove security of supersingular isogeny-based authenticated key exchange (AKE) protocols against the widest possible adversarial attacks, raised by Galbraith in 2018. Concretely, we present two AKEs based on a double-key PKE in the supersingular isogeny setting secure in the sense of CK+, one of the strongest security models for AKE. Our contributions are summarised as follows. Firstly, we propose a strong OW-CPA secure PKE, 2PKEsidh, based on SI-DDH assumption. By applying modified Fujisaki-Okamoto transformation, we obtain a [OW-CCA, OW-CPA] secure KEM, 2KEMsidh. Secondly, we propose a two-pass AKE, SIAKE2, based on SI-DDH assumption, using 2KEMsidh as a building block. Thirdly, we present a modified version of 2KEMsidh that is secure against leakage under the 1-Oracle SI-DH assumption. Using the modified 2KEMsidh as a building block, we then propose a three-pass AKE, SIAKE3, based on 1-Oracle SI-DH assumption. Finally, we prove that both SIAKE2 and SIAKE3 are CK+ secure in the random oracle model and supports arbitrary registration. We also provide an implementation to illustrate the efficiency of our schemes. Our schemes compare favourably against existing isogeny-based AKEs. To the best of our knowledge, they are the first of its kind to offer security against arbitrary registration, wPFS, KCI, and MEX simultaneously. Regarding efficiency, our schemes outperform existing schemes in terms of bandwidth as well as CPU cycle count.
AB - This paper aims to address the open problem, namely, to find new techniques to design and prove security of supersingular isogeny-based authenticated key exchange (AKE) protocols against the widest possible adversarial attacks, raised by Galbraith in 2018. Concretely, we present two AKEs based on a double-key PKE in the supersingular isogeny setting secure in the sense of CK+, one of the strongest security models for AKE. Our contributions are summarised as follows. Firstly, we propose a strong OW-CPA secure PKE, 2PKEsidh, based on SI-DDH assumption. By applying modified Fujisaki-Okamoto transformation, we obtain a [OW-CCA, OW-CPA] secure KEM, 2KEMsidh. Secondly, we propose a two-pass AKE, SIAKE2, based on SI-DDH assumption, using 2KEMsidh as a building block. Thirdly, we present a modified version of 2KEMsidh that is secure against leakage under the 1-Oracle SI-DH assumption. Using the modified 2KEMsidh as a building block, we then propose a three-pass AKE, SIAKE3, based on 1-Oracle SI-DH assumption. Finally, we prove that both SIAKE2 and SIAKE3 are CK+ secure in the random oracle model and supports arbitrary registration. We also provide an implementation to illustrate the efficiency of our schemes. Our schemes compare favourably against existing isogeny-based AKEs. To the best of our knowledge, they are the first of its kind to offer security against arbitrary registration, wPFS, KCI, and MEX simultaneously. Regarding efficiency, our schemes outperform existing schemes in terms of bandwidth as well as CPU cycle count.
KW - Authenticated key exchange
KW - Key encapsulation mechanism
KW - Post quantum
KW - Supersingular elliptic curve isogeny
UR - http://www.scopus.com/inward/record.url?scp=85076714623&partnerID=8YFLogxK
U2 - 10.1007/978-3-030-34578-5_11
DO - 10.1007/978-3-030-34578-5_11
M3 - Conference article published in proceeding or book
AN - SCOPUS:85076714623
SN - 9783030345778
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 278
EP - 308
BT - Advances in Cryptology – ASIACRYPT 2019 - 25th International Conference on the Theory and Application of Cryptology and Information Security, 2019, Proceedings
A2 - Galbraith, Steven D.
A2 - Moriai, Shiho
PB - Springer Science and Business Media Deutschland GmbH
T2 - 25th International Conference on the Theory and Applications of Cryptology and Information Security, ASIACRYPT 2019
Y2 - 8 December 2019 through 12 December 2019
ER -