Revisiting Elliptic Curve Cryptography with Applications to Post-quantum SIDH Ciphers by Wesam Nabil Eid Master of Science Electrical and Computer Engineering University of New Haven 2013 A dissertation submitted to the Department of Computer Engineering and Sciences of Florida Institute of Technology in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Computer Engineering Melbourne, Florida May, 2020 ⃝c Copyright 2020 Wesam Nabil Eid All Rights Reserved The author grants permission to make single copies We the undersigned committee hereby recommend that the attached document be accepted as fulfilling in part the requirements for the degree of Ph.D. in Computer Engineering. \Revisiting Elliptic Curve Cryptography with Applications to Post-quantum SIDH Ciphers" a dissertation by Wesam Nabil Eid Marius C. Silaghi, Ph.D. Associate Professor, Department of Computer Engineering and Sciences Major Advisor Carlos Otero, Ph.D. Associate Professor, Department of Computer Engineering and Sciences Committee Member Susan Earles, Ph.D. Associate Professor, Department of Computer Engineering and Sciences Committee Member Eugene Dshalalow, Dr.rer.nat. Professor, Department of Mathematical Sciences Committee Member Philip Bernhard, Ph.D. Associate Professor and Department Head Department of Computer Engineering and Sciences ABSTRACT Revisiting Elliptic Curve Cryptography with Applications to Post-quantum SIDH Ciphers by Wesam Nabil Eid Thesis Advisor: Marius C. Silaghi, Ph.D. Elliptic Curve Cryptography (ECC) has positioned itself as one of the most promising candidates for various applications since its introduction by Miller and Kolbitz in 1985 [53, 44]. The core operation for ECC is the scalar multiplication [k]P where many efforts have addressed its computation speed. Here we introduce an efficient approach for calculating elliptic curve operations by a novel regrouping of terms and creating new projective representation operators and increasing paral- lelism. These operators and the corresponding projective coordinate representations are shown to lead to adjusted versions of scalar multiplication algorithms that are evaluated. These techniques enable more opportunities for optimizing computations, directing to an important speed-up for every application based on elliptic curves such as encryption, crypt-analysis, digital signatures, and pseudo-random generators. Also benefiting from our work is the post-quantum cryptosystem, Supersingular Isogeny iii Diffie-Helman (SIDH). Its main weakness is elliptic curve computation complexity, that we improve, while its main quantum attacks complexity is maintained. For other elliptic curve schemes, the computation speed-up also favors attacks, which can how- ever be compensated by increasing the size of the key. In addition, we simulate the modeled design as a hardware arithmetic circuit, to further quantify the improvements that can be obtained. iv Table of Contents Abstract iii List of Figures ix List of Tables xi List of Symbols xiii Acknowlegments xiv Dedication xviii Chapter 1 Introduction 1 1.1 Motivation . .2 1.2 Summary of Ideas and Contributions . .3 1.3 Results . .4 1.4 Structure of Dissertation . .5 Chapter 2 Background 7 v Chapter 3 Fast 2nP 40 3.1 Fast nP + mQ .............................. 40 3.1.1 Fast 22P .............................. 40 3.1.2 Fast 23P .............................. 52 3.1.3 Fast 24P .............................. 61 3.1.4 Fast 3P (Point Tripling) . 71 3.1.5 Fast 2nQ + P ........................... 80 3.1.6 Fast 2nP+2Q .......................... 86 3.1.7 2nP+mQ............................. 92 3.1.8 Generalizing 2nP + Q and 2nP + mQ Forms . 98 3.1.9 Another Implementation of 6Q . 100 3.1.10 Another Implementation of 10Q . 109 3.2 Results . 112 3.3 Further optimization . 113 Chapter 4 Direct Doubling 118 4.1 Direct Doubling with Labeling . 136 4.2 Comparing Fast 2nP algorithm vs Direct Doubling . 138 Chapter 5 Other Coordinate Systems 140 5.1 Projective Coordinates . 141 5.2 Jacobian Coordinates . 149 5.3 Montgomery Coordinates . 155 vi Chapter 6 EiSi Coordinates 158 Chapter 7 Sample Applications 174 7.1 Algorithms Overview . 175 7.2 Fast Multiplication with Mixed Base Multiplicands . 177 7.2.1 Right-to-left Extensions . 178 7.2.2 Double and Add Extensions . 181 7.2.3 NAF Extensions . 182 7.3 Fast Multiplication with Base 16 Multiplicands . 186 7.4 Fast Multiplication with Base 32 Multiplicands . 187 7.5 Fast Multiplication with Base 1024 Multiplicands . 188 7.6 Inverting Multiplications based on Curve Order . 189 Chapter 8 Supersingular Isogeny Diffie-Hellman SIDH 191 8.1 Supersingular Curve and Elliptic Curve . 192 8.2 Isogenies . 194 8.3 Isomorphisms . 195 8.4 J-Invariant . 196 8.5 Computing Isogenies over Finite Field . 197 8.5.1 Finite Fields and Frobenius Isogeny . 198 8.6 SIDH and Key Exchange . 200 8.7 SIDH and Post-Quantum Cryptosystem . 202 vii Chapter 9 Results and Experiments 205 9.1 Functions Description and Properties . 206 9.2 Double-and-Add vs NAF vs Right-to-left . 209 9.3 Base 16 vs 32 vs 1024 Multiplicands . 211 9.4 Our Work vs Original . 213 9.5 EiSi Coordinates vs Others . 215 9.6 Number of Multipliers Comparison . 220 Chapter 10 Conclusion 223 References 227 viii List of Figures 2.1 Elliptic curve arithmetic hierarchy [36]. 13 2.2 Cracking the secret key. (a) Standard cells and regular routing us- ing 15K measurementskeybyte found. (b) Standard cells and regular rouing using 15K measurementskeybyte found. (c) WDDL and differ- ential routing using 1.5 M measurementskeybyte found. (d WDDL and differential routing using 1.5 M measurementskeybyte not found [38]. 38 2.3 Generation of Signed Payment [31]. 39 2.4 Validation of Signed Purchase REQ and Signed Purchase Invoice [31]. 39 3.1 Cyclic group of the elliptic curve E [63]. 45 5.1 Montgomery Doubler Implementation Flowchart. 157 7.1 Three point ladder (left-to-right) [40, 29]. 176 7.2 Right-to-left algorithm [29]. 177 7.3 Data-dependency graph for calculating a single double merged with another one (Parallelization characteristic). 178 ix 7.4 First Proposed Algorithm. 179 7.5 Left-to-Right Proposed Algorithm. 183 7.6 Left-to-Right Double-Add-and-Subtract Algorithm. 185 8.1 j-invariants in F4312 [21]. 196 8.2 SIDH Key Exchange Protocol [26]. 201 9.1 Computing the point 24P by using remi func and remi point functions. 208 9.2 Computing the point 29P by using remi func and remi point functions. 209 9.3 DA vs NAF vs RL in terms of Number of Multiplications. 211 9.4 DA vs NAF vs RL in terms of Number of Maximum Levels. 211 9.5 Base 16 vs 32 vs 1024 Multiplicands in terms of Number of Multipli- cations. 213 9.6 Base 16 vs 32 vs 1024 Multiplicands in terms of Number of Maximum Levels. 213 9.7 Base 32 vs Original algorithms in terms of Number of Multiplications. 215 9.8 Our Work vs Other Coordinates Algorithms in terms of Number of Multiplications. 217 9.9 Our Work vs Other Coordinates Algorithms in terms of Number of Maximum Levels. 218 9.10 Maximum levels for different number of multipliers. 222 x List of Tables 3.1 Algorithms Preliminary Measurements. 113 3.2 List of Labels for equations 4P, 8P and 16P. 114 4.1 Number of Mult. in Fast 2n vs Direct Doubling. 139 5.1 List of Labels for Projective Algorithms. 144 5.2 List of Labels for Jacobian Algorithms. 152 8.1 Instantiations of Diffie-Hellman. 202 9.1 DA, NAF and RL Algorithms Measurements. 210 9.2 Base 16, 32 and 1024 Algorithms Measurements. 212 9.3 Base 32 vs Original Algorithms Measurements. 214 9.4 EiSi vs Other Coordinates Measurements. 216 9.5 List of Algorithms Linear Equations. 218 9.6 Expected number of Mults and MaxLs with key of sizes 751 and 1013. 219 9.7 ∆ Values for Base 32 vs Jacobian and Base 1024 vs Montgomery. 219 xi 9.8 The number of multipliers appropriate to achieve the highest level of parallelism. 220 9.9 MaxL at Different Number of Multipliers. 221 xii List of Symbols ECC Elliptic Curve Cryptography Nxn The abscissa in EiSi coordinate Nyn The ordinate in EiSi coordinate Un The scale in EiSi coordinate a mod n The remainder of dividing a by n a (mod n) The residue classes of a modulo n, cf. Gauss a ≡ b (mod n) The residue class of a and b modulo n are the same a−1 mod n The inverse of a modulo n, 0 ≤ a−1 < n s.t. a ∗ a−1 mod n = 1 a−1 (mod n) The residue class of integers a−1, s.t. a ∗ a−1 ≡ 1 (mod n) a −1 b (mod n) a ∗ b (mod n) xiii Acknowledgements The Prophet Muhammad, peace and blessings be upon him, said, He has not thanked Allah who has not thanked people.. Graduate studies at the Florida Institute of Technology have been both challeng- ing and fun. The classes have broadened my perspective as a computer engineering graduate and provided me with the knowledge and skills needed to become an ac- complished engineering instructor, and researcher. I also found the research weekly meetings with my advisor, Dr. Marius Silaghi, where we share updates, carried out new contributions, and learned from his experience, very beneficial. This interac- tion has yielded in many ways to the successful completion of this dissertation which presents the major milestones in my graduation journey. This work would not have been possible without the blessing of Allah, support of the family, patience and sup- port of my academic advisor and financial support that I received from the Saudi Arabian Cultural Mission Scholarship (SACM). I also want to express my gratitude to Umm Al-Qura University, Makkah, KSA, which has shown the confidence in me to grant this opportunity to finish my graduate studies.