Band 8, Heft 1

Abstract. Given two ordinary elliptic curves over a finite field having the same cardinality and endomorphism ring, it is known that the curves admit a nonzero isogeny between them, but finding such an isogeny is believed to be computationally difficult. The fastest known classical algorithm takes exponential time, and prior to our work no faster quantum algorithm was known. Recently, public-key cryptosystems based on the presumed hardness of this problem have been proposed as candidates for post-quantum cryptography. In this paper, we give a new subexponential-time quantum algorithm for constructing nonzero isogenies between two such elliptic curves, assuming the Generalized Riemann Hypothesis (but with no other assumptions). Our algorithm is based on a reduction to a hidden shift problem, and represents the first nontrivial application of Kuperberg's quantum algorithm for finding hidden shifts. This result suggests that isogeny-based cryptosystems may be uncompetitive with more mainstream quantum-resistant cryptosystems such as lattice-based cryptosystems. As part of this work, we also present the first classical algorithm for evaluating isogenies having provably subexponential running time in the cardinality of the base field under GRH.

Abstract. Asymmetric password based key exchange is a key exchange protocol where a client and a server share a low entropic password while the server additionally owns a high entropic secret with respect to a public key. There are simple solutions for this, e.g., [ACM Trans. Inf. Syst. Secur. 2 (1999), 230–268] and its improvement in [Proceedings of CCS 1999, ACM (1999), 63–72]. In the present paper, we consider a new threat to this type of protocol: if a server's high entropic secret gets compromised (e.g., due to cryptanalysis or a poor management), the adversary might quickly break lots of passwords and cause uncountable damage. In this case, one should not expect the protocol to be secure against an off-line dictionary attack since, otherwise, the protocol is in fact a secure password-only key exchange by making the server high entropic secret public. Of course a password-only key exchange does not suffer from this threat as the server does not have a high entropic secret at all. However, known password-only key exchange protocols are not very efficient (note: we only consider protocols without random oracles). This motivates us to study an efficient and secure asymmetric password key exchange that avoids the new threat. In this paper, we first provide a formal model for the new threat, where essentially we require that the active adversary can break ℓ$\ell $ passwords in αℓ|𝒟|$\alpha \ell |\mathcal {D}|$ steps (for α<1/2$\alpha &lt;1/2$) only with a probability negligibly close to exp(-βℓ)$\exp (-\beta \ell )$ for some β>0$\beta &gt;0$, where 𝒟$\mathcal {D}$ is a password dictionary. Then, we construct a framework of asymmetric password based key exchange. We prove that our protocol is secure in the regular model where server high entropic key is never compromised and that it prevents the new threat. To do this, we introduce a new technique by abstracting a probabilistic experiment from the main proof and providing a neat analysis of it.

Abstract. We prove collision bounds for the Pollard rho algorithm to solve the discrete logarithm problem in a general cyclic group 𝐆$\mathbf {G}$. Unlike the setting studied by Kim et al., we consider additive walks: the setting used in practice to solve the elliptic curve discrete logarithm problem. Our bounds differ from the birthday bound 𝒪(|𝐆|)$\mathcal {O}(\sqrt{\vert \mathbf {G}\vert })$ by a factor of log|𝐆|$\sqrt{\log {\vert \mathbf {G}\vert }}$ and are based on mixing time estimates for random walks on finite abelian groups due to Dou and Hildebrand.