2024-03-05 | Fabio Campos, Jorge Chávez-Saab, Jesús-Javier Chi-Domínguez, Michael Meyer, Krijn Reijnders, Francisco Rodríguez-Henríquez, Peter Schwabe, and Thom Wiggers
This paper evaluates the practicality of CSIDH, an isogeny-based non-interactive key exchange (NIKE) protocol, focusing on higher parameter sizes and quantum security. The authors provide a thorough assessment of CSIDH's practicality through three main analyses: efficient implementation approaches, optimization techniques, and performance benchmarking. They propose two approaches—SQALE and CTIDH—to achieve high-security CSIDH implementations. SQALE focuses on protection against physical attacks by eliminating randomness and dummy operations, while CTIDH optimizes for performance using batching techniques. The paper also presents optimized finite field arithmetic and benchmarking results, showing that the optimized implementations outperform previous results by up to 2.53 times. In a real-world use case, the authors integrate CSIDH into TLS variants that rely on NIKE for early authentication. However, they find that even highly optimized implementations result in too-large handshake latency, indicating that CSIDH is only practical in niche cases. The paper discusses related work, including constant-time implementations, improvements in isogeny computation, and the impact of different parameter choices on performance. The authors conclude by highlighting the trade-offs between security and performance in CSIDH and suggest future directions for further research.This paper evaluates the practicality of CSIDH, an isogeny-based non-interactive key exchange (NIKE) protocol, focusing on higher parameter sizes and quantum security. The authors provide a thorough assessment of CSIDH's practicality through three main analyses: efficient implementation approaches, optimization techniques, and performance benchmarking. They propose two approaches—SQALE and CTIDH—to achieve high-security CSIDH implementations. SQALE focuses on protection against physical attacks by eliminating randomness and dummy operations, while CTIDH optimizes for performance using batching techniques. The paper also presents optimized finite field arithmetic and benchmarking results, showing that the optimized implementations outperform previous results by up to 2.53 times. In a real-world use case, the authors integrate CSIDH into TLS variants that rely on NIKE for early authentication. However, they find that even highly optimized implementations result in too-large handshake latency, indicating that CSIDH is only practical in niche cases. The paper discusses related work, including constant-time implementations, improvements in isogeny computation, and the impact of different parameter choices on performance. The authors conclude by highlighting the trade-offs between security and performance in CSIDH and suggest future directions for further research.