2024-03-05 | Fabio Campos, Jorge Chávez-Saab, Jesús-Javier Chi-Domínguez, Michael Meyer, Krijn Reijnders, Francisco Rodríguez-Henríquez, Peter Schwabe, Thom Wiggers
This paper evaluates the practicality of CSIDH, a post-quantum key exchange protocol based on isogenies. The authors assess the performance of high-security CSIDH implementations, which are designed for conservative quantum security and protection against physical attacks. They describe two approaches for implementing high-security CSIDH: dCSIDH, which is deterministic and dummy-free, and CTIDH, which is optimized for performance using batching techniques. The authors optimize both implementations by improving subroutines and finite field arithmetic, and benchmark their performance. Their dCSIDH implementation outperforms previous results by up to 2.53×, while CTIDH is three times faster than dCSIDH. However, even the most optimized implementations result in high handshake latency, making CSIDH impractical for general use. The authors also evaluate CSIDH in real-world network protocols, such as TLS variants, and find that it is too slow for widespread adoption. They conclude that while CSIDH is a promising post-quantum key exchange protocol, its practicality is limited to niche applications. The paper also discusses related work, including constant-time implementations of CSIDH and the quantum security of the protocol. The authors provide their CSIDH software in the public domain and describe the organization of the paper.This paper evaluates the practicality of CSIDH, a post-quantum key exchange protocol based on isogenies. The authors assess the performance of high-security CSIDH implementations, which are designed for conservative quantum security and protection against physical attacks. They describe two approaches for implementing high-security CSIDH: dCSIDH, which is deterministic and dummy-free, and CTIDH, which is optimized for performance using batching techniques. The authors optimize both implementations by improving subroutines and finite field arithmetic, and benchmark their performance. Their dCSIDH implementation outperforms previous results by up to 2.53×, while CTIDH is three times faster than dCSIDH. However, even the most optimized implementations result in high handshake latency, making CSIDH impractical for general use. The authors also evaluate CSIDH in real-world network protocols, such as TLS variants, and find that it is too slow for widespread adoption. They conclude that while CSIDH is a promising post-quantum key exchange protocol, its practicality is limited to niche applications. The paper also discusses related work, including constant-time implementations of CSIDH and the quantum security of the protocol. The authors provide their CSIDH software in the public domain and describe the organization of the paper.