Cryptographic Schemes Based on Isogenies

In this thesis we use isogenies between ordinary elliptic curves for the construction of new cryptographic schemes. The thesis is organized into an introductory chapter followed by three articles. In the introduction we motivate our work by the necessity of exploring new computationally hard problems applicable to cryptography. We describe our work and results, and survey the related work. We also give the background material from algebraic number theory and provide explanatory examples. In the first paper we propose a number of cryptographic schemes based on the group action on a set: a public-key encryption scheme PE , a key agreement protocol KA1, three authenticated key agreement protocols, and some related schemes. We construct an implementation of these schemes for the action of the ideal class group CL(OK) of an imaginary quadratic field K on the set ELLp,n(OK) of isomorphism classes of elliptic curves over Fp with n points and the endomorphism ring OK . Implementation details, such as representation of set and group elements, group action, sampling from CL(OK), and cryptosystem parameter generation, are described as well. The paper presents speed measurements of our trial implementation. In the second paper we provide security reductions for the protocol KA1 and the encryption scheme PE . For the KA1 protocol we use the notion of session key security in the authenticated-link model proposed by Canetti and Krawczyk. For the PE scheme we use a version of the semantic security notion proposed by Goldwasser and Micali. We prove that the security of the KA1 protocol and the PE scheme is based on the decisional Diffie-Hellman group action (DDHA) problem, which is defined in our paper. The class-group DDHA problem is reducible to the isogeny problem: given two isogenous ordinary elliptic curves, compute an isogeny between them. The isogeny problem is studied in our third paper. A low storage algorithm for this problem was proposed by Galbraith, Hess and Smart (GHS) in 2002. We give an improvement of the GHS algorithm by modifying the pseudorandom walk so that lower-degree isogenies are used more frequently. This is motivated by the fact that high degree isogenies are slower to compute than low degree ones. We analyse the running time of the parallel collision search algorithm when the partitioning is uneven. We also give experimental results. We conclude that our isogeny problem algorithm is around 14 times faster than the GHS algorithm when constructing horizontal isogenies between random isogenous elliptic curves over a 160-bit prime field. The expected running time of our improved algorithm indicates that the computational complexity of the isogeny problem is currently exponential in log(p). This page is intentionally left blank.