A trade-off between classical and quantum circuit size for an attack against CSIDH

1 Introduction

Given two elliptic curves E₁, E₂ defined over a finite field 𝔽_q, the isogeny problem consists in computing an isogeny ϕ:E1→E2, i.e. a non-constant morphism that maps the identity point on E₁ to the identity point on E₂. A hash function construction based on supersingular isogeny graphs was first proposed in [9], with a security based on the hardness of computing isogenies. An isogeny-based key-exchange was described by Couveignes [12], and its concept was independently rediscovered by Stolbunov [31].

Childs, Jao and Soukharev observed in [10] that the problem of finding an isogeny between two ordinary elliptic curves E₁ and E₂ defined over 𝔽_q and having the same endomorphism ring could be reduced to the problem of solving the Hidden Subgroup Problem (HSP) for a generalized dihedral group. More specifically, if the endomorphism ring of the curves is isomorphic to an imaginary quadratic order 𝒪, then the problem of finding an isogeny between E₁ and E₂ can be reduced to the problem of finding an ideal a⊆O such that [a]∗E‾1=E‾2 where * is the action of the ideal class group Cl(𝒪), [𝖆] is the class of a in Cl(𝒪) and Ē_i is the isomorphism class of the curve E_i. Let N := | Cl(𝒪)|. Using Kuperberg’s sieve [25], this task requires 2Olog(N) queries to an oracle that computes the action of the class of an element in Cl(𝒪). Using the heuristic oracle of [4], the cost of the oracle can be brought down to 2O˜log(N)3, thus giving an overall complexity of 2Olog(N) where N≈|Δ|.

Although neither the CRS [12, 31] nor the CSIDH (a similar system [8] using supersingular curves defined over 𝔽_p) cryptosystems are NIST candidates, it is natural to evaluate their security according to the methodology proposed by NIST for its standardization process [26]. In particular, Level I is defined in [26, Page 16] as follows: “any attack that breaks [this] security definition must require computational resources comparable to or greater than those required for key search on a block cipher with a 128-bit key (e.g. AES-128).” Hence, this corresponds to 2¹²⁸ classical AES evaluations (2¹⁴³ classical gates, according to the document) or to 2^87.5 quantum gates (with 2953 logical qubits), according to the counts given in [17] on the universal Clifford + T set. We point out that this “or” has no reason to be exclusive: a quantum adversary can also run massive classical computations.

2 Mathematical background

An elliptic curve E defined over a finite field 𝔽_q of characteristic p ≠ 2, 3 is a projective algebraic curve with an affine plane model given by an equation of the form y² = x³ + ax + b, where a, b ∈ 𝔽_q and 4a³ + 27b² ≠ 0. The set of points of an elliptic curve is equipped with an additive group law. Details about the arithmetic of elliptic curves can be found in many references, such as [30, Chap. 3].

Let E₁, E₂ be two elliptic curves defined over 𝔽_q. An isogeny ϕ:E1→E2overFq (resp. over F‾q ) is a non-constant rational map defined over 𝔽_q (resp. over F‾q ) which sends the identity point on E₁ to the identity point on E₂. The degree of an isogeny is its degree as a rational map, and an isogeny of degree ℓ is called an ℓ-isogeny. Moreover, E₁, E₂ are said to be isomorphic over 𝔽_q, or 𝔽_q-isomorphic, if there exist isogenies ϕ1:E1→E2andϕ2:E2→E1 over 𝔽_q whose composition is the identity. Two F‾q -isomorphic elliptic curves have the same j-invariant given by j:=17284a34a3+27b2.

An order 𝒪 in a number field K such that [K : ℚ] = n is a subring of K which is a ℤ-module of rank n. A fractional ideal of 𝒪, is a set of the form a=1dI where I is an ideal of 𝒪 and d ∈ ℤ_>0. A fractional ideal I is said to be invertible if there exists a fractional ideal J such that IJ = 𝒪. The invertible fractional ideals form a multiplicative group I. Let 𝒫 be the subgroup consisting of the invertible principal ideals. The ideal class group Cl(𝒪) is Cl(𝒪) := 𝒥/𝒫. We denote by [𝖆] the class of the fractional ideal a in Cl(𝒪). The ideal class group is finite and its cardinality h_𝒪 satisfies hO≤|Δ|ln⁡(|Δ|) (see [11, §5.10.1]), where Δ is the discriminant of 𝒪.

Let E be an elliptic curve defined over 𝔽_q. An endomorphism of E is either an isogeny defined over F̄_q between E and itself, or the zero morphism. The set of endomorphisms of E forms a ring that is denoted by End(E). For elliptic curves, End(E) is either an order in an imaginary quadratic field (and has ℤ-rank 2) or a maximal order in a quaternion algebra ramified at p (the characteristic of the base field) and ∞ (and has ℤ-rank 4). In the former case, E is said to be ordinary while in the latter it is called supersingular. When a supersingular curve is defined over 𝔽_p, then the ring of its 𝔽_p-endomorphisms, denoted by End_Fp (E), is isomorphic to an imaginary quadratic order, much like in the ordinary case.

When E is ordinary (resp. supersingular over 𝔽_p), the class group of End(E) (resp. End_Fp (E)) acts transitively on isomorphism classes of elliptic curves having the same endomorphism ring. More precisely, the class of an ideal a⊆O acts on Ē with End(E)≃O an isogeny of degree 𝒩(a) (the algebraic norm of a). Likewise, each isogeny φ : E → E^′ where End(E)≃End(E′)≃O corresponds (up to isomorphism) to a class in Cl(𝒪). From an ideal a and the ℓ-torsion (where ℓ = 𝒩(a)), one can recover the kernel of φ, and then using Vélu’s formulae [34], one can derive the corresponding isogeny. We denote by [a]∗E‾ the action of the ideal class of a on E. To evaluate the action of [𝖆], we decompose it as a product of classes of prime ideals of small norm ℓ, and evaluate the action of each prime ideal as an ℓ-isogeny. This strategy was described by Couveignes [12], Galbraith–Hess–Smart [15], and later by Bröker–Charles–Lauter [7] and reused in many subsequent works.

3 Isogenies from solutions to the HSP

As shown in [5, 10], the computation of an isogeny between E₁ and E₂ defined over 𝔽_q such that there is an imaginary quadratic order with 𝒪 ≃ End(E_i) for i = 1, 2 can be done by exploiting the action of the ideal class group of 𝒪 on isomorphism classes of curves with endomorphism ring isomorphic to 𝒪. This concerns the cases of ordinary curves, and supersingular curves defined over 𝔽_p.

Assume we are looking for 𝖆 such that t[a]∗E‾1=E‾2. This is precisely the hard mathematical problem of the CSIDH [8] and CRS [12, 29] cryptosystems. Let A=Zd1×⋯×Zdk≃Cl(O) We define f:Z2⋉A→Fq by

where [ay⃗] is the element of Cl(𝒪) corresponding to y⃗∈A via the isomorphism Cl(𝒪) ≃ A. Let H be the subgroup of ℤ₂ ⋉ A such that f(x,y⃗)=f(x′,y⃗′) if and only if (x,y⃗)−(x′,y⃗′)∈H. Then H={(0,0⃗),(1,s⃗)} where ⃗s ∈ A such that [as⃗]∗E‾1=E‾2. The computation of ⃗s can thus be done through the resolution of the Hidden Subgroup Problem in ℤ₂ ⋉ A.

4 Sieve algorithms for solving the HSP

5 Trade-off classical/quantum

Regev’s variant of Kuperberg’s sieve can be seen as an n₁-step process which is paused at each step to perform a classical brute-force enumeration of cost 2O(n2). Instead of balancing the classical and quantum effort, we propose to spend more effort performing the classical search to reduce the size of the quantum circuit. Let n ≈ n₁n₂, with n₁ = O (n^α) and n₂ = O (n^1−α) for some 0 < α < 1. The case α = 1/2 is essentially Regev’s variant [27].

6 The cost of the isogeny oracle

Let 𝔭₁, . . . , 𝔭_u be prime ideals generating Cl(𝒪). Let 𝔏 be the lattice of relations between 𝔭₁, . . . , 𝔭_u, i.e. the lattice of all the vectors (f₁, . . . , f_u) ∈ ℤ^u such that ∏ipifi is principal. In other words, the ideal class ∏ipifi is the neutral element of Cl(𝒪). The high-level strategy for computing the action of [a]∈Cl(O)onE1‾ is the following: (i) Compute a basis B for 𝔏, (ii) Find a BKZ-reduced basis B^′ of 𝔏, (iii) Find (h₁, . . . , h_u) ∈ ℤ^u such that [a]=∏ipihi, (iv) Use Babai’s nearest plane method on B^′ to find short (h1′,…,hu′)∈Zu such that [a]=∏ipihi′ (v) Evaluate the action of ∏ipihi′ by applying repeatedly the action of the p_i for i = 1, . . . , u. Step 1 is a precomputation. It takes quantum polynomial time. Step 2 can be performed as a precomputation requiring only classical gates.

7 Discussion on Heuristic 1

The idea behind Heuristic 1 is that the number of vectors of length log(|Δ|)^1−α with entries bounded by elog(|Δ|)α is |Δ| while |Cl(O)|≈|Δ|. If the class of ∏ipixi yielded by a vector ⃗x were known to be distributed uniformly at random in Cl(𝒪), then we would cover all of Cl(𝒪) with high probability. Unfortunately, the distribution of the classes of these ideals is not known (unless we consider products over the first log(|Δ|)^2+ε split primes [20], but this is incompatible with our restriction on α). To support Heuristic 1, we drew 5000 elements of Cl(𝒪) for various 𝒪 of increasing discriminant. At each discriminant size, we report the maximal exponent in the decomposition of the random classes with respect to the fist log(|Δ|)^1−α split primes. We systematically observe that it is significantly lower than elog(|Δ|)α In Table 1, we present the evolution of the maximal exponent for α = 0.4 and Disc(𝒪) = −p for p the first prime greater than 2ⁱ such that −p is a fundamental discriminant and i between 35 and 160. In Appendix A we present similar results for α = 0.1, . . . , 0.5 and smaller increments in the size of Δ. Heuristic 1 intersects ongoing research in number theory, and it is a motivation for more study on the structure of the class group. The samples presented in this paper are admittedly low, but they support the fact that Heuristic 1 holds true more than 98% of the time (at least for the sizes of Δ that were inspected). Such a success rate makes Heuristic 1 relevant for discussions within the field of cryptography.

8 On fault tolerant implementations

All the asymptotic results regarding the proposed trade-off between classical and quantum circuits only apply to logical qubits. If we incorporate the cost of error correction, then the quantum circuit has to idle while the classical circuit searches for the number m of vectors b⃗∈{0,1}n2+4 such that ⟨b⃗⋅k⃗⟩mod2n2=z. The logical gate representation of this circuit does not include the cost of idling, but in all realistic models of fault tolerant qubits, operations need to be performed on a qubit that is being stored while the classical computation is being done. There is currently an ongoing debate in the cryptographic community as to how to assign a cost-metric to a quantum algorithm given its representation in the logical quantum circuit-model of computation [3, 21]. One approach is the quantum circuit-size and the other is the product of the quantum circuit-width (#qubits) and the quantum circuit-depth (time taken). We have previously studied our tradeoff in light of the circuit-size metric. We now briefly make some remarks with regards to the latter, which is proposed as it captures the difficulties in performing quantum error-correction.

Regardless of the architecture chosen for quantum computers and method used to perform quantum error-correction, it is clear from theoretical error models regarding physical qubits that if we consider discrete timesteps, then applying single or two-qubit gates induce an error in the qubit with a significantly higher probability than if it were simply resting (or "idling") [13, 14, 23, 28, 33]. As the resources we must expend on error-correction is intrinsically linked to the probability of an error occuring, it is plain that the resources to protect an idle quantum state have the potential to be lower than those required to protect a quantum state undergoing active manipulation. For one example of the proposed gaps and tradeoffs that can exist for different architectures, see [32, Tab 2]. In Table 2, we observe that the error rate while storing a qubit is lower than when applying gates in most system.

Furthermore, classical gates could be significantly faster in practice than quantum gates, thus reducing the quantum cost of idling. In fact, most recent resource estimations [1] can show that, given the current trajectory of quantum architectures, a quantum computation requires inherently a corresponding amount of classical computations. From the counts in [16] a Grover search for an AES-128 key requires 2¹⁰⁶ classical computations, hence approximately 2²⁰ classical computations per quantum gate.

Our tradeoff therefore allows for agility in cryptanalysis depending upon the eventual architecture of quantum computers and opens the door for improvements and further tradeoffs if smarter methods of performing the brute-force enumeration step are discovered. A simple example of a further trade-off would be to employ parallelism in this stage so that if m classical processors are available, then the classical time would be proportional to 2^O(n1−α)/m+O(m), thus reducing the time of quantum idling even more. A full examination of this work under current projections involving quantum error-correction is left for future work.

9 Conclusion

We proposed an asymptotic trade-off between the size of the classical and quantum circuits required to attack CSIDH. This angle is motivated by the fact that to use the full power of the NIST metric, we should authorize 2¹²⁸ classical computations and 2^87.5 quantum gates simultaneously. This work showed that such a hybrid attack could be performed with a quantum and a classical circuit that are both asymptotically smaller than the state-of-the-art. The study of the impact of this attack against the parameters for a specific security level (ex: Level I) is left for future work. In the case of CSIDH-512, the number of Clifford + T gates required to run a reversible CSIDH isogeny computation has been estimated in [3] to approximately 251. This is costly, but if we adjust α such that log(|Δ|)^1−α ≈ 128 for log(|Δ|) = 512 (since log(|Δ|) ≈ log(p) where p is the security parameter), we get α ≈ 0.22. Then log(|Δ|)^α ≈ 4, which indicates that the size of the quantum circuit besides oracle calls might be moderate, thus leaving the door open for the relevance of our algorithms to the analysis of the NIST Level I security of CSIDH.