Verifiable random function from the Deuring correspondence and higher dimensional isogenies
Résumé
In this paper, we introduce DeuringVUF, a new Verifiable
Unpredictable Function (VUF) protocol based on isogenies between supersingular curves.
The most interesting application of this VUF is DeuringVRF a postquantum Verifiable Random Function (VRF). The main advantage of
this new scheme is its compactness, with combined public key and proof
size of roughly 450 bytes, which is orders of magnitude smaller than
other generic purpose post-quantum VRF constructions. This scheme
is also the first post-quantum VRF satisfying unconditional uniqueness.
We show that this scheme is practical by providing a first non-optimized
C implementation that runs in roughly 18ms for verification and 160ms
for evaluation. Up to our knowledge, this is the fastest implementation
of a post-quantum VRF.
The function at the heart of our construction is the one that computes
the codomain of an isogeny of big prime degree from its kernel. The evaluation can be performed efficiently with the knowledge of the endomorphism ring using a new ideal-to-isogeny algorithm introduced recently by
Basso, Dartois, De Feo, Leroux, Maino, Pope, Robert and Wesolowski
that uses computation of dimension 2 isogenies between elliptic products to compute effectively the translation through the Deuring correspondence of any ideal. On the other hand, without the knowledge of
the endomorphism ring, this computation appears to be hard. The security of our DeuringVUF holds under a new assumption call the one-more
isogeny problem (OMIP).
Another application of DeuringVUF is the first hash-and-sign signature
based on isogenies in the standard model. While we don’t expect the
signature in itself to outperform the recent variants of SQIsign, it remains
very competitive in both compactness and efficiency while providing a
new framework to build isogeny-based signature that could lead to new
interesting applications.
We also introduce several new algorithms for the effective Deuring correspondence. In particular, we introduce an algorithm to translate an ideal
of norm a big power of a small prime ℓ into the corresponding isogeny
of dimension 1 using isogenies between abelian variety of dimension 2
as a tool. This algorithm can be used to improve the SQIsign signature
scheme.
Domaines
Cryptographie et sécurité [cs.CR]Origine | Fichiers produits par l'(les) auteur(s) |
---|