## Cryptology ePrint Archive: Report 2019/1404

CSIDH on the surface

Wouter Castryck and Thomas Decru

Abstract: For primes $p \equiv 3 \bmod 4$, we show that setting up CSIDH on the surface, i.e., using supersingular elliptic curves with endomorphism ring $Z[(1 + \sqrt{-p})/2]$, amounts to just a few sign switches in the underlying arithmetic. If $p \equiv 7 \bmod 8$ then the availability of very efficient horizontal 2-isogenies allows for a noticeable speed-up, e.g., our resulting CSURF-512 protocol runs about 5.68% faster than CSIDH-512. This improvement is completely orthogonal to all previous speed-ups, constant-time measures and construction of cryptographic primitives that have appeared in the literature so far. At the same time, moving to the surface gets rid of the redundant factor $Z_3$ of the acting ideal-class group, which is present in the case of CSIDH and offers no extra security.

Category / Keywords: public-key cryptography / isogeny-based cryptography, hard homogeneous spaces, CSIDH, Montgomery curves

Date: received 4 Dec 2019, last revised 31 Jan 2020

Contact author: thomas decru at kuleuven be

Available format(s): PDF | BibTeX Citation

Short URL: ia.cr/2019/1404

[ Cryptology ePrint archive ]