Towards Optimized and Constant-Time CSIDH on Embedded Devices

We present an optimized, constant-time software library for commutative supersingular isogeny Diffie-Hellman key exchange (CSIDH) proposed by Castryck et al. which targets 64-bit ARM processors. The proposed library is implemented based on highly-optimized field arithmetic operations and computes the entire key exchange in constant-time. The proposed implementation is resistant to timing attacks. We adopt optimization techniques to evaluate the highest performance CSIDH on ARM-powered embedded devices such as cellphones, analyzing the possibility of using such a scheme in the quantum era. To the best of our knowledge, the proposed implementation is the first constant-time implementation of CSIDH and the first evaluation of this scheme on embedded devices. The benchmark result on a Google Pixel 2 smartphone equipped with 64-bit high-performance ARM Cortex-A72 core shows that it takes almost 12 s for each party to compute a commutative action operation in constant-time over the 511-bit finite field proposed by Castryck et al. However, using uniform but variable-time Montgomery ladder with security considerations improves these results significantly.

我们提出了一个针对64位ARM处理器的优化的、常数时间的软件库，用于由卡斯崔克等人提出的交换超奇异同源迪菲 - 赫尔曼密钥交换（CSIDH）。所提出的库是基于高度优化的域算术运算实现的，并在常数时间内计算整个密钥交换。所提出的实现对计时攻击具有抵抗力。我们采用优化技术来评估在ARM驱动的嵌入式设备（如手机）上CSIDH的最高性能，分析在量子时代使用这种方案的可能性。据我们所知，所提出的实现是CSIDH的第一个常数时间实现，也是该方案在嵌入式设备上的首次评估。在配备64位高性能ARM Cortex - A72内核的谷歌Pixel 2智能手机上的基准测试结果表明，各方在卡斯崔克等人提出的511位有限域上以常数时间计算一个交换作用操作大约需要12秒。然而，考虑安全性使用统一但可变时间的蒙哥马利阶梯算法显著改善了这些结果。