ABSTRACT
Abstract
In a general aspect, a supersingular isogeny-based cryptography process is performed. In some aspects, a secret integer of a first entity is obtained. A public key of a second entity includes a first image curve and a first pair of elliptic curve points. A first pairing value is computed based on a second pair of elliptic curve points defined by a supersingular isogeny-based cryptosystem. A second pairing value is computed based on the first pair of elliptic curve points. Validating the public key includes verifying whether the first pairing value matches the second pairing value. A second image curve is computed based on the secret integer and the first pair of elliptic curve points. A shared secret value, shared by the first entity and the second entity, is computed based on the second image curve.
Description
BACKGROUND
The following description relates to verifying data in supersingular isogeny-based cryptographic protocols.
Cryptography systems are used to communicate securely over public channels. For example, some cryptography systems provide confidentiality by encrypting messages, and some cryptography systems provide authenticity through digital signatures. Some cryptography systems operate using public keys, private keys and shared secrets.
DESCRIPTION OF DRAWINGS
FIG. 1 is a block diagram showing aspects of an example communication system.
FIG. 2 is a flow diagram showing aspects of an example cryptosystem process.
FIGS. 3A-3B are flow diagrams showing an example supersingular isogeny-based cryptographic protocol.
FIGS. 4A-4B are flow diagrams showing another example supersingular isogeny-based cryptographic protocol.
DETAILED DESCRIPTION
In some aspects of the present disclosure, improved supersingular isogeny-based cryptographic protocols are described. The supersingular isogeny Diffie-Hellman key agreement protocol (SIDH) is an example of a supersingular isogeny-based cryptographic protocol that is believed to be secure against attacks carried out by quantum computers. In some SIDH deployments, if one of the entities reuses its secret key (e.g., as a static private key), then the secret key can be efficiently recovered, for example, with the active attack described by Galbraith et al. (Galbraith, et al., âOn the security of supersingular isogeny cryptosystems,â Advances in CryptologyâASIACRYPT 2016. Lecture Notes in Computer Science vol. 10031. Springer, Berlin, Heidelberg, pp. 63-91, 2016.) A countermeasure to this attack was described by Kirkwood et al. (Kirkwood, et al., âFailure is not an option: standardization issues for post-quantum key agreement,â Workshop on Cybersecurity in a Post - Quantum World, 2015.). However, existing countermeasures are computationally expensive and therefore time consuming and less practical. Here we describe supersingular isogeny-based cryptographic protocols that include improved countermeasures, for example, countermeasures that allow faster computations while achieving the same or otherwise acceptable security levels.
Accordingly, aspects of the systems and techniques described here can be used to improve the operation of communications systems (e.g., data networks, etc.), computer systems (e.g., network-connected computers, etc.), smart devices (e.g., so-called âInternet-of-Thingsâ (IoT) devices, etc.) and other classes of technology. For example, a wide variety of modern technologies rely on computer-implemented cryptosystems for secure operation, and the techniques described here can improve such computer-implemented cryptosystems, for example, making them more secure, more computationally efficient or providing other advantages in some instances.
In some implementations, the techniques described here can be used to neutralize or otherwise reduce exposure to an attack on a supersingular isogeny-based cryptographic protocol, for example, the active attack proposed by Galbraith et al. and potentially other types of attacks. The active attack proposed by Galbraith et al. is performed by one of the two entities (âAliceâ and âBobâ) executing an SIDH protocol. In particular, the attack allows Bob to recover Alice's secret key efficiently one bit a time. In order to determine the i-th bit of Alice's secret key, Bob sends Alice an incorrect public key (E B , U i , V i ) instead of the correct public key (E B , Ï B (P A ), Ï B (Q A )), where U i and V i are some linear combinations of Ï B (P A ) and Ï B (Q A ). In the cryptographic protocols described here, one of the entities (âAliceâ) validates the public key of the other entity (âBobâ) in a manner that neutralizes or otherwise reduces exposure to an attack of the type described by Galbraith et al.
In some cryptographic protocols (including the example protocol 300 shown in FIGS. 3A-3B and variants), Bob sends (an encrypted version of) his secret generator G B instead of a random seed. By receiving the secret generator G B from Bob, Alice can validate Bob's public key without having to duplicate all of Bob's computations to derive the public key. For example, Alice may avoid the computation of both βâ²=PRF(râ² B ) and Gâ² B =P B +[βâ²]Q B , where PRF represents a pseudorandom function that generates the integer βⲠfrom the random seed râ² B . Given that βⲠis a number whose magnitude is approximately equal to 3 m , this prevents Alice from computing an expensive operation of scalar multiplication by a large number βâ².
In addition, the example protocol 300 shown in FIGS. 3A-3B is secure, despite the fact that (potentially dishonest) Bob has several options to modify the data sent to Alice. In particular, Bob can provide a generator point G B that does not have a full order. Or instead of sending the correct generator point G B , Bob can send a different generator of the subgroup <G B >. However, by validating the degree of the isogeny defined by G B (e.g., validating deg(Ïâ² B )=3 m ), Alice can detect if Bob provides a generator point G B that does not have a full order. This condition can be verified in the process of isogeny evaluation, and, at least in some cases, does not require any significant additional computational overhead. Further, by verifying certain conditions (e.g., j(E B )â 0, 1728, Eâ² B =E B , Ïâ² B (P A )=U and Ïâ² B (Q A )=V), Alice can ensure that, by providing alternative generators of <G B >, Bob does not learn any information about Alice's secret key.
In some cryptographic protocols (including the example protocol 400 shown in FIGS. 4A-4B and variants), Alice verifies a pairing value and an isogeny evaluation (e.g., e 2
n (U, V)=e 2
n (P A , Q A ) 3
m and Ïâ² B (Q A )=V in the example shown in FIGS. 4A-4B ). Using the pairing-based validation allows Alice to validate Bob's public key using only one isogeny evaluation (e.g., Ïâ² B (Q A )). In addition, Alice can complete the pairing-based validation before computing any isogeny evaluations, which means that Alice can detect some invalid public keys without an isogeny evaluation. In addition, the example protocol 400 shown in FIGS. 4A-4B is secure, in the sense that it allows Alice to use a static key and detect if Bob dishonestly modified any of the parameters of his public key (E B , Ï B (P A ), Ï B (Q A )).
In some cases, the public key validation techniques described here can be used to improve supersingular isogeny-based key agreement protocols (e.g., SIDH), as well as other supersingular isogeny-based cryptographic protocols. For example, the public key validation techniques described here may be applied to supersingular isogeny-based public key encryption schemes, such as, for example, the public key encryption scheme described by De Feo et al. (De Feo, et al., âTowards quantum-resistant cryptosystems from supersingular elliptic curve isogenies.â Journal of Mathematical Cryptology 8 (3), pp. 209-247, 2014.). As another example, the public key validation techniques described here may be applied to supersingular isogeny-based key encapsulation mechanism (KEM) schemes.
FIG. 1 is a block diagram showing aspects of an example communication system 100 . The example communication system 100 shown in FIG. 1 includes two nodes
102 , 104 . The nodes
102 , 104 use a supersingular isogeny-based cryptosystem to communicate with each other over a channel 106 . The nodes
102 , 104 represent distinct entities in the cryptosystem.
In the example shown, a quantum-enabled adversary 108 has access to the channel 106 , information exchanged on the channel 106 , or both. In some instances, the quantum-enabled adversary 108 can transmit or modify information on the channel 106 . The communication system 100 may include additional or different features, and the components in a communication system may be configured to operate as shown in FIG. 1 or in another manner.
In some implementations, nodes in the communication system 100 may have a server-client relationship. For example, the node 102 can be a server and the node 104 can be its client, or vice-versa. In some implementations, nodes in the communication system 100 may have a peer-to-peer relationship. For example, the nodes
102 , 104 can be peers in a served network, in a peer-to-peer network or another type of network. Nodes may have another type of relationship in the communication system 100 .
In the example shown in FIG. 1 , the example nodes
102 , 104 each have computational resources (e.g., hardware, software, firmware) that are used to communicate with other nodes. In some implementations, nodes in the communication system 100 can be implemented in various systems, such as, for example, laptops, desktops, workstations, smartphones, tablets, personal digital assistants, servers, server clusters, mainframes, IoT devices, and other types of computer systems. As shown in FIG. 1 , the example node 102 includes a memory 110 , a processor 112 , and an interface 114 . Each of the nodes
102 , 104 may include the same, additional or different components. The nodes
102 , 104 may be configured to operate as shown and described with respect to FIG. 1 or in another manner.
In the example shown in FIG. 1 , the entities represented by the nodes
102 , 104 may correspond to a computing device, a computer system, an IP address or other network address, or another type of computer-readable identifier or instance of a computer resource. Accordingly, the computations and other operations of each entity may be performed by one or more processors or other elements of the <figure-callout id="104" label="respective node" fil
BACKGROUND
The following description relates to verifying data in supersingular isogeny-based cryptographic protocols.
Cryptography systems are used to communicate securely over public channels. For example, some cryptography systems provide confidentiality by encrypting messages, and some cryptography systems provide authenticity through digital signatures. Some cryptography systems operate using public keys, private keys and shared secrets.
DESCRIPTION OF DRAWINGS
FIG. 1 is a block diagram showing aspects of an example communication system.
FIG. 2 is a flow diagram showing aspects of an example cryptosystem process.
FIGS. 3A-3B are flow diagrams showing an example supersingular isogeny-based cryptographic protocol.
FIGS. 4A-4B are flow diagrams showing another example supersingular isogeny-based cryptographic protocol.
DETAILED DESCRIPTION
In some aspects of the present disclosure, improved supersingular isogeny-based cryptographic protocols are described. The supersingular isogeny Diffie-Hellman key agreement protocol (SIDH) is an example of a supersingular isogeny-based cryptographic protocol that is believed to be secure against attacks carried out by quantum computers. In some SIDH deployments, if one of the entities reuses its secret key (e.g., as a static private key), then the secret key can be efficiently recovered, for example, with the active attack described by Galbraith et al. (Galbraith, et al., âOn the security of supersingular isogeny cryptosystems,â Advances in CryptologyâASIACRYPT 2016. Lecture Notes in Computer Science vol. 10031. Springer, Berlin, Heidelberg, pp. 63-91, 2016.) A countermeasure to this attack was described by Kirkwood et al. (Kirkwood, et al., âFailure is not an option: standardization issues for post-quantum key agreement,â Workshop on Cybersecurity in a Post - Quantum World, 2015.). However, existing countermeasures are computationally expensive and therefore time consuming and less practical. Here we describe supersingular isogeny-based cryptographic protocols that include improved countermeasures, for example, countermeasures that allow faster computations while achieving the same or otherwise acceptable security levels.
Accordingly, aspects of the systems and techniques described here can be used to improve the operation of communications systems (e.g., data networks, etc.), computer systems (e.g., network-connected computers, etc.), smart devices (e.g., so-called âInternet-of-Thingsâ (IoT) devices, etc.) and other classes of technology. For example, a wide variety of modern technologies rely on computer-implemented cryptosystems for secure operation, and the techniques described here can improve such computer-implemented cryptosystems, for example, making them more secure, more computationally efficient or providing other advantages in some instances.
In some implementations, the techniques described here can be used to neutralize or otherwise reduce exposure to an attack on a supersingular isogeny-based cryptographic protocol, for example, the active attack proposed by Galbraith et al. and potentially other types of attacks. The active attack proposed by Galbraith et al. is performed by one of the two entities (âAliceâ and âBobâ) executing an SIDH protocol. In particular, the attack allows Bob to recover Alice's secret key efficiently one bit a time. In order to determine the i-th bit of Alice's secret key, Bob sends Alice an incorrect public key (E B , U i , V i ) instead of the correct public key (E B , Ï B (P A ), Ï B (Q A )), where U i and V i are some linear combinations of Ï B (P A ) and Ï B (Q A ). In the cryptographic protocols described here, one of the entities (âAliceâ) validates the public key of the other entity (âBobâ) in a manner that neutralizes or otherwise reduces exposure to an attack of the type described by Galbraith et al.
In some cryptographic protocols (including the example protocol 300 shown in FIGS. 3A-3B and variants), Bob sends (an encrypted version of) his secret generator G B instead of a random seed. By receiving the secret generator G B from Bob, Alice can validate Bob's public key without having to duplicate all of Bob's computations to derive the public key. For example, Alice may avoid the computation of both βâ²=PRF(râ² B ) and Gâ² B =P B +[βâ²]Q B , where PRF represents a pseudorandom function that generates the integer βⲠfrom the random seed râ² B . Given that βⲠis a number whose magnitude is approximately equal to 3 m , this prevents Alice from computing an expensive operation of scalar multiplication by a large number βâ².
In addition, the example protocol 300 shown in FIGS. 3A-3B is secure, despite the fact that (potentially dishonest) Bob has several options to modify the data sent to Alice. In particular, Bob can provide a generator point G B that does not have a full order. Or instead of sending the correct generator point G B , Bob can send a different generator of the subgroup <G B >. However, by validating the degree of the isogeny defined by G B (e.g., validating deg(Ïâ² B )=3 m ), Alice can detect if Bob provides a generator point G B that does not have a full order. This condition can be verified in the process of isogeny evaluation, and, at least in some cases, does not require any significant additional computational overhead. Further, by verifying certain conditions (e.g., j(E B )â 0, 1728, Eâ² B =E B , Ïâ² B (P A )=U and Ïâ² B (Q A )=V), Alice can ensure that, by providing alternative generators of <G B >, Bob does not learn any information about Alice's secret key.
In some cryptographic protocols (including the example protocol 400 shown in FIGS. 4A-4B and variants), Alice verifies a pairing value and an isogeny evaluation (e.g., e 2
n (U, V)=e 2
n (P A , Q A ) 3
m and Ïâ² B (Q A )=V in the example shown in FIGS. 4A-4B ). Using the pairing-based validation allows Alice to validate Bob's public key using only one isogeny evaluation (e.g., Ïâ² B (Q A )). In addition, Alice can complete the pairing-based validation before computing any isogeny evaluations, which means that Alice can detect some invalid public keys without an isogeny evaluation. In addition, the example protocol 400 shown in FIGS. 4A-4B is secure, in the sense that it allows Alice to use a static key and detect if Bob dishonestly modified any of the parameters of his public key (E B , Ï B (P A ), Ï B (Q A )).
In some cases, the public key validation techniques described here can be used to improve supersingular isogeny-based key agreement protocols (e.g., SIDH), as well as other supersingular isogeny-based cryptographic protocols. For example, the public key validation techniques described here may be applied to supersingular isogeny-based public key encryption schemes, such as, for example, the public key encryption scheme described by De Feo et al. (De Feo, et al., âTowards quantum-resistant cryptosystems from supersingular elliptic curve isogenies.â Journal of Mathematical Cryptology 8 (3), pp. 209-247, 2014.). As another example, the public key validation techniques described here may be applied to supersingular isogeny-based key encapsulation mechanism (KEM) schemes.
FIG. 1 is a block diagram showing aspects of an example communication system 100 . The example communication system 100 shown in FIG. 1 includes two nodes
102 , 104 . The nodes
102 , 104 use a supersingular isogeny-based cryptosystem to communicate with each other over a channel 106 . The nodes
102 , 104 represent distinct entities in the cryptosystem.
In the example shown, a quantum-enabled adversary 108 has access to the channel 106 , information exchanged on the channel 106 , or both. In some instances, the quantum-enabled adversary 108 can transmit or modify information on the channel 106 . The communication system 100 may include additional or different features, and the components in a communication system may be configured to operate as shown in FIG. 1 or in another manner.
In some implementations, nodes in the communication system 100 may have a server-client relationship. For example, the node 102 can be a server and the node 104 can be its client, or vice-versa. In some implementations, nodes in the communication system 100 may have a peer-to-peer relationship. For example, the nodes
102 , 104 can be peers in a served network, in a peer-to-peer network or another type of network. Nodes may have another type of relationship in the communication system 100 .
In the example shown in FIG. 1 , the example nodes
102 , 104 each have computational resources (e.g., hardware, software, firmware) that are used to communicate with other nodes. In some implementations, nodes in the communication system 100 can be implemented in various systems, such as, for example, laptops, desktops, workstations, smartphones, tablets, personal digital assistants, servers, server clusters, mainframes, IoT devices, and other types of computer systems. As shown in FIG. 1 , the example node 102 includes a memory 110 , a processor 112 , and an interface 114 . Each of the nodes
102 , 104 may include the same, additional or different components. The nodes
102 , 104 may be configured to operate as shown and described with respect to FIG. 1 or in another manner.
In the example shown in FIG. 1 , the entities represented by the nodes
102 , 104 may correspond to a computing device, a computer system, an IP address or other network address, or another type of computer-readable identifier or instance of a computer resource. Accordingly, the computations and other operations of each entity may be performed by one or more processors or other elements of the respective node
102 , 104 . Similarly, information sent to or received by an entity may be sent to or received by an element (e.g., one or more processors, memories, or interfaces) of the respective node
102 , 104 .
The example memory 110 can include, for example, random access memory (RAM), a storage device (e.g., a writable read-only memory (ROM) or others), a hard disk, or another type of storage medium. The example memory 110 can store instructions (e.g., computer code, a computer program, etc.) associated with an operating system, computer applications and other resources. The memory 110 can also store application data and data objects that can be interpreted by one or more applications or virtual machines running on the node 102 . The node 102 can be preprogrammed, or it can be programmed (and reprogrammed), by loading a program from another source (e.g., from a DVD-ROM, from a removable memory device, from a remote server, from a data network or in another manner). In some cases, the memory 110 stores computer-readable instructions for software applications, scripts, programs, functions, executables or other modules that are interpreted or executed by the processor 112 . For example, the computer-readable instructions can be configured to perform one or more of the operations shown in one or both of FIG. 2 .
In the example node 102 shown in FIG. 1 , the processor 112 is a data processing apparatus that can execute instructions, for example, to generate output data based on data inputs. For example, the processor 112 can run computer programs by executing or interpreting the software, scripts, programs, functions, executables, or other modules stored in the memory 110 . In some instances, the processor 112 may perform one or more of the operations shown in FIG. 2 .
The example processor 112 shown in FIG. 1 can include one or more chips or chipsets that include analog circuitry, digital circuitry or a combination thereof. In some cases, the processor 112 includes multiple processor devices such as, for example, one or more main processors and one or more co-processors. For instance, the processor 112 may include a main processor that can delegate certain computational tasks to a cryptographic co-processor, which may be configured to perform the computational tasks more efficiently than the main processor or in parallel with other computational tasks performed by other processor devices. In some instances, the processor 112 coordinates or controls operation of other components of the node 102 , such as, for example, user interfaces, communication interfaces, peripheral devices and possibly other components.
In the example node 102 shown in FIG. 1 , the interface 114 provides communication with other nodes (e.g., via channel 106 ). In some cases, the interface 114 includes a wireless communication interface that provides wireless communication using a wireless protocol or standard. For example, the interface 114 may provide wireless communication via Bluetooth, Wi-Fi, Near Field Communication (NFC), CDMA, TDMA, PDC, WCDMA, CDMA2000, GPRS, GSM, or other forms of wireless communication. Such communication may occur, for example, through a radio-frequency transceiver or another type of component. In some cases, the interface 114 includes a wired communication interface (e.g., USB, Ethernet) that can be connected to one or more input/output devices, such as, for example, a keyboard, a pointing device, a scanner, or a networking device such as a switch or router, for example, through a network adapter.
The example channel 106 can include all or part of a connector, a data communication network or another type of communication link. For example, the channel 106 can include one or more wired or wireless connections, one or more wired or wireless networks or other communication channels. The channel 106 may have any spatial distribution. The channel 106 may be public, private, or include aspects that are public and private. For instance, in some examples, the channel 106 includes one or more of a Local Area Network (LAN), a Wide Area Network (WAN), a Virtual Private Network (VPN), the Internet, a peer-to-peer network, a cellular network, a Wi-Fi network, a Personal Area Network (PAN) (e.g., a Bluetooth low energy (BTLE) network, a ZigBee network, etc.) or other short-range network involving machine-to-machine (M2M) communication, or another type of data communication network.
In the example shown, the quantum-enabled adversary 108 is a node in the communication system 100 that has access to quantum computational resources. For example, the quantum-enabled adversary 108 can be, include, or have access to a quantum computer, a quantum information processor, a quantum memory, a quantum communication interface or a combination of these and possibly other quantum technologies. In some implementations, the quantum-enabled adversary 108 can include a hybrid computing system, for instance, that includes a quantum processor driven by a classical front end processor, or another type of hybrid computing system.
In some examples, the quantum-enabled adversary 108 can store and process information in a quantum system. For instance, the quantum-enabled adversary 108 may encode information as quantum bits (âqubitsâ) and process the information by manipulating the qubits. The information may be encoded in physical qubits, logical qubits, or a combination of these and other types of qubit encodings. In some implementations, the quantum-enabled adversary 108 can operate in a fault-tolerant regime, or the quantum-enabled adversary may operate below the fault-tolerant regime.
Many public key cryptography systems (âcryptosystemsâ) are known to be insecure against an attacker armed with a scalable quantum computer. For example, the Diffie-Hellman (DH) and elliptic curve Diffie-Hellman (ECDH) key agreement protocols are vulnerable to certain types of attacks by quantum-enabled adversaries. The threat of quantum computers to public key cryptography can be mitigated by switching to other public key cryptography systems that are believed to be invulnerable to quantum attack. For example, supersingular isogeny-based protocols have been proposed as a quantum-resistant replacement for contemporary key agreement protocols such as the Diffie-Hellman (DH) and elliptic curve Diffie-Hellman (ECDH).
In some implementations, the example quantum-enabled adversary 108 can perform quantum computing algorithms, execute quantum computing circuits or quantum communication protocols, or perform other types of quantum information processing tasks. In the example shown, the quantum-enabled adversary 108 can perform Shor's algorithm, which allows the quantum-enabled adversary to efficiently solve problems that are believed to be hard on a classical computer. For example, the quantum-enabled adversary 108 may use Shor's algorithm to factor large integers, find discrete logarithms or possibly to solve other problems in a computationally-efficient manner. Accordingly, the example quantum-enabled adversary 108 can compromise the security of certain quantum-vulnerable cryptography systems (e.g., by computing a private key of a certificate authority or other entity based on public information).
The example quantum-enabled adversary 108 shown in FIG. 1 can access information exchanged on the channel 106 . For example, the quantum-enabled adversary 108 may access some or all of the information exchanged between the nodes
102 , 104 . In some instances, the quantum-enabled adversary 108 can directly observe correspondence on the channel 106 ; in some instances, the quantum-enabled adversary 108 indirectly obtains such correspondence, for example, by receiving information observed on the channel 106 by another entity or system.
In some implementations, the quantum-enabled adversary 108 can factor integers, compute discrete logarithms, or perform other classically-hard computational tasks fast enough to compromise the security of certain cryptography systems. For example, the quantum-enabled adversary 108 may be capable of computing prime factors fast enough to compromise certain RSA-based cryptography systems or computing discrete logarithms fast enough to compromise certain ECC-based cryptography systems.
In the example shown in FIG. 1 , the nodes
102 , 104 may use a quantum-resistant cryptography system that cannot be compromised by the example quantum-enabled adversary 108 . For instance, the nodes
102 , 104 may use a cryptography system that is secure against a quantum computer that can efficiently execute Shor's algorithm or other types of algorithms that are known to compromise the security of certain conventional cryptography standards.
In some implementations, the nodes
102 , 104 use a digital signature scheme that allows each node to verify the authenticity of messages received from the other node, and the digital signature scheme can be a quantum-resistant scheme that is not vulnerable to the quantum computing resources of the quantum-enabled adversary 108 . In some implementations, the nodes
102 , 104 use an encryption scheme that allows each node to send confidential messages to the other node, and the encryption scheme can be a quantum-resistant scheme that is not vulnerable to the quantum computing resources of the quantum-enabled adversary 108 . Such digital signature schemes and encryption schemes can include or be used in conjunction with a key agreement protocol or a key encapsulation mechanism that is also secure against attacks by the quantum-enabled adversary 108 . In some examples, the nodes
102 , 104 can use the example techniques shown in FIG. 2 , or the nodes
102 , 104 may use variations of these and other techniques to communicate securely on the channel 106 .
FIG. 2 is a flow diagram showing aspects of an example cryptographic process 200 . The example cryptographic process 200 can be performed, for example, by computer systems that can exchange information over a communication channel. For instance, operations in the cryptographic process 200 may be performed by the nodes
102 , 104 in the example communication system 100 shown in FIG. 1 or in another type of system. The example process 200 may include additional or different operations, including operations performed by additional or different entities, and the operations may be performed in the order shown or in another order.
In some cases, one or more of the operations shown in FIG. 2 are implemented as processes that include multiple operations, sub-processes or other types of routines. For example, the processes shown in FIGS. 3A-3B and 4A-4B can be used, in some instances, to perform one or more of the example operations shown in FIG. 2 . In some cases, operations can be combined, performed in parallel, iterated or otherwise repeated or performed in another manner.
The example process 200 shown in FIG. 2 includes operations performed by nodes
202 A, 202 B. In the example shown, the nodes
202 A, 202 B represent two distinct entities in a supersingular isogeny-based cryptosystem. The two distinct entities are referred to as âAliceâ and âBobâ in FIG. 2 . In the example shown, the nodes
202 A, 202 B exchange public data, and each node uses the public data provided by the other node to execute the process 200 . In some cases, the nodes
202 A, 202 B may have a server-client relationship, a peer-to-peer relationship or another type of relationship. The nodes
202 A, 202 B may communicate with each other, for example, directly or indirectly, in each stage of the process 200 . In some cases, the process 200 or individual operations within the process 200 can be executed by the nodes
202 A, 202 B over a period of seconds, or the process 200 may be executed over a shorter or longer period of time.
In the example shown in FIG. 2 , each entity may correspond to a computing device, a computer system, an IP address or other network address, or another type of computer-readable identifier or instance of a computer resource. Accordingly, the computations and other operations of each entity may be performed by one or more processors or other elements of the respective node
202 A, 202 B. Similarly, information sent to or received by an entity may be sent to or received by an element (e.g., one or more processors, memories, or interfaces) of the respective node
202 A, 202 B.
In some examples, the cryptographic process 200 is secure against quantum-enabled adversaries such as, for example, the quantum-enabled adversary 108 shown in FIG. 1 . For instance, in some cases, the example cryptographic process 200 is secure against certain types of attacks or other processes that can be performed by a quantum-enabled adversary who has access to public information exchanged between the server 202 and the client 204 . The example cryptographic process 200 may also provide security against classically-enabled adversaries who do not have access to quantum computers or other quantum resources.
At 210 A and 210 B, the nodes
202 A, 202 B perform one or more cryptosystem setup operations. A supersingular isogeny-based cryptosystem can be described in terms of a supersingular elliptic curve E defined over a finite field F p
2 . Let pâ¥5 be a prime integer; let F p
2 denote a finite field of characteristic p with p 2 elements; and let E be an elliptic curve defined over F p
2 . The cryptosystem setup operations at 210 A, 210 B can include defining the prime integer p=l A n l B m f±1, where l A and l B are distinct prime integers, where f, n, and m are positive integers with f being coprime to l A and l B , such that l A n â l B m . In some examples described here, l A =2 and l B =3, and p=2 n 3 m fâ1, with f being coprime to 2 and 3, such that 2 n â3 m . In such examples, the elliptic curve E has (2 n 3 m f) 2 points.
The cryptosystem setup operations at 210 A, 210 B can include defining elliptic curve points P A , Q A , P B , Q B on the elliptic curve E. For each elliptic curve point, a pair of numbers in the finite field F p
2 can represent the x-coordinate and the y-coordinate. For instance, each coordinate can be expressed A+i*B for some integers A and B between 0 and p. Therefore, each elliptic curve point can be represented by four integers between 0 and p.
In examples where l A =2 and l B =3, {P A , Q A } represents a basis of the set of 2 n -torsion points E[2 n ], and {P B , Q B } represents a basis of the set of 3 m -torsion points E[3 m ]; the order of elliptic curve points P A and Q A is 2 n ; and the order of elliptic curve points P B and Q B is 3 m . The global system parameters p, E, P A , Q A , P B , Q B , p, l A , l B , f, n and m, which define a supersingular isogeny cryptosystem, can be published to, computed by, or otherwise made available to the nodes
202 A, 202 B. When a cryptographic protocol is executed with these parameters, one of the entities works over a first set of elliptic curve points defined by l A n (e.g., E[2 n ]), and the other entity works over a second set of elliptic curve points defined by l A n (e.g., E[3 m ]). In the examples described here (in FIGS. 3A-3B and 4A-4B ), Alice and Bob agree that Alice will work over the set E[2 n ] and Bob will work over the set E[3 m ].
At 212 A and 212 B, the nodes
202 A, 202 B perform one or more operations to each generate a respective key pair. In some implementations, each respective node
202 A, 202 B produces a public-private key pair. For instance, a first public-private key pair for the first entity (âAliceâ) may be produced at 212 A, and a second public-private key pair for the second entity (âBobâ) may be produced at 212 B. A public-private key pair of an entity includes a private key and a corresponding public key, which are related as proscribed by the cryptosystem. The private key is kept as a secret of the entity, while the public key can be published to other entities in the cryptosystem. In the example protocol 300 shown in FIGS. 3A-3B , Alice's and Bob's respective public-private key pairs are generated by
operations
310 , 312 , 314 and 316 , 318 , 320 . In the example protocol 400 shown in FIGS. 4A-4B , Alice's and Bob's respective public-private key pairs are generated by
operations
410 , 412 , 414 and 408 , 416 , 418 , 420 . A public-private key pair may be generated in another manner. In some cases, a public-private key pair can be used as a static key pair or an ephemeral key pair.
At 214 A and 214 B, the nodes
202 A, 202 B perform one or more operations to derive a shared secret. In some implementations, the nodes
202 A, 202 B produce a shared secret value that can subsequently be used for cryptographic correspondence. For instance, deriving the shared secret at 214 A, 214 B may produce a secret value that is known to both entities (Alice and Bob), but is not publicly known or easily derivable from public information. In the example protocol 300 shown in FIGS. 3A-3B , the shared secret is the j-invariant value (j(E AB )=j(E BA )) computed at 328 and 340 . In the example protocol 400 shown in FIGS. 4A-4B , the shared secret is the j-invariant value (j(E AB )=j(E BA )) computed at 428 and 440 . In some cases, the protocol performed by each entity to derives the shared secret also validates the public key of the other entity. For example, the techniques described with respect to FIGS. 3A-3B and 4A-4B may be used to validate public keys.
At 216 A and 216 B, the shared secret (generated at 214 A and 214 B) is used for cryptographic correspondence. For example, the keys generated by a key agreement protocol may be used in in a supersingular isogeny-based cryptographic protocol to encrypt or decrypt a message, to sign or verify a message or to generate other parameters that are used for cryptographic correspondence. The keys may be used in another manner.
Two example cryptographic protocols
300 , 400 are described below with respect to FIGS. 3A-3B and FIGS. 4A-4B . In the examples shown in FIGS. 3A-3B and FIGS. 4 A- 4 B, the entities (âAliceâ and âBobâ) correspond to a computing device, a computer system, an I
CLAIMS
Claims ( 30 )
What is claimed is:
1. A supersingular isogeny-based cryptography method, comprising:
obtaining a secret integer of a first entity;
obtaining a public key of a second entity, the public key comprising a first image curve and a first pair of elliptic curve points;
obtaining a first pairing value based on a second pair of elliptic curve points defined by a supersingular isogeny-based cryptosystem;
computing, by operation of one or more processors, a second pairing value based on the first pair of elliptic curve points;
validating the public key, wherein validating the public key comprises verifying whether the first pairing value matches the second pairing value;
computing, by operation of one or more processors, a second image curve based on the secret integer and the first pair of elliptic curve points;
computing, by operation of one or more processors, a shared secret value based on the second image curve, wherein the shared secret value is shared by the first entity and the second entity; and
executing a cryptographic correspondence in a communication network between the first entity and the second entity.
2. The supersingular isogeny-based cryptography method of claim 1 , wherein the first pairing value is based on a Weil pairing in a base field, and the second pairing value is based on a Weil pairing in the base field.
3. The supersingular isogeny-based cryptography method of claim 1 , comprising:
computing a generator point based on information from the second entity; and
computing check values based on the generator point,
wherein validating the public key further comprises verifying that the check values match respective values in the public key.
4. The supersingular isogeny-based cryptography method of claim 3 , wherein computing the generator point based on information from the second entity comprises:
obtaining an encrypted seed value from the second entity;
computing a decrypted seed value by decrypting the encrypted seed value; and
computing the generator point based on the decrypted seed value.
5. The supersingular isogeny-based cryptography method of claim 3 , wherein validating the public key comprises:
using the generator point to compute a first elliptic curve point representing an image of a second elliptic curve point under an isogeny having a kernel defined by the generator point, the second elliptic curve point being one of the elliptic curve points in the second pair of elliptic curve points; and
verifying that the first elliptic curve point matches one of the elliptic curve points in the first pair of elliptic curve points.
6. The supersingular isogeny-based cryptography method of claim 3 , wherein validating the public key comprises:
computing a third image curve based on the generator point; and
verifying that the third image curve matches the first image curve.
7. The supersingular isogeny-based cryptography method of claim 1 , wherein validating the public key requires only one isogeny evaluation.
8. The supersingular isogeny-based cryptography method of claim 1 , wherein the first pairing value is precomputed by the first entity before receiving the public key.
9. The supersingular isogeny-based cryptography method of claim 1 , wherein validating the public key comprises determining that the second pubic key is valid, wherein the first pair of elliptic curve points represent an image of the second pair of elliptic curve points under an isogeny.
10. The supersingular isogeny-based cryptography method of claim 1 , wherein computing the shared secret comprises computing the j-invariant of the second image curve.
11. A non-transitory computer-readable medium storing instructions that are operable when executed by data processing apparatus to perform operations comprising:
obtaining a secret integer of a first entity;
obtaining a public key of a second entity, the public key comprising a first image curve and a first pair of elliptic curve points;
obtaining a first pairing value based on a second pair of elliptic curve points defined by a supersingular isogeny-based cryptosystem;
computing a second pairing value based on the first pair of elliptic curve points;
validating the public key, wherein validating the public key comprises verifying whether the first pairing value matches the second pairing value;
computing a second image curve based on the secret integer and the first pair of elliptic curve points;
computing a shared secret value based on the second image curve, wherein the shared secret value is shared by the first entity and the second entity; and
executing a cryptographic correspondence in a communication network between the first entity and the second entity.
12. The non-transitory computer-readable medium of claim 11 , wherein the first pairing value is based on a Weil pairing in a base field, and the second pairing value is based on a Weil pairing in the base field.
13. The non-transitory computer-readable medium of claim 11 , the operations comprising:
computing a generator point based on information from the second entity; and
computing check values based on the generator point,
wherein validating the public key further comprises verifying that the check values match respective values in the public key.
14. The non-transitory computer-readable medium of claim 13 , wherein computing the generator point based on information from the second entity comprises:
obtaining an encrypted seed value from the second entity;
computing a decrypted seed value by decrypting the encrypted seed value; and
computing the generator point based on the decrypted seed value.
15. The non-transitory computer-readable medium of claim 13 , wherein validating the public key comprises:
using the generator point to compute a first elliptic curve point representing an image of a second elliptic curve point under an isogeny having a kernel defined by the generator point, the second elliptic curve point being one of the elliptic curve points in the second pair of elliptic curve points; and
verifying that the first elliptic curve point matches one of the elliptic curve points in the first pair of elliptic curve points.
16. The non-transitory computer-readable medium of claim 13 , wherein validating the public key comprises:
computing a third image curve based on the generator point; and
verifying that the third image curve matches the first image curve.
17. The non-transitory computer-readable medium of claim 11 , wherein validating the public key requires only one isogeny evaluation.
18. The non-transitory computer-readable medium of claim 11 , wherein the first pairing value is precomputed by the first entity before receiving the public key.
19. The non-transitory computer-readable medium of claim 11 , wherein validating the public key comprises determining that the second pubic key is valid, wherein the first pair of elliptic curve points represent an image of the second pair of elliptic curve points under an isogeny.
20. The non-transitory computer-readable medium of claim 11 , wherein computing the shared secret comprises computing the j-invariant of the second image curve.
21. A system comprising:
one or more processors;
memory storing instructions that are operable when executed by the one or more processors to perform operations comprising:
obtaining a secret integer of a first entity;
obtaining a public key of a second entity, the public key comprising a first image curve and a first pair of elliptic curve points;
obtaining a first pairing value based on a second pair of elliptic curve points defined by a supersingular isogeny-based cryptosystem;
computing a second pairing value based on the first pair of elliptic curve points;
validating the public key, wherein validating the public key comprises verifying whether the first pairing value matches the second pairing value;
computing a second image curve based on the secret integer and the first pair of elliptic curve points;
computing a shared secret value based on the second image curve, wherein the shared secret value is shared by the first entity and the second entity; and
executing a cryptographic correspondence in a communication network between the first entity and the second entity.
22. The system of claim 21 , wherein the first pairing value is based on a Weil pairing in a base field, and the second pairing value is based on a Weil pairing in the base field.
23. The system of claim 21 , the operations comprising:
computing a generator point based on information from the second entity; and
computing check values based on the generator point,
wherein validating the public key further comprises verifying that the check values match respective values in the public key.
24. The system of claim 23 , wherein computing the generator point based on information from the second entity comprises:
obtaining an encrypted seed value from the second entity;
computing a decrypted seed value by decrypting the encrypted seed value; and
computing the generator point based on the decrypted seed value.
25. The system of claim 23 , wherein validating the public key comprises:
using the generator point to compute a first elliptic curve point representing an image of a second elliptic curve point under an isogeny having a kernel defined by the generator point, the second elliptic curve point being one of the elliptic curve points in the second pair of elliptic curve points; and
verifying that the first elliptic curve point matches one of the elliptic curve points in the first pair of elliptic curve points.
26. The system of claim 23 , wherein validating the public key comprises:
computing a third image curve based on the generator point; and
verifying that the third image curve matches the first image curve.
27. The system of claim 21 , wherein validating the public key requires only one isogeny evaluation.
28. The system of claim 21 , wherein the first pairing value is precomputed by the first entity before receiving the public key.
29. The system of claim 21 , wherein validating the public key comprises determining that the second pubic key is valid, wherein the first pair of elliptic curve points represent an image of the second pair of elliptic curve points under an isogeny.
30. The system of claim 21 , wherein computing the shared secret comprises computing the j-invariant of the second image curve.
US15/887,348
2018-02-02
2018-02-02
Pairing verification in supersingular isogeny-based cryptographic protocols
Expired - Fee Related
US10116443B1
( en )
Priority Applications (1)
Application Number
Priority Date
Filing Date
Title
US15/887,348
US10116443B1
( en )
2018-02-02
2018-02-02
Pairing verification in supersingular isogeny-based cryptographic protocols
Applications Claiming Priority (1)
Application Number
Priority Date
Filing Date
Title
US15/887,348
US10116443B1
( en )
2018-02-02
2018-02-02
Pairing verification in supersingular isogeny-based cryptographic protocols
Publications (1)
Publication Number
Publication Date
US10116443B1
true
US10116443B1 ( en )
2018-10-30
Family
ID=63895167
Family Applications (1)
Application Number
Title
Priority Date
Filing Date
US15/887,348
Expired - Fee Related
US10116443B1
( en )
2018-02-02
2018-02-02
Pairing verification in supersingular isogeny-based cryptographic protocols
Country Status (1)
Country
Link
US
( 1 )
US10116443B1
( en )
Cited By (33)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
CN109787760A
( en )
*
2019-01-23
2019-05-21
åå°æ»¨å·¥ä¸å¤§å¦
A kind of key secret Enhancement Method and device based on H1 class hash function race of optimization
US10313124B1
( en )
2018-02-02
2019-06-04
ISARA Corporation
Public key validation in supersingular isogeny-based cryptographic protocols
CN110011790A
( en )
*
2019-02-14
2019-07-12
ä¸å½ç§å¦é¢ä¿¡æ¯å·¥ç¨ç 究æ
A kind of anti-quantum key agreement method based on coding
US10630476B1
( en )
2019-10-03
2020-04-21
ISARA Corporation
Obtaining keys from broadcasters in supersingular isogeny-based cryptosystems
CN111080296A
( en )
*
2019-12-05
2020-04-28
æ·±å³åæµ·å¾®ä¼é¶è¡è¡ä»½æéå ¬å¸
A verification method and device based on a blockchain system
US10805081B1
( en )
*
2020-04-30
2020-10-13
ISARA Corporation
Processing batches of point evaluations in a supersingular isogeny-based cryptosystem
US20200328885A1
( en )
*
2019-04-15
2020-10-15
Smart Security Systems, Llc
Enhanced monitoring and protection of enterprise data
US10812265B1
( en )
2020-04-30
2020-10-20
ISARA Corporation
Using cryptographic co-processors in a supersingular isogeny-based cryptosystem
US10812264B1
( en )
2020-04-30
2020-10-20
ISARA Corporation
Traversing a zigzag path tree topology in a supersingular isogeny-based cryptosystem
US10880278B1
( en )
2019-10-03
2020-12-29
ISARA Corporation
Broadcasting in supersingular isogeny-based cryptosystems
US20210266157A1
( en )
*
2020-02-24
2021-08-26
Electronics And Telecommunications Research Institute
Quantum entity authentication apparatus and method
US11165568B2
( en )
2019-01-28
2021-11-02
Knectiq Inc.
System and method for secure electronic data transfer
US11240014B1
( en )
2019-09-10
2022-02-01
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
WO2022064577A1
( en )
*
2020-09-23
2022-03-31
ä¸è±é»æ©æ ªå¼ä¼ç¤¾
Cryptosystem, encryption device, decoding device and key generation device
US11322050B1
( en )
*
2020-01-30
2022-05-03
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11343270B1
( en )
2019-09-10
2022-05-24
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US20220200973A1
( en )
*
2019-04-15
2022-06-23
Bear System, LLC
Blockchain schema for secure data transmission
WO2022146437A1
( en )
*
2020-12-30
2022-07-07
Pqsecure Technologies, Llc
High-performance systems to validate isogeny-based cryptography keys
US11449799B1
( en )
2020-01-30
2022-09-20
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11477016B1
( en )
2019-09-10
2022-10-18
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11496447B1
( en )
2021-04-16
2022-11-08
Umm AI-Qura University
Cryptosystem and method with efficient elliptic curve operators for an extraction of EiSi coordinate system
US20220385954A1
( en )
*
2018-12-07
2022-12-01
Arris Enterprises Llc
Embedding information in elliptic curve base point
US20220393870A1
( en )
*
2021-06-03
2022-12-08
International Business Machines Corporation
Acceleration of elliptic curve-based isogeny cryptosystems
US11533175B1
( en )
2020-01-30
2022-12-20
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography on a smartcard
US11626983B1
( en )
2019-09-10
2023-04-11
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11728988B2
( en )
*
2017-02-28
2023-08-15
Koninklijke Philips N.V.
Elliptic curve isogeny based key agreement protocol
US11736303B1
( en )
*
2019-09-10
2023-08-22
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11838410B1
( en )
2020-01-30
2023-12-05
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US20240184699A1
( en )
*
2021-05-25
2024-06-06
Pqsecure Technologies, Llc
An efficient and scalable architecture and method for isogeny-based cryptosystems
US12200116B1
( en )
2022-11-18
2025-01-14
Wells Fargo Bank, N.A.
Systems and methods for measuring one or more metrics of a cryptographic algorithm in a post-quantum cryptography system
US12248568B2
( en )
2020-01-17
2025-03-11
Wells Fargo Bank, N.A.
Systems and methods for disparate quantum computing threat detection
US20250132904A1
( en )
*
2023-10-18
2025-04-24
Google Llc
Reusing Resumption Secrets Obtained from Post-Quantum Ciphers
US20250274265A1
( en )
*
2024-02-28
2025-08-28
International Business Machines Corporation
Ciphertext Nullification Operations
Citations (5)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US20040139029A1
( en )
*
2002-12-24
2004-07-15
Information And Communications University Educational Foundation
Apparatus and method for generating and verifying ID-based blind signature by using bilinear parings
US20090210716A1
( en )
*
2008-01-30
2009-08-20
Liqun Chen
Direct anonymous attestation using bilinear maps
US20100329454A1
( en )
*
2008-01-18
2010-12-30
Mitsubishi Electric Corporation
Encryption parameter setting apparatus, key generation apparatus, cryptographic system, program, encryption parameter setting method, and key generation method
US20120210118A1
( en )
*
2011-02-14
2012-08-16
Sap Ag
Secure sharing of item level data in the cloud
US20130297929A1
( en )
*
2012-05-07
2013-11-07
Sap Ag
Real-time Asset Tracking using Discovery Services
2018
2018-02-02
US
US15/887,348
patent/US10116443B1/en
not_active
Expired - Fee Related
Patent Citations (5)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US20040139029A1
( en )
*
2002-12-24
2004-07-15
Information And Communications University Educational Foundation
Apparatus and method for generating and verifying ID-based blind signature by using bilinear parings
US20100329454A1
( en )
*
2008-01-18
2010-12-30
Mitsubishi Electric Corporation
Encryption parameter setting apparatus, key generation apparatus, cryptographic system, program, encryption parameter setting method, and key generation method
US20090210716A1
( en )
*
2008-01-30
2009-08-20
Liqun Chen
Direct anonymous attestation using bilinear maps
US20120210118A1
( en )
*
2011-02-14
2012-08-16
Sap Ag
Secure sharing of item level data in the cloud
US20130297929A1
( en )
*
2012-05-07
2013-11-07
Sap Ag
Real-time Asset Tracking using Discovery Services
Non-Patent Citations (7)
* Cited by examiner, â Cited by third party
Title
Costello , et al., " Efficient algorithms for supersingular isogeny Diffie-Hellman ", IACR-CRYPTO-2016; https://eprint.iacr.org/2016/413, 2016, 35 pgs.
De Feo , et al., " Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies ", https://eprint.iacr.org/2011/506, 2011, 25 pgs.
Dent, Alexander , " A Designer's Guide to KEMs ", Cryptology ePrint Archive: Report 2002/174, Oct. 31, 2005, 28 pages.
Fujisaki , et al., " Secure Integration of Asymmetric and Symmetric Encryption Schemes ", CRYPTO' 99, LNCS 1666, pp. 537-554, 1999, 18 pgs.
Galbraith, Steven , " On the Security of Supersingular Isogeny Cryptosystems ", Cryptology ePrint Archive: Report 2016/859, Jan. 31, 2017, 21 pages.
Kirkwood , et al., " Failure is not an Option: Standardization Issues for Post-Quantum Key Agreement ", Accessed online Nov. 29, 2017 at https://csrc.nist.gov/csrc/media/events/workshop-on-cybersecurity-in-a-post-quantum-world/documents/presentations/session7-motley-mark.pdf, 21 pgs.
USPTO, Non-Final Office Action dated May 30, 2018, in U.S. Appl. No. 15/887,240, 16 pgs.
Cited By (58)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US11728988B2
( en )
*
2017-02-28
2023-08-15
Koninklijke Philips N.V.
Elliptic curve isogeny based key agreement protocol
US10313124B1
( en )
2018-02-02
2019-06-04
ISARA Corporation
Public key validation in supersingular isogeny-based cryptographic protocols
US11616994B2
( en )
*
2018-12-07
2023-03-28
Arris Enterprises Llc
Embedding information in elliptic curve base point
US20220385954A1
( en )
*
2018-12-07
2022-12-01
Arris Enterprises Llc
Embedding information in elliptic curve base point
CN109787760B
( en )
*
2019-01-23
2021-10-08
åå°æ»¨å·¥ä¸å¤§å¦
An optimized key secrecy enhancement method and device based on H1 type hash function family
CN109787760A
( en )
*
2019-01-23
2019-05-21
åå°æ»¨å·¥ä¸å¤§å¦
A kind of key secret Enhancement Method and device based on H1 class hash function race of optimization
US12335375B2
( en )
2019-01-28
2025-06-17
Knectiq Inc.
System and method for secure electronic data transfer
US11165568B2
( en )
2019-01-28
2021-11-02
Knectiq Inc.
System and method for secure electronic data transfer
US12003620B2
( en )
2019-01-28
2024-06-04
Knectiq Inc.
System and method for secure electronic data transfer
CN110011790A
( en )
*
2019-02-14
2019-07-12
ä¸å½ç§å¦é¢ä¿¡æ¯å·¥ç¨ç 究æ
A kind of anti-quantum key agreement method based on coding
US20230043229A1
( en )
*
2019-04-15
2023-02-09
Smart Security Systems, Llc
Enhanced monitoring and protection of enterprise data
US20220200973A1
( en )
*
2019-04-15
2022-06-23
Bear System, LLC
Blockchain schema for secure data transmission
US11483143B2
( en )
*
2019-04-15
2022-10-25
Smart Security Systems, Llc
Enhanced monitoring and protection of enterprise data
US20200328885A1
( en )
*
2019-04-15
2020-10-15
Smart Security Systems, Llc
Enhanced monitoring and protection of enterprise data
US20230037520A1
( en )
*
2019-04-15
2023-02-09
Smart Security Systems, Llc
Blockchain schema for secure data transmission
US11240014B1
( en )
2019-09-10
2022-02-01
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11477016B1
( en )
2019-09-10
2022-10-18
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11750378B1
( en )
2019-09-10
2023-09-05
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11343270B1
( en )
2019-09-10
2022-05-24
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11902431B1
( en )
2019-09-10
2024-02-13
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11736281B1
( en )
2019-09-10
2023-08-22
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11736302B1
( en )
*
2019-09-10
2023-08-22
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US20240031170A1
( en )
*
2019-09-10
2024-01-25
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11736303B1
( en )
*
2019-09-10
2023-08-22
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US20240364538A1
( en )
*
2019-09-10
2024-10-31
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11626983B1
( en )
2019-09-10
2023-04-11
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US12069186B2
( en )
*
2019-09-10
2024-08-20
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US10880278B1
( en )
2019-10-03
2020-12-29
ISARA Corporation
Broadcasting in supersingular isogeny-based cryptosystems
WO2021062517A1
( en )
*
2019-10-03
2021-04-08
ISARA Corporation
Broadcasting in supersingular isogeny-based cryptosystems
US10630476B1
( en )
2019-10-03
2020-04-21
ISARA Corporation
Obtaining keys from broadcasters in supersingular isogeny-based cryptosystems
CN111080296B
( en )
*
2019-12-05
2023-12-01
æ·±å³åæµ·å¾®ä¼é¶è¡è¡ä»½æéå ¬å¸
A verification method and device based on blockchain system
CN111080296A
( en )
*
2019-12-05
2020-04-28
æ·±å³åæµ·å¾®ä¼é¶è¡è¡ä»½æéå ¬å¸
A verification method and device based on a blockchain system
US12248568B2
( en )
2020-01-17
2025-03-11
Wells Fargo Bank, N.A.
Systems and methods for disparate quantum computing threat detection
US12073300B2
( en )
2020-01-30
2024-08-27
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11838410B1
( en )
2020-01-30
2023-12-05
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11727310B1
( en )
2020-01-30
2023-08-15
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11727829B1
( en )
*
2020-01-30
2023-08-15
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11533175B1
( en )
2020-01-30
2022-12-20
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography on a smartcard
US12219058B1
( en )
2020-01-30
2025-02-04
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography on a smartcard
US11449799B1
( en )
2020-01-30
2022-09-20
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US12074967B2
( en )
2020-01-30
2024-08-27
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US11322050B1
( en )
*
2020-01-30
2022-05-03
Wells Fargo Bank, N.A.
Systems and methods for post-quantum cryptography optimization
US20210266157A1
( en )
*
2020-02-24
2021-08-26
Electronics And Telecommunications Research Institute
Quantum entity authentication apparatus and method
US11736280B2
( en )
*
2020-02-24
2023-08-22
Electronics And Telecommunications Research Institute
Quantum entity authentication apparatus and method
US10805081B1
( en )
*
2020-04-30
2020-10-13
ISARA Corporation
Processing batches of point evaluations in a supersingular isogeny-based cryptosystem
US10812264B1
( en )
2020-04-30
2020-10-20
ISARA Corporation
Traversing a zigzag path tree topology in a supersingular isogeny-based cryptosystem
US10812265B1
( en )
2020-04-30
2020-10-20
ISARA Corporation
Using cryptographic co-processors in a supersingular isogeny-based cryptosystem
JPWO2022064577A1
( en )
*
2020-09-23
2022-03-31
WO2022064577A1
( en )
*
2020-09-23
2022-03-31
ä¸è±é»æ©æ ªå¼ä¼ç¤¾
Cryptosystem, encryption device, decoding device and key generation device
JP7158635B2
( en )
2020-09-23
2022-10-21
ä¸è±é»æ©æ ªå¼ä¼ç¤¾
Cryptographic system, encryption device, decryption device and key generation device
WO2022146437A1
( en )
*
2020-12-30
2022-07-07
Pqsecure Technologies, Llc
High-performance systems to validate isogeny-based cryptography keys
US11496447B1
( en )
2021-04-16
2022-11-08
Umm AI-Qura University
Cryptosystem and method with efficient elliptic curve operators for an extraction of EiSi coordinate system
US20240184699A1
( en )
*
2021-05-25
2024-06-06
Pqsecure Technologies, Llc
An efficient and scalable architecture and method for isogeny-based cryptosystems
US11683171B2
( en )
*
2021-06-03
2023-06-20
International Business Machines Corporation
Acceleration of elliptic curve-based isogeny cryptosystems
US20220393870A1
( en )
*
2021-06-03
2022-12-08
International Business Machines Corporation
Acceleration of elliptic curve-based isogeny cryptosystems
US12200116B1
( en )
2022-11-18
2025-01-14
Wells Fargo Bank, N.A.
Systems and methods for measuring one or more metrics of a cryptographic algorithm in a post-quantum cryptography system
US20250132904A1
( en )
*
2023-10-18
2025-04-24
Google Llc
Reusing Resumption Secrets Obtained from Post-Quantum Ciphers
US20250274265A1
( en )
*
2024-02-28
2025-08-28
International Business Machines Corporation
Ciphertext Nullification Operations
Similar Documents
Publication
Publication Date
Title
US10313124B1
( en )
2019-06-04
Public key validation in supersingular isogeny-based cryptographic protocols
US10454681B1
( en )
2019-10-22
Multi-use key encapsulation processes
US9800411B1
( en )
2017-10-24
Using a secret generator in an elliptic curve cryptography (ECC) digital signature scheme
JP7221872B2
( en )
2023-02-14
A Key Agreement Protocol Based on Elliptic Curve Homogenies
Odelu et al.
2016
Provably secure authenticated key agreement scheme for smart grid
US9660978B1
( en )
2017-05-23
Using a digital certificate with multiple cryptosystems
US9942040B1
( en )
2018-04-10
Refreshing public parameters in lattice-based cryptographic protocols
US8670563B2
( en )
2014-03-11
System and method for designing secure client-server communication protocols based on certificateless public key infrastructure
US9912479B1
( en )
2018-03-06
Key encapsulation mechanisms
US9571274B2
( en )
2017-02-14
Key agreement protocol
US9705683B2
( en )
2017-07-11
Verifiable implicit certificates
US10027475B2
(<span itemprop="primaryLangu