Package: sibc
SupersingularIsogeny-BasedCryptographic constructionsThis repository includes a python-code library namedsibc, which allows a user-friendly
interface to deal with some isogeny-based cryptographic primitive.The current version of thesibclibrary has integrated SIDH, CSIDH, and B-SIDH schemes using traditional
and velusqrt formulae on Montgomery curve x-only projective coordinates; in particular,sibcallows
working with prime and quadratic field classes that permit operating field elements as integers.
Additionally, the cryptographic primitives are implemented in constant-time concerning the number
of field operations, where a constant-time procedure refers to its running time does not depend on
the input or it possibly does from randomness as CSIDH does.It is worthing to mention, the library is constantly extended, and some signature schemes will be integrated into thesibclibrary.Thesibclibrary aims to allow isogeny-contributors for building new primitives with a constant-time nature.:warning: There is a new devastating attack againstSIDHandSIKEby Castryck & Decru. Currently, there are two public implementations of the Castryck-Decru attack:MagmacodefromCastryck-Decru preprint, andSagemathcodetranslation from the Magma code, by Giacomo Pope.:warning: The attack does extend to B-SIDH and B-SIKE.:exclamation: The attack does not apply to CSIDH.InstallationInstall thesibcmodule which provides thesibcprogram:sudo python3 setup.py installFor development:For this installation method, any further modification in sibc directory will be reflect when running sibc library.# Installing required package
# Before running the following commands, ensure you have the lastest version of pip
pip3 install dh click numpy progress matplotlib networkx stdeb setuptools-scm setuptools

# only pip3 install cpuinfo is missing for macOS (to be fixed in coming versions)
pip3 install pytest pytest-xdist

# Installing the library
sudo pip3 install -e .Debian package buildTo build a package for Debian or Ubuntu, we suggest the use of stdeb:sudo apt install -y dh-python python3-click python3-progress\
  python3-numpy python3-matplotlib python3-networkx \
  python3-stdeb python3-setuptools-scm python3-setuptools python3-cpuinfo
python3 setup.py bdist_deb
sudo dpkg -i deb_dist/python3-sibc_0.0.1-1_all.debUsageThe syntax compilation can be viewed by running one of the following three commands:# Corresponding with the key-exchange protocolsibc--help# Corresponding with benchmarking (only for CSIDH, which has a variable# running-time cost independent from the key)sibccsidh-bench# Corresponding with the costs of KPs (Kernel Point computation), xISOG# (isogeny construction), and xEVAL (isogeny evaluation)sibccsidh-testUsage for thesibctool:Usage:sibc[OPTIONS]COMMAND[ARGS]...,-~~-.___./|'     \(  )         0\_/-, ,----'====///\-'~;/~~~(O)/__/~|/|=(_____|(_________|Options:-p,--prime[p434|p503|p610|p751|p253|p255|p247|p237|p257|p512|p1024|p1792|p2048|p4096|p5120|p6144|p8192|p9216][default:p512]-f,--formula[tvelu|svelu|hvelu][default:hvelu]-a,--algorithm[sidh|sike|csidh|bsidh|bsike][default:csidh]-s,--style[wd1|wd2|df][default:df]-e,--exponent[1|2|3|4|5|6|7|8|9|10][default:10]-m,--multievaluation[default:False]-c,--curvemodel[edwards|montgomery][default:montgomery]-b,--benchmarkINTEGER[default:128]-t,--tuned[default:False]-u,--uninitialized[default:False]-v,--verboseNotthekindofverbosityyoumightexpect[default:False]--versionShowtheversionandexit.--helpShowthismessageandexit.

Commands:bsidh-mainRandominstanceexampleofakey-exchangebsidh-precompute-parametersPrecomputationoftunedvelusqrtparametersbsidh-precompute-strategyPrecomputationofoptimalstrategiesbsidh-testGF(p²)-operationcostofkps,xisog,and...csidh-benchAverageGF(p)-operationcostofaGAEcsidh-boundsGreedy-basedsearchofoptimalexponentscsidh-dhDerivesharedsecretkeyfromCSIDHsk,...csidh-genkeyGeneraterandomCSIDHsecretkeycsidh-headerOptimalstrategiesasC-codeheadersfilescsidh-ijkVelusqrtparametersasC-codeheadersfilescsidh-mainRandominstanceexampleofakey-exchangecsidh-precompute-parametersPrecomputationoftunedvelusqrtparameterscsidh-precompute-strategyPrecomputationofoptimalstrategiescsidh-pubkeyDeriveCSIDHpublickeyfromCSIDHsecretkeycsidh-sdacsSDACsasC-codeheadersfilescsidh-testGF(p)-operationcostofkps,xisog,andxevaldecaps(B)SIKEdecapsulationencaps(B)SIKEencapsulationkeygenGeneraterandom(B)SIKEsecretandpublic...plot-strategydrawstrategygraphsasasubgraph...print-timingsidh-precompute-strategyPrecomputationofoptimalstrategiesSIDH cryptographic APICSIDH,BSIDH,SIDH,SIKE, andBSIKEobjects are available from thesibcpackage and module.Automatically generated documentation is available with pydoc aftersibcis
installed:pydoc3 sibc.csidh
pydoc3 sibc.bsidh
pydoc3 sibc.sidhCommand Line Interface: examples# CSIDHsk_a="$(sibccsidh-genkey)"pk_a="$(echo"$sk_a"|sibccsidh-pubkey-)"sk_b="$(sibccsidh-genkey)"pk_b="$(echo"$sk_b"|sibccsidh-pubkey-)"ss_a="$(echo"$sk_a"|sibccsidh-dh-"$pk_b")"ss_b="$(echo"$sk_b"|sibccsidh-dh-"$pk_a")"echo$ss_aecho$ss_b# SIKEsk="$(sibc-asidh-pp434keygen)"pk3=`echo"${sk}"|tail-n1`ck="$(echo"$pk3"|sibc-asidh-pp434encaps-)"c0=`echo"${ck}"|head-1`c1=`echo"${ck}"|tail-2|head-1`K=`echo"${ck}"|tail-n1`K_="$(echo"$sk"|sibc-asidh-pp434decaps-"$c0$c1")"echo$Kecho$K_# BSIKEsk="$(sibc-absidh-pp253keygen)"pk3=`echo"${sk}"|tail-n1`ck="$(echo"$pk3"|sibc-absidh-pp253encaps-)"c0=`echo"${ck}"|head-1`c1=`echo"${ck}"|tail-2|head-1`K=`echo"${ck}"|tail-n1`K_="$(echo"$sk"|sibc-absidh-pp253decaps-"$c0$c1")"echo$Kecho$K_Basic shared secret generation example with CSIDHfromsibc.csidhimportCSIDH,default_parameterscsidh=CSIDH(**default_parameters)# alice generates a keyalice_secret_key=csidh.secret_key()alice_public_key=csidh.public_key(alice_secret_key)# bob generates a keybob_secret_key=csidh.secret_key()bob_public_key=csidh.public_key(bob_secret_key)# if either alice or bob use their secret key with the other's respective# public key, the resulting shared secrets are the sameshared_secret_alice=csidh.dh(alice_secret_key,bob_public_key)shared_secret_bob=csidh.dh(bob_secret_key,alice_public_key)# Alice and bob produce an identical shared secretassertshared_secret_alice==shared_secret_bobBasic shared secret generation example with BSIDHfromsibc.bsidhimportBSIDH,default_parametersbsidh=BSIDH(**default_parameters)sk_a,pk_a=bsidh.keygen_a()sk_b,pk_b=bsidh.keygen_b()ss_a,ss_b=bsidh.derive_a(sk_a,pk_b),bsidh.derive_b(sk_b,pk_a)ss_a==ss_bBasic example with BSIKE (BSIDH + key encapsulation)fromsibc.bsidhimportBSIKE,default_parametersbsike=BSIKE(**default_parameters)s,sk3,pk3=bsike.KeyGen()c,K=bsike.Encaps(pk3)K_=bsike.Decaps((s,sk3,pk3),c)K==K_bsike255=BSIKE('montgomery','p255','hvelu',True,False,False,False)s,sk3,pk3=bsike255.KeyGen()c,K=bsike255.Encaps(pk3)K_=bsike255.Decaps((s,sk3,pk3),c)K==K_Basic shared secret generation example with SIDHfromsibc.sidhimportSIDH,default_parameterssidh=SIDH(**default_parameters)sk_a,pk_a=sidh.keygen_a()sk_b,pk_b=sidh.keygen_b()ss_a,ss_b=sidh.dh_a(sk_a,pk_b),sidh.dh_b(sk_b,pk_a)ss_a==ss_bBasic example with SIKE (SIDH + key encapsulation)fromsibc.sidhimportSIKE,default_parameterssike=SIKE(**default_parameters)s,sk3,pk3=sike.KeyGen()c,K=sike.Encaps(pk3)K_=sike.Decaps((s,sk3,pk3),c)K==K_sike503=SIKE('montgomery','p503',False,False)s,sk3,pk3=sike503.KeyGen()c,K=sike503.Encaps(pk3)K_=sike503.Decaps((s,sk3,pk3),c)K==K_Adding new primesThe field characteristicpshould be stored in directorydata/sop/, and
CSIDH and BSIDH have different structures (see below):# CSIDH format (here p = cofactor * l_1 * .... l_n - 1)cofactorl_1l_2...l_n# BSIDH formatHexadecimalrepresentationoftheprimep4l_1l_2...l_n
ce_1e_2...e_n
l'_1 l'_2...l'_me'_1e'_2 ... e'_m# SIDH format: p = 2^{e_2} * 3^{e_3} - 1e_2e_3For the case of BSIDH,M := (4^c * l_1^{e_1} * l_2^{e_2} * ... * l_n^{e_n})must divide(p + 1), andN := (l'_1^{e'_1} * l'_2^{e'_2} * ... * l'_n^{e'_n})must divide(p-1). Additionally, the order-MgeneratorsPA,QAandPQA := PA - QAshould be stored in directorygen/as projective
x-coordinate points. Similarly, the order-NgeneratorsPB,QBandPQB := PB - QBalso should be stored it the same directory. Both 3-tuples of points
must be stored in a single file with the following syntax:Re(x(PA))Im(x(PA))Re(x(QA))Im(x(QA))Re(x(PQA))Im(x(PQA))Re(x(PB))Im(x(PB))Re(x(QB))Im(x(QB))Re(x(PQB))Im(x(PQB))whereRe(X)andIm(X)denote the real and imaginary parts of X with respect
toF_p[i]/(i^2 + 1), respectively. Moreover, all the above twelve integers
should be stored in hexadecimal.For SIDH, generators have order eitherM=2^{e_2}orN=3^{e_3}.ExamplesWe summarize some examples of runs of thesibctool as follows:# CSIDH# A single random intances of a key exchangesibc-pp512-fhvelu-acsidh-sdf-e10csidh-main
sibc-pp512-fhvelu-acsidh-sdf-e10-mcsidh-main
sibc-pp512-fhvelu-acsidh-sdf-e10-tcsidh-main
sibc-pp512-fhvelu-acsidh-sdf-e10-m-tcsidh-main# Average GF(p)-operation cost of 64 random instancessibc-pp512-fhvelu-acsidh-sdf-m-e10-b64csidh-bench
sibc-pp512-fhvelu-acsidh-sdf-m-e10-b64-mcsidh-bench
sibc-pp512-fhvelu-acsidh-sdf-m-e10-b64-tcsidh-bench
sibc-pp512-fhvelu-acsidh-sdf-m-e10-b64-t-mcsidh-bench# GF(p)-operation cost of kps, xisog, and xeval blockssibc-pp512-fhvelu-acsidhcsidh-test
sibc-pp512-fhvelu-acsidh-mcsidh-test
sibc-pp512-fhvelu-acsidh-tcsidh-test
sibc-pp512-fhvelu-acsidh-t-mcsidh-test# BSIDH# A single random intances of a key exchangesibc-pp253-fhvelu-absidhbsidh-main
sibc-pp253-fhvelu-absidh-mbsidh-main
sibc-pp253-fhvelu-absidh-tbsidh-main
sibc-pp253-fhvelu-absidh-t-mbsidh-main# GF(p²)-operation cost of kps, xisog, and xeval blockssibc-pp253-ftvelu-absidhbsidh-test
sibc-pp253-fsvelu-absidhbsidh-test
sibc-pp253-fhvelu-absidh-tbsidh-testRemark, our implementation allows us to plot each optimal strategy required (only tested in Linux machines):# CSIDHsibc-pp512-ftvelu-acsidh-sdf-e10plot-strategy
sibc-pp512-fsvelu-acsidh-swd1-e10plot-strategy
sibc-pp512-fhvelu-acsidh-swd2-e5plot-strategy# BSIDHsibc-pp253-fhvelu-absidhplot-strategy
sibc-pp253-fhvelu-absidh-mplot-strategy
sibc-pp253-fhvelu-absidh-t-mplot-strategy# SIDHsibc-pp434-asidhplot-strategy
sibc-pp503-asidhplot-strategy
sibc-pp610-asidhplot-strategy
sibc-pp751-asidhplot-strategyAdditionally, one can created files with extension.hthat includes all the
required variables in a the sdacs, strategies, and velusqrt (at least for CSIDH
implementations).# Suitable bounds search with e = 10.sibc-acsidh-pp512-sdf-fhvelu-e10-ucsidh-bounds# The greedy-based algorithm on a large searching space, it could take hours or even days!: option -u is required# SDACs (options -s and -e do not affect the output)sibc-pp512-fhvelu-acsidh-sdf-e10csidh-sdacs# Optimal sizes of I, J, and K required in velusqrt (options -s and -e do not affect the output)sibc-pp512-fhvelu-acsidh-sdf-e10-tcsidh-ijk# option -t is required# Optimal strategiessibc-pp512-fhvelu-acsidh-sdf-e10-tcsidh-headerBSIDH primesCurrently onlyp253,p255,p247,p237, andp257are implemented and tested in the current API.
Extending this to other primes is straight-forward.SIDH primesCurrently onlyp434,p503,p610, andp751are implemented and tested in the current API.
Extending this to other primes is straight-forward.Precomputing data for a new prime instancesGenerating new data can be easily done by adding and running to eithermisc/create-csidh-data.shormisc/create-bsidh-data.sh. The new prime number description should b stored as previously mentioned.bashmisc/create-csidh-data.sh
bashmisc/create-bsidh-data.shAlso, you can do it manually by doing something as follows:# CSIDHsibc-precompute-sdacs-pp512-acsidh# SDACssibc-pp512-fhvelu-acsidh-m-t-ucsidh-precompute-parameters# Tuned velusqrt parameterssibc-pp512-fhvelu-acsidh-sdf-m-ucsidh-precompute-strategy# Strategies# BSIDHsibc-precompute-sdacs-pp253-absidh# SDACssudosibc-pp253-fsvelu-absidh-ubsidh-precompute-parameters# Tuned velusqrt parameters: the option -u is requiredsudosibc-pp253-fsvelu-absidh-ubsidh-precompute-strategy# Strategies# SIDHsibc-pp434-asidh-usidh-precompute-strategy# Strategiessibc-pp503-asidh-usidh-precompute-strategy# Strategiessibc-pp610-asidh-usidh-precompute-strategy# Strategiessibc-pp751-asidh-usidh-precompute-strategy# StrategiesFurthermore, you can create tests by runningbash misc/create-tests.shandbash misc/test-cli.sh(onlyCSIDH,BSIKE, andSIKEare handled by now).If either a new prime instace or primitive is included, then you should add it to misc directory.
New primitives require new bash scripts. SIDH instances are simple, only one configuration (for now),
and thus you can omit adding them inmiscdirectory.RemarksThe primes labeled asp253,p255,p247, andp237correspond with the examples 2, 3, 5, and 6 fromB-SIDH paper, respectively. In particular,p257denotes the
prime number given invelusqrt paper. The field airthmetic is
centered on primesp = 3 mod 4. Multiplying and squaring inGF(p²) = GF(p)[u]/(u^2 + 1)have a
cost of 3 and 2 multiplications inGF(p), respectively.The current implementation does not have implemented the B-SIDH key validation, it will be included
in the next library version.Adding new prime instancesWhen adding a new isogeny-based instances (the prime number, and public parameters) should be included
in parameter list ofsibc/__main__.py(click option-p,--prime) by modifyingsibc/constants.py(updating the lists/dictionary[csidh/bsidh]_primes). If a new primitive is included, then you need
to updatesibc/__main__.pyby extending the click options-p(--prime) and-a(--algorithm),
and also to include its branch insibc/montgomery/curve.pyandsibc/montgomery/isogeny.pyfiles.ChangesSignificant changes are listed in theCHANGELOGfile. Future integrations/modifications
are listed in theTODOLISTfile.AuthorsGora Adjgora.adj@udl.cat,gora.adj@gmail.com;Jesús-Javier Chi-Domínguezjesus.dominguez@tii.ae,chidoys@gmail.com; andFrancisco Rodríguez-Henríquezfrancisco@cs.cinvestav.mx.Main cryptographer contributors (collaborators):Jorge Chávez-Saabjchavez@computacion.cs.cinvestav.mx,jorgechavezsaab@gmail.comLogo creator contributorFabiola-Argentina Hernández-Torresfarg.cls@outlook.comUser-friendly interface contributorsJacob Appelbaumj.appelbaum@tue.nl; andLeif Rygeleif@synthesize.us.All contributors are listed in theCONTRIBUTORSfile.How to cite this library@misc{sibc,
  author ={{Gora Adj}and{Jes\'us-Javier Chi-Dom\'inguez}and{Francisco Rodr\'iguez-Henr\'iquez}},
  title ={{SIBC}Python library},
  year ={2021},
  howpublished ={\url{https://github.com/JJChiDguez/sibc/}}}LicenseThis project is licensed under the GNU general public license - see theLICENSEfile for details.FundingThis project has initially received funding from the European Research Council (ERC) under the
European Union's Horizon 2020 research and innovation programme (grant agreement No 804476),
while the second author was doing a postdoctoral research stay in Tampere University.The third author received partial funds from the Mexican Science council CONACyT project 313572.