# Cold Boot Attacks on the Supersingular Isogeny Key Encapsulation (SIKE) Mechanism
## 3 Supersingular Isogeny Key Encapsulation Mechanism
### Key Encapsulation Mechanism
#### 3.2.4 The Reference Implementation  
In this section, we review the SIKE's main algorithms as in the reference implementation (see the file six.c). Reviewing this implementation is of great importance to learn the in-memory representation used to store private keys. Let \(\mathtt{n}\) denote the length in bits of the messages to be encapsulated, i.e., \(\mathtt{n}\in\{128,192,256\}\), and let \(\mathtt{k}\) denote the number of bits of the output shared key, i.e., \(\mathtt{k}\in\{128,192,256\}\). Also, \(\mathtt{SHAKE}_{256}(\mathtt{n},d)\) denotes hashing the message \(\mathtt{n}\) and obtaining only \(d\) bits from the output, i.e., the output may be regarded as an infinite bit string, of which computation is stopped after the desired number of output bits is produced [40]. The first algorithm to describe is the key generation algorithm. It is the most relevant algorithm for our work, so we describe it in more detail. Algorithm 1 shows a pseudo-code of the key generation algorithm's implementation. It takes in Params, that contains \(\mathtt{n}\), \(\mathtt{N}_{\mathtt{sk}_{3}}\), and \(\mathtt{MASK}\), and first generates a random \(\lceil\mathtt{n}/8\rceil\) byte array, then generates a secret key \(\mathtt{sk}_{3}\) chosen uniformly at random in the keyspace \(\mathcal{K}_{3}\) and finally calls \(\mathtt{isogen}_{3}\) to get the corresponding encoded public key. The in-memory representation of the private key is a byte array of length \(\lceil\mathtt{n}/8\rceil+\mathtt{N}_{\mathtt{sk}_{3}}+\mathtt{1}_{\mathtt{pk}}\), where \(\mathtt{1}_{\mathtt{pk}}\) is the length in bytes of the encoded public key. The first \(\lceil\mathtt{n}/8\rceil\) bytes correspond to \(\mathtt{s}\), the next \(\mathtt{N}_{\mathtt{sk}_{3}}\) bytes correspond to the secret key \(\mathtt{sk}_{3}\) and finally the last bytes correspond to the encoded public key \(\mathtt{pk}_{3}\). Note that \(\mathtt{pk}_{3}\) is the only publicly known part stored in the private array. ```
functionKeyGen(Params) //generate a random \([n/8]\) byte array. \(s\leftarrow\texttt{randombytes}([\texttt{Params.n}/8])\); //generate a random \(\texttt{N}_{\texttt{sk3}}\) byte array. \(\texttt{sk3}\leftarrow\texttt{randombytes}(\texttt{Params.N}_{\texttt{sk3}})\); //masking last byte of \(\texttt{sk3}\) to guarantee \(\texttt{sk3}\) is in \(\mathcal{K}_{3}\). MASK depends on the chosen parameters. \(\texttt{sk3}_{\texttt{}}[\texttt{Params.N}_{\texttt{sk3}}-1]\leftarrow\texttt{sk 3}_{\texttt{}}[\texttt{Params.N}_{\texttt{sk3}}-1]\) & Params.MASK; //generate the corresponding public key \(\texttt{pk3}\). \(\texttt{pk3}\leftarrow\texttt{isogen3}_{\texttt{}}(\texttt{sk3},\texttt{Params })\); return\((\texttt{s},\texttt{sk3},\texttt{pk3})\); endfunction
```  
**Algorithm 1** Key generation algorithm for SIKE. Regarding the encapsulation mechanism for SIKE, as described by Algorithm 2, it basically generates a message in the message space and hashes it along with the given public key to get r, which is passed as key in \(\mathcal{K}_{2}\) to \(\texttt{isogen}_{2}\) to compute the corresponding public key \(c_{0}\) and the shared string \(\texttt{j}\). The value \(\texttt{j}\) is hashed to get h, which is scored with m to get \(c_{1}\), and then the shared key \(\texttt{K}\) is computed and returned, along with the ciphertext \((c_{0},c_{1})\). ```
functionEncaps(pk3,Params)  m \(\leftarrow\texttt{randombytes}([\texttt{Params.n}/8])\); r \(\leftarrow\texttt{SHAKE}_{\texttt{256}}(\texttt{m}\mid\mid\texttt{pk}_{3}, \texttt{Params.e}_{2})\); c0 \(\leftarrow\texttt{isogen}_{2}(\texttt{r},\texttt{Params})\); j \(\leftarrow\texttt{isoex}_{2}(\texttt{pk}_{3},\texttt{r},\texttt{Params.e}_{2})\); h \(\leftarrow\texttt{SHAKE}_{\texttt{256}}(\texttt{j},\texttt{Params.n})\); c1 \(\leftarrow\texttt{h}\oplus\texttt{m}\); K \(\leftarrow\texttt{SHAKE}_{\texttt{256}}(\texttt{m}\mid\mid(c_{0},c_{1}),\texttt{Params.k})\); return\(((c_{0},c_{1}),\texttt{K})\); endfunction
```  
**Algorithm 2** Encapsulation algorithm for SIKE.