CTIDH: Faster Constant-Time CSIDH

Published in In *IACR Transactions on Cryptographic Hardware and Embedded Systems* (TCHES), 2021

This paper introduces a new key space for CSIDH and a constant-time algorithm for its evaluation. The key space and algorithm are interdependent—neither is useful without the other—but together, they enable the fastest constant-time CSIDH to date.

Highlights:

  • CSIDH-512 (256-bit key space):
    • Previous: 789,000 multiplications, >200M Skylake cycles
    • CTIDH: 438,006 multiplications, 125.53M cycles

This improvement contributes to making CSIDH more practical for post-quantum cryptographic deployment while maintaining resistance to timing attacks.

Recommended citation: Gustavo Banegas, Daniel J. Bernstein, Fabio Campos, Tung Chou, Tanja Lange, Michael Meyer, Benjamin Smith, Jana Sotáková. (2021). "CTIDH: Faster Constant-Time CSIDH." In IACR Transactions on Cryptographic Hardware and Embedded Systems (TCHES).
Download Paper | Download Slides | Download Bibtex