0

SIDH library looks good but lacks documentation and samples. The only signature-related code was found at http://github.com/yhyoo93/isogenysignature/blob/master/tests/kex_tests.c appeared not able to sign/verify message (just measure abstract performance of some partial calculations).

Thus it's not clear how to mix arbitrary message to SIDH signature and then verify the signaure corresponds to initial message?

Victor
  • 13
  • 1
  • 2
    Note that until there are signs that quantum computers are about to become practical (of which there are none at the moment), there's no need to worry about post-quantum signature as long as you have a mechanism for distributing a new signing key (e.g., via a software update). So while post-quantum signatures are fun to study, there's little practical need for them at the moment—just use Ed25519. (The story is different for key agreement or encryption, where secrecy can be destroyed retroactively by a future quantum adversary.) – Squeamish Ossifrage Jul 06 '18 at 02:15
  • 1
    While there exist proposals for SIDH-based signature schemes, they are far from practical at this point, which explains why the only code you found for this is clearly in a proof-of-concept state. If you really need post-quantum signatures now, I would go for hash-based signatures, which have the best-understood security. – yyyyyyy Jul 07 '18 at 11:51

1 Answers1

4

SIDH is a key exchange algorithm, not a digital signature algorithm. The way SIDH works is each side generates a private, random value along with a corresponding public value. The public values are exchanged, and from this, a shared secret can be mutually calculated. No signing is involved.

If you need a post-quantum signature algorithm, you would want to look at something like SPHINCS. You can also use a classical, non-PQ signing algorithm if your threat model allows it.

However, note that SIKE has been badly broken.

forest
  • 15,253
  • 2
  • 48
  • 103