Side-Channel Secure CSIDH with Projective Coordinates

CSIDH is an isogeny-based Non-Interactive Key Exchange (NIKE) proposed at ASIACRYPT'18. In this work, we present the first masked version of CSIDH and, in fact, any isogeny-based scheme. We develop gadgets to efficiently mask all arithmetics in the underlying finite field and prove them secure in the <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>d</mml:mi> </mml:mrow> </mml:math> -probing model. In particular, we develop new gadgets for the Montgomery ladder using the fact that projective values already represent a multiplicative sharing in two variables. The technique (dubbed quotient masking) might be of independent interest. Lastly, we provide an efficient implementation based on High-Security CSIDH (Communications in Cryptology 2024). We show that the relative computational overhead of masking the latter—compared to other state-of-the-art CSIDH implementations—is similar to other masked implementations of post-quantum cryptography primitives.