Questions tagged [isogeny]
Elliptic curve isogenies are structure-preserving maps between elliptic curves which have been proposed as a foundation of post-quantum cryptosystems.
53 questions
2 votes
1 answer
142 views
Question about some details in SQIsign signing algorithm
The reference is Algorithm 4.2 on page 40 in this document https://sqisign.org/spec/sqisign-20250707.pdf. I'm confused by lines 28-33. We have $I_{com,rsp}$ correspond to the isogeny $\varphi_{rsp}^{...
- 966
3 votes
2 answers
171 views
Deuring correspondence in SQIsign
I have some questions to clarify my understanding about Deuring correspondence between quaternions and isogenies in SQIsign(2D) version 2.0.1 https://sqisign.org/ Let $E_0$ be an elliptic curve with ...
- 966
1 vote
1 answer
222 views
Map between Weierstrass curves sharing common field and subgroup, preserving dlog?
I have 2 Weierstrass curves defined over the same finite field. Both have $21888242871839275222246405745257275088548364400416034343698204186575808495617$ as common subgroup/suborder. If I’ve got 2 ...
- 283
1 vote
1 answer
88 views
How to compute division points on elliptic curve
Some algorithms in isogeny-based crypto have a step that, given a point $P$ and an integer $n$, finds a point $Q$ such that $nQ = P$. What is the theory and algorithm for this?
- 966
0 votes
0 answers
94 views
What’s the formula for turning a twisted edward curve into a regular or twisted Weirestrass curve back and forth?
I already have equations for converting points but what are the equations for converting the elliptic curve’s equation themsevles ? I’m espescially interested in twisted Weirestrass since quadratic ...
- 283
2 votes
2 answers
171 views
Soundness and honest-verifier zero-knowledge implies EUF-CMA using Fiat-Shamir?
I am originally a mathematician but I have started to examine the security properties of the PQC Isogeny-based protocols SQIsign and SQIsignHD. In various papers I came across various implications of ...
- 101
1 vote
0 answers
42 views
Is there a curve that supports both pairing checks and Montgomery ladders?
Is there a curve that supports both? Or are there two curves that can be mapped between using a 2-isogeny that support pairing checks on one and Montgomery ladders on the other? Is there a paper on it?...
- 11
0 votes
1 answer
137 views
Is it possible to map points from curve BN254 to C25519 and back using a 2-isogeny?
If it is could you give me a paper that states it is possible? Thank you
- 3
3 votes
2 answers
338 views
CSIDH - The inverse problem
I started studying CSIDH a few weeks ago and, seeing these papers [1] [2], I was wondering: Given $[a]E$ and $E$, find $[a]^{-1}E$. I read that is easy to find $[a]^{-1}E_0$ knowing $[a]E_0$ by ...
16 votes
1 answer
6k views
The death of isogeny-based cryptography?
Wouter Castryck and Thomas Decru recently broke SIDH. From the abstract: We present an efficient key recovery attack on the Supersingular Isogeny Diffie-Hellman protocol (SIDH), based on a "glue-...
- 161
2 votes
0 answers
67 views
Generating pairs of elliptic $\mathbb{F}_q$-curves isogenous over $\mathbb{F}_q$ such that nobody knows an $\mathbb{F}_q$-isogeny between them
Let $\mathbb{F}_q$ be a large finite field. What if I invent how to efficiently construct pairs of elliptic "cryptographically strong" $\mathbb{F}_q$-curves $E_1$, $E_2$ isogenous over $\...
- 495
1 vote
0 answers
69 views
What is an advantage of the Charles--Lauter--Goren hash function?
What is an advantage of the Charles--Lauter--Goren hash function (based on isogenies of elliptic curves) among other provably secure collision-resistance hash functions ? I heard that it is slower.
- 495
7 votes
1 answer
382 views
CSIDH - l ideal generators
I am trying to study the CSIDH algorithm. I have some beginner background in elliptic curves and I have been following Andrew Sutherland's lectures (https://math.mit.edu/classes/18.783/2019/lectures....
- 507
2 votes
0 answers
101 views
Cryptographic invariant maps
In [BGK+18] in section 4, Boneh et al. write that: For any choice of ideal classes $\mathfrak{a}_1,\dots,\mathfrak{a}_n,\mathfrak{a}_1',\dots,\mathfrak{a}_n'$ in ${Cl}(\mathcal{O})$, the abelian ...
- 173
0 votes
1 answer
163 views
Theorem of the dual isogeny in SIDH Zk proof
In the proof of soundness for the SIDH ZK proof protocol (section 6.2 in DJP11) the authors refer to the "Theorem of the dual isogeny". What do they mean by this? In particular, I don't ...
- 173