Paper 2023/640 Original: eprint.iacr.org/2023/640 ↗
A Direct Key Recovery Attack on SIDH
Abstract
We present an attack on SIDH utilising isogenies between polarized products of two supersingular elliptic curves. In the case of arbitrary starting curve, our attack (discovered independently from [CD22]) has subexponential complexity, thus significantly reducing the security of SIDH and SIKE. When the endomorphism ring of the starting curve is known, our attack (here derived from [CD22]) has polynomial-time complexity assuming the generalised Riemann hypothesis. Our attack applies to any isogeny-based cryptosystem that publishes the images of points under the secret isogeny, for example SÉTA and B-SIDH. It does not apply to CSIDH, CSI-FiSh, or SQISign.
Metadata
- Available format(s)
PDF- Category
- Attacks and cryptanalysis
- Publication info
- Preprint.
- History
- 2023-05-05: last updated
- 2023-05-05: published
- Short URL
- https://ia.cr/2023/640
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2023/640,
author = {Luciano Maino and Chloe Martindale and Lorenz Panny and Giacomo Pope and Benjamin Wesolowski},
title = {A Direct Key Recovery Attack on SIDH},
howpublished = {Cryptology {ePrint} Archive, Paper 2023/640},
year = {2023},
url = {https://eprint.iacr.org/2023/640}
}