#isogenies
LightNews LightNews
eprint.ing.bot
Hash-Based Blind Signatures: First Steps (Javier Herranz, Hugo Louiso) ia.cr/2025/2097
Abstract. Hash-based signatures are a strong candidate for post-quantum scenarios requiring authentication and integrity. Their security relies only on (well-studied) properties of hash functions, so they may be thought as being more robust than other schemes that (today) resist quantum attacks, like those based on lattices, coding or isogenies. Recent works are also studying hash-based signature schemes with additional properties, like group, ring, threshold, or aggregate signature schemes. In this work we do the same for the important case of blind signatures. We describe a possible hash-based instantiation of Fischlin’s generic scheme, we motivate our choices and we finally give some benchmarks for running times and memory requirements, resulting from our C implementation.
November 17, 2025 at 1:53 AM
ucldiscovery.bsky.social
Open Access UCL Research: Isogenies and Selmer Groups of Abelian Varieties.
discovery.ucl.ac.uk/id/eprint/10...
Isogenies and Selmer Groups of Abelian Varieties - UCL Discovery
UCL Discovery is UCL's open access repository, showcasing and providing access to UCL research outputs from all UCL disciplines.
discovery.ucl.ac.uk
November 6, 2025 at 10:26 AM
mathag-bot.bsky.social
Zhiyuan Li, Ziwei Lu, Zhichao Tang: Derived isogenies between abelian varieties https://arxiv.org/abs/2510.22612 https://arxiv.org/pdf/2510.22612 https://arxiv.org/html/2510.22612
October 28, 2025 at 6:36 AM
arxiv-math-ag.bsky.social
Zhiyuan Li, Ziwei Lu, Zhichao Tang
Derived isogenies between abelian varieties
https://arxiv.org/abs/2510.22612
October 28, 2025 at 5:35 AM
eprint.ing.bot
Compact, Efficient and CCA-Secure Updatable Encryption from Isogenies (Antonin Leroux, Maxime Roméas) ia.cr/2025/1853
Abstract. Updatable Encryption (UE) allows ciphertexts to be updated under new keys without decryption, enabling efficient key rotation. Constructing post-quantum UE with strong security guarantees is challenging: the only known CCA-secure scheme, COM-UE, uses bitwise encryption, resulting in large ciphertexts and high computational costs. We introduce DINE, a CCA-secure, isogeny-based post-quantum UE scheme that is both compact and efficient. Each encryption, decryption, or update requires only a few power-of-2 isogeny computations in dimension 2 to encrypt 28B messages, yielding 320B ciphertexts and 224B update tokens at NIST security level 1—significantly smaller than prior constructions. Our full C implementation demonstrates practical performances: updates in 7ms, encryptions in 48ms, and decryptions in 86ms. Our design builds on recent advances in isogeny-based cryptography, combining high-dimensional isogeny representations with the Deuring correspondence. We also introduce new algorithms for the Deuring correspondence which may be of independent interest. Moreover, the security of our scheme relies on new problems that might open interesting perspectives in isogeny-based cryptography. Image showing part 2 of abstract.
October 8, 2025 at 4:39 AM
eprint.ing.bot
Better Bounds for Finding Fixed-Degree Isogenies via Coppersmith’s Method (Marius A. Aardal, Diego F. Aranha, Yansong Feng, Yiming Gao, Yanbin Pan) ia.cr/2025/1812
Abstract. The hardness of finding isogenies of degree d between supersingular elliptic curves is a fundamental assumption in isogeny-based cryptography. Let E₁ and E₂ be supersingular elliptic curves defined over 𝔽_(p²), and let d > p^(1/2) be smooth. At CRYPTO~2024, Benčina et al. proposed an algorithm with time complexity Õ(max {p^(1/2), d/p^(5/8)}) in the classical setting and Õ(max {p^(1/4), d^(1/2)/p^(1/4)}) in the quantum setting. In this work, we first observe that their analysis omits a sub-exponential factor exp (O(log^(3/4)p)). We then improve their result to Õ(max {p^(1/2), exp (O(log^(4/5)p)) ⋅ d/p^(2/3)}) classically and Õ(max {p^(1/4), exp (O(log^(4/5)p)) ⋅ d^(1/2)/p^(1/3)}) quantumly. Our approach relies on small-root bounds for Coppersmith’s method applied to a four-variable integer equation. To this end, we adapt the explicit asymptotic formulas for small-root bounds introduced by Feng et al. (CRYPTO~2025) in the modular setting to the integer setting. As an additional application, we strengthen the attack of Benčina et al. on a signature scheme introduced at ACNS~2024, reducing its security by 9 bits. We expect that these refined techniques for Coppersmith’s method will be valuable for further post-quantum cryptanalysis. Image showing part 2 of abstract.
October 8, 2025 at 3:03 AM
borisfouotsa.bsky.social
Main ingredient: orientations don't like inert primes because they bring no advantage for computing isogenies with such degrees.
September 24, 2025 at 12:20 PM
eprint.ing.bot
WaterSQI and PRISMO: Quaternion Signatures for Supersingular Isogeny Group Actions (Tako Boris Fouotsa) ia.cr/2025/1737
Abstract. Isogeny group action based signatures are obtained from a sigma protocol with high soundness error, say $\frac{1}{2}$ for its most basic variant. One needs to independently repeat the sigma protocol O(λ) times to reduce the soundness error to negligible (with λ being the security parameter). These repetitions come with a considerable efficiency and size overhead. On the other hand, quaternion isogeny-based signatures such as SQIsign and PRISM are directly obtained from a sigma protocol with a negligible soundness error. The secret key in the SQIsign and PRISM is a random supersingular isogeny, and both schemes are insecure when the secret isogeny arises from the supersingular isogeny group action setting. In this paper, we propose WaterSQI and PRISMO, variants of SQIsign and PRISM respectively, suited for secret isogenies that arise from the supersingular isogeny group action setting. They use a sigma protocol whose soundness error is negligible without requiring parallel repetitions. They are hence more compact and O(λ) times more efficient compared to Generalised CSI-FiSh (the generalisation of CSI-FiSh to large parameters using generic isogeny group action evaluation algorithms such as Clapotis/KLaPoTi/PEGASIS). For example, for our proof of concept implementation with a 2000 bits prime in sagemath, PRISMO, when compared to Generalised CSI-FiSh with the same public key size, is about 3x faster for key generation, 273x faster for signing and 4900x faster for verification, while also being 29x more compact (signature size). Image showing part 2 of abstract.
September 24, 2025 at 12:37 AM
eprint.ing.bot
How (not) to Build Identity-Based Encryption from Isogenies (Elif Ozbay Gurler, Patrick Struck) ia.cr/2025/1726
Abstract. In this work we show obstacles when constructing identity-based encryption (IBE) from isogenies. We first give a modular description for IBEs, what we call a canonical IBE, that consists of two components: an identity key derivation scheme and a public-key encryption scheme. This allows us to investigate the identity key derivation scheme (where the obstacles are rooted in) in isolation. We present several approaches, showing that they can either not be realized—extracting the secret keys would require to solve the underlying hardness assumption—or result in IBE schemes that are insecure—users can use their secret keys to compute secret keys of other users. Finally, we identify properties for isogeny-based trapdoor functions that one would need in order to overcome the identified obstacles.
September 23, 2025 at 12:34 AM
eprint.ing.bot
SQIsign with Fixed-Precision Integer Arithmetic (Won Kim, Jeonghwan Lee, Hyeonhak Kim, Changmin Lee) ia.cr/2025/1649
Abstract. SQIsign is an isogeny-based, post-quantum signature scheme over supersingular elliptic curves that represents isogenies via objects of a quaternion algebra, enabling very compact signatures and efficient computations. However, the SQIsign implementation relies on GMP library, which dynamically allocates size of integers so hinders portability and complicates memory control. Furthermore, a consolidated worst-case bound on the integer coefficients representing quaternion algebra elements does not exist, leaving the required static precision unclear for a GMP-free implementation. In this work, we audit every routine in the SQIsign Round-2 specification that manipulates quaternion elements and prove a uniform worst-case bound on coefficient growth. Complementing the theoretical bounds, we repeat the key generation and signing process of Round-2 SQIsign reference code implemented with GMP library, record peak operand sizes, and derive experimental bounds. Based on this bound, we choose a fixed-size precision representation and implement SQIsign in C without dynamic allocation such as GMP library. Image showing part 2 of abstract.
September 12, 2025 at 2:38 PM
eprint.ing.bot
Transforming the POKE public key Protocol into a Key Encapsulation Mechanism (Nouhou Abdou Idris, Yunusa Abdulsalam, Mustapha Hedabou) ia.cr/2025/1616
Abstract. The inherent presence of large-scale quantum computers is deemed to threaten the traditional public-key cryptographic systems. As a result, NIST has necessitated the development of post-quantum cryptography (PQC) algorithms. Isogeny-based schemes have compact key sizes; however, there have been some fundamental vulnerabilities in the smooth-degree isogeny systems. Therefore, the literature has concentrated its efforts on higher-dimensional isogenies of non-smooth degrees. In this work, we present POKE-KEM, a key encapsulation mechanism (KEM) derived from the POKE public-key encryption (PKE) scheme via a Fujisaki-Okamoto (FO) transformation with its corresponding optimized security levels during transformation. Despite POKE’s efficiency advantages, its current formulation provides only IND-CPA security, limiting practical deployment where adaptive chosen-ciphertext security is essential. The resulting POKE-KEM construction achieves IND-CCA security under the computational hardness of the C-POKE problem in both the random oracle model (ROM) and quantum random oracle model (QROM). Our implementation demonstrates significant practical advantages across all NIST security levels (128, 192, and 256 bits), supporting the practical viability of POKE-KEM for post-quantum cryptographic deployments. We provide a comprehensive security analysis including formal proofs of correctness, rigidity, and IND-CCA security. Our underlying construction leverages the difficulty of recovering isogenies with unknown, non-smooth degrees, resistant to known quantum attacks Image showing part 2 of abstract.
September 11, 2025 at 4:31 PM
eprint.ing.bot
Refined Humbert Invariants in Supersingular Isogeny Degree Analysis (Eda Kırımlı, Gaurish Korpal) ia.cr/2025/1605
Abstract. In this paper, we discuss refined Humbert invariants of principally polarized superspecial abelian surfaces. Kani introduced the refined Humbert invariant of a principally polarized abelian surface in 1994. The main contribution of this paper is to calculate the refined Humbert invariant of a principally polarized superspecial abelian surface. We present three applications of computing this invariant in the context of isogeny-based cryptography. First, we discuss the maximum of the minimum degrees of isogenies between two uniformly random supersingular elliptic curves independent of their endomorphism ring structures. Second, we provide a different perspective on the fixed isogeny degree problem using refined Humbert invariants, and analyze this problem on average without endomorphism rings. Third, we give experimental evidence for the proven upper bounds that the minimum distance is $\approx \sqrt{p}$; our work verifies this claim up to p=727.
September 11, 2025 at 4:14 PM
eprint.ing.bot
Qlapoti: Simple and Efficient Translation of Quaternion Ideals to Isogenies (Giacomo Borin, Maria Corte-Real Santos, Jonathan Komada Eriksen, Riccardo Invernizzi, Marzio Mula, Sina Schaeffler, Frederik Vercauteren) ia.cr/2025/1604
Abstract. The main building block in isogeny-based cryptography is an algorithmic version of the Deuring correspondence, called IdealToIsogeny. This algorithm takes as input left ideals of the endomorphism ring of a supersingular elliptic curve and computes the associated isogeny. Building on ideas from QFESTA, the Clapoti framework by Page and Robert reduces this problem to solving a certain norm equation. The current state of the art is however unable to efficiently solve this equation, and resorts to a relaxed version of it instead. This impacts not only the efficiency of the IdealToIsogeny procedure, but also its success probability. The latter issue has to be mitigated with complex and memory-heavy rerandomization procedures, but still leaves a gap between the security analysis and the actual implementation of cryptographic schemes employing IdealToIsogeny as a subroutine. For instance, in SQIsign the failure probability is still 2⁻⁶⁰ which is not cryptographically negligible. The main contribution of this paper is a very simple and efficient algorithm called Qlapoti which approaches the norm equation from Clapoti directly, solving all the aforementioned problems at once. First, it makes the IdealToIsogeny subroutine between 2.2 and 2.6 times faster. This signigicantly improves the speed of schemes using this subroutine, including notably SQIsign and . On top of that, Qlapoti has a cryptographically negligible failure probability. This eliminates the need for rerandomization, drastically reducing memory consumption, and allows for cleaner security reductions. Image showing part 2 of abstract.
September 11, 2025 at 4:14 PM
arxiv-math-nt.bsky.social
Marius B\u{a}loi
A new approach in constructing isogenies of elliptic curves in characteristic three
https://arxiv.org/abs/2509.00427
September 3, 2025 at 9:41 AM
mathnt-bot.bsky.social
Marius B\u{a}loi: A new approach in constructing isogenies of elliptic curves in characteristic three https://arxiv.org/abs/2509.00427 https://arxiv.org/pdf/2509.00427 https://arxiv.org/html/2509.00427
September 3, 2025 at 6:39 AM
durumcrustulum.com
again we really oughta slap an FO transform on them isogenies for adaptive security / static usage 😅
eprint.ing.bot ePrint Updates @eprint.ing.bot · Aug 30
Adaptive Attack on Static POKÉ Keys (David Lim, Yan Bo Ti) ia.cr/2025/1541
Abstract. Isogeny-based cryptosystems continue to show promise in post-quantum cryptography. In recent years, numerous constructions have been proposed, one of which is POKÉ, a compact and efficient public-key exchange system that uses higher-dimensional isogenies. This paper leverages a well-known adaptive attack on SIDH by Galbrath, Petit, Shani and Ti, and demonstrates a similar attack on POKÉ, when given a key exchange oracle with the same assumptions as those posed by Galbraith et al. This attack relies on the user to employ long-term static keys which is against the intent of the designers of POKÉ. Indeed, this attack provides further evidence that POKÉ should not be used with a long-term static key.
August 30, 2025 at 11:13 PM
eprint.ing.bot
Adaptive Attack on Static POKÉ Keys (David Lim, Yan Bo Ti) ia.cr/2025/1541
Abstract. Isogeny-based cryptosystems continue to show promise in post-quantum cryptography. In recent years, numerous constructions have been proposed, one of which is POKÉ, a compact and efficient public-key exchange system that uses higher-dimensional isogenies. This paper leverages a well-known adaptive attack on SIDH by Galbrath, Petit, Shani and Ti, and demonstrates a similar attack on POKÉ, when given a key exchange oracle with the same assumptions as those posed by Galbraith et al. This attack relies on the user to employ long-term static keys which is against the intent of the designers of POKÉ. Indeed, this attack provides further evidence that POKÉ should not be used with a long-term static key.
August 30, 2025 at 5:49 PM
pq-react.bsky.social
✒️ Explore the PQ-REACT publications!
Today, we will explore "An Internet Messenger Using Post-Quantum Cryptography Algorithms Based on Isogenies of Elliptic Curves" written by Beniamin Jankowski, Kamil Szydłowski, Marcin Niemiec & Piotr Chołda
Read the full paper🗞️: pqreact.eu/publications/
#PQREACT
August 29, 2025 at 12:14 PM
eprint.ing.bot
Snake Mackerel: An Isogeny-Based AKEM Leveraging Randomness Reuse (Jonas Janneck, Jonas Meers, Massimo Ostuzzi, Doreen Riepel) ia.cr/2025/1474
Abstract. An Authenticated Key Encapsulation Mechanism (AKEM) combines public-key encryption and digital signatures to provide confidentiality and authenticity. AKEMs build the core of Hybrid Public Key Encryption (RFC 9180) and serve as a useful abstraction for messaging applications like the Messaging Layer Security (MLS) protocol (RFC 9420) and Signal’s X3DH protocol. To date, most existing AKEM constructions either rely on classical (non post-quantum) assumptions or on unoptimized black-box approaches leading to suboptimal efficiency. In this work, we choose a different abstraction level to combine KEMs and identification schemes more efficiently by leveraging randomness reuse. We construct a generic scheme and identify the necessary security requirements on the underlying KEM and identification scheme when reusing parts of their randomness. This allows for a concrete instantiation from isogenies based on the POKÉ KEM (EUROCRYPT’25) and the SQIsignHD identification scheme (EUROCRYPT’24). To be used in our black-box construction, the identification scheme requires the more advanced security property of response non-malleability. Hence, we further show that a slight modification of SQIsignHD satisfies this notion, which might be of independent interest. Putting everything together, our final scheme yields the most compact AKEM from PQ assumptions with public keys of 366 bytes and ciphertexts of 216 bytes while fulfilling the strongest confidentiality and authenticity notions. Image showing part 2 of abstract.
August 20, 2025 at 1:39 PM
cosic.bsky.social
"PEGASIS: Practical Effective Class Group Action using 4-Dimensional Isogenies" will be presented at #CRYPTO by Riccardo Invernizzi in Santa Barbara next week.
Paper: eprint.iacr.org/2025/401
Conference: crypto.iacr.org/2025/program...
PEGASIS: Practical Effective Class Group Action using 4-Dimensional Isogenies
In this paper, we present the first practical algorithm to compute an effective group action of the class group of any imaginary quadratic order $\mathcal{O}$ on a set of supersingular elliptic curves...
eprint.iacr.org
August 14, 2025 at 12:11 PM
cosic.bsky.social
"Orient Express: Using Frobenius to Express Oriented Isogenies" accepted at #Latincrypt in Medellín.
Paper: eprint.iacr.org/2025/1047
Conference: ciencias.medellin.unal.edu.co/eventos/lati...
Orient Express: Using Frobenius to Express Oriented Isogenies
In this paper we study supersingular elliptic curves primitively oriented by an imaginary quadratic order, where the orientation is determined by an endomorphism that factors through the Frobenius iso...
eprint.iacr.org
August 14, 2025 at 12:10 PM
eprint.ing.bot
INKE: Fast Isogeny-Based PKE using Intermediate Curves (Hyeonhak Kim, Seokhie Hong, Suhri Kim) ia.cr/2025/1458
Abstract. POKÉ (Point-Based Key Exchange), proposed by Basso and Maino in Eurocrypt 2025, is currently the fastest known isogeny-based public key encryption scheme, combining a SIDH-like protocol with higher-dimensional isogenies. However, the higher-dimensional representation inherently requires discrete logarithm computations, which restricts the use of torsion points to smooth subgroups. As a result, reducing the size of the underlying prime p is difficult, limiting further efficiency gains. In this work, we propose a variant of POKÉ that retains the higher-dimensional representation but avoids discrete logarithm computations. By replacing the point with the intermediate curve as a shared secret, we are able to reduce the size of the prime p and reduce the number of point evaluations, resulting in faster key generation, encryption, and decryption at the cost of a larger public key. We provide optimized C implementations of both POKÉ and our variant. Our results demonstrate that the proposed method improves key generation and encryption by 16% and 22% respectively, and decryption by more than 50%, for all security levels. These results highlight the practicality of our approach, particularly in computation-constrained environments and applications where fast decryption is essential, such as data processing, network communication, and database encryption. Image showing part 2 of abstract.
August 13, 2025 at 1:29 PM
cosic.bsky.social
There's still a bit of time to register for the Leuven Isogeny Days 6, go to www.esat.kuleuven.be/cosic/projec... for info & registration!
#isogeny #isogenies #isocrypt
Leuven Isogeny Days 6 — 10/11/12 September 2025 – ISOCRYPT
www.esat.kuleuven.be
August 12, 2025 at 1:35 PM
pq-react.bsky.social
🌞 Summer is the perfect time to explore #quantum science!
Explore the PQ-REACT publications covering a wide range of quantum topics.
Today, it's time to explore "An Internet Messenger Using Post-Quantum Cryptography Algorithms Based on Isogenies of Elliptic Curves".
🗞️: www.mdpi.com/2079-9292/14...
August 11, 2025 at 11:26 AM
eprint.ing.bot
A Compact Post-quantum Strong Designated Verifier Signature Scheme from Isogenies (Farzin Renan) ia.cr/2025/1335
Abstract. Digital signatures are essential cryptographic tools that provide authentication and integrity in digital communications. However, privacy-sensitive applications—such as e-voting and digital cash—require more restrictive verification models to ensure confidentiality and control. Strong Designated Verifier Signature (SDVS) schemes address this need by enabling the signer to designate a specific verifier, ensuring that only this party can validate the signature. Existing SDVS constructions are primarily based on number-theoretic assumptions and are therefore vulnerable to quantum attacks. Although post-quantum alternatives—particularly those based on lattices—have been proposed, they often entail large key and signature sizes. In this work, we introduce CSI-SDVS, a novel isogeny-based SDVS scheme that offers a compact, quantum-resistant alternative. Our construction builds on the ideal class group action framework of CSIDH and the signature techniques of CSI-FiSh, and relies on the hardness of the Multi-Target Group Action Inverse Problem (MT-GAIP). CSI-SDVS achieves strong security guarantees—namely, Strong Unforgeability under Chosen-Message Attacks (SUF-CMA), Non-Transferability (NT), and Privacy of Signer’s Identity (PSI)—in the random oracle model. Remarkably, both the keys and signatures in CSI-SDVS are of size 𝒪(λ), representing a significant improvement over the typical 𝒪(λ²) bounds in existing post-quantum SDVS schemes, thereby making it among the most compact PQC-based SDVS schemes and the only post-quantum secure construction based on isogenies. Image showing part 2 of abstract.
July 22, 2025 at 10:05 PM