#isogeny
LightNews LightNews
mathnt-bot.bsky.social
Do Eon Cha, Imin Chen: Double-orientations on supersingular isogeny graphs https://arxiv.org/abs/2510.15820 https://arxiv.org/pdf/2510.15820 https://arxiv.org/html/2510.15820
October 20, 2025 at 6:39 AM
arxiv-math-nt.bsky.social
Do Eon Cha, Imin Chen
Double-orientations on supersingular isogeny graphs
https://arxiv.org/abs/2510.15820
October 20, 2025 at 4:18 AM
maria.isogeny.club
Last week at The Isogeny Club we had a great talk by Sebastian Spindler about modular curves! Check it out here: www.youtube.com/watch?v=EDU7...

Be sure to join us again next Tuesday at the usual time :) isogeny.club
The Isogeny Club #7.2 Counting l-isogenies with different modular polynomials
YouTube video by The Isogeny Club
www.youtube.com
October 14, 2025 at 10:13 AM
arxiv-math-nt.bsky.social
Alice Lin
Finiteness of Heights in Isogeny Classes of Motives with Semistable Reduction
https://arxiv.org/abs/2510.10403
October 14, 2025 at 6:42 AM
mathnt-bot.bsky.social
Alice Lin: Finiteness of Heights in Isogeny Classes of Motives with Semistable Reduction https://arxiv.org/abs/2510.10403 https://arxiv.org/pdf/2510.10403 https://arxiv.org/html/2510.10403
October 14, 2025 at 6:39 AM
eprint.ing.bot
Compact, Efficient and CCA-Secure Updatable Encryption from Isogenies (Antonin Leroux, Maxime Roméas) ia.cr/2025/1853
Abstract. Updatable Encryption (UE) allows ciphertexts to be updated under new keys without decryption, enabling efficient key rotation. Constructing post-quantum UE with strong security guarantees is challenging: the only known CCA-secure scheme, COM-UE, uses bitwise encryption, resulting in large ciphertexts and high computational costs. We introduce DINE, a CCA-secure, isogeny-based post-quantum UE scheme that is both compact and efficient. Each encryption, decryption, or update requires only a few power-of-2 isogeny computations in dimension 2 to encrypt 28B messages, yielding 320B ciphertexts and 224B update tokens at NIST security level 1—significantly smaller than prior constructions. Our full C implementation demonstrates practical performances: updates in 7ms, encryptions in 48ms, and decryptions in 86ms. Our design builds on recent advances in isogeny-based cryptography, combining high-dimensional isogeny representations with the Deuring correspondence. We also introduce new algorithms for the Deuring correspondence which may be of independent interest. Moreover, the security of our scheme relies on new problems that might open interesting perspectives in isogeny-based cryptography. Image showing part 2 of abstract.
October 8, 2025 at 4:39 AM
eprint.ing.bot
Better Bounds for Finding Fixed-Degree Isogenies via Coppersmith’s Method (Marius A. Aardal, Diego F. Aranha, Yansong Feng, Yiming Gao, Yanbin Pan) ia.cr/2025/1812
Abstract. The hardness of finding isogenies of degree d between supersingular elliptic curves is a fundamental assumption in isogeny-based cryptography. Let E₁ and E₂ be supersingular elliptic curves defined over 𝔽_(p²), and let d > p^(1/2) be smooth. At CRYPTO~2024, Benčina et al. proposed an algorithm with time complexity Õ(max {p^(1/2), d/p^(5/8)}) in the classical setting and Õ(max {p^(1/4), d^(1/2)/p^(1/4)}) in the quantum setting. In this work, we first observe that their analysis omits a sub-exponential factor exp (O(log^(3/4)p)). We then improve their result to Õ(max {p^(1/2), exp (O(log^(4/5)p)) ⋅ d/p^(2/3)}) classically and Õ(max {p^(1/4), exp (O(log^(4/5)p)) ⋅ d^(1/2)/p^(1/3)}) quantumly. Our approach relies on small-root bounds for Coppersmith’s method applied to a four-variable integer equation. To this end, we adapt the explicit asymptotic formulas for small-root bounds introduced by Feng et al. (CRYPTO~2025) in the modular setting to the integer setting. As an additional application, we strengthen the attack of Benčina et al. on a signature scheme introduced at ACNS~2024, reducing its security by 9 bits. We expect that these refined techniques for Coppersmith’s method will be valuable for further post-quantum cryptanalysis. Image showing part 2 of abstract.
October 8, 2025 at 3:03 AM
arxiv-quant-ph.bsky.social
Eleni Agathocleous, Tobias Hartung, Karl Jansen, Lukas Mansour
Isogeny Graphs in Superposition and Quantum Onion Routing
https://arxiv.org/abs/2510.01464
October 3, 2025 at 7:43 AM
eprint.ing.bot
A collision attack on the LTZ hash function based on a conjecture on supersingular non-superspecial isogeny graphs of dimension 2 (Ryo Ohashi, Hiroshi Onuki) ia.cr/2025/1776
Abstract. In 2023, LeGrow, Ti, and Zobernig proposed a cryptographic hash function (we refer to it as the LTZ hash function in this paper) based on a certain (2,2)-isogeny graph between supersingular non-superspecial abelian surfaces over 𝔽_(p⁴). The authors estimated that the time and space complexities required to find a collision in the LTZ hash function are both given by Õ(p³). In this paper, we first propose a mathematical conjecture on the number of vertices defined over the smaller field 𝔽_(p²) in the isogeny graphs used in the LTZ hash function. Based on this conjecture, we then construct a collision-finding algorithm for the LTZ hash function, which preserves the time complexity Õ(p³), while reducing the required memory to O(log (p)²). We implemented this algorithm in Rust, and successfully found a collision for parameters claimed to provide 35-37 bits of security, within 26.2MB of memory usage on average in 20.2 hours.
October 3, 2025 at 7:08 AM
quantph-bot.bsky.social
Eleni Agathocleous, Tobias Hartung, Karl Jansen, Lukas Mansour: Isogeny Graphs in Superposition and Quantum Onion Routing https://arxiv.org/abs/2510.01464 https://arxiv.org/pdf/2510.01464 https://arxiv.org/html/2510.01464
October 3, 2025 at 6:49 AM
krxiv-quant-ph.bsky.social
Isogeny Graphs in Superposition and Quantum Onion Routing
https://arxiv.org/pdf/2510.01464
Eleni Agathocleous, Tobias Hartung, Karl Jansen, Lukas Mansour.
https://arxiv.org/abs/2510.01464
arXiv abstract link
arxiv.org
October 3, 2025 at 5:01 AM
arxiv-math-nt.bsky.social
Enrique Gonz\'alez-Jim\'enez, Joan-C. Lario
Faltings elliptic curves in twisted $\mathbb Q$-isogeny classes
https://arxiv.org/abs/2509.23283
September 30, 2025 at 7:09 AM
mathnt-bot.bsky.social
Enrique Gonz\'alez-Jim\'enez, Joan-C. Lario: Faltings elliptic curves in twisted $\mathbb Q$-isogeny classes https://arxiv.org/abs/2509.23283 https://arxiv.org/pdf/2509.23283 https://arxiv.org/html/2509.23283
September 30, 2025 at 6:39 AM
borisfouotsa.bsky.social
Quaternion signatures for isogeny group actions: showing how to adapt SQIsign and PRISM to the group actions setting, unleashing WaterSQI and PRISMO signatures that come with a tremendous speed-up over CSI-FiSh style signatures.
eprint.ing.bot ePrint Updates @eprint.ing.bot · Sep 24
WaterSQI and PRISMO: Quaternion Signatures for Supersingular Isogeny Group Actions (Tako Boris Fouotsa) ia.cr/2025/1737
Abstract. Isogeny group action based signatures are obtained from a sigma protocol with high soundness error, say $\frac{1}{2}$ for its most basic variant. One needs to independently repeat the sigma protocol O(λ) times to reduce the soundness error to negligible (with λ being the security parameter). These repetitions come with a considerable efficiency and size overhead. On the other hand, quaternion isogeny-based signatures such as SQIsign and PRISM are directly obtained from a sigma protocol with a negligible soundness error. The secret key in the SQIsign and PRISM is a random supersingular isogeny, and both schemes are insecure when the secret isogeny arises from the supersingular isogeny group action setting. In this paper, we propose WaterSQI and PRISMO, variants of SQIsign and PRISM respectively, suited for secret isogenies that arise from the supersingular isogeny group action setting. They use a sigma protocol whose soundness error is negligible without requiring parallel repetitions. They are hence more compact and O(λ) times more efficient compared to Generalised CSI-FiSh (the generalisation of CSI-FiSh to large parameters using generic isogeny group action evaluation algorithms such as Clapotis/KLaPoTi/PEGASIS). For example, for our proof of concept implementation with a 2000 bits prime in sagemath, PRISMO, when compared to Generalised CSI-FiSh with the same public key size, is about 3x faster for key generation, 273x faster for signing and 4900x faster for verification, while also being 29x more compact (signature size). Image showing part 2 of abstract.
September 24, 2025 at 12:20 PM
eprint.ing.bot
WaterSQI and PRISMO: Quaternion Signatures for Supersingular Isogeny Group Actions (Tako Boris Fouotsa) ia.cr/2025/1737
Abstract. Isogeny group action based signatures are obtained from a sigma protocol with high soundness error, say $\frac{1}{2}$ for its most basic variant. One needs to independently repeat the sigma protocol O(λ) times to reduce the soundness error to negligible (with λ being the security parameter). These repetitions come with a considerable efficiency and size overhead. On the other hand, quaternion isogeny-based signatures such as SQIsign and PRISM are directly obtained from a sigma protocol with a negligible soundness error. The secret key in the SQIsign and PRISM is a random supersingular isogeny, and both schemes are insecure when the secret isogeny arises from the supersingular isogeny group action setting. In this paper, we propose WaterSQI and PRISMO, variants of SQIsign and PRISM respectively, suited for secret isogenies that arise from the supersingular isogeny group action setting. They use a sigma protocol whose soundness error is negligible without requiring parallel repetitions. They are hence more compact and O(λ) times more efficient compared to Generalised CSI-FiSh (the generalisation of CSI-FiSh to large parameters using generic isogeny group action evaluation algorithms such as Clapotis/KLaPoTi/PEGASIS). For example, for our proof of concept implementation with a 2000 bits prime in sagemath, PRISMO, when compared to Generalised CSI-FiSh with the same public key size, is about 3x faster for key generation, 273x faster for signing and 4900x faster for verification, while also being 29x more compact (signature size). Image showing part 2 of abstract.
September 24, 2025 at 12:37 AM
maria.isogeny.club
The Isogeny Club Season 7 starts today! At 5pm CEST, Bruno Sterner will talk about finding large smooth twins from short lattice vectors. More details at isogeny.club
September 23, 2025 at 7:23 AM
eprint.ing.bot
How (not) to Build Identity-Based Encryption from Isogenies (Elif Ozbay Gurler, Patrick Struck) ia.cr/2025/1726
Abstract. In this work we show obstacles when constructing identity-based encryption (IBE) from isogenies. We first give a modular description for IBEs, what we call a canonical IBE, that consists of two components: an identity key derivation scheme and a public-key encryption scheme. This allows us to investigate the identity key derivation scheme (where the obstacles are rooted in) in isolation. We present several approaches, showing that they can either not be realized—extracting the secret keys would require to solve the underlying hardness assumption—or result in IBE schemes that are insecure—users can use their secret keys to compute secret keys of other users. Finally, we identify properties for isogeny-based trapdoor functions that one would need in order to overcome the identified obstacles.
September 23, 2025 at 12:34 AM
eprint.ing.bot
Kani’s lemma from Clifford algebra (Tomoki Moriya) ia.cr/2025/1706
Abstract. In 1997, Kani proved Kani’s lemma, which asserts that a commutative diagram of four g‑dimensional abelian varieties induces an isogeny between product abelian varieties of dimension 2g, in counting the number of genus-2 curves admitting two distinct elliptic subcovers. In these years, Kani’s lemma plays a fundamental role in isogeny-based cryptography: Kani’s lemma has found numerous cryptographic applications, including both cryptanalysis and protocol construction. However, direct investigation into the lemma itself remains scarce. In this work, we propose a generalization of Kani’s lemma. We present a novel formulation that, given a commutative diagram of 2^(n + 1) abelian varieties of dimension g, yields an isogeny of dimension 2^(n)g. We further establish a connection between this generalized lemma and the theory of Clifford algebras, using the latter as a foundational tool in our construction. To exemplify our framework, we explicitly construct the resulting 2^(n)g‑dimensional isogenies for the cases n = 1, 2, 3. The cases of n = 2, 3 provide nontrivial generalizations of the original Kani’s lemma. This generalization is expected to have novel applications in the fields of both mathematics and cryptography. Image showing part 2 of abstract.
September 20, 2025 at 1:57 PM
mathnt-bot.bsky.social
Jun Bo Lau, Travis Morrison, Eli Orvis, Gabrielle Scullard, Lukas Zobernig: Zeta functions of abstract isogeny graphs and modular curves https://arxiv.org/abs/2509.15214 https://arxiv.org/pdf/2509.15214 https://arxiv.org/html/2509.15214
September 19, 2025 at 6:40 AM
arxiv-math-nt.bsky.social
Jun Bo Lau, Travis Morrison, Eli Orvis, Gabrielle Scullard, Lukas Zobernig
Zeta functions of abstract isogeny graphs and modular curves
https://arxiv.org/abs/2509.15214
September 19, 2025 at 4:47 AM
eprint.ing.bot
Modular Forms and Hecke Operators for Post-Quantum Cryptography (Trey Li) ia.cr/2025/1681
Abstract. We introduce modular forms and Hecke operators to cryptography and propose the Hecke problem as a new foundation for post-quantum cryptography. Given two modular forms, the Hecke problem asks to recover the Hecke operator that maps one to the other. While there is a deep relation to isogeny problems through the modularity theorem, this problem is rooted in arithmetic geometry and differs fundamentally in structure and mechanism. We prove NP-hardness of this problem and use it to construct a non-interactive key exchange scheme that achieves higher efficiency than isogeny-based schemes and smaller key sizes than lattice-based and code-based schemes.
September 18, 2025 at 1:49 PM
getnews-me.bsky.social
The new dummy‑free dCTIDH implementation (dCTIDH‑2048‑194 and dCTIDH‑2048‑205) reaches median evaluation times of 1.59–1.60 Gcyc, a ~5% speed boost over CTIDH and four‑times faster than dCSIDH. https://getnews.me/dummy-free-deterministic-ctidh-boosts-isogeny-cryptography/ #isogeny #postquantum
Dummy-Free Deterministic CTIDH Boosts Isogeny Cryptography
September 18, 2025 at 12:19 PM
eprint.ing.bot
Strong Designated Verifier Signatures with Non-delegatability from CSIDH (Hiroki Minamide, Keisuke Tanaka, Masayuki Tezuka) ia.cr/2025/1673
Abstract. Abstract. Designated verifier signature allows a signer to designate a verifier who can verify the signature. A strong designated verifier signature (SDVS) enhances privacy by ensuring that the signature itself does not leak information about the signer’s identity to anyone other than the designated verifier. Non-delegatability is a property, as it prevents the signer’s ability to generate valid signatures from being delegated to others. This property is important for SDVS applications such as e-voting. To date, post-quantum SDVS schemes with non-delegatability have been proposed. These schemes are lattice-based or hash-based schemes. While isogeny-based SDVS schemes have been proposed, none of the existing works provide a proof of non-delegatability. In this paper, we present the first isogeny-based SDVS scheme with a formal proof of non-delegatability. Our construction uses the quadratic twists of elliptic curves. The security of our scheme is proven under the commutative supersingular isogeny gap Diffie–Hellman assumption and the group action inversion problem assumption in the random oracle model. Image showing part 2 of abstract.
September 18, 2025 at 10:18 AM
krijn.isogeni.es
Announcing The Isogeny Problems!

A curated list of the seven foremost unsolved problems in isogeny-based cryptography. Solving one of these profound questions would mark a monumental advance, and as a resolver you'd get eternal honor and epic rewards!

Full list: isogeni.es/problems
The Isogeny Problems
isogeni.es
September 15, 2025 at 7:43 AM
eprint.ing.bot
SQIsign with Fixed-Precision Integer Arithmetic (Won Kim, Jeonghwan Lee, Hyeonhak Kim, Changmin Lee) ia.cr/2025/1649
Abstract. SQIsign is an isogeny-based, post-quantum signature scheme over supersingular elliptic curves that represents isogenies via objects of a quaternion algebra, enabling very compact signatures and efficient computations. However, the SQIsign implementation relies on GMP library, which dynamically allocates size of integers so hinders portability and complicates memory control. Furthermore, a consolidated worst-case bound on the integer coefficients representing quaternion algebra elements does not exist, leaving the required static precision unclear for a GMP-free implementation. In this work, we audit every routine in the SQIsign Round-2 specification that manipulates quaternion elements and prove a uniform worst-case bound on coefficient growth. Complementing the theoretical bounds, we repeat the key generation and signing process of Round-2 SQIsign reference code implemented with GMP library, record peak operand sizes, and derive experimental bounds. Based on this bound, we choose a fixed-size precision representation and implement SQIsign in C without dynamic allocation such as GMP library. Image showing part 2 of abstract.
September 12, 2025 at 2:38 PM