GeezerVisonThe World Wide Web, restored to 800 pixels of glory. |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites |
GeezerVison is showing issikebrokenyet.github.io — Is SIKE broken yet? SchemesName
Type
Classical Security
Quantum Security
References
Additional Information
CommentFolklore version of SIDH where the initiator (Alice) selects a random starting curve before starting the key exchange, and transmits it along with its public key. First published mention in [BdQ+19], Section 11.1, as a possible countermeasure against torsion point attacks (see [Pet17]). Also mentioned in [Cos21] for the same reason. CommentCandidate to the NIST Post-Quantum Standardization process until the 4th round. CommentMore compact variant of SIDH exploiting torsion points both on the curve and its twist. CommentAncestor of CSIDH based on the theory of complex multiplication on ordinary curves defined over finite fields. Initially discovered by Couveignes in '97 [Cou06], was left unpublished and was independently rediscovered by [RS06]. [DKS18] introduce tweaks to the parameters to improve performance. CommentVariant of CRS/CSIDH based on the action of a class group on a set of supersingular curves reached by "volcano descent". CommentProof of knowledge and signature based on group actions. Usually instantiated from CSIDH. Not very efficient. CommentProof of knowledge and signature based on the group action CSIDH-512, for which the class group structure was computed on purpose. AssumptionsName
Classical Security
Quantum Security
References
Additional Information
CommentThe problem of computing an isogeny of degree A between two random supersingular curves, given its action on a torsion subgroup of order B ≈ A, coprime A. First introduced in [JDF11] to claim security of SIDH, where A and B are powers of small primes, and then generalized in several works to cover general A and B. CommentVariant of CSSI where one of the two curves is "special", in the sense that its endomorphism ring is known and contains endomorphisms of "small" norm. CommentA generalisation of CSIDH in which the orientation and class group action is hidden in intermediate data, protecting against Kuperberg's subexponential quantum attack CommentThe variant of the isogeny path problem where the distance between the two curves in some isogeny graph is bounded away from the average distance of two random curves. [GP+16] proves that this problem heuristically reduces to the problem of finding paths of generic length. CommentSame as the supersingular endomorphism ring problem, but for random curves over a prime field $\mathbb{F}_p$. CommentGiven two random elements $x_0$, $x_1$ in a set acted upon transitively by a group $G$, find an element of G that maps $x_0$ to $x_1$. By random self-reducibility, this is equivalent to the problem where $x_0$ is fixed. CommentThe variant where the set is a set of ordinary curves with endomorphism ring isomorphic to an order $\mathcal{O}$, and the set is the class group of $\mathcal{O}$. CommentThe variant where the set is a set of supersingular curves with an orientation (an explicit embedding of a quadratic imaginary order into the endomorphism ring of the curve) and the group is the class group of the orientation. Shown to be equivalent to $\mathcal{O}$-EndRing in [Wes21]. CommentThe anaologue of CDH for group actions. CommentCommentCommentShown to be equivalent to $\mathcal{O}$-EndRing in [Wes21] CommentThe anaologue of DDH for group actions. CommentCommentCommentCommentGiven two supersingular isogenies $\phi: E_0 \to E_1$ and $\phi': E_2 \to E_3$ of the same degree $A$, and given an integer $B$ coprime to $A$, decide whether there exist isogenies $\psi: E_0 \to E_2$ and $\psi': E_1 \to E_3$ of degree $B$ such that $\phi,\phi',\psi,\psi'$ form a commutative diagram. AttacksName
Complexity
Quantum?
References
Additional Information
CommentUseful to find isogeny walks of unusually short length, such as in SIDH. CommentClaw finding quantum algorithm. Useful to find isogeny walks of unusually short length, such as in SIDH. CommentMemory efficient version of MITM. For a fixed amount of memory the best time complexity is $\exp(n)^{3/4}$. If memory scales with input size, time can scale anywhere between $\exp(n)^{3/4}$ and $\exp(n)^{1/2}$. CommentSolves the isogeny problem with torsion point information (CSSI), assuming the endomorphism ring of the starting curve is special. CommentPolynomial-time generalization of Castryck-Decru for arbitrary starting curve. CommentQuantum version of Delfs-Galbraith. Comment$\exp(1/4)$ reduction of the supersingular isogeny path problem to the vectorization problem for supsersingular curves over $\mathbb{F}_p$. |
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |