Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Journal of Mathematical Cryptology

An efficient post-quantum KEM from CSIDH

Mingping Qi

Published Jan 1, 2022• 6 citations
Publisher

Abstract

Abstract The SIDH and CSIDH are now the two most well-known post-quantum key exchange protocols from the supersingular isogeny-based cryptography, which have attracted much attention in recent years and served as the building blocks of other supersingular isogeny-based cryptographic schemes. The famous SIKE is a post-quantum key encapsulation mechanism (KEM) constructed on the SIDH, motivated by which, this article presents a new post-quantum KEM-based on the CSIDH, which is thereby named as CSIKE. The presented CSIKE has much higher computation efficiency in the decapsulation part by involving an additional tag in the encapsulation results. The new CSIKE is formally proved to be IND-CCA secure under the standard isogeny-based quantum resistant security assumption. Moreover, by comparing the new CSIKE with the only two existing CSIDH-based KEM schemes, i.e., CSIDH-PSEC-KEM and CSIDH-ECIES-KEM, it can be easily found that the new CSIKE has a slightly longer encapsulation size than CSIDH-PSEC-KEM and CSIDH-ECIES-KEM, but (i) it beats the CSIDH-PSEC-KEM by the improvement of approximately 50% in decapsulation speed, and (ii) it has a certain advantage over the CSIDH-ECIES-KEM in security since in the random oracle model, the security proof for CSIDH-ECIES-KEM needs to rely on the stronger CSI-GDH assumption, while the new CSIKE just needs to rely on the basic CSI-CDH assumption.

DOI
10.1515/jmc-2022-0007

Related papers

Post-Quantum Variants of ISO/IEC Standards

Kazuki Yoneyama

ISO/IEC standardizes several chosen ciphertext-secure key encapsulation mechanism (KEM) schemes in ISO/IEC 18033-2. However, all ISO/IEC KEM schemes are not quantum resilient. In this paper, we introduce new isogeny-based KEM schemes (i.e., CSIDH-ECIES-KEM and CSIDH-PSEC-KEM) by modifying Diffie-Hellman-based KEM schemes in ISO/IEC standards. The main advantage of our schemes are compactness. The key size and the ciphertext overhead of our schemes are about five times smaller than these of SIKE-KEM which is submitted to NIST's post-quantum cryptosystems standardization.

•Nov 7, 2019•12 citations

Post-Quantum Variants of ISO/IEC Standards: Compact Chosen Ciphertext Secure Key Encapsulation Mechanism from Isogenies

Kazuki Yoneyama

ISO/IEC standardizes several chosen ciphertext-secure key encapsulation mechanism (KEM) schemes in ISO/IEC 18033-2. However, all ISO/IEC KEM schemes are not quantum resilient. In this paper, we introduce new isogeny-based KEM schemes (i.e., CSIDH-ECIES-KEM and CSIDH-PSEC-KEM) by modifying Diffie-Hellman-based KEM schemes in ISO/IEC standards. The main advantage of our schemes are compactness. The key size and the ciphertext overhead of our schemes are smaller than these of SIKE, which is submitted to NIST's post-quantum cryptosystems standardization, for current security analyses. Moreover, though SIKE is proved in the classical random oracle model, CSIDH-PSEC-KEM is proved in the quantum random oracle model. Finally, we discuss difficulty to construct isogeny-based KEM from ISO/IEC KEM schemes in the standard model (i.e., ACE-KEM and FACE-KEM).

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences•Dec 31, 2020•5 citations

Supersingular Isogenies: A Quantum-Secure Paradigm for Elliptic Curve Cryptography

PAULO SÉRGIO DE ANDRADE

The emergence of quantum computing poses a significant threat to the security of currently deployed public-key cryptosystems, including those based on elliptic curves (ECC). Shor's algorithm can solve the underlying integer factorization and discrete logarithm problems in polynomial time, rendering established cryptographic standards obsolete. This has catalyzed the development of post-quantum cryptography (PQC), a new generation of algorithms resistant to attacks by both classical and quantum computers. Among the most promising PQC candidates are systems based on supersingular isogeny graphs. This paper provides a comprehensive analysis of the supersingular isogeny paradigm as a quantum-secure evolution of elliptic curve cryptography. It begins by introducing the mathematical foundations of elliptic curves and isogenies, which are structure-preserving maps between them. The core of isogeny-based cryptography lies in the conjectured hardness of finding an isogeny path between two given supersingular elliptic curves in the vast isogeny graph. This is fundamentally different from the discrete logarithm problem that underpins traditional ECC. We review the foundational Supersingular Isogeny Diffie-Hellman (SIDH) key exchange protocol and its subsequent realization as the Supersingular Isogeny Key Encapsulation (SIKE) mechanism, which was a candidate in the NIST PQC standardization process. We discuss its advantages, such as small key sizes and perfect forward secrecy, which made it an attractive alternative. However, the paper also presents a balanced view by thoroughly examining the devastating cryptanalytic breakthroughs of 2022 that rendered the original SIDH/SIKE schemes insecure. These attacks, which exploit auxiliary point information, underscore the dynamic nature of PQC research. Despite this setback, the isogeny-based field remains active, with ongoing research into alternative constructions like CSIDH and other variants that are not vulnerable to the known attacks. We conclude that while the initial promise of SIDH/SIKE was broken, the underlying mathematical problem of finding isogenies remains a compelling basis for quantum-secure cryptography, representing a paradigm of active research rather than a discarded concept.

•Nov 11, 2025•0 citations

DualSecure Key Exchange (DSKE): A Hybrid ECDH-SIDH Protocol for Post-Quantum Cryptography

Veera Reddy Dasari, Padmaja Madugula

Quantum computing threatens classical key exchange protocols such as Elliptic Curve Diffie–Hellman (ECDH). Post-quantum schemes like Supersingular Isogeny Diffie–Hellman (SIDH) offer quantum resistance but at notable computational and communication costs. We propose DualSecure Key Exchange (DSKE), a hybrid protocol that integrates the classical security of ECDH with the quantum resistance of SIDH. Methodology: DSKE jointly derives two shared secrets -KECDH via elliptic-curve scalar multiplication over a 256-bit prime field and KSIDHvia supersingular isogeny mappings—then fuses them using a secure KDF (e.g., SHA-3): K=KDF(KECDH || KSIDH). We formalize core operations and asymptotics (ECDH O(n3); SIDH O(mlog m)), specify key materials, and fix parameter choices aligned with established baselines (e.g., Curve25519 for ECDH and standard SIKE/SIDH parameter sets) to ensure reproducibility. Experimental settings: Evaluations were conducted on an Intel Core i7 with 16 GB RAM using Python-based cryptographic libraries, with repeated trials for timing stability. Results: DSKE achieves runtime = 6.6 ms versus ECDH = 1.2 ms and SIDH = 5.4 ms; communication = 512 bytes versus ECDH = 128 bytes and SIDH = 384 bytes; and key size 1024 bits (hybrid) versus 256 bits (ECDH) and 768 bits (SIDH). Comparative analysis against SIKE further contextualizes DSKE’s efficiency–security trade-off. Security strength follows the minimum of the constituent levels; with a 256-bit prime for ECDH (=128-bit classical) and standard SIDH/SIKE parameters (targeting =128-bit quantum), the fused key maintains an effective 128-bit level under the stated assumptions and KDF construction. These results indicate that DSKE offers a balanced pathway toward post-quantum readiness, particularly for long-lived, security-critical deployments that can tolerate modest overheads for dual-layer protection.

Informatica•Feb 2, 2026•0 citations

Elliptic Curve Isogenies: A New Frontier for Post-Quantum Cryptography

PAULO SÉRGIO DE ANDRADE

The rise of quantum computing poses a significant threat to contemporary public-key cryptography, which relies on problems like integer factorization and the discrete logarithm, both of which are solvable in polynomial time by Shor's algorithm. This has prompted a global effort to develop and standardize post-quantum cryptographic primitives that are resistant to attacks by both classical and quantum computers. Among the various families of post-quantum candidates, isogeny-based cryptography has emerged as a particularly compelling, albeit challenging, alternative. This paper explores the mathematical foundations of elliptic curve isogenies and their application as a basis for quantum-resistant cryptographic protocols. We delve into the structure of supersingular elliptic curves and the associated isogeny graphs, which form the basis for the conjectured hardness of the underlying computational problems. The Supersingular Isogeny Diffie-Hellman (SIDH) protocol and its derivative, Supersingular Isogeny Key Encapsulation (SIKE), are examined in detail as principal examples of this cryptographic paradigm. We analyze their key advantages, most notably their exceptionally small key sizes, which offer significant benefits for constrained environments. However, the security landscape of isogeny-based cryptography has been dramatically reshaped by recent cryptanalytic breakthroughs that completely broke the SIKE protocol. This paper analyzes the nature of these attacks, discussing the vulnerabilities they exploited and the profound implications for the field. We conclude by surveying the current state of isogeny-based cryptography in the aftermath of these developments, outlining the proposed countermeasures, alternative designs, and the open research questions that define the new frontier for this promising area of post-quantum cryptography.

•Nov 14, 2025•0 citations

Enhancing Post-Quantum KEMs: A Secure and Efficient Transformation

Sai Charan Reddy Nevuri

This paper proposes a new generic Encrypt-thenMAC (EtM) transformation for constructing IND-CCA secure Key Encapsulation Mechanisms (KEMs) in the post-quantum setting. The transformation builds on a public-key encryption scheme satisfying one-wayness under plaintext-checking attacks (OW-PCA) and an existentially unforgeable MAC, and formally achieves tight IND-CCA security in the random oracle model via a rigorous security reduction. Unlike the widely used FujisakiOkamoto (FO) transformation, our approach eliminates the need for ciphertext re-encryption during decapsulation-a major source of computational overhead and side-channel vulnerability in lattice-based implementations. We instantiate the transformation using the ML-KEM (FIPS 203) subroutine, yielding the ML-KEM-EtM variant. Experimental results show that ML-KEMEtM reduces decapsulation cycle counts by$72-79 {\%}$across security levels, with only a modest increase in encapsulation cost$(1.8-7.3 {\%})$and ciphertext size$(1.0-2.1 {\%})$. The scheme thus offers a practical and efficient a lternative to F O-based KEMs, especially in performance-critical scenarios such as post-quantum TLS handshakes, where decapsulation efficiency is paramount.

International Symposium on Digital Forensics and Security (ISDFS)•Mar 19, 2026•0 citations
Abstract The SIDH and CSIDH are now the two most well-known post-quantum key exchange protocols from the supersingular isogeny-based cryptography, which have attracted much attention in recent years and served as the building blocks of other supersingular isogeny-based cryptographic schemes. The famous SIKE is a post-quantum key encapsulation mechanism (KEM) constructed on the SIDH, motivated by which, this article presents a new post-quantum KEM-based on the CSIDH, which is thereby named as CSIKE. The presented CSIKE has much higher computation efficiency in the decapsulation part by involving an additional tag in the encapsulation results. The new CSIKE is formally proved to be IND-CCA secure under the standard isogeny-based quantum resistant security assumption. Moreover, by comparing the new CSIKE with the only two existing CSIDH-based KEM schemes, i.e., CSIDH-PSEC-KEM and CSIDH-ECIES-KEM, it can be easily found that the new CSIKE has a slightly longer encapsulation size than CSIDH-PSEC-KEM and CSIDH-ECIES-KEM, but (i) it beats the CSIDH-PSEC-KEM by the improvement of approximately 50% in decapsulation speed, and (ii) it has a certain advantage over the CSIDH-ECIES-KEM in security since in the random oracle model, the security proof for CSIDH-ECIES-KEM needs to rely on the stronger CSI-GDH assumption, while the new CSIKE just needs to rely on the basic CSI-CDH assumption.
ISO/IEC standardizes several chosen ciphertext-secure key encapsulation mechanism (KEM) schemes in ISO/IEC 18033-2. However, all ISO/IEC KEM schemes are not quantum resilient. In this paper, we introduce new isogeny-based KEM schemes (i.e., CSIDH-ECIES-KEM and CSIDH-PSEC-KEM) by modifying Diffie-Hellman-based KEM schemes in ISO/IEC standards. The main advantage of our schemes are compactness. The key size and the ciphertext overhead of our schemes are about five times smaller than these of SIKE-KEM which is submitted to NIST's post-quantum cryptosystems standardization.
ISO/IEC standardizes several chosen ciphertext-secure key encapsulation mechanism (KEM) schemes in ISO/IEC 18033-2. However, all ISO/IEC KEM schemes are not quantum resilient. In this paper, we introduce new isogeny-based KEM schemes (i.e., CSIDH-ECIES-KEM and CSIDH-PSEC-KEM) by modifying Diffie-Hellman-based KEM schemes in ISO/IEC standards. The main advantage of our schemes are compactness. The key size and the ciphertext overhead of our schemes are smaller than these of SIKE, which is submitted to NIST's post-quantum cryptosystems standardization, for current security analyses. Moreover, though SIKE is proved in the classical random oracle model, CSIDH-PSEC-KEM is proved in the quantum random oracle model. Finally, we discuss difficulty to construct isogeny-based KEM from ISO/IEC KEM schemes in the standard model (i.e., ACE-KEM and FACE-KEM).
The emergence of quantum computing poses a significant threat to the security of currently deployed public-key cryptosystems, including those based on elliptic curves (ECC). Shor's algorithm can solve the underlying integer factorization and discrete logarithm problems in polynomial time, rendering established cryptographic standards obsolete. This has catalyzed the development of post-quantum cryptography (PQC), a new generation of algorithms resistant to attacks by both classical and quantum computers. Among the most promising PQC candidates are systems based on supersingular isogeny graphs. This paper provides a comprehensive analysis of the supersingular isogeny paradigm as a quantum-secure evolution of elliptic curve cryptography. It begins by introducing the mathematical foundations of elliptic curves and isogenies, which are structure-preserving maps between them. The core of isogeny-based cryptography lies in the conjectured hardness of finding an isogeny path between two given supersingular elliptic curves in the vast isogeny graph. This is fundamentally different from the discrete logarithm problem that underpins traditional ECC. We review the foundational Supersingular Isogeny Diffie-Hellman (SIDH) key exchange protocol and its subsequent realization as the Supersingular Isogeny Key Encapsulation (SIKE) mechanism, which was a candidate in the NIST PQC standardization process. We discuss its advantages, such as small key sizes and perfect forward secrecy, which made it an attractive alternative. However, the paper also presents a balanced view by thoroughly examining the devastating cryptanalytic breakthroughs of 2022 that rendered the original SIDH/SIKE schemes insecure. These attacks, which exploit auxiliary point information, underscore the dynamic nature of PQC research. Despite this setback, the isogeny-based field remains active, with ongoing research into alternative constructions like CSIDH and other variants that are not vulnerable to the known attacks. We conclude that while the initial promise of SIDH/SIKE was broken, the underlying mathematical problem of finding isogenies remains a compelling basis for quantum-secure cryptography, representing a paradigm of active research rather than a discarded concept.
Quantum computing threatens classical key exchange protocols such as Elliptic Curve Diffie–Hellman (ECDH). Post-quantum schemes like Supersingular Isogeny Diffie–Hellman (SIDH) offer quantum resistance but at notable computational and communication costs. We propose DualSecure Key Exchange (DSKE), a hybrid protocol that integrates the classical security of ECDH with the quantum resistance of SIDH. Methodology: DSKE jointly derives two shared secrets -KECDH via elliptic-curve scalar multiplication over a 256-bit prime field and KSIDHvia supersingular isogeny mappings—then fuses them using a secure KDF (e.g., SHA-3): K=KDF(KECDH || KSIDH). We formalize core operations and asymptotics (ECDH O(n3); SIDH O(mlog m)), specify key materials, and fix parameter choices aligned with established baselines (e.g., Curve25519 for ECDH and standard SIKE/SIDH parameter sets) to ensure reproducibility. Experimental settings: Evaluations were conducted on an Intel Core i7 with 16 GB RAM using Python-based cryptographic libraries, with repeated trials for timing stability. Results: DSKE achieves runtime = 6.6 ms versus ECDH = 1.2 ms and SIDH = 5.4 ms; communication = 512 bytes versus ECDH = 128 bytes and SIDH = 384 bytes; and key size 1024 bits (hybrid) versus 256 bits (ECDH) and 768 bits (SIDH). Comparative analysis against SIKE further contextualizes DSKE’s efficiency–security trade-off. Security strength follows the minimum of the constituent levels; with a 256-bit prime for ECDH (=128-bit classical) and standard SIDH/SIKE parameters (targeting =128-bit quantum), the fused key maintains an effective 128-bit level under the stated assumptions and KDF construction. These results indicate that DSKE offers a balanced pathway toward post-quantum readiness, particularly for long-lived, security-critical deployments that can tolerate modest overheads for dual-layer protection.
The rise of quantum computing poses a significant threat to contemporary public-key cryptography, which relies on problems like integer factorization and the discrete logarithm, both of which are solvable in polynomial time by Shor's algorithm. This has prompted a global effort to develop and standardize post-quantum cryptographic primitives that are resistant to attacks by both classical and quantum computers. Among the various families of post-quantum candidates, isogeny-based cryptography has emerged as a particularly compelling, albeit challenging, alternative. This paper explores the mathematical foundations of elliptic curve isogenies and their application as a basis for quantum-resistant cryptographic protocols. We delve into the structure of supersingular elliptic curves and the associated isogeny graphs, which form the basis for the conjectured hardness of the underlying computational problems. The Supersingular Isogeny Diffie-Hellman (SIDH) protocol and its derivative, Supersingular Isogeny Key Encapsulation (SIKE), are examined in detail as principal examples of this cryptographic paradigm. We analyze their key advantages, most notably their exceptionally small key sizes, which offer significant benefits for constrained environments. However, the security landscape of isogeny-based cryptography has been dramatically reshaped by recent cryptanalytic breakthroughs that completely broke the SIKE protocol. This paper analyzes the nature of these attacks, discussing the vulnerabilities they exploited and the profound implications for the field. We conclude by surveying the current state of isogeny-based cryptography in the aftermath of these developments, outlining the proposed countermeasures, alternative designs, and the open research questions that define the new frontier for this promising area of post-quantum cryptography.
This paper proposes a new generic Encrypt-thenMAC (EtM) transformation for constructing IND-CCA secure Key Encapsulation Mechanisms (KEMs) in the post-quantum setting. The transformation builds on a public-key encryption scheme satisfying one-wayness under plaintext-checking attacks (OW-PCA) and an existentially unforgeable MAC, and formally achieves tight IND-CCA security in the random oracle model via a rigorous security reduction. Unlike the widely used FujisakiOkamoto (FO) transformation, our approach eliminates the need for ciphertext re-encryption during decapsulation-a major source of computational overhead and side-channel vulnerability in lattice-based implementations. We instantiate the transformation using the ML-KEM (FIPS 203) subroutine, yielding the ML-KEM-EtM variant. Experimental results show that ML-KEMEtM reduces decapsulation cycle counts by72−79%72-79 {\%}72−79%across security levels, with only a modest increase in encapsulation cost(1.8−7.3%)(1.8-7.3 {\%})(1.8−7.3%)and ciphertext size(1.0−2.1%)(1.0-2.1 {\%})(1.0−2.1%). The scheme thus offers a practical and efficient a lternative to F O-based KEMs, especially in performance-critical scenarios such as post-quantum TLS handshakes, where decapsulation efficiency is paramount.