Supersingular Isogeny Diffie-Hellman (SIDH) Explorer

What is SIDH?

Supersingular Isogeny Diffie-Hellman (SIDH) is a key exchange based on isogenies between supersingular elliptic curves. It was designed to resist attacks by both classical and quantum computers, and for about ten years it was a leading post-quantum candidate.

SIDH is broken and must not be used. In July 2022, Castryck and Decru published an attack that runs on an ordinary classical computer and recovers the shared secret in about an hour on a single core. SIKE, the NIST candidate built on SIDH, was withdrawn. This page explains how the protocol worked and why the attack succeeded.

How SIDH Works

1. Both parties agree on a supersingular elliptic curve E and two pairs of points (PA, QA) and (PB, QB).
2. Alice generates a secret integer mA and computes an isogeny φA: E → EA.
3. Bob generates a secret integer mB and computes an isogeny φB: E → EB.
4. Alice computes and sends her public key: (φA(PB), φA(QB)).
5. Bob computes and sends his public key: (φB(PA), φB(QA)).
6. Alice computes the j-invariant of EB/⟨φB(PA) + [mA]φB(QA)⟩.
7. Bob computes the j-invariant of EA/⟨φA(PB) + [mB]φA(QB)⟩.
8. Both parties now have the same shared secret j-invariant.

Key Features

• Designed for post-quantum security: it targeted quantum attackers, but the 2022 attack is classical and breaks it anyway.
• Small Key Sizes: Compared to other post-quantum algorithms, which is why it was attractive.
• Based on Complex Mathematics: Uses isogenies between supersingular elliptic curves.
• Diffie-Hellman-like Structure: Familiar concept, with each party publishing images of the other party's torsion points. That extra information is what the attack exploits.

Applications

• Studied as a way to future-proof key exchange in TLS and other protocols (no longer recommended)
• Research into isogeny-based cryptography, which continues with other constructions

Advantages

• Designed to resist known quantum algorithms such as Shor's algorithm
• Relatively small key sizes compared to other post-quantum schemes
• Based on isogeny problems that looked hard, until the published torsion-point information made them solvable
• Compact keys and ciphertexts compared with other post-quantum schemes

Challenges and Limitations

• Computationally intensive compared to current classical algorithms
• Relatively new, requiring more cryptanalysis and security proofs
• Implementation challenges due to complex mathematics
• Broken in 2022 by the Castryck-Decru attack, with further attacks by Maino, Martindale, Panny, Pope and Wesolowski, and by Robert

Current Status and Future Prospects

SIDH is no longer considered secure and is not used in practice. Isogeny-based cryptography is still an active research area, using constructions that do not publish the extra torsion-point information. For deployment today, NIST has standardized lattice-based schemes such as ML-KEM (derived from CRYSTALS-Kyber).

References and Further Reading

• Jao, D., & De Feo, L. (2011). Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. In Post-Quantum Cryptography (pp. 19-34). Springer, Berlin, Heidelberg.
• Costello, C., Longa, P., & Naehrig, M. (2016). Efficient algorithms for supersingular isogeny Diffie-Hellman. In Advances in Cryptology – CRYPTO 2016 (pp. 572-601). Springer, Berlin, Heidelberg.
• De Feo, L., Jao, D., & Plût, J. (2014). Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. Journal of Mathematical Cryptology, 8(3), 209-247.
• Castryck, W., & Decru, T. (2023). An efficient key recovery attack on SIDH. In Advances in Cryptology – EUROCRYPT 2023. Springer. (ePrint 2022/975)
• National Institute of Standards and Technology (NIST). (2022). Post-Quantum Cryptography Standardization. https://csrc.nist.gov/projects/post-quantum-cryptography

Conclusion

SIDH is a useful case study in post-quantum cryptography. It offered small keys and an elegant design, yet a classical attack in 2022 broke it completely. The lesson is that a scheme which resists known quantum algorithms is not automatically secure, and that new schemes need years of public cryptanalysis before they can be trusted.
For students and professionals in the field of cryptography, the SIDH story is a reason to prefer standardized, heavily analysed algorithms, and to use hybrid key exchange (classical plus post-quantum) while confidence in newer schemes builds.