CSIDH: Commutative Supersingular Isogenies

CSIDH (Commutative Supersingular Isogeny Diffie-Hellman, Castryck et al., 2018) is an isogeny-based key exchange that avoids the SIDH torsion-point leakage entirely by using a fundamentally different algebraic structure. CSIDH works with supersingular curves over Fp (not Fp2 as in SIDH). The hardness assumption is the commutativity of the class group action: two parties each apply a secret class group element to a common starting curve, and commutativity ensures both arrive at the same shared curve. No auxiliary torsion point information is published — the public key is just a single j-invariant. This design survived the Castryck-Decru attack on SIDH.

Over Fp with p = 3 mod 4, the supersingular curves E have a distinguished endomorphism pi (the Frobenius), and their endomorphism algebra contains the imaginary quadratic order Z[pi]. The ideal class group Cl(Z[pi]) acts freely and transitively on the set of supersingular curves over Fp (up to isomorphism). An ideal a in Cl(Z[pi]) acts on a curve E to produce a new curve a * E, computed as the curve E/E[a] where E[a] is the torsion subgroup corresponding to ideal a. This action is commutative: a * (b * E) = b * (a * E) = [ab] * E. This is the CSIDH group action, providing a commutative analog of Diffie-Hellman.