Future of Isogeny-Based Cryptography

The July 2022 Castryck-Decru break of SIKE changed the isogeny field dramatically. Before the break, isogeny-based cryptography was a promising post-quantum direction with small key sizes, active standardization efforts, and growing community. After SIKE's fall, the field was forced to reexamine its foundations. The key question: which aspects of isogeny-based cryptography remain hard after the new Richelot isogeny techniques? The answer appears to be: endomorphism-ring-based hardness (used in SQISign) and commutative class group actions (CSIDH) remain intact. SIDH-specific auxiliary torsion-point leakage is the broken component, not isogenies in general.

SQISign (Short Quaternion and Isogeny Signature, De Feo et al., 2020) is the most compact known post-quantum signature scheme. Public key: 64 bytes (a supersingular j-invariant). Signature: 177 bytes at Level 1. For comparison, ML-DSA (Dilithium) has 1312-byte public keys and 2420-byte signatures at Level 2. SQISign's security is based on the Deuring correspondence: the problem of computing an isogeny of prescribed degree between two given supersingular curves is equivalent to finding an ideal in the endomorphism ring quaternion algebra. SQISign uses a Fiat-Shamir identification scheme over this hard problem, producing a signature as a compressed representation of the response isogeny.

SQISign's compactness comes at a severe performance cost. Signing requires computing an isogeny of large degree (around p^{1/4}) using ideal-to-isogeny translation in the quaternion algebra — a computationally intensive operation taking approximately 60-600 seconds on a desktop CPU depending on parameter set. Verification is faster (around 200 ms) but still much slower than ML-DSA verification (microseconds). SQISign 2.0 (2023) improved performance 100x through algorithm improvements, bringing signing to 1-10 seconds. SQISign HD (high degree) and other variants continue optimization. The target application is use cases where bandwidth is severely constrained (IoT certificates, blockchain data, space communications) and computational speed is secondary.

FESTA (Fast Encryption from Supersingular Torsion Attacks, 2023) is a KEM designed explicitly to avoid SIDH-style torsion-point leakage. The key design insight: instead of publishing phi_A(P_B) and phi_A(Q_B) as in SIDH, FESTA uses a different isogeny structure where the encryptor's public key is the image curve only (no torsion images). FESTA uses 2^n-isogenies in a modified way that allows decryption without the counterparty's torsion basis images. Early analysis suggests FESTA resists the Castryck-Decru attack due to its different auxiliary information structure. FESTA is a promising direction but requires more cryptanalytic scrutiny — the isogeny community is cautious after SIKE's surprise break.

SCALLOP (Scalable Commutative Actions with Large Oriented Primes, 2023) addresses CSIDH's quantum security weakness. CSIDH's small prime p = 512 bits gives only ~65 bits of quantum security (Kuperberg's subexponential algorithm). SCALLOP uses a different algebraic structure: curves with complex multiplication by large imaginary quadratic orders, where the class group is specifically designed to resist Kuperberg-style quantum attacks. SCALLOP achieves a larger effective class group with parameters that provide 128-bit quantum security at smaller parameter sizes than CSIDH-5000. The trade-off: SCALLOP's algebraic setup is more complex and has received less independent analysis than CSIDH.

Given isogeny schemes' unique compactness (SQISign's 177-byte signatures, CSIDH's 64-byte keys) and their distinct hardness assumptions from lattice schemes, hybrid constructions combine isogeny and lattice components for defense in depth. A hybrid KEM: encapsulate with ML-KEM-512 AND with CSIDH-512, hash both secrets together. The combined key requires breaking both ML-KEM (LWE hardness) and CSIDH (class group action) simultaneously. If either remains unbroken, the hybrid is secure. This cryptographic agility approach is endorsed by NIST and NSA for organizations wanting additional assurance beyond any single post-quantum primitive, especially where quantum computer timelines are uncertain.

Isogeny-based zero-knowledge proofs are an emerging research direction. The isogeny path problem (find phi: E -> E' given both curves) can serve as a hard problem for proof-of-knowledge schemes. Sigma protocols for "I know an isogeny from E to E'" enable authentication without revealing the isogeny. Vero (2022) demonstrates a practical isogeny-based ZK proof system. These ZK proofs are naturally compact (the statement is just two j-invariants) but currently too slow for practical deployment. As isogeny computation improves, isogeny-based ZK proofs may provide alternatives to lattice-based or hash-based proofs where assumptions diversity is valued.

Isogeny techniques are not only relevant for post-quantum cryptography — they have applications in classical elliptic curve cryptography. The Schoof-Elkies-Atkin (SEA) algorithm for counting points on elliptic curves uses isogenies to compute the Frobenius trace, enabling efficient generation of secure elliptic curve parameters. Isogenies appear in Pollard's rho improvements for ECDLP computation. The CM (Complex Multiplication) method for constructing curves with prescribed order uses class polynomials that are fundamentally isogeny objects. Isogeny-based cryptanalysis tools (finding smooth-degree isogeny paths) are used to evaluate proposed elliptic curve parameters for hidden trapdoors — directly related to the Dual EC DRBG concern.

As of 2024, no isogeny-based scheme is standardized by NIST or other major bodies. The NIST PQC process standardized ML-KEM, ML-DSA, SLH-DSA, and FN-DSA — all lattice or hash-based. NIST is conducting a second round of PQC signatures evaluation; SQISign submitted but faces performance concerns. The isogeny community is working toward a more mature SQISign 3.0 with practical signing times (sub-second target). ISO and ETSI have not standardized any isogeny scheme. The most likely near-term standardization path: SQISign for niche applications requiring minimal signature sizes, possibly as an informational standard rather than a mandatory primitive. Wide deployment requires order-of-magnitude performance improvements.

Active research directions in isogeny-based cryptography as of 2024: (1) SQISign variants (SQISign 2.0, HD, Fast SQISign) improving signing performance toward sub-second operation. (2) Quantum security analysis of CSIDH and variants — tightening the Kuperberg attack estimates and exploring algebraic structures that resist it. (3) New hardness assumptions — supersingular endomorphism ring computations, module problems over imaginary quadratic rings. (4) Isogeny-based oblivious PRFs and applications to privacy-preserving protocols. (5) Hardware implementations of isogeny arithmetic — exploiting FPGA parallelism for CSIDH's class group action. (6) Integration of isogeny-based group actions with generic group action cryptography frameworks for new functional encryption and attribute-based schemes.

The SIKE break might suggest abandoning isogeny-based cryptography entirely. The cryptographic community takes the opposite view: the break was valuable precisely because it identified which structures are unsafe (SIDH's torsion-point leakage) and which remain hard (endomorphism rings, class group actions). Studying isogenies remains important for: (1) post-quantum diversity — having security assumptions beyond lattices reduces systemic risk if LWE is broken; (2) SQISign provides uniquely compact signatures with no current competition; (3) isogeny techniques inform elliptic curve cryptanalysis and parameter validation; (4) the mathematics is beautiful and productive — the tools developed for SIKE's break directly improved understanding of elliptic curve endomorphism rings used in other contexts.

What is the hardness assumption underlying SQISign signatures?

After SIKE's 2022 break, isogeny cryptography continues via different hardness assumptions. SQISign provides 177-byte post-quantum signatures (smallest known) based on endomorphism ring hardness; performance is improving (sub-second goal). FESTA designs around SIDH's torsion-point leakage for KEMs. SCALLOP targets 128-bit quantum security via oriented curves. Hybrid isogeny+lattice schemes provide assumption diversity. No isogeny scheme is currently standardized. SQISign standardization is the most likely near-term path. The SIKE break strengthened understanding of what must be hidden in isogeny protocols and produced new mathematical tools used across elliptic curve cryptography.