Isogeny-Based Cryptography

Isogeny-based cryptography offers the smallest keys of any post-quantum family, built on the hardness of finding isogenies between supersingular elliptic curves. It is also the field's most striking cautionary tale: the leading candidate SIKE was broken in 2022 by a classical attack. Research continues with CSIDH and the compact signature scheme SQIsign, but the family is not yet ready for production reliance.

The Hard Problem

An isogeny is a structure-preserving map between elliptic curves. The security assumption is that, given two supersingular elliptic curves, it is hard to find an isogeny (a path in the isogeny graph) connecting them. This problem has no efficient classical or quantum algorithm in general, and crucially it allows extremely compact key material — the headline advantage of the family.

Tiny Keys

Isogeny schemes produce the smallest public keys and ciphertexts of any PQC family — often well under a kilobyte, comparable to or smaller than classical ECC. In a world where lattice and especially code-based schemes inflate handshake sizes, this compactness is genuinely attractive for bandwidth-constrained settings. That promise is exactly why the SIKE break was so consequential.

The SIKE Break — A Cautionary Tale

SIDH / SIKE was a Round-4 KEM candidate in the NIST process and a leading hope for compact post-quantum key exchange. In 2022, Castryck and Decru published a key-recovery attack that broke SIDH/SIKE outright — running on a single classical computer in hours, with no quantum computer required. The attack exploited extra structural information (auxiliary torsion points) that SIDH revealed.

Ongoing Research

The SIKE break did not end isogeny research; it redirected it. The structural weakness was specific to SIDH's use of torsion-point images, not to isogeny problems in general.

• CSIDH — a commutative-isogeny key-exchange design with a different structure than SIDH. It avoids the torsion-point leakage that doomed SIDH, though its quantum security level and performance remain active research topics.
• SQIsign — a compact isogeny-based signature scheme that has advanced to the third round of the NIST additional-signatures process; its public keys and signatures are very small, but signing is computationally heavy and it remains under evaluation.

Where It Stands

Isogeny cryptography remains scientifically fascinating and uniquely compact, but it is experimental from a deployment standpoint. Use standardized lattice, hash-based, and code-based schemes today, and watch SQIsign and CSIDH as longer-term possibilities.

Standards & references

• An efficient key recovery attack on SIDH (Castryck-Decru, 2022) — the classical attack that broke SIKE.
• NIST PQC project — where SIKE competed and SQIsign is being evaluated.
• Resources — full standards register