We study two important families of problems in isogeny-based cryptography and how they
relate to each other: computing the endomorphism ring of supersingular elliptic curves, and …

It has recently been rigorously proven (and was previously known under certain heuristics)
that the general supersingular isogeny problem reduces to the supersingular endomorphism …

We present an attack on SIDH utilising isogenies between polarized products of two
supersingular elliptic curves. In the case of arbitrary starting curve, our attack (discovered …

Abstract The supersingular Endomorphism Ring problem is the following: given a
supersingular elliptic curve, compute all of its endomorphisms. The presumed hardness of …

In this paper, we introduce a polynomial-time algorithm to compute a connecting O O-ideal
between two supersingular elliptic curves over F _p F p with common F _p F p …

The recent devastating attacks on SIDH rely on the fact that the protocol reveals the images
φ (P) and φ (Q) of the secret isogeny φ: E 0→ E on a basis {P, Q} of the N-torsion subgroup E …

We present an efficient key recovery attack on the Supersingular Isogeny Diffie–Hellman
protocol (SIDH). The attack is based on Kani's “reducibility criterion” for isogenies from …

Abstract The Isogeny to Endomorphism Ring Problem (IsERP) asks to compute the
endomorphism ring of the codomain of an isogeny between supersingular curves in …

We present an overview of supersingular isogeny cryptography and how it fits into the broad
theme of post-quantum public-key crypto. The paper also gives a brief tutorial of elliptic …

An important open problem in supersingular isogeny-based cryptography is to produce,
without a trusted authority, concrete examples of 'hard supersingular curves' that is …