… Feo Supersingular Isogeny Diffie-Hellman (SIDH) key agreement scheme is based on the
intractability of the Computational Supersingular … We will denote the elliptic curve that Vélu’s …

… protocol using supersingular elliptic curves, named SIDH (Supersingular Isogeny … SIDH).
CSIDH uses an action of an ideal class group on a set of classes of supersingular elliptic curves…

… elliptic curves, given a representation of their kernel. In the initial supersingular isogeny-based
key agreement protocol, SIDH [2]… and then use the final elliptic curve in each sequence to …

… Let p be a prime number; for simplicity we restrict to supersingular elliptic curves defined
over \(\… 2 we recall basic properties of supersingular elliptic curves and the SIDH protocol. …

… The best known attacks against Jao and De Feo’s SIDH protocol [23] try to recover either …
the supersingular isogeny problem: given a finite field K and two supersingular elliptic curves \(…

… One such piece of information is the endomorphism ring of the starting elliptic curve. In fact,
… on SIDH [17] also need a known endomorphism ring. Since many current attacks on SIDH all …

… long time, but the SSI-T problem is specific to SIDH and its variants. It is natural to wonder how
the … results on supersingular elliptic curves, quaternion algebras and the SIDH protocol. In …

… Recent attacks on SIDH by … two supersingular elliptic curves. It follows that, for an isogeny
based scheme to be secure, it must avoid giving too much information about its elliptic curves …

… SIDH. We also present statements about ordinary and supersingular curves that are specific
to CSIDH and SIDH… after understanding CSIDH we believe SIDH is easier to comprehend. …

… exchange protocol SIDH formed the … supersingular elliptic curves and every such curve has
a representation that is defined over p2 , we can assume that all supersingular elliptic curves …