5. Isogenybased cryptosystems

Problem 5.1.
[Kirsten Eisentraeger] Can quantum algorithms be used to attack SIDH by using the extra points? Are there SIDH attacks better than clawfinding? 
Problem 5.2.
[Lorenz Panny] Are there CSIDH attacks better than hidden shift? What is the cost of the hidden shift attack? 
Problem 5.3.
[Dan Boneh] Solve Decisional DiffieHellman (DDH) in the context of CSIDH: Let $E_0$ be a supersingular elliptic curve defined over $\mathbb F_p$ with endomorphism ring $\mathbb Z[\pi]$. Distinguish between triples $(\mathfrak a * E_0, \mathfrak b* E_0,\mathfrak c* E_0)$ and triples $(\mathfrak a * E_0, \mathfrak b* E_0,\mathfrak a\mathfrak b * E_0)$ where $\mathfrak a, \mathfrak b, \mathfrak c$ are ideals in $\mathbb Z[\pi]$ of odd norm.
Cite this as: AimPL: Quantum algorithms for analysis of publickey crypto, available at http://aimpl.org/quantumalg.