
## 5. Isogeny-based cryptosystems

1. #### Problem 5.1.

[Kirsten Eisentraeger] Can quantum algorithms be used to attack SIDH by using the extra points? Are there SIDH attacks better than claw-finding?
• #### Problem 5.2.

[Lorenz Panny] Are there CSIDH attacks better than hidden shift? What is the cost of the hidden shift attack?
• #### Problem 5.3.

[Dan Boneh] Solve Decisional Diffie-Hellman (DDH) in the context of CSIDH: Let $E_0$ be a supersingular elliptic curve defined over $\mathbb F_p$ with endomorphism ring $\mathbb Z[\pi]$. Distinguish between triples $(\mathfrak a * E_0, \mathfrak b* E_0,\mathfrak c* E_0)$ and triples $(\mathfrak a * E_0, \mathfrak b* E_0,\mathfrak a\mathfrak b * E_0)$ where $\mathfrak a, \mathfrak b, \mathfrak c$ are ideals in $\mathbb Z[\pi]$ of odd norm.

Cite this as: AimPL: Quantum algorithms for analysis of public-key crypto, available at http://aimpl.org/quantumalg.