[PDF] Top 20 The supersingular isogeny problem in genus 2 and beyond

... w)). For fixed w, the attack envisioned above gives an asymptotic improvement over vOW for all g > 1. If an adversary has access to a large amount of storage, then vOW may still be the best classical algorithm for g ≤ ... See full document

... and isogeny-based ...over supersingular elliptic curves. In the heart of the isogeny-based cryptography are the supersingular elliptic ...the isogeny graph of su- persingular elliptic ... See full document

... So far, Petit’s techniques cannot be applied to the parameters proposed by Jao and De Feo, hence the proposed schemes [23,15,2] remain secure. Neverthe- less and in anticipation of potential further cryptanalysis ... See full document

... the isogeny computation problem for ordinary elliptic curves, and obtained a subexponential-time quantum ...the supersingular case (because of non- commutativity of endomorphism ...employ ... See full document

... Section 2 introduces preliminary material on supersingular elliptic curves and the arithmetic of quaternion algebras, and we recall some well-known facts from [Mes86,Piz80,Wat69], with an emphasis on ... See full document

... logarithm problem had become the primary choice for concrete instantiations of fundamental cryptographic protocols, and enabled many new advancements in the ...between supersingular elliptic curves. Their ... See full document

... Remark 4. In practice we will replace the random oracle by a concrete hash function with a certain output length t. The correct choice of t in the quantum setting is still a subject of active research. As mentioned in ... See full document

... ring problem is polynomially equivalent to Problem ...ring problem reduces to Problem ...`-power isogeny by a left ideal in a maximal order is ... See full document

... is supersingular isogeny ...logarithm problem thanks to Shor’s algorithm ...all supersingular elliptic curves defined over a finite field F p 2 , and exponentiation maps are replaced by ... See full document

... π 2 = −p. For a general order there exists a unique maximal 2-sided ideal P over p, and this ideal is principal if and only if there exists such an element ...the 2-sided class group, and p-extremal ... See full document

... c 2 ) and ( c 3 ) follow from the same arguments used to prove the equivalence between ( c 1 ) , ( c 2 ) and ( c 3 ) ; indeed, this process simply amounts to a change of ...each problem is actually ... See full document

... use supersingular elliptic curve isogenies is the hash function construction of Charles et ...the isogeny graph path-finding ...on supersingular elliptic curve isogenies, along with a new assumption ... See full document

... logarithm problem (ECDLP) are cornerstones of public key ...degree isogeny between two given elliptic curves have ...hard problem is identifying the class group element mapping one given curve to ... See full document

... (PQC) i.e. cryptographic algorithms that are considered to be secure against an attack by a quantum computer. The National Institute of Standards and Tech- nology (NIST) [3] published a report on PQC providing an ... See full document

... or genus 1 curves, has been well studied and consequently all of the speed records for fast curve-based cryptography are for elliptic curves ...high genus have also been considered for cryptographic ... See full document

... imaginary genus 2 curves, Gaudry showed in [20] that one can perform cryptographic scalar multiplications much more efficiently in the special case that the Jacobian of the curve C/K has K-rational ... See full document

... Now consider the case when g = 0. The simplest case is when Σ · Σ > 0. Then a tubular neighborhood of Σ has normal bundle N with boundary a lens space. Since ∂N has a metric with positive scalar curvature, and N is ... See full document

... problems. Problem severity was assigned using a 3-point scale based on time wasted or task ...on problem two, seven participants (44%) encountered the problem, five were assigned a high impact ... See full document

... The proposed non-redundant modular arithmetic algorithms, which were implemented on top of the most recent version of Microsoft’s SIDH library [11] (version 3.0), demonstrates that the supersingular ... See full document

... The Homfly polynomial of a link in R 3 is unchanged if the orientations of all its components are reversed. The map induced on the Homfly skein of the annulus when the annulus is rotated by π, reversing its core ... See full document