An efficient key recovery attack on SIDH

Wouter Castryck · Thomas Decru

Eurocrypt 2023

Time bound

Heuristic polynomial time, apart from parameter-dependent integer factorizations

Space bound

Not stated in the checked source

Source / version date

30 Jul 2022

Comparison variant

Classical · known endomorphism ring

Cost scale

Parameter-dependent

attack-information

SIDH public auxiliary torsion images

assumption

Known endomorphism ring; stated heuristic and integer-factorization qualifications

Assumptions and source notes

Known starting-curve endomorphism ring is assumed. The attack exploits the auxiliary torsion images in a SIDH public key. The source reports an SIKEp434 break in about ten minutes on one core; that timing is not a universal complexity exponent.

Source location

Abstract
Version: Checked 2026-11-08; see linked source version/date

Primary source ↗

@misc{cd22,
  author = {Wouter Castryck and Thomas Decru},
  title = {{An efficient key recovery attack on SIDH}},
  year = {2023},
  doi = {10.1007/978-3-031-30589-4_15},
  url = {https://eprint.iacr.org/2022/975},
  keywords = {SIDH, SIKE, torsion images},
  cr_date = {2022-07-30},
  cr_date_precision = {day},
  cr_status = {published},
  cr_venue = {EUROCRYPT 2023},
  cr_author_ids = {wouter-castryck; thomas-decru}
}