{"id":"5fea82f7-8e60-47ff-a1ef-85cd6c112af2","arxiv_id":"1908.07458","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"This paper proposes an undeniable signature scheme built from isogenies of genus-2 supersingular hyperelliptic curves.","lead":"A researcher proposes a new type of digital signature based on complex mathematical curves called supersingular hyperelliptic curves, extending an existing post-quantum crypto approach. If it works, it would let a signer control who can verify a signature, which is useful for privacy-sensitive applications.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Hash-to-kernel mapping in Eq. (3) does not enforce maximal isotropicity; in genus 2 a random 12-tuple defines a valid (l^e,l^e)-isogeny with only ~4.7% probability (l=3, e=1).","rationale":"The reader correctly identifies the unproven extension of the genus-1 security analysis as the weakest point. The stress-test found a more basic, concrete failure in the same direction: the signing algorithm of Section 3.3 takes an arbitrary 12-coordinate hash value and uses it to define a kernel with three generators, but a maximal isotropic subgroup of a genus-2 Jacobian's l^e-torsion is a rank-2 Lagrangian submodule. A random tuple therefore almost never defines a valid isogeny; the scheme is not well-defined for generic messages. This is a correctness flaw, not merely a missing proof. The proposed check would quantify the failure probability in a small instance. If the authors instead intended the hash to output only valid coefficients, the hash domain and the validity constraints must be specified; as written, the construction cannot be instantiated. Hence the verdict should move from CONDITIONAL to REJECT for the current version, though a revised version with a proper hash-to-kernel mapping and the missing proofs could be reconsidered.","tokens_in":7266,"tokens_out":18699,"duration_ms":185827,"concrete_test":"Implement the signing step for a tiny parameter set: p = 2^a 3^b 5^c f ± 1, l_M = 3, e_M = 1, choose a supersingular genus-2 hyperelliptic curve H over F_{p^2} with a rational basis of J_H[3], and treat H as a random oracle to (Z/3Z)^12. For 10^5 random messages, compute the subgroup generated by the three sums in Eq. (3), reduce coefficients mod 3, and test whether the subgroup has order 9 and is totally isotropic under the 3-Weil pairing. If the fraction of valid messages is not overwhelming (e.g., below 95%), the scheme as written is not well-defined for generic messages and the hash-to-kernel mapping must be revised.","verdict_should_be":"REJECT","load_bearing_attack":"Section 3.3, Eq. (3), defines the message-dependent kernel K_M as the subgroup generated by three linear combinations of the M_i basis, with coefficients h_1,...,h_12 taken directly from the hash H: {0,1}* -> Z^12. For φ_M: J_H -> J_M to be an (l_M^{e_M}, l_M^{e_M}) isogeny, K_M must be a maximal isotropic subgroup of J_H[l_M^{e_M}]; in genus 2 this subgroup has order l_M^{2e_M} and is generated by two independent vectors with trivial Weil pairing. Three arbitrary generators span a subgroup of order up to l_M^{3e_M}, and a randomly chosen 12-tuple yields a valid maximal isotropic subgroup only rarely: for l=3, e=1 (where J_H[3] ≅ (Z/3)^4), the fraction of tuples generating a Lagrangian subspace is about 40·624/3^12 ≈ 4.7%. Thus for most messages the signing algorithm either fails to construct an isogeny or produces a quotient that is not a principally polarized abelian surface, breaking the rest of the scheme. Section 4.1 acknowledges that the scalars must satisfy conditions guaranteeing maximality and isotropicity, but neither the signing procedure nor the hash domain enforces these conditions. This is not a missing proof but a well-definedness failure of the construction; consequently the claimed adaptation of [16] cannot be evaluated.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an undeniable signature scheme for genus-2 supersingular hyperelliptic curves, following the structure of Jao-Soukharev's genus-1 scheme. It defines setup, key generation, a signing procedure using isogenies between jacobians, and confirmation/disavowal protocols. Security is stated through nine new computational problems and by claiming that the security analysis of the genus-1 problems and the proofs of [16] extend to the genus-2 setting. The manuscript contains no complete security proof and no implementation.","tokens_in":7620,"tokens_out":9621,"duration_ms":102289,"significance":"If completed and proven, a secure genus-2 isogeny-based undeniable signature scheme would be a meaningful contribution to post-quantum cryptography, since most isogeny-based constructions are elliptic-curve based and the genus-2 setting offers a richer isogeny graph. The paper is honest about the assumptions it makes, and the list of problems is a useful starting point. However, the contribution as written is a proposal rather than a proven construction: the central signing step is not well-defined for generic messages, and the security properties are deferred to [16] rather than demonstrated. No machine-checked proofs or reproducible code accompany the paper.","major_comments":[{"comment":"The kernel K_M is defined as the subgroup generated by three linear combinations of the M_i. For the quotient J_H/K_M to be a principally polarized abelian surface via an (l_M^{e_M}, l_M^{e_M})-isogeny, K_M must be a maximal isotropic subgroup of J_H[l_M^{e_M}], which in genus 2 has order l_M^{2e_M} and is generated by two elements with trivial Weil pairing. Three arbitrary generators span a subgroup of order up to l_M^{3e_M}, and for l=3, e=1 the fraction of hash outputs (h_1,...,h_12) for which the three vectors lie in and generate a Lagrangian subspace is only 40*624/3^12, about 4.7%. Thus for most messages the signing algorithm produces no valid isogeny phi_M. The remark in Section 4.1 that scalars must satisfy 'certain conditions that guarantee maximality and isotropicity' is not implemented in Eq. (3), and no such condition is imposed on the hash function. This is a well-definedness failure of the scheme, not merely a missing proof.","section":"Section 3.3, Eq. (3)"},{"comment":"The claims that CON and DIS are complete, sound, and zero-knowledge, and that the scheme is unforgeable and invisible, are all made by saying that the reasonings of [16] can be used 'after adapting the methods for our genus-2 context'. No adapted proof is given. The genus-2 setting differs in the structure of torsion subgroups, the Weil pairing, the definition of the kernel subgroups, and the isogeny graph; the transfer from [16] is therefore not immediate. Since these properties are the central security claim of the paper, the manuscript needs either complete proofs or precise reductions to Problems 1-9.","section":"Section 4.1"},{"comment":"The assertion that the probability of J_AM being a branch point of the modular curve X0(l_C^{e_C}) is 'negligible' is not quantified, and no probability space or parameter is specified. This probability statement is load-bearing for the completeness of DIS; it needs a precise statement and proof, or the protocol must be modified to avoid relying on it.","section":"Section 4.1, DIS completeness"}],"minor_comments":[{"comment":"The phrase 'based in supersingular hyperelliptic curves' should be 'based on supersingular hyperelliptic curves'.","section":"Abstract"},{"comment":"The prime form p = l_A^{e_A} l_M^{e_C} l_C^{e_C} f +/- 1 appears to contain a typo; from Section 3.1 one expects l_A^{e_A} l_M^{e_M} l_C^{e_C} f +/- 1.","section":"Section 4, first paragraph"},{"comment":"The notation 'K_M C' is ambiguous; using a single symbol such as K_{MC} = <phi_M(K_C)> would make the displayed isomorphisms easier to read.","section":"Section 3.4, Eq. (7)"},{"comment":"The procedure for choosing the scalars a_i and c_i is not self-contained; the paper should state the maximal-isotropy conditions explicitly rather than only referring to Section 3.2 of [8].","section":"Section 3.2 and 3.4"}],"recommendation":"reject","confidential_remarks":"This is an early-stage proposal whose main signing algorithm is not well-defined for generic messages, and whose security properties are deferred rather than proved. The hash-to-kernel issue in Eq. (3) is a concrete mathematical obstruction, not a stylistic gap. I would not encourage resubmission unless the authors replace the hash-to-kernel mapping with a valid encoding of maximal isotropic subgroups and provide actual proofs for the security properties."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper is not ready. The construction breaks at the signing step because the hash-to-kernel mapping in Eq. (3) doesn't enforce maximal isotropicity. In genus 2, an (l^e, l^e)-isogeny kernel must be an order-l^{2e} subgroup with trivial Weil pairing, generated by two independent vectors. The scheme picks three linear combinations from a 12-tuple of hash outputs. For l=3, e=1, a random 12-tuple gives a valid maximal isotropic subgroup only about 4.7% of the time. So for most messages, either the isogeny doesn't exist or the quotient isn't a principally polarized abelian surface. The author knows the scalars have to satisfy conditions—Section 4.1 says so—but the signing algorithm never samples from that constrained set. This is a well-definedness failure, not a missing proof.\n\nWhat the paper does well: it's a clear, honest adaptation of Jao-Soukharev to genus 2, follows the move to Richelot isogenies, and defines a full set of candidate hard problems. It doesn't overclaim; it explicitly defers security to [16]. The underlying idea—combining undeniable signatures with genus-2 isogenies—is new and worth exploring if the kernel selection is fixed.\n\nSoft spots: beyond the maximality issue, all security claims (completeness, soundness, zero-knowledge, unforgeability, invisibility) are deferred to 'adapting' [16], with no reduction. The DIS completeness argument contains an unquantified negligibility assumption about branch points. The hard problems are new assumptions without supporting reductions. These are serious, but the maximality problem is the first thing to fix.\n\nWho should read it: people working on higher-genus isogeny crypto. It's a nice illustration of the gap between genus-1 and genus-2 constructions.\n\nRecommendation: worth sending to a serious referee because the flaw is specific and fixable, and the proposal may become useful after revision. If I were the editor, I'd send it out but expect a major revision or a reject in its current form.","headline":"The paper's hash-to-kernel signing step breaks the construction in genus 2; the rest is a promising but unproven sketch.","tokens_in":8108,"tokens_out":3277,"would_cite":false,"duration_ms":33486,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A60","14G50"],"pacs":[],"model":"deepseek-v4-flash","headline":"Undeniable signatures can be built on supersingular genus-2 hyperelliptic curves using Richelot isogenies","keywords":["undeniable signatures","supersingular hyperelliptic curves","Richelot isogenies","genus-2 isogeny graph","G2-invariants","post-quantum cryptography","zero-knowledge protocols"],"falsifier":"Run the invisibility game at the smallest proposed parameters: generate many real and fake challenge surfaces and attempt to distinguish them using only the public $G_2$-invariants and the auxiliary point images. A distinguisher that succeeds with non-negligible advantage would refute the paper's invisibility claim; repeated failure under exhaustive search would support the claim.","tokens_in":7076,"feed_emoji":"🔐","tokens_out":10391,"duration_ms":93179,"temperature":0.7,"pith_summary":"The paper proposes an undeniable signature scheme whose keys and signatures live on supersingular hyperelliptic curves of genus 2. An undeniable signature lets the signer decide, through interactive confirmation and denial protocols, whether a given signature is accepted or rejected; the attraction is quantum-resistant cryptographic security from isogenies. The scheme claims completeness, soundness, zero-knowledge, unforgeability and invisibility by transplanting the proofs of a genus-1 isogeny-based undeniable signature scheme, with the genus-1 j-invariant replaced by G2-invariants and elliptic-curve isogenies replaced by Richelot (2,2)-isogenies between jacobians. If the transplantation holds, the richer genus-2 isogeny graph (fifteen (2,2)-isogenies per surface instead of three 2-isogenies) would support similar security at potentially smaller parameters.","feed_headline":"Undeniable signatures move to supersingular genus-2 curves","feed_subtitle":"Richelot isogenies between genus-2 jacobians give signer-controlled verification and a denser graph for post-quantum security.","key_machinery":"The load-bearing objects are Richelot isogenies: (2,2)-isogenies between jacobians of genus-2 curves, whose kernel is a maximal isotropic subgroup with respect to the 2-Weil pairing. The paper builds every step of key generation, signing, confirmation and denial from such kernels, using the $G_2$-invariants $G=(g_1,g_2,g_3)$ of Igusa invariants as the public isomorphism-class data in place of the elliptic $j$-invariant. The mechanism that carries the security argument is the commuting-square structure $J_{AM}$ reached both through $K_A$ then $K_M$ and through $K_M$ then $K_A$; the protocols exploit this symmetry by having the verifier randomize between two checks, forcing a prover to exhibit either the secret kernel or compatibility of the isogeny chains on the auxiliary torsion points.","core_discovery":"On the paper's own terms, the central discovery is a template for an undeniable signature scheme in the genus-2 isogeny setting. A signer's private key is a tuple of scalars defining a maximal isotropic kernel $K_A$ on the torsion $J_H[l_A^{e_A}]$ of a supersingular genus-2 jacobian; the public key is the $G_2$-invariants of the quotient $J_A$ plus the images of the other torsion bases. A signature on a message is computed by walking the Richelot isogeny graph through the message-dependent kernel $K_M$, producing a surface $J_{AM}$ and a list of images of the auxiliary points. Confirmation and denial protocols (CON and DIS) use a third torsion basis $l_C^{e_C}$ to prove in zero knowledge whether the signed surface matches the public one. The paper's security section states that the genus-1 security analysis extends easily, so the eight listed isogeny problems (decisional, computational, Diffie-Hellman, and modified one-sided versions) underlie the claimed unforgeability and invisibility, and that the CON/DIS protocols inherit completeness, soundness and zero-knowledge after adapting the arguments of [16].","pith_inferences":["The author leaves implicit that the same kernel-commuting template might apply to other genus-1 isogeny primitives, such as key exchange or oblivious transfer; this paper only instantiates undeniable signatures.","Because the public key uses G2-invariants, one could test the invisibility claim experimentally at small parameters: sample real and fake challenges and attempt to distinguish them with invariant statistics; the paper does not report such tests.","The DIS completeness argument depends on the jacobian not being a branch point in the modular-curve covering; a concrete quantitative estimate of how small that probability is for the proposed parameters would turn a plausibility claim into a checkable bound."],"forward_implications":["If the security adaptation is valid, the scheme gives a post-quantum undeniable signature in genus 2 whose verification can be selectively enabled or denied by the signer.","The denser genus-2 isogeny graph may support comparable security with fewer isogeny computations, as the paper states.","The paper's eight isogeny problems become explicit targets: any efficient solver for a member of the Diffie-Hellman family would break unforgeability or invisibility of the scheme.","The CON and DIS protocols are designed so the verifier's random challenge forces a cheating prover to fail, assuming the branch-point exceptional case is negligible, with both claims carried over from the genus-1 proofs."],"supporting_citations":[{"why":"Supplies the genus-1 undeniable signature scheme and the completeness, soundness, zero-knowledge, unforgeability, and invisibility proofs that the paper adapts.","marker":"[16]"},{"why":"Provides the genus-2 isogeny graph machinery, Richelot isogeny techniques, and the Section 3.2 method for sampling kernels and computing isogenies.","marker":"[8]"},{"why":"Gives the computational problems in supersingular elliptic-curve isogenies that the paper says extend to the genus-2 setting.","marker":"[10]"},{"why":"Defines the supersingular isogeny problems and key-exchange setting in genus 1 whose hardness assumptions are transplanted.","marker":"[5]"},{"why":"Defines the G2-invariants used as public isomorphism-class data in place of the elliptic j-invariant.","marker":"[2]"},{"why":"Provides the abelian-variety theorems on polarizations and isogenies used to guarantee that kernel quotients are principally polarized abelian surfaces.","marker":"[20]"},{"why":"Supplies the author's previous genus-2 supersingular isogeny techniques reused for the kernel computations in this scheme.","marker":"[7]"}],"fun_headline_variants":["Undeniable signatures from genus-2 isogenies","Richelot isogenies enable undeniable signatures","Supersingular genus-2: new undeniable signatures","Post-quantum undeniable signatures via genus-2"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole security argument rests on one premise: that a proof which works for the elliptic-curve version of the scheme still works when the curves are replaced by genus-2 jacobians and the isogenies by their genus-2 analogue; if that transfer fails, the claimed guarantees could fail.","fun_headline_variants_meta":{"raw":{"variants":["Undeniable signatures from genus-2 isogenies","Richelot isogenies enable undeniable signatures","Supersingular genus-2: new undeniable signatures","Post-quantum undeniable signatures via genus-2"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000675,"raw_usage":{"total_tokens":3004,"prompt_tokens":809,"completion_tokens":2195,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":425,"completion_tokens_details":{"reasoning_tokens":2131}},"tokens_in":425,"tokens_out":2195,"duration_ms":16409,"temperature":1.0,"reasoning_tokens":2131,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T12:35:34.120700+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the invisibility game at the smallest proposed parameters: generate many real and fake challenge surfaces and attempt to distinguish them using only the public $G_2$-invariants and the auxiliary point images. A distinguisher that succeeds with non-negligible advantage would refute the paper's invisibility claim; repeated failure under exhaustive search would support the claim.","supporting_citations":[{"cited_title":"In: Mosca M","cited_arxiv_id":null,"evidence_quote":"Supplies the genus-1 undeniable signature scheme and the completeness, soundness, zero-knowledge, unforgeability, and invisibility proofs that the paper adapts."},{"cited_title":"Quantum Information Processing 17(10), 1–22 (2018)","cited_arxiv_id":null,"evidence_quote":"Gives the computational problems in supersingular elliptic-curve isogenies that the paper says extend to the genus-2 setting."},{"cited_title":"Cryp- tology ePrint Archive: Report 2019/758 (2019)","cited_arxiv_id":null,"evidence_quote":"Supplies the author's previous genus-2 supersingular isogeny techniques reused for the kernel computations in this scheme."}],"review_version":1}