{"id":"af0eeff6-163d-448c-b1b2-67c2dc82cd75","arxiv_id":"2411.18844","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A proposed (n,t)-threshold scheme that shares encodings of a torsion point and its image under a secret isogeny, using erasure-correcting codes and the SIDH key-recovery algorithm for reconstruction.","lead":"The authors propose a threshold secret-sharing scheme in which shares are blocks of encoded torsion-point images, and t participants reconstruct a secret isogeny path by erasure correction followed by the SIDH key-recovery algorithm. It is the first scheme to use the SIDH attack constructively, but the code dimension argument is internally inconsistent.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 4 requires a binary code of length γn to encode a γn-bit message and correct γ(n−t) erasures; the Singleton bound forces k=γn and d≤1, so no such code exists as stated.","rationale":"The reader's weakest assumption identifies exactly the load-bearing contradiction: the scheme fixes the secret word w to length γn and the codeword c to length γn, yet the threshold property requires the code to have dimension k<γn with positive erasure-correction capacity. I independently re-derived the contradiction from the Singleton bound: an injective code on 2^{γn} messages has minimum distance at most 1, so it cannot correct γ(n−t) erasures when t<n. This is an internal inconsistency in the central theorem, not a disagreement with consensus. A possible repair would be to restrict the message space to the actual (much smaller) set of SESS-encodable points and define an explicit map from those points into a lower-dimensional message space, but the paper does not do this, and its security proof would then need a different entropy argument than counting missing codeword bits. The construction idea may be salvageable, but the proof of Theorem 4 as written does not establish the central claim. I therefore agree with the reader's REJECT verdict and see no reason to adjust it.","tokens_in":12861,"tokens_out":5911,"duration_ms":60865,"concrete_test":"Run the following consistency check for a minimal admissible instance, γ=1, n=3, t=2. Theorem 4 requires a binary code of length 3 that encodes all 2^3 words w=SP||SP' and corrects γ(n−t)=1 erasure. Singleton bound: an injective code of size 8 has d≤3−log2 8+1=1, so it cannot correct 1 erasure; a code with d≥2 has size at most 4 (k≤2), so it cannot encode 3-bit w. Reproduce Theorem 4's proof with the concrete hyperoval subfield code [2^r+2,k*,d*] proposed in Section 5 and exhibit the encoder map from an arbitrary γn-bit w into F2^{k*}; if no such map is given, the theorem fails as stated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Theorem 4's proof fixes w=SP||SP' to be exactly γn bits and then encodes w as a codeword c of length γn (the n participants receive γ-bit chunks covering all γn positions). For a binary code C=[γn,k,d] to encode arbitrary γn-bit messages injectively, k must equal γn; Singleton then gives d≤1, so C cannot correct any erasures, contradicting the hypothesis that it corrects γ(n−t) erasures for t<n. Theorem 5 itself uses k<γn via t≥k/γ combined with t<n, so the claimed encoder cannot accept w unless w is confined to a k-dimensional subspace, which is never specified or shown for SESS outputs. The only escape would be to treat w as drawn from the smaller set of actual point encodings and to map those to k-bit messages; but then the perfect-secrecy argument in Theorem 5, which counts 2^{γ(n−t+1)} brute-force attempts over missing codeword bits, would need to be replaced by an entropy analysis over that smaller message space, and no such analysis is given. Thus the load-bearing premise of a binary code that simultaneously encodes a γn-bit word and corrects γ(n−t) erasures is unsupported and, as stated, impossible.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a threshold secret-sharing scheme for supersingular isogeny paths. The dealer encodes two torsion points P and P′ (auxiliary data for recovering the isogeny) into a bit string w = SP||SP′ of length γn, splits w into n blocks of γ bits, and distributes one block to each participant. Reconstruction works by treating the missing blocks from any t participants as erasures, using a binary error-correcting code C to recover w, then invoking the SIDH key-recovery machinery (Robert's algorithm together with the reduction of Feo, Fouotsa, and Panny) to compute the secret isogeny from the recovered points. The main theorems claim that any code C correcting γ(n−t) erasures yields a threshold-t scheme and that the scheme is perfect under the parameter bound k/γ ≤ t ≤ n−128/γ+1. Section 5 proposes instantiations from Reed-Solomon codes, subfield codes of hyperoval codes, and binary representations of RS codes with burst-erasure correction.","tokens_in":13182,"tokens_out":7222,"duration_ms":67453,"significance":"The high-level idea of turning the SIDH attack into a reconstruction tool for a shared isogeny path is conceptually interesting, and the paper correctly emphasizes the distinction between the broken SI-TP problem and the still-hard isogeny path problem. If the construction worked, it would be a novel combination of isogeny-based cryptography, point encodings, and coding-theoretic secret sharing. However, the central encoding/erasure-correction premise is infeasible as stated: the proof of Theorem 4 requires encoding a γn-bit message into a binary codeword of length γn while the same code is supposed to correct γ(n−t) erasures, which the Singleton bound forbids. The security proof of Theorem 5 also conflates brute-force work with perfect secrecy. The paper ships no implementation or machine-checked proof, and the main technical claims are not salvageable by local edits within the current framework.","major_comments":[{"comment":"The proof sets w = SP||SP′ to be a word of length γn and encodes it as a codeword c = (c_1, ..., c_n) of length γn, so that the n participants collectively receive all γn bits. For this encoding to be injective on the whole space {0,1}^{γn}, the binary code C must have dimension k = γn; the Singleton bound then gives minimum distance d ≤ 1, so C cannot correct any erasure. This contradicts the theorem's assumption that C corrects γ(n−t) erasures for t<n and also contradicts the bound t ≥ k/γ in Theorem 5, which together with t<n forces k < γn. The proof never states that w is drawn from a k-dimensional subspace or specifies any code family that avoids this dimensional obstruction; the claimed threshold reconstruction therefore rests on an impossible encoding/erasure-correction premise.","section":"§3, Theorem 4 and Procedure 1"},{"comment":"The proof does not establish the perfect threshold property required by Definition 2. It argues that with t−1 shares the adversary must make 2^{γ(n−t+1)} brute-force attempts, but perfect secrecy has a precise information-theoretic meaning: any subset of t−1 shares must have zero mutual information with the secret. No entropy calculation, indistinguishability argument, or simulator is provided. In addition, 'NIST security level I' is used as if it were a formal condition; it is a computational heuristic, and the proof gives no reduction showing that an adversary with t−1 shares and bounded resources cannot learn the path. The derivation of t ≤ n−128/γ+1 from γ(n−t+1) ≥ 128 is presented as self-evidently sufficient for security, but no argument is given for that sufficiency.","section":"§4, Theorem 5"},{"comment":"The reconstruction algorithm is not well defined. Line 10 sets c ← E^{-1}(y) with the comment 'Correcting the erasures in y', but E in Procedure 1 is the encoder of the code, not a decoder; the correct operation would be a decoder that takes the received word with erasures and returns a codeword, followed by the inverse encoder to recover w. Neither such a decoder nor its erasure-correction guarantee is specified beyond the theorem's assumption. The notation is also inconsistent with the preceding text, where y_i is a block of γ bits but c is indexed as c_1, ..., c_n; the share formula y_i = (c_i, c_{i+1}, ..., c_{i+γ}) is dimensionally wrong. As a result, even if a suitable code existed, the paper would not provide a complete algorithm for reconstruction.","section":"§3, Procedure 2"}],"minor_comments":[{"comment":"The symbol E is used for both an elliptic curve and the encoding map; this ambiguity makes Procedures 1 and 2 hard to follow.","section":"Throughout"},{"comment":"The encoding function ψ is stated to map points to strings of length γn/2, but no parameter condition such as 2^{γn/2} ≥ #E(F_q) is given; without it, the encoding step may not be injective for all points on the chosen curve.","section":"§2.2, Remark 1"},{"comment":"The condition 'N contains a large smooth square factor' is left undefined, and the proof then speaks of N being a power of a small prime ℓ, which is a different condition; the statement should be made precise.","section":"§2.1, Theorem 3"},{"comment":"The proof jumps from Theorem 7 to the bound ǫ ≤ (γ−2)/r+2 without deriving the displayed inequality for r>γ−2; this step should be spelled out.","section":"§5.2, Corollary 2 proof"},{"comment":"The loop 'for 0 ≤ j ≤ γn' should be a half-open interval to avoid an off-by-one error when processing the γn-bit word.","section":"§3, Procedure 2"}],"recommendation":"reject","confidential_remarks":"This is a technical reject rather than a novelty reject. The high-level research direction—using the SIDH attack as a reconstruction oracle for shared isogeny paths—is interesting and worth encouraging. However, the Singleton-bound obstruction in Theorem 4 is central and cannot be fixed by a local change; any serious revision would need to redesign the message space, the code parameters, and the security model. The authors should also replace the brute-force argument in Theorem 5 with either an information-theoretic proof of perfect secrecy or a clearly stated computational security notion with a proof."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the thing you need to know: the central threshold construction in this paper cannot work as written. Theorem 4 asks for a binary code that encodes a γn-bit message into a γn-bit codeword while correcting γ(n−t) erasures. The Singleton bound, which the authors cite, forces the dimension to equal the length, so the code has distance 1 and corrects no erasures. There is no such code. This is not a minor gap; it's the load-bearing step.\n\nWhat's actually new: the paper is, as far as I know, the first to deliberately use Robert's SIDH key-recovery algorithm as a constructive tool in a threshold scheme, and the idea of sharing images of torsion points is a genuinely different angle from existing isogeny threshold schemes like Sashimi or CSI-RAShi. The paper also does a decent job surveying isogeny attacks, encoding functions, and code-based secret sharing. The sections on Reed-Solomon subfield codes and burst erasures show the authors know their coding theory.\n\nThe soft spots are proportional. The main one is fatal. The proof of Theorem 4 never specifies how a γn-bit message is encoded into a code of dimension k<γn. If the set of possible w values is small, you could in principle map them into a k-dimensional subspace, but that would change the message space and require a proper entropy analysis for the secrecy claim. The paper does neither. The perfect-secrecy argument in Theorem 5 is a brute-force count over missing codeword bits, which assumes the adversary has no prior information about w; that assumption is unjustified. There is also no instantiation, no parameter choice, no efficiency numbers, so even if the code-theoretic issue were fixed, the practical relevance is undemonstrated.\n\nOverall: the paper is readable and the high-level idea is appealing, but as submitted it proves a theorem that is false under its own assumptions. I would not accept it in this form. I would still send it to a referee rather than desk-reject, because the flaw is specific and the construction is likely salvageable with a proper systematic code that adds redundancy, or by treating the point encodings as a small source. The authors deserve a chance to repair it.","headline":"The idea is fresh but the main theorem is impossible as stated: no binary code can encode a γn-bit message and correct erasures with no redundancy.","tokens_in":13682,"tokens_out":3477,"would_cite":false,"duration_ms":32365,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A62","94B35","14G50","11T71"],"pacs":[],"model":"deepseek-v4-flash","headline":"A threshold scheme that treats missing shares as erasures in a binary code, with the SIDH attack as the recovery engine, claims to share an isogeny path among n participants with threshold t.","keywords":["secret sharing","threshold scheme","isogeny path problem","SIDH attack","error-correcting codes","erasure correction","supersingular elliptic curves","post-quantum cryptography"],"falsifier":"Take any instance with n > t and compute the parameters in Theorem 4: w is a gamma n-bit string and c is a codeword of length gamma n, so the code has length ell = gamma n and must encode a message of length gamma n, forcing dimension k = gamma n and minimum distance d <= 1; a code with d <= 1 cannot correct a single erasure, contradicting the required gamma(n-t) > 0 erasure-correction capacity.","tokens_in":12607,"feed_emoji":"🔐","tokens_out":6436,"duration_ms":52706,"temperature":0.7,"pith_summary":"The paper aims to establish the first threshold secret-sharing scheme for isogeny paths that uses the 2022 SIDH key-recovery attack as a constructive tool. The proposal encodes the images of a torsion point under the secret isogeny as a bitstring, distributes the bits in gamma-bit blocks to n participants, and treats missing blocks as erasures when t participants gather. Erasure correction recovers the encoded points, and a polynomial-time isogeny-recovery algorithm then reconstructs the secret path. If the construction works, it would give a post-quantum threshold scheme whose security rests on the isogeny path problem rather than on the broken SIDH key-exchange instance.","feed_headline":"SIDH attack repurposed to share isogeny path secrets","feed_subtitle":"Any t of n participants recover a secret isogeny path by letting the code fill in missing shares as erasures.","key_machinery":"The load-bearing machinery is an erasure-correcting binary code C of length ell = gamma n together with the algorithmic pipeline that turns the SIDH attack into reconstruction: Robert's polynomial-time solution of the Supersingular Isogeny with Torsion problem, reached through the reduction of the one-torsion-point variant (SI-OTP) given by De Feo, Fouotsa, and Panny. The code's erasure-correction capacity matches exactly the number of missing gamma-bit blocks when t of n participants are present, and the encoding and decoding functions SESS and its inverse connect elliptic-curve points to the bit strings the code operates on.","core_discovery":"The paper's central claim, stated as Theorem 4, is that a binary code C able to correct gamma(n-t) erasures lets one share a secret isogeny I:E0->E1 among n participants with threshold t. The dealer encodes the encoding of the start torsion point P and its image P'=I(P), concatenates them into a gamma n-bit word w, and encodes w into a codeword c of C; participant i receives the gamma-bit block y_i along with its index. Reconstruction fills the t known blocks into the codeword, treats the remaining n-t blocks as erasures, and decodes. The paper further claims, in Theorem 5, that under NIST security level I the scheme is a perfect threshold scheme whenever k/gamma <= t <= n - 128/gamma + 1, with the lower bound coming from the Singleton bound and the upper bound from a brute-force attack by t-1 participants.","pith_inferences":["The proof of Theorem 4 appears to encode a gamma n-bit message into a codeword of the same length gamma n; if that is literal, the Singleton bound forces dimension k = gamma n and minimum distance d <= 1, so the code cannot correct any erasure. A workable version would need the message length to be strictly less than gamma n, with the extra length providing redundancy.","The template generalizes: any secret that can be recovered from a pair of auxiliary values via a known polynomial-time attack could in principle be thresholdized by erasure-coding those auxiliary values.","One testable extension is to replace the rate-1 encoding with a systematic [gamma n, k, d] code and set the message length to k; the threshold bounds would then shift, and one could measure the resulting share size against existing isogeny threshold schemes."],"forward_implications":["If Theorem 4 holds, any isogeny path can be shared among n parties with reconstruction by any t of them, using only the torsion-point images as auxiliary data.","The NIST Level I bound gives a concrete recipe for choosing gamma and the code dimension k so that t-1 colluding participants face at least 2^128 guesses.","The hyperoval subfield-code corollary gives explicit parameter ranges, such as t between 2/gamma or 3/gamma and (2^r - 126)/gamma + 1.","The binary-representation Reed-Solomon variant handles burst erasures, with each gamma-bit burst affecting at most two RS symbols when r > gamma - 2.","The construction would be the first isogeny threshold scheme that exploits the SIDH attack as a cryptographic tool rather than treating it only as a break."],"supporting_citations":[{"why":"Castryck-Decru key-recovery attack on SIDH, the event the paper repurposes as a constructive tool.","marker":"[8]"},{"why":"Robert's polynomial-time algorithm for SI-TP, used as the final reconstruction step.","marker":"[34]"},{"why":"De Feo-Fouotsa-Panny reduction from the one-torsion-point problem to SI-TP, used to recover the isogeny from a single point image.","marker":"[18]"},{"why":"MacWilliams-Sloane textbook supplying the Singleton bound, erasure-correction capacity, and Reed-Solomon code facts used in the theorems and corollaries.","marker":"[29]"},{"why":"Tibouchi's Elligator Squared encoding, part of the SESS family that maps elliptic-curve points to bitstrings.","marker":"[37]"},{"why":"Bernstein-Hamburg-Krasnova-Lange Elligator encoding, another SESS component for point-to-bitstring representation.","marker":"[2]"},{"why":"Heng-Ding construction of subfield codes of MDS codes, used for the hyperoval-code corollary.","marker":"[22]"},{"why":"Heng-Ding result that subfield codes of hyperoval codes are distance-optimal, motivating the code choice in Corollary 1.","marker":"[21]"}],"fun_headline_variants":["Repurposed SIDH attack shares isogeny paths","Erasure codes plug missing shares in isogeny scheme","t-of-n isogeny secret sharing with code repair","From SIDH break to isogeny threshold scheme"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The scheme assumes that a binary code of length gamma n can encode the full gamma n-bit message w into a codeword of the same length while still correcting gamma(n-t) erasures; the Singleton bound makes this impossible unless the message is shorter than the codeword.","fun_headline_variants_meta":{"raw":{"variants":["Repurposed SIDH attack shares isogeny paths","Erasure codes plug missing shares in isogeny scheme","t-of-n isogeny secret sharing with code repair","From SIDH break to isogeny threshold scheme"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000442,"raw_usage":{"total_tokens":2185,"prompt_tokens":835,"completion_tokens":1350,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":451,"completion_tokens_details":{"reasoning_tokens":1281}},"tokens_in":451,"tokens_out":1350,"duration_ms":11360,"temperature":1.0,"reasoning_tokens":1281,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T10:50:36.892171+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take any instance with n > t and compute the parameters in Theorem 4: w is a gamma n-bit string and c is a codeword of length gamma n, so the code has length ell = gamma n and must encode a message of length gamma n, forcing dimension k = gamma n and minimum distance d <= 1; a code with d <= 1 cannot correct a single erasure, contradicting the required gamma(n-t) > 0 erasure-correction capacity.","supporting_citations":[{"cited_title":"Breaking SIDH in polynomial time","cited_arxiv_id":null,"evidence_quote":"Robert's polynomial-time algorithm for SI-TP, used as the final reconstruction step."},{"cited_title":"De Feo, T.B","cited_arxiv_id":null,"evidence_quote":"De Feo-Fouotsa-Panny reduction from the one-torsion-point problem to SI-TP, used to recover the isogeny from a single point image."},{"cited_title":"MacWilliams and N","cited_arxiv_id":null,"evidence_quote":"MacWilliams-Sloane textbook supplying the Singleton bound, erasure-correction capacity, and Reed-Solomon code facts used in the theorems and corollaries."},{"cited_title":"Tibouchi.: Elligator squared: uniform points on ell iptic curves of prime order as uniform random strings","cited_arxiv_id":null,"evidence_quote":"Tibouchi's Elligator Squared encoding, part of the SESS family that maps elliptic-curve points to bitstrings."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Bernstein-Hamburg-Krasnova-Lange Elligator encoding, another SESS component for point-to-bitstring representation."},{"cited_title":"Heng and C","cited_arxiv_id":null,"evidence_quote":"Heng-Ding construction of subfield codes of MDS codes, used for the hyperoval-code corollary."},{"cited_title":"Heng and C","cited_arxiv_id":null,"evidence_quote":"Heng-Ding result that subfield codes of hyperoval codes are distance-optimal, motivating the code choice in Corollary 1."}],"review_version":1}