{"id":"c2d4f192-9042-412b-8f66-51a15725ea15","arxiv_id":"2507.14893","paper_version":3,"verdict":"REJECT","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"The paper describes CSI-SDVS, a compact isogeny-based strong designated verifier signature scheme, but its security reductions are invalid.","lead":"A compact isogeny-based signature scheme that lets a signer address a message to one specific verifier is presented. The scheme is small, but the security proofs contain serious gaps, so the claimed guarantees are not established.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"SUF-CMA proof is not a reduction: the simulator samples both secret keys, so its extracted [s_i+v_i]E0 is computed from known exponents rather than solving an external parallelization challenge. The central security theorem is therefore unsupported.","rationale":"Good-faith reading: the construction is a reasonable isogeny-based designated-verifier analogue of a Schnorr-style signature, and the NT argument is essentially correct: real and simulated signatures have the same uniform distribution of z and the same uniform distribution of the hashed curves. The PSI section is more of an intuitive claim than a formal reduction, but the dominant question is unforgeability. The paper's abstract and conclusion promise SUF-CMA, and Theorem 5.1 is the only proof offered. That proof is internally inconsistent: it claims an external-challenge reduction and then samples the secrets, so it cannot be a reduction to MT-GAIP or parallelization. The reader's weakest_assumption identifies exactly this circularity. I agree with that diagnosis. The appropriate verdict remains REJECT: the main security guarantee is unsupported, and no amount of efficiency or compactness compensates for an invalid reduction. I would not manufacture an additional objection; the provided proof, not the construction itself, is the blocker.","tokens_in":15089,"tokens_out":10068,"duration_ms":118791,"concrete_test":"Repair attempt: re-derive Theorem 5.1 as a genuine reduction by giving the simulator only an external parallelization challenge (E0, {E_i=[s_i]E0}, {\\hat E_i=[v_i]E0}) and deleting the two secret-sampling steps in the Setup of the proof. Then answer one OSign query on message m: the simulator must output (h,z) with h=H([v_i+z_i]E_i || m), but computing [v_i+z_i]E_i requires v_i (or s_i). The proof gives no method to compute this value from the public challenge, so the simulation is undefined. If, after this check, no alternative simulation is supplied, Theorem 5.1 cannot be accepted as a valid reduction.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The single load-bearing defect is in the proof of Theorem 5.1 (SUF-CMA). The proof announces that the simulator S receives the signer and verifier public keys from a challenger and simulates all oracles 'without ever accessing the corresponding secret keys,' but the Setup then has S sample s_i and v_i itself and form E_i=[s_i]E0, \\hat E_i=[v_i]E0. Every later oracle response is computed using these known exponents, and the final extraction [−z*_i]Y*_i = [s_i+v_i]E0 is simply an arithmetic recomputation from S's own randomness. That does not constitute a solution to an externally posed parallelization instance. A genuine reduction would give S only (E0,{E_i},{\\hat E_i}) and require it to answer OSign/OSimul without s_i or v_i. The OSign routine as written needs v_i to compute Y_i=[v_i]\\bar E_i; the OSimul routine needs skV; no alternative simulation is provided anywhere in the proof. Hence the reduction is circular and the SUF-CMA theorem is unproven. This is the load-bearing result for the paper's central claim: without it, the scheme has no supported unforgeability guarantee.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript presents CSI-SDVS, a strong designated verifier signature scheme based on the CSIDH/CSI-FiSh group action on supersingular elliptic curves. It defines the scheme, gives an efficiency analysis, and claims SUF-CMA, non-transferability, and privacy of signer's identity in the random oracle model under the MT-GAIP assumption. The main technical content is the security analysis in Section 5, especially the SUF-CMA proof of Theorem 5.1.","tokens_in":15329,"tokens_out":9617,"duration_ms":101761,"significance":"The construction is compact and the paper is clearly organized. If the security proofs were correct, the scheme would be a noteworthy post-quantum SDVS and, as claimed, the only isogeny-based one. The efficiency comparison to lattice-based schemes is plausible. However, the central SUF-CMA proof is not a valid reduction, and the PSI proof is only a sketch; the main advertised guarantees are therefore not established. No implementation or machine-checked proofs are provided.","major_comments":[{"comment":"The proof of Theorem 5.1 is not a reduction to any external hard problem. In the Setup step the simulator S samples the exponents s_i and v_i itself and constructs E_i=[s_i]E0 and \\hat E_i=[v_i]E0, so the extracted value [s_i+v_i]E0, obtained as [-z*_i]Y*_i, is computed from S's own randomness. No parallelization or MT-GAIP instance is embedded. Moreover, the OSign oracle samples a fresh v_i for each signing query, so the returned signature is not valid under the real Verify algorithm (which uses the fixed verifier exponent v_i^real), and OVerify checks a private hash-list condition rather than running Verify. The simulation is therefore not faithful to the SUF-CMA experiment, and the claimed extraction does not solve a hard problem. Theorem 5.1 is unproven.","section":"5, Theorem 5.1"},{"comment":"The proof of Theorem 5.3 does not construct a reduction from MT-GAIP. It asserts that 'according to the definition of MT-GAIP ... it is evident' that the adversary cannot compute the curves Y_i^{(j)} without skV, but it never explains how a PSI adversary with non-negligible distinguishing advantage is converted into an algorithm solving Problem 2.7. The proof also does not specify how the random oracle H is simulated or how hash queries are answered, even though the challenge signature contains a hash value. The claim that distinguishing requires recovering [s_i^{(b)}+v_i]E0 is asserted rather than derived. The theorem is therefore unsupported.","section":"5, Theorem 5.3"},{"comment":"The theorem statement of Theorem 5.1 invokes MT-GAIP, but the proof concludes by claiming to solve 'the parallelization problem in the HHS model' (Section 2.4). These are different problems: Problem 2.7 is a multi-target group-action inverse problem, whereas parallelization asks, given x, y=g*x, and z, to compute g*z. No bridging lemma shows that a parallelization solver is equivalent to, or reduces from, an MT-GAIP solver. The cited tight reduction in [28] concerns GAIP, not the parallelization problem. Thus the security theorem is not connected to the stated hardness assumption.","section":"2.4 and 5, Theorem 5.1"}],"minor_comments":[{"comment":"The SUF-CMA experiment in Definition 2.2 and Figure 1 does not give the adversary access to the random oracle, but the proof of Theorem 5.1 introduces a hashing oracle OH; the game should be specified with explicit random-oracle access.","section":"2.2, Figure 1"},{"comment":"In the proof of Theorem 5.1, OSign reuses the symbol v_i for a freshly sampled exponent, the same symbol as the verifier's secret key from Setup; this obscures the fact that the oracle does not use the real verifier key.","section":"5, Theorem 5.1"},{"comment":"There are typographical and grammatical issues, e.g., 'Checck' in the proof of Theorem 5.3 and the verification-oracle condition 'check if [z_i]E_i = \\bar E_i or for all i' in Theorem 5.1, which should read 'for all i check [z_i]E_i = \\bar E_i'.","section":"5, Theorems 5.1 and 5.3"},{"comment":"Reference [11] is given as 'Process, P.S.: Third Round Candidate Announcement' and lacks the actual authors and context; please correct the citation.","section":"References"}],"recommendation":"reject","confidential_remarks":"The paper's main theorem is unproven because the SUF-CMA reduction is circular: the simulator knows the secrets it later 'extracts'. This is a load-bearing error that cannot be repaired by local edits, since Theorem 5.1 would need a genuinely new proof technique that embeds an external challenge and simulates valid signatures. The PSI proof is also only a sketch, and the assumption mismatch between MT-GAIP and parallelization further weakens the security claims. I recommend rejection, although the construction itself might be salvageable in a future revision with a correct security proof."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Read 2507.14893. The construction is what it says: CSI-FiSh plus the standard Schnorr-style SDVS template, so the design is compact and easy to follow. The NT proof (Theorem 5.2) is essentially correct—real and simulated signatures are identically distributed because the b_i and r_i masks are uniform. That part deserves credit.\n\nThe soft spot is Theorem 5.1, and it is load-bearing. The SUF-CMA reduction is not a reduction. In the Setup, the simulator samples the signer's s_i and the verifier's v_i itself, computes E_i and \\hat E_i, and then uses those exponents to answer every oracle. When the forgery arrives, the extraction [−z*_i]Y*_i = [s_i+v_i]E0 is just arithmetic on its own randomness; nothing external is solved. The proof never embeds a parallelization instance. Also, the simulated signing oracle produces Y_i = [v_i][z_i]E_i with a freshly sampled v_i, which is not consistent with the fixed verifier secret key that real verification uses; the verification oracle in the proof checks a different condition than the real Verify. So the claimed SUF-CMA guarantee is unsupported. The PSI proof is hand-waving in the same style: it asserts that without skV the adversary cannot compute the Y_i, but it never formalizes a reduction to MT-GAIP, and the adversary has both signer secret keys, so the argument is incomplete.\n\nThe scheme is simple, and the NT side is fine, but the central security theorem fails. Without SUF-CMA, the paper's main claim is unsupported. That is not a minor gap; it is the difference between a security proof and a security sketch with a circular step. The paper does not deserve a serious referee in this form, though it might be worth revisiting if the authors produce a genuine reduction.","headline":"Straightforward CSI-FiSh + Schnorr-style SDVS with a broken SUF-CMA proof; the construction is clean but the central security theorem is unsupported.","tokens_in":15837,"tokens_out":2728,"would_cite":false,"duration_ms":28785,"reading_group":"no","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper constructs CSI-SDVS, a strong designated verifier signature scheme from isogeny class-group actions, and claims post-quantum security with compact keys and signatures.","keywords":["Strong Designated Verifier Signatures","Post-quantum Cryptography","Isogeny-based Cryptography","CSIDH","CSI-FiSh","MT-GAIP","Supersingular elliptic curves","Class group action"],"falsifier":"Run the proof's SUF-CMA simulator against the real scheme at a small parameter size and feed a signing-oracle transcript $(h,z)$ into the true Verify algorithm; the transcript is accepted by the simulated oracle only because the simulator programmed the hash entry, so a rejection by the real Verify (or a need to program hashes after the fact to force acceptance) would show the simulated experiment differs from the real one and would falsify the claimed reduction. A second direct check is to compare real and simulated signature transcripts on the same message and look for any statistical difference in $(z, h)$.","tokens_in":14875,"feed_emoji":"🔐","tokens_out":14207,"duration_ms":149910,"temperature":0.7,"pith_summary":"Ordinary digital signatures let anyone check authenticity, but privacy-sensitive applications such as e-voting, digital cash, and confidential documents need signatures that only one designated verifier can validate, and that cannot be reused as proof by a third party. The paper introduces CSI-SDVS, a strong designated verifier signature scheme built from the action of the ideal class group on $\\mathbb{F}_p$-isomorphism classes of supersingular elliptic curves, in the CSIDH/CSI-FiSh setting, and argues that it is the only isogeny-based post-quantum SDVS construction. It claims Strong Unforgeability under Chosen-Message Attacks, Non-Transferability, and Privacy of Signer's Identity in the random oracle model, under the hardness of the Multi-Target Group Action Inverse Problem. If the scheme is sound, designated verifier signatures become available with keys and signatures of size $O(\\lambda)$ bits, substantially smaller than the lattice-based SDVS schemes surveyed in the paper, giving quantum-resistant private authentication without factoring or discrete-logarithm assumptions.","feed_headline":"Isogenies shrink post-quantum designated-verifier signatures","feed_subtitle":"The CSIDH-based design keeps keys and signatures at O(λ) bits and hides the signer's identity.","key_machinery":"The central object is the free and transitive group action of the ideal class group $\\mathrm{Cl}(\\mathcal{O})$ on the set $\\mathrm{Ell}_p(\\mathcal{O})$ of $\\mathbb{F}_p$-isomorphism classes of supersingular elliptic curves whose $\\mathbb{F}_p$-rational endomorphism ring is $\\mathcal{O}$, with the class group represented cyclically as exponents in $\\mathbb{Z}_N$ through a fixed generator $g$. The identity that carries the scheme is $[v_i][b_i - s_i]E_i = [b_i]\\hat E_i$ whenever $E_i = [s_i]E_0$ and $\\hat E_i = [v_i]E_0$; both real signing and verifier-side simulation reduce to this curve-shifting equality, and the hash of the recovered curve tuple is the challenge. The declared hardness engine is the Multi-Target Group Action Inverse Problem, backed by the parallelization problem of hard homogeneous spaces, and the proof strategy is to show that a forgery or a signer-identification break would let an adversary solve one of these isogeny problems.","core_discovery":"On its own terms, the paper's discovery is that a CSIDH-style shifting trick can serve as a strong designated verifier signature. A base supersingular curve $E_0$ is fixed; the signer's public key is a list of curves $E_i = [s_i]E_0$ and the verifier's public key is $\\hat E_i = [v_i]E_0$, where the secret exponents $s_i, v_i$ are sampled from $\\mathbb{Z}_N$ and $[a]$ denotes the class-group element $g^a$ acting on curves. To sign $m$, the signer samples fresh $b_i$, computes $Y_i = [b_i]\\hat E_i$, forms the hash $h = H(Y_1\\|\\cdots\\|Y_\\eta\\|m)$, and outputs $(h, z_i = b_i - s_i \\bmod N)$. The verifier recomputes $Y_i' = [v_i + z_i]E_i$, and the identity $[v_i + b_i - s_i][s_i]E_0 = [b_i][v_i]E_0$ makes the real and simulated transcripts agree. The paper asserts that this compact scheme is strongly unforgeable, non-transferable, and signer-anonymous in the random oracle model, and that no other isogeny-based SDVS construction currently offers post-quantum security.","pith_inferences":["Editorial inference: the same offset-signing identity works for any hard homogeneous space with a known-order cyclic group, so the pattern is a general template for SDVS from commutative group actions, not a CSIDH-specific trick.","Editorial inference: since both the signer and the verifier can generate identically distributed transcripts, the scheme is effectively a two-party proof that one of the two secret exponents is known; this points toward a generic proof-of-knowledge formulation of SDVS security rather than assumption-specific reductions.","Editorial inference: the scheme's compactness claim depends on the CSI-FiSh precomputation of the class group structure for CSIDH-512; any future parameter set would need the same precomputation or the sizes and sampling costs would change."],"forward_implications":["If CSI-SDVS is secure, designated-verifier signatures can be realized from isogeny group actions with key and signature sizes of $O(\\lambda)$ bits, in contrast to the $\\lambda^2$-scale sizes of the lattice-based SDVS constructions surveyed in the paper.","Privacy-sensitive applications such as e-voting and digital cash would gain a quantum-resistant signing primitive whose verification is restricted to one party and whose transcripts cannot be transferred as proof.","The non-transferability property means the designated verifier can simulate any message's signature, so a signature transcript is never decisive evidence about who authored it.","If the MT-GAIP assumption holds, an observer holding both candidate signers' public keys cannot tell which signer produced a given signature without the verifier's secret key.","The scheme would fill the gap left by the earlier isogeny-based SDVS construction built on SIDH, which was broken by the SIDH key-recovery attacks."],"supporting_citations":[{"why":"It defines MT-GAIP and the cyclic class-group representation used for keys, sampling, and the PSI reduction.","marker":"[24]"},{"why":"It supplies the CSIDH group action and the CSIDH-512 parameter setting that the scheme instantiates.","marker":"[23]"},{"why":"It introduces hard homogeneous spaces and the parallelization problem invoked in the SUF-CMA extraction argument.","marker":"[27]"},{"why":"It gives the tight reduction from MT-GAIP to GAIP in known-class-group settings that the paper relies on for its hardness claim.","marker":"[28]"},{"why":"It provides the SDVS syntax and security model adopted, and is the earlier isogeny SDVS scheme the paper replaces.","marker":"[18]"},{"why":"It introduces designated verifier signatures and non-transferability, the privacy goal the construction must meet.","marker":"[1]"},{"why":"It formalizes SDVS and the Privacy of Signer's Identity notion used in the security model.","marker":"[3]"}],"fun_headline_variants":["Isogeny-based designated-verifier signatures go post-quantum","Compact SDVS from isogenies resists quantum attacks","CSIDH gives a compact post-quantum designated-verifier signature","New isogeny scheme makes designated-verifier signatures quantum-safe"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The proof of strong unforgeability depends on the assumption that a simulator can embed an external puzzle about finding the secret isogeny step between two public curves into the public keys and still answer all signing and verification queries; in the proof the simulator instead chooses all the secret exponents itself, and the transcripts it produces through the signing oracle would not pass the real verification algorithm, so that load-bearing embedding is never actually supplied.","fun_headline_variants_meta":{"raw":{"variants":["Isogeny-based designated-verifier signatures go post-quantum","Compact SDVS from isogenies resists quantum attacks","CSIDH gives a compact post-quantum designated-verifier signature","New isogeny scheme makes designated-verifier signatures quantum-safe"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000475,"raw_usage":{"total_tokens":2437,"prompt_tokens":1107,"completion_tokens":1330,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":723,"completion_tokens_details":{"reasoning_tokens":1254}},"tokens_in":723,"tokens_out":1330,"duration_ms":12454,"temperature":1.0,"reasoning_tokens":1254,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T15:45:11.691323+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the proof's SUF-CMA simulator against the real scheme at a small parameter size and feed a signing-oracle transcript $(h,z)$ into the true Verify algorithm; the transcript is accepted by the simulated oracle only because the simulator programmed the hash entry, so a rejection by the real Verify (or a need to program hashes after the fact to force acceptance) would show the simulated experiment differs from the real one and would falsify the claimed reduction. A second direct check is to compare real and simulated signature transcripts on the same message and look for any statistical difference in $(z, h)$.","supporting_citations":[{"cited_title":"International conference on the theory and application of cryptology and information security, pp","cited_arxiv_id":null,"evidence_quote":"It defines MT-GAIP and the cyclic class-group representation used for keys, sampling, and the PSI reduction."},{"cited_title":"Advances in Cryptology–ASIACRYPT 2018, pp","cited_arxiv_id":null,"evidence_quote":"It supplies the CSIDH group action and the CSIDH-512 parameter setting that the scheme instantiates."},{"cited_title":"M.: Hard Homogeneous Spaces","cited_arxiv_id":null,"evidence_quote":"It introduces hard homogeneous spaces and the parallelization problem invoked in the SUF-CMA extraction argument."},{"cited_title":"D.: SeaSign: compact isogeny signatures from class group actions","cited_arxiv_id":null,"evidence_quote":"It gives the tight reduction from MT-GAIP to GAIP in known-class-group settings that the paper relies on for its hardness claim."},{"cited_title":"Fourth International Conference on Intelligent Networking and Collaborative Systems, pp","cited_arxiv_id":null,"evidence_quote":"It provides the SDVS syntax and security model adopted, and is the earlier isogeny SDVS scheme the paper replaces."},{"cited_title":"International Conference on the Theory and Applications of Cryptographic Techniques, pp","cited_arxiv_id":null,"evidence_quote":"It introduces designated verifier signatures and non-transferability, the privacy goal the construction must meet."},{"cited_title":"International Conference on Security in Communication Networks, pp","cited_arxiv_id":null,"evidence_quote":"It formalizes SDVS and the Privacy of Signer's Identity notion used in the security model."}],"review_version":1}