REVIEW 3 major objections 4 minor 24 references
Undeniable signatures based on isogenies of supersingular hyperelliptic curves
T0 review · 3 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash
Pith's one-line read Undeniable signatures can be built on supersingular genus-2 hyperelliptic curves using Richelot isogenies
desk verdict The paper's hash-to-kernel signing step breaks the construction in genus 2; the rest is a promising but unproven sketch. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing objects are Richelot isogenies: (2,2)-isogenies between jacobians of genus-2 curves, whose kernel is a maximal isotropic subgroup with respect to the 2-Weil pairing. The paper builds every step of key generation, signing, confirmation and denial from such kernels, using the $G_2$-invariants $G=(g_1,g_2,g_3)$ of Igusa invariants as the public isomorphism-class data in place of the elliptic $j$-invariant. The mechanism that carries the security argument is the commuting-square structure $J_{AM}$ reached both through $K_A$ then $K_M$ and through $K_M$ then $K_A$; the protocols exploit this symmetry by having the verifier randomize between two checks, forcing a prover to exhibit either the secret kernel or compatibility of the isogeny chains on the auxiliary torsion points.
What would settle it
Run the invisibility game at the smallest proposed parameters: generate many real and fake challenge surfaces and attempt to distinguish them using only the public $G_2$-invariants and the auxiliary point images. A distinguisher that succeeds with non-negligible advantage would refute the paper's invisibility claim; repeated failure under exhaustive search would support the claim.
Extended reading notes
Core claim
On the paper's own terms, the central discovery is a template for an undeniable signature scheme in the genus-2 isogeny setting. A signer's private key is a tuple of scalars defining a maximal isotropic kernel $K_A$ on the torsion $J_H[l_A^{e_A}]$ of a supersingular genus-2 jacobian; the public key is the $G_2$-invariants of the quotient $J_A$ plus the images of the other torsion bases. A signature on a message is computed by walking the Richelot isogeny graph through the message-dependent kernel $K_M$, producing a surface $J_{AM}$ and a list of images of the auxiliary points. Confirmation and denial protocols (CON and DIS) use a third torsion basis $l_C^{e_C}$ to prove in zero knowledge whether the signed surface matches the public one. The paper's security section states that the genus-1 security analysis extends easily, so the eight listed isogeny problems (decisional, computational, Diffie-Hellman, and modified one-sided versions) underlie the claimed unforgeability and invisibility, and that the CON/DIS protocols inherit completeness, soundness and zero-knowledge after adapting the arguments of [16].
Load-bearing premise
The whole security argument rests on one premise: that a proof which works for the elliptic-curve version of the scheme still works when the curves are replaced by genus-2 jacobians and the isogenies by their genus-2 analogue; if that transfer fails, the claimed guarantees could fail.
Editorial extensions
If this is right
- If the security adaptation is valid, the scheme gives a post-quantum undeniable signature in genus 2 whose verification can be selectively enabled or denied by the signer.
- The denser genus-2 isogeny graph may support comparable security with fewer isogeny computations, as the paper states.
- The paper's eight isogeny problems become explicit targets: any efficient solver for a member of the Diffie-Hellman family would break unforgeability or invisibility of the scheme.
- The CON and DIS protocols are designed so the verifier's random challenge forces a cheating prover to fail, assuming the branch-point exceptional case is negligible, with both claims carried over from the genus-1 proofs.
Reading between the lines
- The author leaves implicit that the same kernel-commuting template might apply to other genus-1 isogeny primitives, such as key exchange or oblivious transfer; this paper only instantiates undeniable signatures.
- Because the public key uses G2-invariants, one could test the invisibility claim experimentally at small parameters: sample real and fake challenges and attempt to distinguish them with invariant statistics; the paper does not report such tests.
- The DIS completeness argument depends on the jacobian not being a branch point in the modular-curve covering; a concrete quantitative estimate of how small that probability is for the proposed parameters would turn a plausibility claim into a checkable bound.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes an undeniable signature scheme for genus-2 supersingular hyperelliptic curves, following the structure of Jao-Soukharev's genus-1 scheme. It defines setup, key generation, a signing procedure using isogenies between jacobians, and confirmation/disavowal protocols. Security is stated through nine new computational problems and by claiming that the security analysis of the genus-1 problems and the proofs of [16] extend to the genus-2 setting. The manuscript contains no complete security proof and no implementation.
Significance. If completed and proven, a secure genus-2 isogeny-based undeniable signature scheme would be a meaningful contribution to post-quantum cryptography, since most isogeny-based constructions are elliptic-curve based and the genus-2 setting offers a richer isogeny graph. The paper is honest about the assumptions it makes, and the list of problems is a useful starting point. However, the contribution as written is a proposal rather than a proven construction: the central signing step is not well-defined for generic messages, and the security properties are deferred to [16] rather than demonstrated. No machine-checked proofs or reproducible code accompany the paper.
major comments (3)
- [Section 3.3, Eq. (3)] The kernel K_M is defined as the subgroup generated by three linear combinations of the M_i. For the quotient J_H/K_M to be a principally polarized abelian surface via an (l_M^{e_M}, l_M^{e_M})-isogeny, K_M must be a maximal isotropic subgroup of J_H[l_M^{e_M}], which in genus 2 has order l_M^{2e_M} and is generated by two elements with trivial Weil pairing. Three arbitrary generators span a subgroup of order up to l_M^{3e_M}, and for l=3, e=1 the fraction of hash outputs (h_1,...,h_12) for which the three vectors lie in and generate a Lagrangian subspace is only 40*624/3^12, about 4.7%. Thus for most messages the signing algorithm produces no valid isogeny phi_M. The remark in Section 4.1 that scalars must satisfy 'certain conditions that guarantee maximality and isotropicity' is not implemented in Eq. (3), and no such condition is imposed on the hash function. This is a well-definedness failure of the scheme, not merely a missing proof.
- [Section 4.1] The claims that CON and DIS are complete, sound, and zero-knowledge, and that the scheme is unforgeable and invisible, are all made by saying that the reasonings of [16] can be used 'after adapting the methods for our genus-2 context'. No adapted proof is given. The genus-2 setting differs in the structure of torsion subgroups, the Weil pairing, the definition of the kernel subgroups, and the isogeny graph; the transfer from [16] is therefore not immediate. Since these properties are the central security claim of the paper, the manuscript needs either complete proofs or precise reductions to Problems 1-9.
- [Section 4.1, DIS completeness] The assertion that the probability of J_AM being a branch point of the modular curve X0(l_C^{e_C}) is 'negligible' is not quantified, and no probability space or parameter is specified. This probability statement is load-bearing for the completeness of DIS; it needs a precise statement and proof, or the protocol must be modified to avoid relying on it.
minor comments (4)
- [Abstract] The phrase 'based in supersingular hyperelliptic curves' should be 'based on supersingular hyperelliptic curves'.
- [Section 4, first paragraph] The prime form p = l_A^{e_A} l_M^{e_C} l_C^{e_C} f +/- 1 appears to contain a typo; from Section 3.1 one expects l_A^{e_A} l_M^{e_M} l_C^{e_C} f +/- 1.
- [Section 3.4, Eq. (7)] The notation 'K_M C' is ambiguous; using a single symbol such as K_{MC} = <phi_M(K_C)> would make the displayed isomorphisms easier to read.
- [Section 3.2 and 3.4] The procedure for choosing the scalars a_i and c_i is not self-contained; the paper should state the maximal-isotropy conditions explicitly rather than only referring to Section 3.2 of [8].
Circularity Check
No significant circularity: the scheme adapts external isogeny-based protocols, and the identified gaps are correctness issues rather than self-referential reductions.
full rationale
The paper is a construction proposal, not a derivation that re-labels its inputs as outputs. The signature kernel in Eq. (3) is defined from the message hash and is not fitted to, nor defined in terms of, the security properties it later claims; the fact that a random tuple may fail to generate a maximal isotropic subgroup is a well-definedness or correctness defect, not a circular reduction. Security claims in Section 4.1 explicitly borrow the reasoning of Jao-Soukharev [16] and Galbraith-Vercauteren [10], which are external sources; the statement that these reasonings can be adapted to genus 2 is an unproved analogy, but an unproved analogy is not circularity. The sole self-citation, [7], is mentioned as a source of techniques and no load-bearing theorem is imported from it; the concrete parameter choices are delegated to [8]. No fitted parameter is relabeled as a prediction, no uniqueness theorem from the authors' prior work is invoked, and no equation is shown to be equivalent to its own input by construction. Accordingly there is no significant circularity; the skepticism expressed in the reader's take is best classified as correctness risk.
Assumptions & free parameters
assumptions (5)
- domain assumption Every principally polarized abelian surface over F_p is isomorphic to the jacobian of a genus-2 curve or a product of elliptic curves (Theorem 1 from [8]).
- domain assumption Isogenies with maximal isotropic kernels preserve principal polarizations (Proposition 1 from [8]).
- domain assumption A supersingular hyperelliptic curve of genus 2 can be obtained as a double cover of a supersingular elliptic curve.
- ad hoc to paper The security analysis of the genus-1 isogeny problems extends to the genus-2 setting easily.
- ad hoc to paper The probability that J_AM equals a branch-point jacobian is negligible.
Cite this review
Pith. "Pith review of Undeniable signatures based on isogenies of supersingular hyperelliptic curves." pith.science (2026). https://pith.science/paper/HZGRYF2R
@misc{pith2026190807458,
author = {Pith},
title = {Pith review of: Undeniable signatures based on isogenies of supersingular hyperelliptic curves},
year = {2026},
howpublished = {\url{https://pith.science/paper/HZGRYF2R}},
note = {Machine review of arXiv:1908.07458}
}
read the original abstract
We present a proposal for an undeniable signature scheme based in supersingular hyperelliptic curves of genus 2.
Reference graph
Works this paper leans on
-
[16]
Jao, D., Soukharev, V.: Isogeny-Based Quantum-Resista nt Undeniable Signatures. In: Mosca M. (eds) Post-Quantum Cryptography. PQCrypto 201 4. Lecture Notes in Computer Science, vol 8772. Springer, Cham (2014)
work page 2014
-
[1]
Barreto, P., Oliveira, G., Benits, W.: Supersingular Iso geny Oblivious Transfer. arXiv:1805.06589v1 (2018)
arXiv 2018
-
[2]
Cardona, G., Quer, J.: Field of moduli and field of definitio n for curves of genus 2. arXiv:math/0207015v1 (2002)
arXiv 2002
-
[3]
arXiv:1903.06451v1 (201 9) Isogeny based undeniable signatures 9
Castryck, W., Decru, T., Smith, B.: Hash functions from su perspecial genus-2 curves using Richelot isogenies. arXiv:1903.06451v1 (201 9) Isogeny based undeniable signatures 9
arXiv 1903
-
[4]
Journal of Cryptology 22(1), 93–113 (2009)
Charles, D.X., Lauter, K.E., Goren, E.Z.: Cryptographic Hash Functions from Expander Graphs. Journal of Cryptology 22(1), 93–113 (2009)
2009
-
[5]
Journal of Mathematica l Cryptology 8(3): 209–247 (2015)
De Feo, L., Jao, D., Plˆ ut, J.: Towards quantum-resistantcryptosystems from super- singular elliptic curve isogenies. Journal of Mathematica l Cryptology 8(3): 209–247 (2015)
2015
-
[6]
Cryptology ePrint Archive: Report 2018/824 (2018 )
De Feo, L., Galbraith, S.D.: SeaSign: Compact isogeny sig natures from class group actions. Cryptology ePrint Archive: Report 2018/824 (2018 )
2018
-
[7]
Cryp- tology ePrint Archive: Report 2019/758 (2019)
Fern` andez-Val` encia, R.: Genus 2 Supersingular Isogen y Oblivious Transfer. Cryp- tology ePrint Archive: Report 2019/758 (2019)
work page 2019
Show all 24 references
-
[8]
Cryptolog y ePrint Archive: Report 2019/177 (2019)
Flynn, E.V., Bo Ti, Y.: Genus Two Cryptography. Cryptolog y ePrint Archive: Report 2019/177 (2019)
2019
-
[9]
Galbraith, S.D.: Mathematics of public key cryptography . 1st edn. Cambridge Uni- versity Press, United Kingdom (2012)
2012
-
[10]
Quantum Information Processing 17(10), 1–22 (2018)
Galbraith, S.D., Vercauteren, F.: Computational probl ems in supersingular elliptic curve isogenies. Quantum Information Processing 17(10), 1–22 (2018)
2018
-
[11]
Cam- bridge University Press, United Kingdom, United States of A merica (2004)
Goldreich, O.: Foundations of Cryptography: Volume 1, B asic Techniques. Cam- bridge University Press, United Kingdom, United States of A merica (2004)
2004
-
[12]
Goldreich, O.: Foundations of Cryptography: Volume 2, B asic Applications. 1st edn. Cambridge University Press, United States of America ( 2004)
2004
-
[13]
arXiv:math/0409352v1 (2004)
Gonzalez, J., Guardia, J., Rotger, V.: Abelian Surfaces of GL2-type as Jacobians of Curves. arXiv:math/0409352v1 (2004)
2004 arXiv
-
[14]
Hazay, C., Lindell, Y.: Efficient Secure Two-Party Protoc ols: Techniques and Con- structions. 1st edn. Springer-Verlag, Germany (2010)
2010
-
[15]
NCTT 2003 Proceedings, Shah Alam, Malaysia (2003)
Ibrahim, S., Kamat, M., Salleh, M., Aziz S.R.A.: Secure E -voting with blind sig- nature, 4th National Conference of Telecommunication Tech nology, 2003. NCTT 2003 Proceedings, Shah Alam, Malaysia (2003)
2003
-
[17]
STOC ’88 Proceedings of the twentieth annual ACM symposium on Theory of computing, 2 0–31 (1988)
Kilian, J.: Founding crytpography on oblivious transfe r. STOC ’88 Proceedings of the twentieth annual ACM symposium on Theory of computing, 2 0–31 (1988)
1988
-
[18]
In: Kwiecie´ n A., Gaj P., Stera P
Kucharczyk, M.: Blind Signatures in Electronic Voting S ystems. In: Kwiecie´ n A., Gaj P., Stera P. (eds) Computer Networks. CN 2010. Communica tions in Computer and Information Science, vol 79. Springer, Berlin, Heidelb erg (2010)
2010
-
[19]
Reprint edition
Lang, S.: Abelian Varieties. Reprint edition. Dover Pub lications, United States of America (2019)
2019
-
[20]
In: Cornell, G., Silver man, J.H
Milne, J.S.: Abelian Varieties. In: Cornell, G., Silver man, J.H. (eds.) Arithmetic Geometry. Springer-Verlag, United States of America (1986 )
1986
-
[21]
Bulletin de la S
Ogg, A.P.: Hyperelliptic modular curves. Bulletin de la S. M. F., 102, 449 – 462 (1974)
1974
-
[22]
Aarhus Universitet Preprint Series 38 (1973)
Oort, F., Ueno, K.: Principally Polarized Abelian Varia ties of Dimension Two or Three are Jacobian Varieties. Aarhus Universitet Preprint Series 38 (1973)
1973
-
[23]
JSIAM Letters 9, 29–32 (2017)
Tachibana, H., Takashima, K., Takagi, T.: Constructing an efficient hash function from 3-isogenies. JSIAM Letters 9, 29–32 (2017)
2017
-
[24]
In Takagi, T., Wakayama, M., Tanaka, K., Kunihiro, N., Ki- moto, K., Duong, D.H
Takashima, K.: Efficient Algorithms for Isogeny Sequence s and Their Crypto- graphic Applications. In Takagi, T., Wakayama, M., Tanaka, K., Kunihiro, N., Ki- moto, K., Duong, D.H. (eds.) Mathematical Modelling for Nex t-Generation Cryp- tography. Springer, Singapore (2018)
2018
Reviewed August 14, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.