Sharing the Path: A Threshold Scheme from Isogenies and Error Correcting Codes

M. Anwar Hasan; Mohamadou Sall

REVIEW 3 major objections 5 minor 42 references

Sharing the Path: A Threshold Scheme from Isogenies and Error Correcting Codes

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A threshold scheme that treats missing shares as erasures in a binary code, with the SIDH attack as the recovery engine, claims to share an isogeny path among n participants with threshold t.

desk verdict The idea is fresh but the main theorem is impossible as stated: no binary code can encode a γn-bit message and correct erasures with no redundancy. read the letter →

arxiv 2411.18844 v1 pith:VP5ISWCA submitted 2024-11-28 cs.CR cs.ITmath.IT

Mohamadou Sall , M. Anwar Hasan This is my paper · ORCID

classification cs.CRcs.ITmath.IT MSC 94A6294B3514G5011T71

keywords secretsharingthresholdschemeisogenypathproblemSIDHattackerror-correctingcodeserasurecorrectionsupersingularellipticcurvespost-quantumcryptography

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to establish the first threshold secret-sharing scheme for isogeny paths that uses the 2022 SIDH key-recovery attack as a constructive tool. The proposal encodes the images of a torsion point under the secret isogeny as a bitstring, distributes the bits in gamma-bit blocks to n participants, and treats missing blocks as erasures when t participants gather. Erasure correction recovers the encoded points, and a polynomial-time isogeny-recovery algorithm then reconstructs the secret path. If the construction works, it would give a post-quantum threshold scheme whose security rests on the isogeny path problem rather than on the broken SIDH key-exchange instance.

What carries the argument

The load-bearing machinery is an erasure-correcting binary code C of length ell = gamma n together with the algorithmic pipeline that turns the SIDH attack into reconstruction: Robert's polynomial-time solution of the Supersingular Isogeny with Torsion problem, reached through the reduction of the one-torsion-point variant (SI-OTP) given by De Feo, Fouotsa, and Panny. The code's erasure-correction capacity matches exactly the number of missing gamma-bit blocks when t of n participants are present, and the encoding and decoding functions SESS and its inverse connect elliptic-curve points to the bit strings the code operates on.

What would settle it

Take any instance with n > t and compute the parameters in Theorem 4: w is a gamma n-bit string and c is a codeword of length gamma n, so the code has length ell = gamma n and must encode a message of length gamma n, forcing dimension k = gamma n and minimum distance d <= 1; a code with d <= 1 cannot correct a single erasure, contradicting the required gamma(n-t) > 0 erasure-correction capacity.

Watch

Extended reading notes

Core claim

The paper's central claim, stated as Theorem 4, is that a binary code C able to correct gamma(n-t) erasures lets one share a secret isogeny I:E0->E1 among n participants with threshold t. The dealer encodes the encoding of the start torsion point P and its image P'=I(P), concatenates them into a gamma n-bit word w, and encodes w into a codeword c of C; participant i receives the gamma-bit block y_i along with its index. Reconstruction fills the t known blocks into the codeword, treats the remaining n-t blocks as erasures, and decodes. The paper further claims, in Theorem 5, that under NIST security level I the scheme is a perfect threshold scheme whenever k/gamma <= t <= n - 128/gamma + 1, with the lower bound coming from the Singleton bound and the upper bound from a brute-force attack by t-1 participants.

Load-bearing premise

The scheme assumes that a binary code of length gamma n can encode the full gamma n-bit message w into a codeword of the same length while still correcting gamma(n-t) erasures; the Singleton bound makes this impossible unless the message is shorter than the codeword.

Editorial extensions

If this is right

If Theorem 4 holds, any isogeny path can be shared among n parties with reconstruction by any t of them, using only the torsion-point images as auxiliary data.
The NIST Level I bound gives a concrete recipe for choosing gamma and the code dimension k so that t-1 colluding participants face at least 2^128 guesses.
The hyperoval subfield-code corollary gives explicit parameter ranges, such as t between 2/gamma or 3/gamma and (2^r - 126)/gamma + 1.
The binary-representation Reed-Solomon variant handles burst erasures, with each gamma-bit burst affecting at most two RS symbols when r > gamma - 2.
The construction would be the first isogeny threshold scheme that exploits the SIDH attack as a cryptographic tool rather than treating it only as a break.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The proof of Theorem 4 appears to encode a gamma n-bit message into a codeword of the same length gamma n; if that is literal, the Singleton bound forces dimension k = gamma n and minimum distance d <= 1, so the code cannot correct any erasure. A workable version would need the message length to be strictly less than gamma n, with the extra length providing redundancy.
The template generalizes: any secret that can be recovered from a pair of auxiliary values via a known polynomial-time attack could in principle be thresholdized by erasure-coding those auxiliary values.
One testable extension is to replace the rate-1 encoding with a systematic [gamma n, k, d] code and set the message length to k; the threshold bounds would then shift, and one could measure the resulting share size against existing isogeny threshold schemes.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Here's the thing you need to know: the central threshold construction in this paper cannot work as written. Theorem 4 asks for a binary code that encodes a γn-bit message into a γn-bit codeword while correcting γ(n−t) erasures. The Singleton bound, which the authors cite, forces the dimension to equal the length, so the code has distance 1 and corrects no erasures. There is no such code. This is not a minor gap; it's the load-bearing step.

What's actually new: the paper is, as far as I know, the first to deliberately use Robert's SIDH key-recovery algorithm as a constructive tool in a threshold scheme, and the idea of sharing images of torsion points is a genuinely different angle from existing isogeny threshold schemes like Sashimi or CSI-RAShi. The paper also does a decent job surveying isogeny attacks, encoding functions, and code-based secret sharing. The sections on Reed-Solomon subfield codes and burst erasures show the authors know their coding theory.

The soft spots are proportional. The main one is fatal. The proof of Theorem 4 never specifies how a γn-bit message is encoded into a code of dimension k<γn. If the set of possible w values is small, you could in principle map them into a k-dimensional subspace, but that would change the message space and require a proper entropy analysis for the secrecy claim. The paper does neither. The perfect-secrecy argument in Theorem 5 is a brute-force count over missing codeword bits, which assumes the adversary has no prior information about w; that assumption is unjustified. There is also no instantiation, no parameter choice, no efficiency numbers, so even if the code-theoretic issue were fixed, the practical relevance is undemonstrated.

Overall: the paper is readable and the high-level idea is appealing, but as submitted it proves a theorem that is false under its own assumptions. I would not accept it in this form. I would still send it to a referee rather than desk-reject, because the flaw is specific and the construction is likely salvageable with a proper systematic code that adds redundancy, or by treating the point encodings as a small source. The authors deserve a chance to repair it.

Referee Report

3 major / 5 minor

Summary. The paper proposes a threshold secret-sharing scheme for supersingular isogeny paths. The dealer encodes two torsion points P and P′ (auxiliary data for recovering the isogeny) into a bit string w = SP||SP′ of length γn, splits w into n blocks of γ bits, and distributes one block to each participant. Reconstruction works by treating the missing blocks from any t participants as erasures, using a binary error-correcting code C to recover w, then invoking the SIDH key-recovery machinery (Robert's algorithm together with the reduction of Feo, Fouotsa, and Panny) to compute the secret isogeny from the recovered points. The main theorems claim that any code C correcting γ(n−t) erasures yields a threshold-t scheme and that the scheme is perfect under the parameter bound k/γ ≤ t ≤ n−128/γ+1. Section 5 proposes instantiations from Reed-Solomon codes, subfield codes of hyperoval codes, and binary representations of RS codes with burst-erasure correction.

Significance. The high-level idea of turning the SIDH attack into a reconstruction tool for a shared isogeny path is conceptually interesting, and the paper correctly emphasizes the distinction between the broken SI-TP problem and the still-hard isogeny path problem. If the construction worked, it would be a novel combination of isogeny-based cryptography, point encodings, and coding-theoretic secret sharing. However, the central encoding/erasure-correction premise is infeasible as stated: the proof of Theorem 4 requires encoding a γn-bit message into a binary codeword of length γn while the same code is supposed to correct γ(n−t) erasures, which the Singleton bound forbids. The security proof of Theorem 5 also conflates brute-force work with perfect secrecy. The paper ships no implementation or machine-checked proof, and the main technical claims are not salvageable by local edits within the current framework.

major comments (3)

[§3, Theorem 4 and Procedure 1] The proof sets w = SP||SP′ to be a word of length γn and encodes it as a codeword c = (c_1, ..., c_n) of length γn, so that the n participants collectively receive all γn bits. For this encoding to be injective on the whole space {0,1}^{γn}, the binary code C must have dimension k = γn; the Singleton bound then gives minimum distance d ≤ 1, so C cannot correct any erasure. This contradicts the theorem's assumption that C corrects γ(n−t) erasures for t<n and also contradicts the bound t ≥ k/γ in Theorem 5, which together with t<n forces k < γn. The proof never states that w is drawn from a k-dimensional subspace or specifies any code family that avoids this dimensional obstruction; the claimed threshold reconstruction therefore rests on an impossible encoding/erasure-correction premise.
[§4, Theorem 5] The proof does not establish the perfect threshold property required by Definition 2. It argues that with t−1 shares the adversary must make 2^{γ(n−t+1)} brute-force attempts, but perfect secrecy has a precise information-theoretic meaning: any subset of t−1 shares must have zero mutual information with the secret. No entropy calculation, indistinguishability argument, or simulator is provided. In addition, 'NIST security level I' is used as if it were a formal condition; it is a computational heuristic, and the proof gives no reduction showing that an adversary with t−1 shares and bounded resources cannot learn the path. The derivation of t ≤ n−128/γ+1 from γ(n−t+1) ≥ 128 is presented as self-evidently sufficient for security, but no argument is given for that sufficiency.
[§3, Procedure 2] The reconstruction algorithm is not well defined. Line 10 sets c ← E^{-1}(y) with the comment 'Correcting the erasures in y', but E in Procedure 1 is the encoder of the code, not a decoder; the correct operation would be a decoder that takes the received word with erasures and returns a codeword, followed by the inverse encoder to recover w. Neither such a decoder nor its erasure-correction guarantee is specified beyond the theorem's assumption. The notation is also inconsistent with the preceding text, where y_i is a block of γ bits but c is indexed as c_1, ..., c_n; the share formula y_i = (c_i, c_{i+1}, ..., c_{i+γ}) is dimensionally wrong. As a result, even if a suitable code existed, the paper would not provide a complete algorithm for reconstruction.

minor comments (5)

[Throughout] The symbol E is used for both an elliptic curve and the encoding map; this ambiguity makes Procedures 1 and 2 hard to follow.
[§2.2, Remark 1] The encoding function ψ is stated to map points to strings of length γn/2, but no parameter condition such as 2^{γn/2} ≥ #E(F_q) is given; without it, the encoding step may not be injective for all points on the chosen curve.
[§2.1, Theorem 3] The condition 'N contains a large smooth square factor' is left undefined, and the proof then speaks of N being a power of a small prime ℓ, which is a different condition; the statement should be made precise.
[§5.2, Corollary 2 proof] The proof jumps from Theorem 7 to the bound ǫ ≤ (γ−2)/r+2 without deriving the displayed inequality for r>γ−2; this step should be spelled out.
[§3, Procedure 2] The loop 'for 0 ≤ j ≤ γn' should be a half-open interval to avoid an off-by-one error when processing the γn-bit word.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: Theorem 4 reduces threshold recovery to the assumed erasure-correction capability of C, an external code primitive, with no self-citations, fitted parameters, or renamed known results.

full rationale

Walking the derivation chain: Theorem 4 assumes a binary code C correcting γ(n−t) erasures and then builds shares as codeword chunks; recovery is erasure decoding followed by SESS inversion and the external Feo–Fouotsa–Panny/Robert algorithms. The threshold property is exactly the assumed erasure-correction radius, but that is a standard reduction, not a circular derivation: the code property is an input, not something the paper claims to derive. Theorem 5 adds the Singleton bound to relate k, γ, n, and t; no fitted constant is renamed as a prediction. All cited theorems (Robert's SIDH attack, Feo et al.'s SI-OTP reduction, MacWilliams–Sloane coding facts) are independent external results, not self-citations, so the self-citation patterns do not apply. The serious concern raised by the skeptic — that no binary [γn,k,d] code can both encode an arbitrary γn-bit word and correct γ(n−t) erasures unless k=γn and d≤1 — is a feasibility/soundness objection to the construction, not an instance of the paper's conclusion being equivalent to its inputs. Under the circularity rubric, correctness gaps are out of scope. No step in the paper fits the enumerated circularity patterns.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on an unspecified encoding abstraction and an internally inconsistent code model, plus two domain assumptions about isogeny problems. No new physical or mathematical entity is introduced.

free parameters (3)

γ (bit-block length per participant)
Chosen by hand to set code length ℓ=γn and security bound γ(n-t+1)≥128; no method is given to select it, and Theorem 4 depends on it.
Code C parameters [ℓ,k,d]
The scheme requires a code that corrects γ(n-t) erasures while encoding a γn-bit message; the existence of such parameters is assumed rather than derived, and conflicts with the Singleton bound.
Torsion order N
Chosen to contain a large smooth square factor so Theorem 3 applies; its size affects encoding length and security but is not instantiated.

assumptions (4)

ad hoc to paper There exists an injective encoding ψ (called SESS) that maps any elliptic-curve point to a fixed-length bit string and is efficiently invertible, for all relevant supersingular curves.
The paper abstracts several encoding algorithms into one SESS function without specifying which algorithm is used or proving the required properties; Elligator 2 only works for even-order curves.
ad hoc to paper A binary [γn,k,d] code can encode a message of length γn and correct γ(n-t) erasures with k<γn.
This is the load-bearing assumption in Theorem 4 and Theorem 5; it contradicts the Singleton bound when k<γn, and the paper provides no alternative code model.
domain assumption The SI-OTP problem with a large smooth square torsion order is solvable in polynomial time (Theorem 3 of [18]).
The reconstruction step depends entirely on the cited reduction of Feo-Fouotsa-Panny and Robert's algorithm.
domain assumption The SI-OTP problem is computationally hard for an adversary without the torsion images.
The threshold security claim assumes that without enough shares the unknown bits cannot be guessed faster than 2^128; no reduction to SI-OTP is given.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Sharing the Path: A Threshold Scheme from Isogenies and Error Correcting Codes." pith.science (2026). https://pith.science/paper/VP5ISWCA

@misc{pith2026241118844,
  author       = {Pith},
  title        = {Pith review of: Sharing the Path: A Threshold Scheme from Isogenies and Error Correcting Codes},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VP5ISWCA}},
  note         = {Machine review of arXiv:2411.18844}
}

read the original abstract

In 2022, a prominent supersingular isogeny-based cryptographic scheme, namely SIDH, was compromised by a key recovery attack. However, this attack does not undermine the isogeny path problem, which remains central to the security of isogeny-based cryptography. Following the attacks by Castryck and Decru, as well as Maino and Martindale, Robert gave a mature and polynomial-time algorithm that transforms the SIDH key recovery attack into a valuable cryptographic tool. In this paper, we combine this tool with advanced encoding techniques to construct a novel threshold scheme.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 39 canonical work pages

[1]

Atapoor, K

S. Atapoor, K. Baghery, D. Cozzo, R. Pedersen (2023). CSI -SharK: CSI-FiSh with Sharing-friendly Keys. In: Simpson, L., Rezazadeh Baee, M.A. (eds) Information Security and Privacy. ACISP 2023. Lecture Notes in Computer Science, vol 13915. Springer, Cham. https://doi.org/10.1007/978-3-031- 35486-1_21

doi:10.1007/978-3-031- 2023
[2]

D. J. Bernstein, M. Hamburg, A. Krasnova, T. Lange.: Elli gator: elliptic-curve points indistinguishable from uniform random strings. In: Sadeghi, A.-R., Gligor, V.D., Yung, M., (eds.) ACM CCS 2013, pp. 967-980. ACM Press, November 2013

work page 2013
[3]

D. J. Bernstein and T. Lange. Safe curves for elliptic-cu rve cryptography Cryp- tology ePrint Archive, Paper 2024/1265, 2024 https://eprint.iacr.org/ 2024/1265

work page 2024
[4]

Bertilsson and I

M. Bertilsson and I. Ingemarsson. A construction of prac tical secret sharing schemes using linear block codes. In J. Seberry and Y. Zheng, editors, Advances in Cryptology -AUSCRYPT’92, volume 718 of Lecture Notes in Compu t. Sci., pages 67-79. Springer, Berlin, Heidelberg, 1993

work page 1993
[5]

Beullens, L

W. Beullens, L. Disson, R. Pedersen, F. Vercauteren.: CS I-RAShi: distributed key generation for CSIDH. In: Cheon, J.H., Tillich, J.-P. (eds.) PQCrypto 2021 2021. LNCS, vol. 12841, pp. 257–276. Springer, Cham (2021). https: //doi.org/10.1007/978-3-030-81293-5_14

work page doi:10.1007/978-3-030-81293-5_14 2021
[6]

Beullens, B

W. Beullens, B. Preneel, A. Szepieniec, F. Vercauteren. : LUOV. Round 2 submission, NIST Post-Quantum Cryptography Standardization (2019). https: //www.esat.kuleuven.be/cosic/pqcrypto/luov/

work page 2019
[7]

G. R. Blakley. Safeguarding cryptographic keys. In Managing Requirements Knowledge, International Workshop on. IEEE Computer Society. 1979. 11

work page 1979
[8]

Castryck, T

W. Castryck, T. Decru.: An eﬃcient key recovery attack on SIDH. In: Hazay, C., Stam, M. (eds.): EUROCRYPT 2023, Part V, LNCS, vol. 140 08. Springer, Heidelberg (2023) pp. 423–447. https://doi.org/10.1007/978-3- 031-30589-4_15

doi:10.1007/978-3- 2023

Show all 42 references

[9]

Castryck, T

W. Castryck, T. Lange, C. Martindale, L. Panny, J. Renes. CSIDH: an eﬃcient post-quantum commutative group action. In: Peyrin, T., Galbraith, S. (eds.) ASIACRYPT 2018. LNCS, vol. 11274, pp. 395-427. Springer, Cham (2018). https://doi.org/10.1007/978-3-030-03332-315

2018 doi
[10]

Chavez-Saab, F

J. Chavez-Saab, F. Rodriguez-Henriquez, M. Tibouchi. : SwiftEC: Shallue- van de Woestijne Indiﬀerentiable Function to Elliptic Curve s. In: Agrawal, S., Lin, D. (eds) Advances in Cryptology - ASIACRYPT 2022. ASIACRYP T

2022
[11]

Chen, T.M

L. Chen, T.M. Laing, K.M. Martin.: Eﬃcient, XOR-based, ideal (t,n )- thresh- old schemes. In: Foresti, S., Persiano, G. (eds.) CANS 2016. LNCS, vol. 10052, pp. 467-483. Springer, Cham (2016). https://doi.org/10.1007/978- 3-319-48965-0_28

2016 doi
[12]

Hard homogeneous spaces 1997

Jean-Marc Couveignes. Hard homogeneous spaces 1997. IACR Cryptology ePrint Archive 2006/291. https://ia.cr/2006/291

1997
[13]

Cozzo, N

D. Cozzo, N. P. Smart, N.P. (2019). Sharing the LUOV: Thr eshold Post- quantum Signatures. In: Albrecht, M. (eds) Cryptography and Coding. IMACC

2019
[14]

Cozzo, N

D. Cozzo, N. P. Smart.: Sashimi: cutting up CSI-FiSh sec ret keys to produce an actively secure distributed signing protocol. In: Ding, J., Tillich, J.-P. (eds.) PQCrypto 2020. LNCS, vol. 12100, pp. 169–186. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-44223-1_10

2020 doi
[15]

Desmedt.: Threshold cryptosystems

Y. Desmedt.: Threshold cryptosystems. In: Seberry, J., Zheng, Y. (eds.) AUSCRYPT 1992. LNCS, vol. 718, pp. 1-14. Springer, Heidelberg (1993). https://doi.org/10.1007/3-540-57220-1_47

1993 doi
[16]

van Dijk

M. van Dijk. A linear construction of perfect secret sha ring schemes. In A. DeSantis, editor, Advances in Cryptology - EUROCRYPT’94, volu me 950 of Lecture Notes in Comput. Sci., pages 23-34. Springer, Berlin, Heidelberg, 1995

1995
[17]

J. Ding, M. S. Chen, A. Petzoldt, D. Schmidt, B. Y. Yang.: Rainbow. Round 2 submission, NIST Post-Quantum Cryptography Standardization (2019). https://csrc.nist.gov/projects/post-quantum-cryptog raphy/ round-2-submissions

2019
[18]

De Feo, T.B

L. De Feo, T.B. Fouotsa, L. Panny (2024). Isogeny Proble ms with Level Struc- ture. In: Joye, M., Leander, G. (eds) Advances in Cryptology - EUROCRY PT

2024
[19]

De Feo, M

L. De Feo, M. Meyer.: Threshold schemes from isogeny ass umptions. In: Kiayias, A., Kohlweiss, M., Wallden, P., Zikas, V. (eds.) PK C 2020. LNCS, vol. 12111, pp. 187–212. Springer, Cham (2020). https://doi.org/10.1007/ 978-3-030-45388-6_7

2020
[20]

Moriya, C

T.B Fouotsa, T. Moriya, C. Petit. (2023). M-SIDH and MD- SIDH: Coun- tering SIDH Attacks by Masking Information. In: Hazay, C., Stam, M. (eds) Advances in Cryptology – EUROCRYPT 2023. EUROCRYPT 2023. Lecture Notes in Computer Science, vol 14008. Springer, Cham. https: //doi.or...

2023 doi
[21]

Heng and C

Z. Heng and C. Ding. The subﬁeld codes of hyperoval and co nic codes, Finite Fields Their Appl., vol. 56, pp. 308-331, Mar. 2019

2019
[22]

Heng and C

Z. Heng and C. Ding. The Subﬁeld Codes of Some [ q + 1, 2,q ] MDS Codes, IEEE TRANSACTIONS ON INFORMATION THEORY, VOL. 68, NO. 6, JUNE 2022

2022
[23]

Hineman and M

A. Hineman and M. Blaum, A Modiﬁed Shamir Secret Sharing Scheme With Eﬃcient Encoding, in IEEE Communications Letters, vol. 26, no. 4, pp. 758- 762, April 2022,

2022
[24]

D. Jao, L. De Feo.: Towards quantum-resistant cryptosy stems from supersin- gular elliptic curve isogenies. In: Yang, B.-Y. (ed.) PQCrypto 2011. LNCS, vol. 7071, pp. 19–34. Springer, Heidelberg (2011). https://doi.org/10.1007/ 978-3-642-25405-5_2

2011
[25]

Maino, C

L. Maino, C. Martindale. An attack on SIDH with arbitrar y starting curve. Cryptology ePrint Archive, Paper 2022/1026 (2022). https://eprint.iacr. org/2022/1026

2022
[26]

J. L. Massey. Minimal codewords and secret sharing. In Proc. 6th Joint Swedish- Russian Workshop on Information Theory, pages 276-279, Molle, Sweden, Au- gust 1993

1993
[27]

J. L. Massey. Some applications of coding theory. In P. G. Ferell, editor, Cryptography, Codes and Ciphers: Cryptography and Coding IV, pages 33-47. Formara Ltd, Essex, 1995

1995
[28]

R. J. McEliece and D. V. Sarwate. On sharing secrets and R eed-Solomon codes. Commun. ACM, 24:583-584, 1981

1981
[29]

MacWilliams and N

F. MacWilliams and N. Sloane. The Theory of Error-Corre cting Codes North- holland Publishing Company, 2nd edition, (1978)

1978
[30]

Nakamoto

S. Nakamoto. (2008). Bitcoin: A peer-to-peer electron ic cash system. 2008 https://bitcoin.org/bitcoin.pdf

2008
[31]

Peralta, L

R. Peralta, L. T. Brand˜ ao.: Nist ﬁrst call for multi-pa rty threshold schemes. National Institute of Standards and Technology (2023) . https://doi.org/10. 6028/NIST.IR.8214C.ipd, https://doi.org/10.6028/NIST.IR.8214C.ipd

2023 doi
[32]

del Pino, S

R. del Pino, S. Katsumata, M. Maller, F. Mouhartem, T. Pr est, MJ. Saarinen. (2024). Threshold Raccoon: Practical Threshold Signature s from Standard Lattice Assumptions. In: Joye, M., Leander, G. (eds) Advances in Cryptology – EUROCRYPT 2024. EUROCRYPT 2024. Lecture Notes in ...

2024 doi
[33]

Renvall and C

A. Renvall and C. Ding. The access structure of some secr et-sharing schemes. In J. Pieprzyk and J. Seberry, editors, Information Security a nd Privacy, vol- ume 1172 of Lecture Notes in Comput. Sci., pages 67-78. Springer, Berlin, Heidelberg, 1996

1996
[34]

Breaking SIDH in polynomial time

D. Robert. “Breaking SIDH in polynomial time”. In: Eurocrypt 2023 (Apr. 2023). Ed. by C. Hazay and M. Stam, pp. 472–503

2023
[35]

D. Robert. Breaking SIDH in polynomial time, August 202 2
[36]

How to Share a Secret

Adi Shamir. How to Share a Secret. Communications of the Association for Computing Machinery 22, 11 (Nov. 1979), 612-613

1979
[37]

Tibouchi.: Elligator squared: uniform points on ell iptic curves of prime order as uniform random strings

M. Tibouchi.: Elligator squared: uniform points on ell iptic curves of prime order as uniform random strings. In: Christin, N., Safavi-Naini, R. (eds.) FC 2014. LNCS, vol. 8437, pp. 139–156. Springer, Heidelberg (2014). https: //doi.org/10.1007/978-3-662-45472-5_10 13

2014 doi
[38]

Tibouchi, T

M. Tibouchi, T. Kim.: Improved elliptic curve hashing a nd point representa- tion. Des. Codes Cryptogr. 82(1-2), 161-177 (2017)

2017
[39]

Eﬃcient secret sharing schemes achieving optimal information rate,

Y. Wang and Y. Desmedt, “Eﬃcient secret sharing schemes achieving optimal information rate,” in Proc. IEEE Inf. Theory Workshop ITW, Hobart, TAS, Australia, Nov. 2014, pp. 516-520. 14

2014
[2019]

Springer, Cham

Lecture Notes in Computer Science() , vol 11929. Springer, Cham. https: //doi.org/10.1007/978-3-030-35199-1_7

doi
[2022]

Springer , Cham

Lecture Notes in Computer Science, vol 13791. Springer , Cham. https: //doi.org/10.1007/978-3-031-22963-3_3

doi
[2024]

Lecture Notes in Computer Science, vol 1 4657

EUROCRYPT 2024. Lecture Notes in Computer Science, vol 1 4657. Springer, Cham. https://doi.org/10.1007/978-3-031-58754-2_7

2024 doi

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [1]

Atapoor, K

S. Atapoor, K. Baghery, D. Cozzo, R. Pedersen (2023). CSI -SharK: CSI-FiSh with Sharing-friendly Keys. In: Simpson, L., Rezazadeh Baee, M.A. (eds) Information Security and Privacy. ACISP 2023. Lecture Notes in Computer Science, vol 13915. Springer, Cham. https://doi.org/10.1007/978-3-031- 35486-1_21

doi:10.1007/978-3-031- 2023

[2] [2]

D. J. Bernstein, M. Hamburg, A. Krasnova, T. Lange.: Elli gator: elliptic-curve points indistinguishable from uniform random strings. In: Sadeghi, A.-R., Gligor, V.D., Yung, M., (eds.) ACM CCS 2013, pp. 967-980. ACM Press, November 2013

work page 2013

[3] [3]

D. J. Bernstein and T. Lange. Safe curves for elliptic-cu rve cryptography Cryp- tology ePrint Archive, Paper 2024/1265, 2024 https://eprint.iacr.org/ 2024/1265

work page 2024

[4] [4]

Bertilsson and I

M. Bertilsson and I. Ingemarsson. A construction of prac tical secret sharing schemes using linear block codes. In J. Seberry and Y. Zheng, editors, Advances in Cryptology -AUSCRYPT’92, volume 718 of Lecture Notes in Compu t. Sci., pages 67-79. Springer, Berlin, Heidelberg, 1993

work page 1993

[5] [5]

Beullens, L

W. Beullens, L. Disson, R. Pedersen, F. Vercauteren.: CS I-RAShi: distributed key generation for CSIDH. In: Cheon, J.H., Tillich, J.-P. (eds.) PQCrypto 2021 2021. LNCS, vol. 12841, pp. 257–276. Springer, Cham (2021). https: //doi.org/10.1007/978-3-030-81293-5_14

work page doi:10.1007/978-3-030-81293-5_14 2021

[6] [6]

Beullens, B

W. Beullens, B. Preneel, A. Szepieniec, F. Vercauteren. : LUOV. Round 2 submission, NIST Post-Quantum Cryptography Standardization (2019). https: //www.esat.kuleuven.be/cosic/pqcrypto/luov/

work page 2019

[7] [7]

G. R. Blakley. Safeguarding cryptographic keys. In Managing Requirements Knowledge, International Workshop on. IEEE Computer Society. 1979. 11

work page 1979

[8] [8]

Castryck, T

W. Castryck, T. Decru.: An eﬃcient key recovery attack on SIDH. In: Hazay, C., Stam, M. (eds.): EUROCRYPT 2023, Part V, LNCS, vol. 140 08. Springer, Heidelberg (2023) pp. 423–447. https://doi.org/10.1007/978-3- 031-30589-4_15

doi:10.1007/978-3- 2023