Pith. sign in

REVIEW 3 major objections 4 minor 32 references

A Compact Post-quantum Strong Designated Verifier Signature Scheme from Isogenies

T0 review · 3 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper constructs CSI-SDVS, a strong designated verifier signature scheme from isogeny class-group actions, and claims post-quantum security with compact keys and signatures.

desk verdict Straightforward CSI-FiSh + Schnorr-style SDVS with a broken SUF-CMA proof; the construction is clean but the central security theorem is unsupported. read the letter →

arxiv 2507.14893 v3 pith:EKDTQ5DF submitted 2025-07-20 cs.CR math.NT

Farzin Renan This is my paper · ORCID
classification cs.CRmath.NT
keywords StrongDesignatedVerifierSignaturesPost-quantumCryptographyIsogeny-basedCSIDHCSI-FiShMT-GAIPSupersingularellipticcurvesClassgroupaction
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Ordinary digital signatures let anyone check authenticity, but privacy-sensitive applications such as e-voting, digital cash, and confidential documents need signatures that only one designated verifier can validate, and that cannot be reused as proof by a third party. The paper introduces CSI-SDVS, a strong designated verifier signature scheme built from the action of the ideal class group on $\mathbb{F}_p$-isomorphism classes of supersingular elliptic curves, in the CSIDH/CSI-FiSh setting, and argues that it is the only isogeny-based post-quantum SDVS construction. It claims Strong Unforgeability under Chosen-Message Attacks, Non-Transferability, and Privacy of Signer's Identity in the random oracle model, under the hardness of the Multi-Target Group Action Inverse Problem. If the scheme is sound, designated verifier signatures become available with keys and signatures of size $O(\lambda)$ bits, substantially smaller than the lattice-based SDVS schemes surveyed in the paper, giving quantum-resistant private authentication without factoring or discrete-logarithm assumptions.

What carries the argument

The central object is the free and transitive group action of the ideal class group $\mathrm{Cl}(\mathcal{O})$ on the set $\mathrm{Ell}_p(\mathcal{O})$ of $\mathbb{F}_p$-isomorphism classes of supersingular elliptic curves whose $\mathbb{F}_p$-rational endomorphism ring is $\mathcal{O}$, with the class group represented cyclically as exponents in $\mathbb{Z}_N$ through a fixed generator $g$. The identity that carries the scheme is $[v_i][b_i - s_i]E_i = [b_i]\hat E_i$ whenever $E_i = [s_i]E_0$ and $\hat E_i = [v_i]E_0$; both real signing and verifier-side simulation reduce to this curve-shifting equality, and the hash of the recovered curve tuple is the challenge. The declared hardness engine is the Multi-Target Group Action Inverse Problem, backed by the parallelization problem of hard homogeneous spaces, and the proof strategy is to show that a forgery or a signer-identification break would let an adversary solve one of these isogeny problems.

What would settle it

Run the proof's SUF-CMA simulator against the real scheme at a small parameter size and feed a signing-oracle transcript $(h,z)$ into the true Verify algorithm; the transcript is accepted by the simulated oracle only because the simulator programmed the hash entry, so a rejection by the real Verify (or a need to program hashes after the fact to force acceptance) would show the simulated experiment differs from the real one and would falsify the claimed reduction. A second direct check is to compare real and simulated signature transcripts on the same message and look for any statistical difference in $(z, h)$.

Watch

Extended reading notes

Core claim

On its own terms, the paper's discovery is that a CSIDH-style shifting trick can serve as a strong designated verifier signature. A base supersingular curve $E_0$ is fixed; the signer's public key is a list of curves $E_i = [s_i]E_0$ and the verifier's public key is $\hat E_i = [v_i]E_0$, where the secret exponents $s_i, v_i$ are sampled from $\mathbb{Z}_N$ and $[a]$ denotes the class-group element $g^a$ acting on curves. To sign $m$, the signer samples fresh $b_i$, computes $Y_i = [b_i]\hat E_i$, forms the hash $h = H(Y_1\|\cdots\|Y_\eta\|m)$, and outputs $(h, z_i = b_i - s_i \bmod N)$. The verifier recomputes $Y_i' = [v_i + z_i]E_i$, and the identity $[v_i + b_i - s_i][s_i]E_0 = [b_i][v_i]E_0$ makes the real and simulated transcripts agree. The paper asserts that this compact scheme is strongly unforgeable, non-transferable, and signer-anonymous in the random oracle model, and that no other isogeny-based SDVS construction currently offers post-quantum security.

Load-bearing premise

The proof of strong unforgeability depends on the assumption that a simulator can embed an external puzzle about finding the secret isogeny step between two public curves into the public keys and still answer all signing and verification queries; in the proof the simulator instead chooses all the secret exponents itself, and the transcripts it produces through the signing oracle would not pass the real verification algorithm, so that load-bearing embedding is never actually supplied.

Editorial extensions

If this is right

  • If CSI-SDVS is secure, designated-verifier signatures can be realized from isogeny group actions with key and signature sizes of $O(\lambda)$ bits, in contrast to the $\lambda^2$-scale sizes of the lattice-based SDVS constructions surveyed in the paper.
  • Privacy-sensitive applications such as e-voting and digital cash would gain a quantum-resistant signing primitive whose verification is restricted to one party and whose transcripts cannot be transferred as proof.
  • The non-transferability property means the designated verifier can simulate any message's signature, so a signature transcript is never decisive evidence about who authored it.
  • If the MT-GAIP assumption holds, an observer holding both candidate signers' public keys cannot tell which signer produced a given signature without the verifier's secret key.
  • The scheme would fill the gap left by the earlier isogeny-based SDVS construction built on SIDH, which was broken by the SIDH key-recovery attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the same offset-signing identity works for any hard homogeneous space with a known-order cyclic group, so the pattern is a general template for SDVS from commutative group actions, not a CSIDH-specific trick.
  • Editorial inference: since both the signer and the verifier can generate identically distributed transcripts, the scheme is effectively a two-party proof that one of the two secret exponents is known; this points toward a generic proof-of-knowledge formulation of SDVS security rather than assumption-specific reductions.
  • Editorial inference: the scheme's compactness claim depends on the CSI-FiSh precomputation of the class group structure for CSIDH-512; any future parameter set would need the same precomputation or the sizes and sampling costs would change.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The manuscript presents CSI-SDVS, a strong designated verifier signature scheme based on the CSIDH/CSI-FiSh group action on supersingular elliptic curves. It defines the scheme, gives an efficiency analysis, and claims SUF-CMA, non-transferability, and privacy of signer's identity in the random oracle model under the MT-GAIP assumption. The main technical content is the security analysis in Section 5, especially the SUF-CMA proof of Theorem 5.1.

Significance. The construction is compact and the paper is clearly organized. If the security proofs were correct, the scheme would be a noteworthy post-quantum SDVS and, as claimed, the only isogeny-based one. The efficiency comparison to lattice-based schemes is plausible. However, the central SUF-CMA proof is not a valid reduction, and the PSI proof is only a sketch; the main advertised guarantees are therefore not established. No implementation or machine-checked proofs are provided.

major comments (3)
  1. [5, Theorem 5.1] The proof of Theorem 5.1 is not a reduction to any external hard problem. In the Setup step the simulator S samples the exponents s_i and v_i itself and constructs E_i=[s_i]E0 and \hat E_i=[v_i]E0, so the extracted value [s_i+v_i]E0, obtained as [-z*_i]Y*_i, is computed from S's own randomness. No parallelization or MT-GAIP instance is embedded. Moreover, the OSign oracle samples a fresh v_i for each signing query, so the returned signature is not valid under the real Verify algorithm (which uses the fixed verifier exponent v_i^real), and OVerify checks a private hash-list condition rather than running Verify. The simulation is therefore not faithful to the SUF-CMA experiment, and the claimed extraction does not solve a hard problem. Theorem 5.1 is unproven.
  2. [5, Theorem 5.3] The proof of Theorem 5.3 does not construct a reduction from MT-GAIP. It asserts that 'according to the definition of MT-GAIP ... it is evident' that the adversary cannot compute the curves Y_i^{(j)} without skV, but it never explains how a PSI adversary with non-negligible distinguishing advantage is converted into an algorithm solving Problem 2.7. The proof also does not specify how the random oracle H is simulated or how hash queries are answered, even though the challenge signature contains a hash value. The claim that distinguishing requires recovering [s_i^{(b)}+v_i]E0 is asserted rather than derived. The theorem is therefore unsupported.
  3. [2.4 and 5, Theorem 5.1] The theorem statement of Theorem 5.1 invokes MT-GAIP, but the proof concludes by claiming to solve 'the parallelization problem in the HHS model' (Section 2.4). These are different problems: Problem 2.7 is a multi-target group-action inverse problem, whereas parallelization asks, given x, y=g*x, and z, to compute g*z. No bridging lemma shows that a parallelization solver is equivalent to, or reduces from, an MT-GAIP solver. The cited tight reduction in [28] concerns GAIP, not the parallelization problem. Thus the security theorem is not connected to the stated hardness assumption.
minor comments (4)
  1. [2.2, Figure 1] The SUF-CMA experiment in Definition 2.2 and Figure 1 does not give the adversary access to the random oracle, but the proof of Theorem 5.1 introduces a hashing oracle OH; the game should be specified with explicit random-oracle access.
  2. [5, Theorem 5.1] In the proof of Theorem 5.1, OSign reuses the symbol v_i for a freshly sampled exponent, the same symbol as the verifier's secret key from Setup; this obscures the fact that the oracle does not use the real verifier key.
  3. [5, Theorems 5.1 and 5.3] There are typographical and grammatical issues, e.g., 'Checck' in the proof of Theorem 5.3 and the verification-oracle condition 'check if [z_i]E_i = \bar E_i or for all i' in Theorem 5.1, which should read 'for all i check [z_i]E_i = \bar E_i'.
  4. [References] Reference [11] is given as 'Process, P.S.: Third Round Candidate Announcement' and lacks the actual authors and context; please correct the citation.

Circularity Check

1 steps flagged · score 6.0 of 10

SUF-CMA 'reduction' solves a parallelization instance using exponents the simulator itself sampled; the central unforgeability theorem is circular.

  1. self definitional [Section 5, Theorem 5.1 proof (Setup and Extracting the Forgery)]
    "Strictly speaking, the simulator S first interacts with its challenger C to obtain the public keys of the signer and the designated verifier, and subsequently simulates all oracle responses for A without ever accessing the corresponding secret keys. ... For each i ∈ [η], sample si ∈ ZN uniformly at random and compute Ei := [si]E0. ... For each i ∈ [η], sample vi ∈ ZN uniformly at random and compute ˆEi := [vi]E0. ... [−z∗ i ]Yi = [si − b∗ i ][b∗ i ] ˆEi = [si] ˆEi = [si + vi]E0, for each i ∈ [η]."

    The proof claims a reduction to the HHS parallelization problem, but in Setup the simulator S itself samples every si and vi and computes the public keys from them. The final 'extracted' value [si+vi]E0 is therefore obtained by arithmetic on S's own randomness; it is not recovered from an externally supplied instance (E0, {Ei}, {ˆEi}) with unknown exponents. A genuine reduction would give S only the public curves and require simulation of OSign/OSimul/OVerify without si and vi, but the provided OSign routine explicitly resamples vi and uses it to form Yi=[vi]¯Ei, and no secret-free simulation is given. Thus the solution to the claimed hard problem is an input to the simulator by construction, making Theorem 5.1 a self-definitional step rather than a hardness reduction.

full rationale

The one genuinely circular load-bearing step is in the proof of Theorem 5.1 (SUF-CMA). The proof announces an external challenger and claims S works 'without ever accessing the corresponding secret keys,' then immediately has S sample all signer and verifier exponents and build the public keys from them. At the end it 'extracts' [si+vi]E0 from the forgery, a value S already knows from its own Setup. No external parallelization challenge is embedded, so the reduction is satisfied by construction, not by adversary extraction. This invalidates the paper's central unforgeability claim. The NT proof is a statistical indistinguishability argument and is not circular in the same way. The PSI proof asserts rather than proves the needed MT-GAIP reduction, and it also ignores that the PSI experiment hands the adversary both signer secret keys, so [si^(b)+vi]E0 = [si^(b)]ˆEi is computable; this is a serious correctness gap but not the central circularity. No load-bearing self-citation chain was found; the cited CSI-FiSh and class-group results are external. Because one central theorem reduces to its own inputs while the other results rest on independent (if flawed) arguments, the score is 6 rather than higher.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The scheme rests on the standard CSIDH/CSI-FiSh assumptions and imports the cyclic class group structure from [24]. No new free parameters or entities are introduced beyond the scheme's eta parallel instances, which is a tunable design choice.

assumptions (5)
  • domain assumption The ideal class group Cl(O) for the CSIDH-512 parameter set is cyclic with known generator g.
    Imported from CSI-FiSh [24] and used in Section 3 to represent class group elements as exponents in Z_N.
  • standard math The ideal class group action on F_p-isomorphism classes of supersingular elliptic curves is free and transitive.
    Standard property of the class group action, stated in Section 2.3 and used throughout the scheme.
  • domain assumption GAIP and MT-GAIP are computationally hard for this class group action.
    The security claims in Theorems 5.1 and 5.3 rely on these assumptions, introduced in Section 2.4.
  • domain assumption The hash function H is modeled as a random oracle.
    The security proofs in Section 5 assume H is a random oracle, as stated in the abstract and Section 3.
  • domain assumption The group action can be evaluated efficiently for the chosen exponents and curves.
    The scheme's algorithms in Section 3 require computing [a]E for arbitrary a in Z_N, which is not straightforward without the CSI-FiSh precomputed relation lattice; this is imported from [24].

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Compact Post-quantum Strong Designated Verifier Signature Scheme from Isogenies." pith.science (2026). https://pith.science/paper/EKDTQ5DF

@misc{pith2026250714893,
  author       = {Pith},
  title        = {Pith review of: A Compact Post-quantum Strong Designated Verifier Signature Scheme from Isogenies},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EKDTQ5DF}},
  note         = {Machine review of arXiv:2507.14893}
}
abstract

Digital signatures are fundamental cryptographic tools that provide authentication and integrity in digital communications. However, privacy-sensitive applications, such as e-voting and digital cash, require more restrictive verification models to ensure confidentiality and control. Strong Designated Verifier Signature (SDVS) schemes address this need by enabling the signer to designate a specific verifier, ensuring that only this party can validate the signature. Existing SDVS constructions are primarily based on number-theoretic assumptions and are therefore vulnerable to quantum attacks. Although post-quantum alternatives, particularly those based on lattices, have been proposed, they often entail large key and signature sizes. In this work, we present $\mathsf{CSI\text{-}SDVS}$, a novel isogeny-based SDVS scheme that offers a compact, quantum-resistant alternative to existing SDVS constructions. The scheme leverages the ideal class group action on $\mathbb{F}_p$-isomorphism classes of supersingular elliptic curves and is founded on the hardness of the Multi-Target Group Action Inverse Problem (MT-GAIP). $\mathsf{CSI\text{-}SDVS}$ achieves strong security guarantees, Strong Unforgeability under Chosen-Message Attacks (SUF-CMA), Non-Transferability (NT), and Privacy of Signer's Identity (PSI), in the random oracle model, thereby making it among the most compact PQC-based SDVS schemes and the only post-quantum secure construction based on isogenies.

Figures

Figures reproduced from arXiv: 2507.14893 by the authors.

Figure 1
Figure 1. ExpSUF-CMA SDVS,A Experiment [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. ExpNT SDVS,A Experiment. The advantage of A in the above game is defined by AdvNT SDVS,A(λ) = [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. ExpPSI SDVS,A Experiment. The advantage of A in the above game is defined by AdvPSI SDVS,A(λ) = [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 31 canonical work pages

  1. [28]

    D.: SeaSign: compact isogeny signatures from class group actions

    De Feo, L., Galbraith, S. D.: SeaSign: compact isogeny signatures from class group actions. EUROCRYPT 2019, pp. 759–789. Springer (2019)

    work page 2019

  2. [1]

    International Conference on the Theory and Applications of Cryptographic Techniques, pp

    Jakobsson, M., Sako, K., Impagliazzo, R.: Designated verifier proofs and their applications. International Conference on the Theory and Applications of Cryptographic Techniques, pp. 143–154. Springer (1996)

    work page 1996

  3. [2]

    In: United States Patent, 1996, https://patents.google.com/patent/US5493614A/en

    Chaum, D.: Private signature and proof systems. In: United States Patent, 1996, https://patents.google.com/patent/US5493614A/en. (1996)

    work page 1996

  4. [3]

    International Conference on Security in Communication Networks, pp

    Laguillaumie, F., Vergnaud, D.: Designated verifier signatures: Anonymity and efficient con- struction from any bilinear map. International Conference on Security in Communication Networks, pp. 105–119. Springer (2004)

    work page 2004

  5. [4]

    International conference on information security and cryptology (pp

    Saeednia, S., Kremer, S., Markowitch, O.: An efficient strong designated verifier signature scheme. International conference on information security and cryptology (pp. 40-54). Berlin, Heidelberg. Springer (2003)

    work page 2003

  6. [5]

    International Conference on Information Security Practice and Experience (pp

    Huang, X., Susilo, W., Mu, Y., Zhang, F.: Short (identity-based) strong designated verifier signature schemes. International Conference on Information Security Practice and Experience (pp. 214-225). Berlin, Heidelberg. Springer (2006)

    work page 2006

  7. [6]

    D.: A novel identity-based strong designated verifier signature scheme

    Kang, B., Boyd, C., Dawson, E. D.: A novel identity-based strong designated verifier signature scheme. Journal of Systems and Software, 82(2), 270-273. (2009)

    work page 2009

  8. [7]

    W.: Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer

    Shor, P. W.: Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM review, pp. 303–332. SIAM (1999)

    work page 1999

Show all 32 references
  1. [8]

    R.: Code-based strong designated verifier signatures: security analysis and a new construction

    Asaar, M. R.: Code-based strong designated verifier signatures: security analysis and a new construction. Cryptology ePrint Archive. (2016)

    2016

  2. [9]

    International Journal of Grid and Utility Computing, 7(1), pp.61-67

    Ren, Y., Wang, H., Du, J., Ma, L.: Code-based authentication with designated verifier. International Journal of Grid and Utility Computing, 7(1), pp.61-67. (2016)

    2016

  3. [10]

    K., Ahmadian-Attari, M., Aref, M

    Shooshtari, M. K., Ahmadian-Attari, M., Aref, M. R.: Provably secure strong designated verifier signature scheme based on coding theory. International Journal of Communication Systems, 30(7), p.e3162. (2017)

    2017

  4. [11]

    S.: Third Round Candidate Announcement

    Process, P. S.: Third Round Candidate Announcement. Information Technology Laboratory- Computer Security Resource Center. (2020)

    2020

  5. [12]

    Inter- national Journal of Communication Systems, 31(17), p.e3803

    Thanalakshmi, P., Anitha, R.: A new code-based designated verifier signature scheme. Inter- national Journal of Communication Systems, 31(17), p.e3803. (2018)

    2018

  6. [13]

    Proceedings of the fortieth annual ACM symposium on Theory of computing, pp

    Gentry, C., Peikert, C., Vaikuntanathan, V.: Trapdoors for hard lattices and new crypto- graphic constructions. Proceedings of the fortieth annual ACM symposium on Theory of computing, pp. 197–206. (2008)

    2008

  7. [14]

    Malaysian Journal of Computer Science, pp

    Wang, F., Hu, Y., Wang, B.: Lattice-based strong designate verifier signature and its appli- cations. Malaysian Journal of Computer Science, pp. 11–22. (2012)

    2012

  8. [15]

    R.: Strong designated verifier signature scheme from lattices in the standard model

    Noh, G., Jeong, I. R.: Strong designated verifier signature scheme from lattices in the standard model. Security and Communication Networks, pp. 6202–6214. Wiley Online Library (2016) CSI-SDVS: Isogeny-based Strong Designated Verifier Signature Scheme 18

    2016

  9. [16]

    IEEE Access, pp

    Cai, J., Jiang, H., Zhang, P., Zheng, Z., Lyu, G., Xu, Q.: An efficient strong designated verifier signature based on R-SIS assumption. IEEE Access, pp. 3938–3947. IEEE (2019)

    2019

  10. [17]

    Computer Standards & Interfaces, pp

    Zhang, Y., Susilo, W., Guo, F.: Lattice-based strong designated verifier signature with non- delegatability. Computer Standards & Interfaces, pp. 103904. Elsevier (2025)

    2025

  11. [18]

    Fourth International Conference on Intelligent Networking and Collaborative Systems, pp

    Sun, X., Tian, H., Wang, Y.: Toward quantum-resistant strong designated verifier signature from isogenies. Fourth International Conference on Intelligent Networking and Collaborative Systems, pp. 292–296. IEEE (2012)

    2012

  12. [19]

    Cryptology ePrint Archive, Paper 2011/506

    De Feo, L., Jao, D., Plˆ ut, J.: Towards quantum resistant cryptosystems from supersingular elliptic curve isogenies. Cryptology ePrint Archive, Paper 2011/506. https://eprint.iacr.org/2011/506 (2011)

    2011

  13. [20]

    In: Annual Interna- tional Conference on the Theory and Applications of Cryptographic Techniques, pp

    Castryck, W., Decru, T.: An efficient key recovery attack on SIDH. In: Annual Interna- tional Conference on the Theory and Applications of Cryptographic Techniques, pp. 423–447. Springer (2023)

    2023

  14. [21]

    In: Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp

    Maino, L., Martindale, C., Panny, L., Pope, G., Wesolowski, B.: A direct key recovery attack on SIDH. In: Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp. 448–471. Springer (2023)

    2023

  15. [22]

    In: Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp

    Robert, D.: Breaking SIDH in polynomial time. In: Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp. 472–503. Springer (2023)

    2023

  16. [23]

    Advances in Cryptology–ASIACRYPT 2018, pp

    Castryck, W., Lange, T., Martindale, C., Panny, L., Renes, J.: CSIDH: an efficient post- quantum commutative group action. Advances in Cryptology–ASIACRYPT 2018, pp. 395–

    2018

  17. [24]

    International conference on the theory and application of cryptology and information security, pp

    Beullens, W., Kleinjung, T., Vercauteren, F.: CSI-FiSh: efficient isogeny based signatures through class group computations. International conference on the theory and application of cryptology and information security, pp. 227–247. Springer (2019)

    2019

  18. [25]

    C.: Elliptic curves: number theory and cryptography

    Washington, L. C.: Elliptic curves: number theory and cryptography. Chapman and Hall/CRC (2008)

    2008

  19. [26]

    H.: The arithmetic of elliptic curves

    Silverman, J. H.: The arithmetic of elliptic curves. Springer (2009)

    2009

  20. [27]

    M.: Hard Homogeneous Spaces

    Couveignes, J. M.: Hard Homogeneous Spaces. Cryptology ePrint Archive, Paper 2006/291 (2006)

    2006

  21. [29]

    SIAM Journal on Computing, pp

    Kuperberg, G.: A subexponential-time quantum algorithm for the dihedral hidden subgroup problem. SIAM Journal on Computing, pp. 170–188. SIAM (2005)

    2005

  22. [30]

    arXiv preprint arXiv:1112.3333

    Kuperberg, G.: Another subexponential-time quantum algorithm for the dihedral hidden subgroup problem. arXiv preprint arXiv:1112.3333. (2011)

    2011 arXiv

  23. [31]

    EUROCRYPT 2020, pp

    Bonnetain, X., Schrottenloher, A.: Quantum security analysis of CSIDH. EUROCRYPT 2020, pp. 493–522. Springer (2020) CSI-SDVS: Isogeny-based Strong Designated Verifier Signature Scheme 19

    2020

  24. [32]

    Annual international conference on the theory and applications of cryptographic techniques, pp

    Peikert, C.: He gives C-sieves on the CSIDH. Annual international conference on the theory and applications of cryptographic techniques, pp. 463–492. Springer (2020)

    2020

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.