Isogeny Cryptography (and SIKE's Fall)

In 2022 a post-quantum cryptography competition run by NIST was entering its final round. Among the finalists sat SIKE — a system that had survived seven years of public scrutiny, built on a branch of mathematics so exotic that most cryptographers barely recognized it.

Six weeks before the announcement, two Belgian researchers, Wouter Castryck and Thomas Decru, published a preprint. They had broken SIKE completely: a single-core laptop needed about one hour to recover any private key. No quantum computer required.

The scheme relied on isogeny-based cryptography — a technique for building key-exchange protocols by walking through a vast graph of elliptic curves, where each edge is a structure-preserving map called an isogeny. The hope was that finding the exact path someone took through this graph was computationally hopeless. The reality turned out to be more subtle, and more humbling.

To understand what went wrong, we need to understand what isogenies are, why walks on their graph seemed so safe, and what extra information SIKE accidentally leaked.

The demo below builds a small isogeny graph. Each node is an elliptic curve (labeled by its j-invariant), and each edge is a degree-2 isogeny — a structure-preserving map between curves.

<p class="hint">
  {{hint}}
</p>
<div id="graph-wrap">
  <canvas id="c" width="480" height="300"></canvas>
</div>
<div class="controls">
  <button id="btn-walk" type="button">{{btn_walk}}</button>
  <button id="btn-torsion" type="button" disabled>{{btn_torsion}}</button>
  <button id="btn-reset" type="button" class="ghost">{{btn_reset}}</button>
</div>
<div id="info" class="info-box"></div>

* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; margin: 0; color: #222; }
.hint { font-size: .88rem; color: #444; margin: 0 0 .8rem; line-height: 1.5; }
#graph-wrap { background: #f4f7fa; border-radius: 10px; overflow: hidden; margin-bottom: .7rem; }
canvas { display: block; max-width: 100%; }
.controls { display: flex; gap: .5rem; flex-wrap: wrap; margin-bottom: .6rem; }
button { font: 600 13px system-ui; padding: .4rem .85rem; border-radius: 8px; cursor: pointer;
         border: 1px solid #1d3557; background: #1d3557; color: #fff; }
button.ghost { background: #fff; color: #1d3557; }
button:disabled { opacity: .4; cursor: default; }
.info-box { font-size: .88rem; line-height: 1.55; min-height: 2.4em;
            background: #eef3f8; border-radius: 8px; padding: .5rem .8rem; color: #1d3557; }
.info-box.warn { background: #fff3cd; color: #7a5200; }
.info-box.danger { background: #fde8ea; color: #8b1e26; }

// Code not found

In the real SIKE protocol, Alice picks a secret random walk (a path through the graph) and publishes where she ended up, together with auxiliary torsion-point images that helped the other party do their own computation. Those extra points are what Castryck and Decru exploited: the auxiliary data constrained Alice's secret path so tightly that a classical algorithm could recover it efficiently. The graph looked like a labyrinth — but SIKE handed the attacker a map.

Isogeny cryptography sits on a genuinely hard mathematical problem — but that problem is not the one SIKE was actually relying on.

The hard part (still standing): given two elliptic curves E and E′, find an isogeny between them. For random curves over large fields the best known algorithms run in subexponential time classically and in roughly $O(p^{1/4})$ time with a quantum computer — slow enough to be practical, and offering real post-quantum resistance. Systems like CSIDH and SQIsign build on this and remain active research candidates.

The SIDH problem (what SIKE used): the Supersingular Isogeny Diffie-Hellman protocol had Alice and Bob each walk the graph along secret paths of different prime degrees, then exchange endpoints. The security assumption was that recovering the secret walk from the endpoint alone was hard. And it was.

The fatal leak: SIKE also transmitted images of torsion points — fixed reference points mapped through each party's secret isogeny — to let the other party finish the handshake. Castryck and Decru showed that these images give a classical attacker enough structural information to reconstruct the secret isogeny via an elegant attack using Richelot isogenies and gluing of higher-dimensional abelian varieties. The attack runs in polynomial time once those torsion images are available.

The lesson is sharp: the underlying isogeny path problem is hard. The specific extra data SIKE exposed broke the problem down into something solvable. NIST removed SIKE from the competition immediately after the preprint appeared. Factoring and discrete logarithms fell to Shor's quantum algorithm; SIKE fell to a classical attack on information it volunteered.

SIKE's collapse did not kill isogeny cryptography — it killed one particular protocol that leaked too much.

• SQIsign (Short Quaternion and Isogeny Signature): a digital signature scheme based on the hardness of computing isogenies between supersingular curves. It offers extremely compact signatures (~200 bytes) and remains a serious NIST candidate. No torsion-point images are exposed.
• CSIDH (Commutative SIDH): uses ordinary (non-supersingular) elliptic curves and a commutative group action, avoiding the auxiliary data that sank SIKE. Its quantum security is debated but classically it is solid.
• Threshold and verifiable delay functions: isogenies' algebraic structure makes them attractive for protocols where multiple parties must compute jointly without any one seeing the secret.
• Proof-of-work and time-lock puzzles: the sequential nature of isogeny chains (you cannot parallelize a walk easily) makes them a natural primitive for time-locked cryptography.

The SIKE saga illustrates a general principle that shows up in lattice cryptography too: the hard problem and the protocol built on it are different things. Leaking auxiliary structure can collapse the security gap even when the core problem stays unsolved.

SIKE's defeat was one of the most dramatic moments in modern cryptography: a finalist in a six-year standardization process, broken overnight by a classical algorithm, on a laptop, with elegant mathematics that many experts said they should have seen coming.

The underlying problem — walking an isogeny graph without being detected — remains genuinely hard. What failed was the decision to hand the attacker extra structural information in the name of efficiency. In cryptography, efficiency and security are always in tension, and SIKE found the wrong side of that line.

Post-quantum cryptography continues. NIST standardized CRYSTALS-Kyber (lattice-based), CRYSTALS-Dilithium, and FALCON in 2024. Isogeny schemes like SQIsign remain active contenders for the next round. The graph of elliptic curves is still a formidable labyrinth — you just have to be careful what you hand to the person trying to find your path. See also: Shor's algorithm and factoring for the quantum threats that started the post-quantum race.