Paper 2016/413

Efficient algorithms for supersingular isogeny Diffie-Hellman

Craig Costello, Patrick Longa, and Michael Naehrig


We propose a new suite of algorithms that significantly improve the performance of supersingular isogeny Diffie-Hellman (SIDH) key exchange. Subsequently, we present a full-fledged implementation of SIDH that is geared towards the 128-bit quantum and 192-bit classical security levels. Our library is the first constant-time SIDH implementation and is up to 2.9 times faster than the previous best (non-constant-time) SIDH software. The high speeds in this paper are driven by compact, inversion-free point and isogeny arithmetic and fast SIDH-tailored field arithmetic: on an Intel Haswell processor, generating ephemeral public keys takes 46 million cycles for Alice and 54 million cycles for Bob, while computing the shared secret takes 44 million and 52 million cycles, respectively. The size of public keys is only 564 bytes, which is significantly smaller than most of the popular post-quantum key exchange alternatives. Ultimately, the size and speed of our software illustrates the strong potential of SIDH as a post-quantum key exchange candidate and we hope that these results encourage a wider cryptanalytic effort.

Available format(s)
Publication info
A minor revision of an IACR publication in CRYPTO 2016
Post-quantum cryptographyDiffie-Hellman key exchangesupersingular elliptic curvesisogeniesSIDH
Contact author(s)
craigco @ microsoft com
2019-09-17: last of 3 revisions
2016-04-28: received
See all versions
Short URL
Creative Commons Attribution


      author = {Craig Costello and Patrick Longa and Michael Naehrig},
      title = {Efficient algorithms for supersingular isogeny Diffie-Hellman},
      howpublished = {Cryptology ePrint Archive, Paper 2016/413},
      year = {2016},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.