Paper 2024/459

Isogeny problems with level structure

Luca De Feo, IBM Research Europe, Zürich, Switzerland
Tako Boris Fouotsa, EPFL, Lausanne, Switzerland
Lorenz Panny, Technische Universität München, Germany

Given two elliptic curves and the degree of an isogeny between them, finding the isogeny is believed to be a difficult problem---upon which rests the security of nearly any isogeny-based scheme. If, however, to the data above we add information about the behavior of the isogeny on a large enough subgroup, the problem can become easy, as recent cryptanalyses on SIDH have shown. Between the restriction of the isogeny to a full $N$-torsion subgroup and no ''torsion information'' at all lies a spectrum of interesting intermediate problems, raising the question of how easy or hard each of them is. Here we explore modular isogeny problems where the torsion information is masked by the action of a group of $2\times 2$ matrices. We give reductions between these problems, classify them by their difficulty, and link them to security assumptions found in the literature.

Available format(s)
Attacks and cryptanalysis
Publication info
A minor revision of an IACR publication in EUROCRYPT 2024
IsogeniesPost-quantumSecurity reductions.
Contact author(s)
eurocrypt24 @ defeo lu
tako fouotsa @ epfl ch
lorenz @ yx7 cc
2024-03-22: approved
2024-03-18: received
See all versions
Short URL
Creative Commons Attribution


      author = {Luca De Feo and Tako Boris Fouotsa and Lorenz Panny},
      title = {Isogeny problems with level structure},
      howpublished = {Cryptology ePrint Archive, Paper 2024/459},
      year = {2024},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.