Was anyone using SIKE in production when it was broken?

Cloudflare deployed SIKE in their hybrid TLS experiment in 2019-2020. They were quick to remove it after Castryck-Decru. No production users were exposed because hybrid TLS still had the classical X25519 leg.

Are CSIDH-using deployments safe?

CSIDH wasn't directly affected by Castryck-Decru; the attack used SIDH-specific torsion-point-image structure that CSIDH doesn't share. CSIDH remains believed-secure but is research-stage; not in production deployment.

Should we keep isogeny crypto in our long-term planning?

Yes — at the level of "monitor the field; consider when production-mature." Don't budget for isogeny deployment in your current PQ migration.

What about quantum attacks on isogenies?

Best classical attack on supersingular isogeny problem: subexponential (better than lattices' exponential). Quantum attacks: similar improvements as classical, no Shor-equivalent. Isogenies' quantum-security margin is reasonable but smaller than lattice schemes.

Is there a "next isogeny scheme" race like the NIST PQC?

NIST's "additional signatures" round is a smaller-scale equivalent. Multiple isogeny-based candidates are being evaluated. Result expected 2025-2027.

Isogeny-Based Cryptography — SIKE's Death, CSIDH and SQISign Future, and the Lessons for PQ Migration

Read as

Isogeny-based cryptography uses maps between elliptic curves — a different mathematical structure from RSA, ECC, or lattices. SIKE, a NIST PQ finalist, was killed by Castryck-Decru in 2022 (a brilliant attack that runs on a laptop in an hour, removing SIKE from production candidates). Successors — CSIDH, SQISign, SCALLOP — continue research-stage. Isogenies remain interesting for niche cases (smaller keys than lattices) but won’t compete with ML-KEM for general PQ deployment in this decade. This module is the technical post-mortem and the current isogeny landscape.

SIKE’s death is the cleanest cautionary tale in recent cryptography — algorithm reaches NIST PQC Round 4 (the final round before standardisation), then is broken in a polynomial-time classical attack. The lesson: even rigorously evaluated cryptography can fall to clever new attacks. Diversification across mathematical assumptions matters.

What an isogeny is

An isogeny is a non-constant rational map between two elliptic curves, defined over the same finite field, that’s a group homomorphism on the points. Intuitively: if you have two curves E₁ and E₂, an isogeny φ: E₁ → E₂ takes points on E₁ to points on E₂ in a way that preserves the curve’s group structure.

The cryptographic problem: given two curves and the promise that they’re isogenous, find the isogeny between them. Classically, this requires walking through the “isogeny graph” — a graph where nodes are curves and edges are isogenies of small degree. The walk problem is exponential time classically.

Want this for your team?

Custom team training + practitioner advisory

Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.

Book team training call Replies in 4 working hrs · India-only · Senior consultants

Isogeny-Based Cryptography — SIKE’s Death, CSIDH and SQISign Future, and the Lessons for PQ Migration

What an isogeny is

Custom team training + practitioner advisory

Other modules in this track

What is Quantum Computing — Qubits, Superposition, Entanglement (Beginner)

Why Quantum Matters for Cybersecurity — The Post-Quantum Threat in Plain English

Shor’s Algorithm Explained — Why RSA and ECC Will Break