Tessera

Folgen

Jonathan Komada Eriksen

@jonathan.isogeny.club

Post-doc at COSIC, probably more known for dubious rhymes than research.

19 Posts80 Follower 30 Folgt

ePrint Updates @eprint.ing.bot · 2w ago

Identity-Based Encryption from Isogenies (Shweta Agrawal, Andrea Basso, Sikhar Patranabis) ia.cr/2026/1457

Abstract. We provide the first construction of identity-based encryption from isogeny-based assumptions. Security of our construction relies on a novel assumption called the “CDH with Mismatched Torsion” (CD-HwMT) assumption, which we introduce. At a high level, the assumption posits the hardness of solving a CDH-like problem even when the adversary is given some additional “safe” leakage. We justify our assumption by showing that, in the Algebraic Isogeny Model, our assumption reduces to well-known assumptions from the literature.

As a bonus feature, our identity-based encryption enjoys anonymity, which means that the ciphertexts hide not only the message but also the target identity. We additionally obtain the first isogeny based constructions of laconic oblivious transfer, as well as public-key encryption that simultaneously satisfies security against high-rate key leakage and key-dependent message/circular security from the CDHwMT assumption. All our constructions can be conjectured to be post-quantum secure.

At the heart of our results lie several new techniques, which we believe will help in building even more advanced cryptography in isogeny-land.

COSIC @cosic.bsky.social · 2w ago

We’re excited to announce the 7th edition of the Leuven Isogeny Days (Sept 16–18, 2026)! Registration is now open, join us! More info & signup: esat.kuleuven.be/cosic/projec... #LID #Isogeny #IsogenyDays

Krijn Reijnders @krijn.isogeni.es · 3w ago

Excited about isogenies? Wanna claim some rewards? Solve one of the seven Isogeny Problems, the hardest open problems in isogeny-based cryptography! Full write-up now on ePrint: ia.cr/2026/1431 Webpage: isogeni.es/problems Now with EVEN MORE REWARDS!!

The Isogeny Problems

A list of foremost unsolved problems in isogeny-based cryptography, with expositions by leading experts.

isogeni.es

Krijn Reijnders @krijn.isogeni.es · 3w ago

Excited to share that I've been awarded a Veni grant from the NWO! This grant allows me the freedom to explore research of my own choosing, and to achieve faster, better, and simpler post-quantum cryptography using deep mathematical insight. More info: www.ru.nl/en/about-us/...

Veni grants for eight Radboud researchers | Radboud University

The Dutch Research Council (NWO) has awarded a Veni grant to eight young researchers of the Radboud University and Radboudumc.

ru.nl

Jonathan Komada Eriksen @jonathan.isogeny.club · 4w ago

This summer has been a dream come true. That is worth celebrating. In life, its easy to get lost in working for you own personal goals. But, I can 100% say that this feeling of love, hope and togetherness surpasses the joy I could EVER feel over any personal achievement ❤️

Damien Robert @damienrobert.bsky.social · last mo.

It's been a while since I last posted about MIKE, but a lot of exciting stuff happened meanwhile. MIKE is described in more details in this 4 part thread: - CSIDH bsky.app/profile/dami... - SIDH bsky.app/profile/dami... - MIKE bsky.app/profile/dami... - Speculations: bsky.app/profile/dami...

Damien Robert@damienrobert.bsky.social · 6mo ago

# Part 1: CSIDH

Jonathan Komada Eriksen @jonathan.isogeny.club · last mo.

TL;DR: The main idea is that given an p.p.a.v. A and an endomorphism 𝛼 of polarized degree d > 1, the points of A that are "eventually fixed by 𝛼" share similarities to an ab. var. over a finite field (both are naturally Zhat-modules), and thus Bruin's formula for the Tate-pairing generalizes 🥳

ePrint Updates@eprint.ing.bot · last mo.

The Generalised Tate Pairing over any field (Jonathan Komada Eriksen) ia.cr/2026/1325

Abstract. We generalise a pairing on elliptic curves over finite fields, called the generalised Tate pairing, which is defined in terms of an arbitrary endomorphism of the curve, with certain trace requirements. We rederive this pairing from group cohomology, which allows us to generalise the pairing to principally polarized abelian varieties over any field, endomorphisms of any trace, and prove perfectness using a general duality theorem.

Andrea Basso @andreavbasso.bsky.social · 3mo ago

Round 3 of the NIST additional signatures process announced! 🎉 And SQIsign is part of it!! ⛷️⛷️

Screenshot of email announcement saying:

Nine Candidates Advance to the Third Round of the Additional Digital Signatures for the PQC Standardization Process

After 18 months of evaluation, NIST has selected nine candidates for the third round of the Additional Digital Signatures for the Post-Quantum Cryptography (PQC) Standardization Process. The advancing digital signature algorithms are:

FAEST
HAWK
MAYO
MQOM
QR-UOV
SDitH
SNOVA
SQIsign
UOV

Tjerand Silde @tjesi.bsky.social · 3mo ago

We have two openings at our Department of Information Security and Communication Technology at NTNU: Associate Professor in Cryptographic Engineering: www.jobbnorge.no/en/available... Professor/Associate Professor in Mobile and Computer Networks: www.jobbnorge.no/en/available... Apply by June 12!

Aleksei Udovenko @affine.group · 3mo ago

The paper shows how to find affine maps agreeing with an S-box on as many as possible inputs. Look for presentation at #Eurocrypt 2026 today! The code is already available. Also check out a vide-coded interactive tool, it's fun to play with: affine.group/pages/greedy...

Greedy Extension (DDT) Algorithm

affine.group

ePrint Updates@eprint.ing.bot · 3mo ago

Algorithmic Toolkit for Linearization of S-boxes (Alex Biryukov, Philip Tureček, Aleksei Udovenko) ia.cr/2026/913

Abstract. Linearization is a cryptanalysis technique in which a nonlinear function (an S-box) is represented by an affine mapping on a certain subset of inputs. Its variants were applied to analyze Keccak, LowMC, RAIN and AIM. In these primitives, the S-boxes are either very small (up to 5 bits) or are very specific monomial functions over a binary field. Linearization of arbitrary S-boxes was never practically explored due to the lack of theoretic, algorithmic, and cryptanalytic understanding.

For the first time, we develop an algorithmic toolkit which allows one to compute strong linearizations of S-boxes, when they exist. For up to n = 8 bits, our algorithms are able to find provably the best possible approximations, while for larger S-boxes it is feasible to obtain good approximations together with meaningful upper bounds. We apply our algorithms to a variety of S-boxes from existing primitives, to monomial functions, to so-called APN functions, and to 16-bit Super-Sboxes. We obtain interesting results raising many new open questions and open up new research directions, as well as a foundation for developing cryptanalytic attacks.

To advance the cryptanalytic utility of linearization, we study and solve the problem of covering an S-box with multiple approximations. As an application, we derive a generic linearization approach for the CICO problem (constrained-input-constrained-output) over SPN-based permutations (Substitution-Permutation Networks) with general linear layers. This is the first such general cryptanalysis based on the existence of a strong linearization of the S-box.

Jonathan Komada Eriksen @jonathan.isogeny.club · 4mo ago

Might be a bit late on this post, but wanted to take the opportunity to praise my PhD supervisor Colin Boyd, after he became an IACR Fellow this year iacr.org/fellows/2026... ! I think few people can claim to have had a positive impact on as many people's lives as Colin!

Colin Boyd, 2026 IACR Fellow

iacr.org

Damien Robert @damienrobert.bsky.social · 4mo ago

By the way as you know lately I have been thinking about cubical structures in terms of derived quadratic forms, and although a bit conceptual it is *amazing* for having a better understanding of what we can do with them. For instance the monodromy leak can be explained in a paragraph:

Jonathan Komada Eriksen @jonathan.isogeny.club · 4mo ago

Writeup of the crypto-challenge MonoDOOM ETERNAL from #KalmarCTF - A follow up from last-years MonoDOOM challenge, this time with botched side-channel protection! jonathke.github.io/monoDOOM-ETE...

Kalmarunionen @kalmarunionendm.bsky.social · 4mo ago

#KalmarCTF is currently well underway - and we’re once again featuring prizes sponsored by @hex-rays.bsky.social and Zellic ! Come play along by visiting kalmarc.tf

Maria Corte-Real Santos @maria.isogeny.club · 5mo ago

New PRISM improvements 🥳 We extended our PRISM paper to present two new variants: one that achieves strong unforgeability, and another that allows for smaller parameters and therefore faster signatures! eprint.iacr.org/2026/443.pdf

eprint.iacr.org

Tjerand Silde @tjesi.bsky.social · 6mo ago

Published an opinion piece (in Norwegian) about PQC (yay) vs QKD (buu) in @digi.no today, together with @jonathan.isogeny.club, Kristian Gjøsteen (NTNU), Øyvind Ytrehus (UiB), and Morten Øygarden (UiB): www.digi.no/artikler/deb...

Spekulativ kvanteteknologi løser ikke sikkerhetsproblemene våre

Kvantedatamaskiner kan i fremtiden knekke dagens kryptografi. Derfor må vi sikre at data som sendes i dag ikke kan leses av morgendagens angripere.

digi.no

Damien Robert @damienrobert.bsky.social · 6mo ago

Continuation and end of the thread started here: bsky.app/profile/dami... # Part 4: Speculations Previously: - Part 1: CSIDH bsky.app/profile/dami... - Part 2: SIDH bsky.app/profile/dami... - Part 3: MIKE bsky.app/profile/dami...

Damien Robert@damienrobert.bsky.social · 6mo ago

I am very happy to announce that thanks to the hard work of many people (The "MIKE Team"), we now have a working implementation in SageMath of MIKE (Module Isogeny Key Exchange).

Damien Robert @damienrobert.bsky.social · 6mo ago

I am very happy to announce that thanks to the hard work of many people (The "MIKE Team"), we now have a working implementation in SageMath of MIKE (Module Isogeny Key Exchange).

arXiv math.AG Algebraic Geometry @mathag-bot.bsky.social · 7mo ago

Thomas Decru, Sabrina Kunzweiler: Abelian surfaces in Hesse form and explicit isogeny formulas https://arxiv.org/abs/2601.05922 https://arxiv.org/pdf/2601.05922 https://arxiv.org/html/2601.05922

Tanja Lange @hyperelliptic.bsky.social · 7mo ago

Bit of a last-minute announcement: school on isogenies 9 - 13 Feb at Okinawa Institute of Science and Technology (OIST) groups.oist.jp/tsvp/event/s... Registration deadline is tomorrow (15 Jan).

School: Introduction to Isogeny-based Cryptography (TSVP-TP25IC)

Title: "Introduction to Isogeny-based Cryptography" Abstract: Isogeny-based cryptography is a fast-moving field, and recent developments have introduced several new techniques, making the barrier of e...

groups.oist.jp

Krijn Reijnders @krijn.isogeni.es · 7mo ago

New year, new pairing

ePrint Updates@eprint.ing.bot · 7mo ago

The Cokernel Pairing (Krijn Reijnders) ia.cr/2026/001

Abstract. We study a new pairing, beyond the Weil and Tate pairing. The Weil pairing is a non-degenerate pairing E[m] × E[m] → μ_(m), which operates on the kernel of [m]. Similarly, when μ_(m) ⊆ 𝔽_(q)^(*), the Tate pairing is a non-degenerate pairing E[m](𝔽_(q)) × E(𝔽_(q))/[m]E(𝔽_(q)) → μ_(m), which connects the kernel and the rational cokernel of [m]. We define a pairing
⟨ ⟩_(m) : E(𝔽_(q))/[m]E(𝔽_(q)) × E(𝔽_(q))/[m]E(𝔽_(q)) → μ_(m)
on the rational cokernels of [m], filling the gap left by the Weil and Tate pairing. When E[m] ⊆ E(𝔽_(q)), this pairing is non-degenerate, and can be computed using three Tate pairings, and two discrete logarithms in μ_(m), assuming a basis for E[m]. For m = ℓ prime, this pairing allows us to study E(𝔽_(q))/[ℓ]E(𝔽_(q)) directly and to simplify the computation for a basis of E[ℓ^(k)], and more generally the Sylow ℓ-torsion. This finds natural applications in isogeny-based cryptography when computing ℓ^(k)-isogenies.

Jonathan Komada Eriksen @jonathan.isogeny.club · 10mo ago

TL;DR: See title 🥳

ePrint Updates@eprint.ing.bot · 10mo ago

qt-Pegasis: Simpler and Faster Effective Class Group Actions (Pierrick Dartois, Jonathan Komada Eriksen, Riccardo Invernizzi, Frederik Vercauteren) ia.cr/2025/1859

Abstract. In this paper, we revisit the recent PEGASIS algorithm that computes an effective group action of the class group of any imaginary quadratic order R on a set of supersingular elliptic curves primitively oriented by R. Although PEGASIS was the first algorithm showing the practicality of computing unrestricted class group actions at higher security levels, it is complicated and prone to failures, which leads to many rerandomizations.

In this work, we present a new algorithm, qt-Pegasis, which is much simpler, but at the same time faster and removes the need for rerandomization of the ideal we want to act with, since it never fails. It leverages the main technique of the recent qlapoti approach. However, qlapoti solves a norm equation in a quaternion algebra, which corresponds to the full endomorphism ring of a supersingular elliptic curve. We show that the algorithm still applies in the quadratic setting, by embedding the quadratic ideal into a quaternion ideal using a technique similar to the one applied in KLaPoTi. This way, we can reinterpret the output of qlapoti as four equivalent quadratic ideals, instead of two equivalent quaternion ideals. We then show how to construct a Clapoti-like diagram in dimension 2, which embeds the action of the ideal in a 4-dimensional isogeny.

We implemented our qt-Pegasis algorithm in SageMath for the CSURF group action, and we achieve a speedup over PEGASIS of 1.8× for the 500-bit parameters and 2.6× for the 4000-bit parameters.

ePrint Updates @eprint.ing.bot · 10mo ago

Olingo: Threshold Lattice Signatures with DKG and Identifiable Abort (Kamil Doruk Gur, Patrick Hough, Jonathan Katz, Caroline Sandsbråten, Tjerand Silde) ia.cr/2025/1789

Abstract. We present Olingo, a framework for threshold lattice signatures that is the first to offer all desired properties for real-world implementations of quantum-secure threshold signatures: small keys and signatures, low communication and round complexity, non-interactive online signing, distributed key generation (DKG), and identifiable abort.

Our starting point is the framework of Gur, Katz, and Silde (PQCrypto 2024). We change the underlying signature scheme to Raccoon (Katsumata et al., Crypto 2024), remove the trapdoor commitments, and apply numerous improvements and optimizations to achieve all the above properties. We provide detailed proofs of security for our new framework and present concrete parameters and benchmarks.

At the 128-bit security level, for up to 1024 parties and supporting 2⁶⁰ signatures, our scheme has 2.6 KB public keys and 9.7 KB signatures; while signing requires communication of 953 KB per party. Using the LaBRADOR proof system (Beullens and Seiler, Crypto 2023), this can be further reduced to 596 KB. An optimistic non-interactive version of our scheme requires only 83 KB communication per party.

Maria Corte-Real Santos @maria.isogeny.club · 10mo ago

For those who missed it, the recording is live! www.youtube.com/watch?v=lvhh...

The Isogeny Club #7.1 Large smooth twins from short lattice vectors

YouTube video by The Isogeny Club

youtube.com

Damien Robert @damienrobert.bsky.social · 11mo ago

And you solve the failure rate problem, which was a big source of trouble in the previous implementation. And the new algorithm is simpler to implement! So very exciting result! (Although I had been spoiled already by @jonathan.isogeny.club talk at Bordeaux in May :))

Krijn Reijnders @krijn.isogeni.es · 11mo ago

Announcing The Isogeny Problems! A curated list of the seven foremost unsolved problems in isogeny-based cryptography. Solving one of these profound questions would mark a monumental advance, and as a resolver you'd get eternal honor and epic rewards! Full list: isogeni.es/problems

The Isogeny Problems

isogeni.es

Jonathan Komada Eriksen @jonathan.isogeny.club · 11mo ago

... The paper might have been out for less than 24 hours, but that is clearly plenty for yx7 to implement a more computer-algebra friendly implementation that works for any "nice" order! 🥳🥳 github.com/yyyyx4/qlapo...

GitHub - yyyyx4/qlapoti-sage: Qlapoti algorithm, generalized — a simple Sage implementation.

Qlapoti algorithm, generalized — a simple Sage implementation. - yyyyx4/qlapoti-sage

github.com

ePrint Updates@eprint.ing.bot · 11mo ago

Qlapoti: Simple and Efficient Translation of Quaternion Ideals to Isogenies (Giacomo Borin, Maria Corte-Real Santos, Jonathan Komada Eriksen, Riccardo Invernizzi, Marzio Mula, Sina Schaeffler, Frederik Vercauteren) ia.cr/2025/1604

Abstract. The main building block in isogeny-based cryptography is an algorithmic version of the Deuring correspondence, called IdealToIsogeny. This algorithm takes as input left ideals of the endomorphism ring of a supersingular elliptic curve and computes the associated isogeny. Building on ideas from QFESTA, the Clapoti framework by Page and Robert reduces this problem to solving a certain norm equation. The current state of the art is however unable to efficiently solve this equation, and resorts to a relaxed version of it instead. This impacts not only the efficiency of the IdealToIsogeny procedure, but also its success probability. The latter issue has to be mitigated with complex and memory-heavy rerandomization procedures, but still leaves a gap between the security analysis and the actual implementation of cryptographic schemes employing IdealToIsogeny as a subroutine. For instance, in SQIsign the failure probability is still 2⁻⁶⁰ which is not cryptographically negligible.

The main contribution of this paper is a very simple and efficient algorithm called Qlapoti which approaches the norm equation from Clapoti directly, solving all the aforementioned problems at once. First, it makes the IdealToIsogeny subroutine between 2.2 and 2.6 times faster. This signigicantly improves the speed of schemes using this subroutine, including notably SQIsign and . On top of that, Qlapoti has a cryptographically negligible failure probability. This eliminates the need for rerandomization, drastically reducing memory consumption, and allows for cleaner security reductions.

Maria Corte-Real Santos @maria.isogeny.club · 11mo ago

TL;DR: we solve norm equations in a better way and get around a 2x improvement to IdealToIsogeny routines crucial in both SQIsign and PRISM.

ePrint Updates@eprint.ing.bot · 11mo ago

ePrint Updates @eprint.ing.bot · 11mo ago