Tessera

Folgen

Krijn Reijnders

@krijn.isogeni.es

Post-doc in post-quantum cryptography. Mostly isogenies nowadays. See krijnreijnders.com

64 Posts164 Follower 99 Folgt

ePrint Updates @eprint.ing.bot · 2w ago

The supersingular isogeny problem in time and memory p^(1/3 + o(1)) (Benjamin Wesolowski) ia.cr/2026/1486

Abstract. We prove that under a plausible heuristic assumption (on the smoothness of certain random integers), the supersingular isogeny problem can be solved in time and memory p^(1/3 + o(1)). This improves upon the previous best complexity of p^(1/2) ⋅ (log p)^(O(1)). This problem is arguably the central hard problem underlying isogeny-based cryptography, and the cost of its resolution is a major (and often the only) factor in the choice of secure parameters. The impact on concrete parameter sets remains to be clarified, as the asymptotic advantage of the new algorithm is mitigated by a superpolynomial overhead hiding in the o(1) exponent, and by its high memory requirement.

COSIC @cosic.bsky.social · 2w ago

We’re excited to announce the 7th edition of the Leuven Isogeny Days (Sept 16–18, 2026)! Registration is now open, join us! More info & signup: esat.kuleuven.be/cosic/projec... #LID #Isogeny #IsogenyDays

ePrint Updates @eprint.ing.bot · 3w ago

The Isogeny Problems (Wouter Castryck, Luca De Feo, Steven D. Galbraith, Péter Kutas, Krijn Reijnders, Benjamin Wesolowski) ia.cr/2026/1431

Abstract. This work contains an exposition of the seven foremost unsolved problems in the domain of isogeny-based cryptography, obtained by asking eleven experts in isogeny-based cryptography what they considered to be the most important unsolved problems in isogeny-based cryptography, and curated down to the seven problems in this document. For each problem, an expert wrote a short write-up giving the precise statements and descriptions per problem.

Krijn Reijnders @krijn.isogeni.es · 3w ago

Excited about isogenies? Wanna claim some rewards? Solve one of the seven Isogeny Problems, the hardest open problems in isogeny-based cryptography! Full write-up now on ePrint: ia.cr/2026/1431 Webpage: isogeni.es/problems Now with EVEN MORE REWARDS!!

The Isogeny Problems

A list of foremost unsolved problems in isogeny-based cryptography, with expositions by leading experts.

isogeni.es

Krijn Reijnders @krijn.isogeni.es · 3w ago

Excited to share that I've been awarded a Veni grant from the NWO! This grant allows me the freedom to explore research of my own choosing, and to achieve faster, better, and simpler post-quantum cryptography using deep mathematical insight. More info: www.ru.nl/en/about-us/...

Veni grants for eight Radboud researchers | Radboud University

The Dutch Research Council (NWO) has awarded a Veni grant to eight young researchers of the Radboud University and Radboudumc.

ru.nl

Paolo Santini @palli-santini.bsky.social · 3w ago

📢 Upcoming online seminar organized by the "UMI Crittografia e Codici" Group 🗣️ Giuseppe D'Alconzo (Telsy S.p.A.) 📅 July 22, 3:00 PM (CEST) Title: Invariants and Group Actions: An Algebraic Attack Framework for Isomorphism Problems More information on 👉 sites.google.com/view/crittog...

Jonathan Komada Eriksen @jonathan.isogeny.club · last mo.

TL;DR: The main idea is that given an p.p.a.v. A and an endomorphism 𝛼 of polarized degree d > 1, the points of A that are "eventually fixed by 𝛼" share similarities to an ab. var. over a finite field (both are naturally Zhat-modules), and thus Bruin's formula for the Tate-pairing generalizes 🥳

ePrint Updates@eprint.ing.bot · last mo.

The Generalised Tate Pairing over any field (Jonathan Komada Eriksen) ia.cr/2026/1325

Abstract. We generalise a pairing on elliptic curves over finite fields, called the generalised Tate pairing, which is defined in terms of an arbitrary endomorphism of the curve, with certain trace requirements. We rederive this pairing from group cohomology, which allows us to generalise the pairing to principally polarized abelian varieties over any field, endomorphisms of any trace, and prove perfectness using a general duality theorem.

ePrint Updates @eprint.ing.bot · 2mo ago

A computational framework for principally polarized abelian varieties and applications (Maria Corte-Real Santos, Etienne Piasecki, Benjamin Wesolowski) ia.cr/2026/1142

Abstract. We construct a new framework for cryptographers to work with principally polarized abelian varieties (PPAVs). This framework offers a computational approach to abelian varieties agnostic to the choice of a coordinate system, culminating in the definition of an efficient model for principally polarised abelian varieties. We exhibit an instantiation of our framework by means of the theta model, thereby streamlining the documented capacities of the model, and extending them with new fundamental algorithms, like the computation of automorphism groups. Our framework focuses on what can be done with these objects, computationally, while relegating low-level considerations to the background, like the specific choice of a coordinate system (and thus the necessity to rely on Mumford’s theory of theta coordinates). We illustrate the utility of our framework by proving that we can interpolate polarised isogenies in any dimension, generalizing to higher dimensions the most disruptive algorithm for elliptic curves in recent years. We prove that this interpolation offers a universal, canonical, and compact way to represent isogenies.

Andrea Basso @andreavbasso.bsky.social · 3mo ago

Round 3 of the NIST additional signatures process announced! 🎉 And SQIsign is part of it!! ⛷️⛷️

Screenshot of email announcement saying:

Nine Candidates Advance to the Third Round of the Additional Digital Signatures for the PQC Standardization Process

After 18 months of evaluation, NIST has selected nine candidates for the third round of the Additional Digital Signatures for the Post-Quantum Cryptography (PQC) Standardization Process. The advancing digital signature algorithms are:

FAEST
HAWK
MAYO
MQOM
QR-UOV
SDitH
SNOVA
SQIsign
UOV

Krijn Reijnders @krijn.isogeni.es · 4mo ago

Even though its not actually post-quantum crypto, I would never pass on a cool application of the Tate pairing: Much faster subgroup membership testing! (the credits go to the rest of the team, though, who write amazingly fast code!!)

ePrint Updates@eprint.ing.bot · 4mo ago

Divide-and-Pair: Faster subgroup membership testing for elliptic curves (Yu Dai, Youssef El Housni, Dimitri Koshelev, Krijn Reijnders) ia.cr/2026/749

Abstract. Subgroup membership testing (SMT) on an elliptic curve with non-trivial cofactor is essential to prevent small-subgroup attacks in cryptographic protocols. In the existing literature, there exist two non-trivial methods for SMT on elliptic curves with modest cofactor (typically a power of 2): Pornin’s approach tests membership by repeatedly dividing by prime divisors of the cofactor (mostly halving), finishing with Legendre symbols; Koshelev’s approach replaces all divisions with Tate pairings (possibly in the quadratic extension of the base field), but requires non-degeneracy conditions that are not always met. In this paper, we observe that both approaches sit at the extremes of a single division-pairing trade-off. The resulting method, Divide-and-Pair, is always at least as fast as either Pornin’s or Koshelev’s method and strictly faster in many cases. We instantiate Divide-and-Pair on five curves in widespread use, including Curve25519, Curve448, GC256A, Fourℚ and JubJub. Our Go implementation, built on the open-source gnark-crypto library, achieves significant speedups over state-of-the-art tests, namely of 2.4× on Curve25519, of 1.6× on Curve448, of 1.7× on GC256A, of 8.2× on Fourℚ and of 7.5× on JubJub.

Luca De Feo @bsky.defeo.lu · 4mo ago

Looking forward to AM-PQC 2026, the Workshop on Algebraic Methods in Post-Quantum Cryptography this August in Macedonia! pqcrypto.cs.ru.nl/ampqc/ Stipends for students are available. Apply before May 4th!

Workshop on Algebraic Methods in Post-Quantum Cryptography 2026

pqcrypto.cs.ru.nl

COSIC @cosic.bsky.social · 4mo ago

Pierre Pébereau just joined COSIC as a postdoc in Fre Vercauteren's team: "I chose COSIC to work with excellent researchers on the analysis of post-quantum signature algorithms." #choosecosic

Deirdre Connolly¹ ² @durumcrustulum.com · 4mo ago

from @bwesterb.bsky.social: bas.westerbaan.name/notes/2026/0...

Factoring is not a good benchmark to track Q-day

Homepage of dr. Bas Westerbaan, principal research engineer at Cloudflare, working on making the Internet post-quantum secure

bas.westerbaan.name

Krijn Reijnders @krijn.isogeni.es · 4mo ago

I should add to this: winner of best paper award at Eurocrypt 2026!! As a single author. During his PhD. Incredible achievement!(protip: he will graduate soon-ish 👀)

Krijn Reijnders @krijn.isogeni.es · last yr.

Single author, fifteen pages, reduces the bit complexity of millenia-old UOV instances!!

@mccurley.bsky.social · 4mo ago

In honor of April Fool's Day (which has already started in Australia), I offer you debrisprint.iacr.org for AI-generated cryptology content.

Craptology debrisPrint Snarkive

debrisprint.iacr.org

Jonathan Komada Eriksen @jonathan.isogeny.club · 4mo ago

Writeup of the crypto-challenge MonoDOOM ETERNAL from #KalmarCTF - A follow up from last-years MonoDOOM challenge, this time with botched side-channel protection! jonathke.github.io/monoDOOM-ETE...

Luca De Feo @bsky.defeo.lu · 5mo ago

We still have a few spots left at MaGIC! Registration closes this week... Hurry up if you want to be on top of all the latest news on Cryptographic Group Actions! magic-workshop.github.io

MaGIC 2026 - Marche Workshop on Group Actions in Cryptography

A workshop dedicated to the study of cryptographic group actions, a rapidly evolving area at the intersection of algebraic geometry, number theory, and post-quantum cryptography. The workshop will bri...

magic-workshop.github.io

Krijn Reijnders @krijn.isogeni.es · 5mo ago

Thomas and I looked at directed isogeny graphs! In dim 1, we often ignore directedness, as there are only 2 "problematic" curves. Not so in dim 2: we analyze the action of automorphisms on level structures and the resulting directed graphs. Crucial: Directed (2,2)-graphs looks Ramanujan after all!

ePrint Updates@eprint.ing.bot · 5mo ago

Expander properties of superspecial isogeny digraphs with level structure (Thomas Decru, Krijn Reijnders) ia.cr/2026/500

Abstract. Charles, Goren and Lauter proved that the supersingular ℓ-isogeny graph is a Ramanujan graph, which is an optimal expander. Jordan and Zaytman argued that this is no longer true in dimension two, but Florit and Smith showed that those graphs exhibit good expansion properties nonetheless. Castryck, Decru and Smith however have pointed out that the higher-dimensional analogue setting should only consider a subset of all edges, namely the paths corresponding to (ℓ^(k), ℓ^(k))-isogenies, so-called good extensions, instead of all (ℓ^(a), ℓ^(b), ℓ^(c), ℓ^(d))-isogenies in general, which contain bad extensions too. Such bad extensions lead to many small cycles in the graph, which are a cryptographic problem due to collisions and a graph-theoretic nuisance as these superfluous edges counteract part of the expansion properties. Restricting to good extensions makes the resulting graph directed, as outgoing edges now depend on the incoming edge. We study (ℓ, ℓ)-level surfaces and (ℓ)^(g)-isogeny digraphs restricted to good extensions for concrete small dimensions and degrees ℓ. These graphs exhibit excellent expander properties: by our heuristic evidence, they are Ramanujan graphs for all primes ℓ in dimension 1, and for ℓ = 2 in dimension 2. Our main conjecture implies that this would still be the case for ℓ = 3 in dimension 2, but not for any larger ℓ in dimension 2, or any ℓ in dimension 3 and up. Furthermore, we generalize the work of Florit and Smith from ℓ = 2 to general primes ℓ, by classifying all abelian surfaces with nontrivial automorphism groups and their actions on their maximal isotropic (ℓ, ℓ)−subgroups.

Maria Corte-Real Santos @maria.isogeny.club · 5mo ago

The second variant (salt-PRISM) is implemented in C. We find that signing is between 1.4 and 1.6 times faster than SQIsign, whereas verification is between 1.2 times slower to 1.01 times faster. Notably, for Level V, salt-PRISM is faster than SQIsign in both. github.com/mariascrs/PR...

GitHub - mariascrs/PRISM_v2: A C implementation of PRISM v2 (the salted variant).

A C implementation of PRISM v2 (the salted variant). - mariascrs/PRISM_v2

github.com

ePrint Updates @eprint.ing.bot · 5mo ago

The principal ideal problem for endomorphism rings of superspecial abelian varieties (Wouter Castryck, Jonathan Komada Eriksen, Riccardo Invernizzi, Frederik Vercauteren) ia.cr/2026/454

Abstract. We describe a Las Vegas algorithm for the principal ideal problem in matrix rings M_(g)(O) for g ≥ 2, over maximal orders O in the rational quaternion algebra B_(p, ∞) ramified at ∞ and a prime number p. Under plausible heuristic assumptions, the method has expected polynomial runtime. An implementation in SageMath shows that it runs very efficiently in practice, with compact output. Our main auxiliary result is a method for finding endomorphisms of superspecial abelian varieties (i.e., powers of supersingular elliptic curves) with a prescribed kernel.

ePrint Updates @eprint.ing.bot · 5mo ago

PRISM with a pinch of salt: Simple, Efficient and Strongly Unforgeable Signatures from Isogenies (Andrea Basso, Giacomo Borin, Wouter Castryck, Maria Corte-Real Santos, Riccardo Invernizzi, Antonin Leroux, Luciano Maino, Frederik Vercauteren, Benjamin Wesolowski) ia.cr/2026/443

Abstract. The problem of computing an isogeny of large prime degree from a supersingular elliptic curve of unknown endomorphism ring is assumed to be hard both for classical as well as quantum computers. In this work, we first build a two-round identification protocol whose security reduces to this problem. The challenge consists of a random large prime q and the prover simply replies with an efficient representation of an isogeny of degree q from its public key. Using the hash-and-sign paradigm, we then derive a signature scheme with a very simple and flexible signing procedure and prove its security in the standard model. The most efficient variant of our signature schemes features a signing which is 1.4× to 1.6× faster than the most recent implementaion of SQIsign, whereas verification ranges from 1.2× slower to 1.01× faster depending on the security level. The sizes of public key and signature are comparable to existing schemes.

Andrea Basso @andreavbasso.bsky.social · 5mo ago

We're organizing a workshop on cryptographic group actions bringing together the isogeny and code communities. The workshop is just before Eurocrypt, a quick train away from Rome in the beautiful Marche. Early registration ends this week, so grab your spot soon! magic-workshop.github.io

MaGIC 2026 - Marche Workshop on Group Actions in Cryptography

magic-workshop.github.io

ePrint Updates @eprint.ing.bot · 6mo ago

Breaking digital signatures from tropical matrix semirings (Alessandro Sferlazza) ia.cr/2026/327

Abstract. In a recent preprint, Grigoriev, Monico, and Shpilrain proposed a digital signature protocol based on the use of matrices over the tropical integer semiring. We show some design flaws of the proposed scheme, together with an efficient attack to forge signatures for an arbitrary message, and a key-recovery attack when given access to a list of honest signatures.

ePrint Updates @eprint.ing.bot · 5mo ago

Tripling on Hessian curves via isogeny decomposition (Thomas Decru, Sabrina Kunzweiler) ia.cr/2026/334

Abstract. We provide a new interpretation of the arithmetic on Hessian Kummer lines using level-3 theta structures. This allows us to break the record for tripling on elliptic curves and their Kummer lines, requiring only 4 multiplications and 4 squarings per tripling for well-chosen curve parameters.

Paolo Santini @palli-santini.bsky.social · 6mo ago

📢📢📢 𝐌𝐚𝐆𝐈𝐂 𝟐𝟎𝟐𝟔 𝐌𝐚𝐫𝐜𝐡𝐞 𝐖𝐨𝐫𝐤𝐬𝐡𝐨𝐩 𝐨𝐧 𝐆𝐫𝐨𝐮𝐩 𝐀𝐜𝐭𝐢𝐨𝐧𝐬 𝐢𝐧 𝐂𝐫𝐲𝐩𝐭𝐨𝐠𝐫𝐚𝐩𝐡𝐲 In May 5-8, let's all gather together to speak about Group Actions! Early registration until March 8! Organized with Marco Baldi, @bsky.defeo.lu, @giacomoborin.bsky.social, @andreavbasso.bsky.social magic-workshop.github.io

MaGIC 2026 - Marche Workshop on Group Actions in Cryptography

magic-workshop.github.io

Paris Marx @parismarx.com · last yr.

Silicon Valley’s alliance with Donald Trump was a mask off moment and showed the world we can’t depend on US tech companies. For the past few months, I’ve been trying to get off US tech and I put together a guide so you find alternatives too. I hope you find it helpful!

Getting off US tech: a guide

I’m in the process of dropping US tech services. Here’s how I did it, and options you should consider.

disconnect.blog

Krijn Reijnders @krijn.isogeni.es · 7mo ago

New year, new pairing

ePrint Updates@eprint.ing.bot · 7mo ago

The Cokernel Pairing (Krijn Reijnders) ia.cr/2026/001

Abstract. We study a new pairing, beyond the Weil and Tate pairing. The Weil pairing is a non-degenerate pairing E[m] × E[m] → μ_(m), which operates on the kernel of [m]. Similarly, when μ_(m) ⊆ 𝔽_(q)^(*), the Tate pairing is a non-degenerate pairing E[m](𝔽_(q)) × E(𝔽_(q))/[m]E(𝔽_(q)) → μ_(m), which connects the kernel and the rational cokernel of [m]. We define a pairing
⟨ ⟩_(m) : E(𝔽_(q))/[m]E(𝔽_(q)) × E(𝔽_(q))/[m]E(𝔽_(q)) → μ_(m)
on the rational cokernels of [m], filling the gap left by the Weil and Tate pairing. When E[m] ⊆ E(𝔽_(q)), this pairing is non-degenerate, and can be computed using three Tate pairings, and two discrete logarithms in μ_(m), assuming a basis for E[m]. For m = ℓ prime, this pairing allows us to study E(𝔽_(q))/[ℓ]E(𝔽_(q)) directly and to simplify the computation for a basis of E[ℓ^(k)], and more generally the Sylow ℓ-torsion. This finds natural applications in isogeny-based cryptography when computing ℓ^(k)-isogenies.

COSIC @cosic.bsky.social · 8mo ago

🎄 Happy holidays from all of us in the COSIC research group! Proof that science is better with friends.

Krijn Reijnders @krijn.isogeni.es · 8mo ago

Dear publishers, this may come as a shock to you, but in general, I do not want to download a tiny .bib file for every reference. I simply want to copy-paste.

Maria Corte-Real Santos @maria.isogeny.club · 9mo ago

Catch up on last weeks Isogeny Club talk! We welcomed Eli Orvis who taught us about abstract isogeny graphs: www.youtube.com/watch?v=Gzcc...

The Isogeny Club #7.4 Ihara zeta functions of abstract isogeny graphs and modular curves

YouTube video by The Isogeny Club

youtube.com