One of the fundamental hardness assumptions underlying isogeny-based cryptography is the problem of finding a non-trivial endomorphism of a given supersingular elliptic curve. We show that this problem is related to the problem of finding a good splitting of a principally polarized superspecial abelian surface. We provide formal security reductions, as well as a proof-of-concept implementation of an algorithm to compute endomorphisms of elliptic curves by solving the splitting problem.
Instant messaging applications, such as Signal or iMessage, are highly-popular, enabling users to communicate asynchronously in a secure manner. Asynchronous messaging protocols are particularly interesting since they allow the evolution of session keys through ratcheting. This evolution guarantees both Forward Secrecy ( ) —past session keys are protected even upon leakage— and Post-Compromise Secrecy ( ) —following the compromise of a party’s state, future session keys eventually become secure again. Classical ratcheting algorithms, such as the Double Ratchet (proposed by Marlinspike and Perrin) rely on successive Diffie-Hellman key-exchange steps run asynchronously, which essentially amount to Non-Interactive Key-Exchange (NIKE). Yet, such algorithms are not quantum-secure. A recent proposal details RHQC: a double ratchet relying on the HQC Key-Encapsulation Mechanism —KEM— (with modified parameters). The RHQC scheme is optimized compared to a naïve quantum-secure ratchet, such as the one recently proposed in the context of Signal, and uses only two polynomials instead of three. This is possible since the first part of an HQC ciphertext is a syndrome and the public key is also a syndrome, with the same morphology. Unfortunately, we prove in this paper that RHQC is not -secure, contradicting the claims made by the proposing work. Our attack exploits the fact that compromising one of the two endpoints essentially allows the attacker to extract the private ratchet keys of following ratchets, which ensures that healing is never achieved. As, essentially, the ratchet public key is an Ouroboros-like ciphertext, we propose an extraction algorithm called based on , as introduced by Baldelli et al.. This decoder allows us to break the -security of RHQC with overwhelming probability. Additionally, we prove that it is impossible to fix RHQC with a lower complexity than the naïve approach.
In the McEliece public-key encryption scheme, a private key is almost always not determined uniquely by its associated public key. We highlight a structural characterization of equivalent private keys that reduces the cost estimate for a simple private-key search using the support-splitting algorithm (SSA) by a polynomial but practically very substantial factor. In addition, we show how to apply the attack to extended codes in order to further improve the performance of the attack. (All of these techniques appear to be known to experts, but not all details have previously been laid out in the literature.) In addition to spelling out the—thus far—missing details underlying these attack strategies, we provide an optimized software implementation of the SSA for this kind of key search and demonstrate its capabilities in practice by solving a key-recovery challenge with a naïve a-priori cost estimate of 2^91 bit operations in just ≈ 1470 core days, testing ≈ 7700 private-key candidates per core and second in the process. We stress that the speedup from those equivalences on private keys and from our implementation techniques is merely polynomial and does not indicate any weakness in realistic instantiations of the McEliece cryptosystem, whose parameter choices are primarily constrained by decoding attacks rather than ludicrously more expensive key-recovery attacks.
PRISM is an isogeny-based digital signature whose security relies on the problem of computing large prime degree isogenies from a supersingular elliptic curve of unknown endomorphism ring. In this paper, we design SPIDER, a digital signature that builds on a sigma protocol which when given a supersingular elliptic curve E, proves the knowledge of an isogeny ϕ : E→ E' of prime (or non smooth) degree d. SPIDER can hence be seen as a proof of knowledge of a PRISM signature. The latter observation allows us to combine SPIDER and PRISM to obtain an Identity-Based Signature (IBS) which we denote by SPIDER-IBS. SPIDER-IBS is the most efficient and the most compact isogeny-based IBS scheme, as all its predecessors are based on isogeny group actions.
Non-interactive publicly verifiable secret sharing (PVSS) schemes enable the decentralized (re-)sharing of secrets in adversarial environments, allowing anyone to verify the correctness of distributed shares. Such schemes are essential for large-scale decentralized applications, including committee-based systems that require both transparency and robustness. However, existing PVSS schemes rely on group-based cryptography, making them vulnerable to quantum attacks and limiting their suitability for post-quantum applications. In this work, we propose the first practical, fully lattice-based, non-interactive PVSS scheme, grounded on standard lattice assumptions for post-quantum security. At the heart of our design lies a generic framework that transforms vector commitments and linear encryption schemes into practical PVSS protocols. We enhance vector commitments by incorporating proof of smallness, ensuring that encrypted shares are both verifiable and privacy-preserving. Our scheme introduces two tailored lattice-based encryption schemes, each supporting efficient proofs of decryption correctness. This framework provides strong verifiability guarantees while maintaining low proof sizes and computational efficiency.
