A Trade-Off Between Classical And Quantum Circuit Size For An Attack Against Csidh

We propose a heuristic algorithm to solve the underlying hard problem of the CSIDH cryptosystem (and other isogeny-based cryptosystems using elliptic curves with endomorphism ring isomorphic to an imaginary quadratic order O). Let Delta = Disc(O) (in CSIDH, Delta = -4p for p the security parameter). Let 0 < alpha < 1/2, our algorithm requires:A classical circuit of size 2((O) over tilde (log(vertical bar Delta vertical bar)1-alpha)).A quantum circuit of size 2((O) over tilde (log(vertical bar Delta vertical bar)alpha)).Polynomial classical and quantum memory.Essentially, we propose to reduce the size of the quantum circuit below the state-of-the-art complexity 2((O) over tilde (log(vertical bar Delta vertical bar)1/2)) at the cost of increasing the classical circuit-size required. The required classical circuit remains subexponential, which is a superpolynomial improvement over the classical state-of-the-art exponential solutions to these problems. Our method requires polynomial memory, both classical and quantum.