- It's early days to assess the full implications yet, but there is an excellent blog by Stephen Galbraith that seems to indicate that this does not currently apply to all isogeny-based schemes (in particular CSIDH and SQIsign). He writes:
Does it break CSIDH or other isogeny cryptosystems?
No. The attack very specifically relies on two things: (1) that the degree of the secret isogeny is known; (2) the attacker is provided with the auxiliary points. Hence the attack does not seem to break CSIDH or SQISign.
This does not rule out other attacks on these systems (including Chris Peikert's quantum attack in He Gives C-Sieves on the CSIDH). It seems pretty clear than SIKE is dead in the water though (a random "level 5" parameter set has been broken in under one day on a single core).
- The topic of isogeny-based cryptography is still relatively arcane with not many experts. The mathematical breadth of literature on isogenies is much broader than this community. There's also considerable use of results slightly outside of elliptic curve isogenies to more general isogenies. Again, Galbraith writes:
Why was it only discovered now?
The theoretical foundations of the attack are described in a paper by Kani from 1997 (and also some useful tools are in a paper by Howe, Leprévost and Poonen from 2000). So in some sense the attack could have been noticed at any time. But a key point is that this is not an attack one is going to discover by thinking only about isogenies between elliptic curves. The attack deeply exploits Richelot isogenies and products of elliptic curves and I doubt the attack can be expressed meaningfull without that language. This is the power of generalisation and extension. So what was necessary to find the attack was to have a community of scholars studying “esoteric” subjects like extending isogeny crypto to abelian surfaces.
