I am looking for a strong alternative to elliptic curve cryptography. It should be something that could face quantum computing attacks, but nothing created by the NSA.
I heard about isogeny key exchange, i.e. supersingular isogeny, is it really secure? Otherwise, what would be an alternative that fulfills the above?
In addition, what would be a post-quantum algorithm for file encryption? Perhaps snow 3g?
Supersingular isogenies are a rather recent attempt at post quantum security. You will have a hard time finding an efficient and secure implementation, and even if you write one yourself, the algorithms have not yet seen that much cryptanalysis. (Although that's a subjective judgement call.)
If post quantum security wasn't a concern, you could choose from any number of non-NSA elliptic curves. However, quantum computers, if practical, can break elliptic curves (using Shor's algorithm).
NTRU is, like the other answer notes, a more practical and established alternative for post quantum cryptography. It still isn't necessarily as efficient or well studied as elliptic curves, though. As a practical matter the main implementation is under GPLv2.
For key exchange there is also the "new hope" lattice algorithm which is being field-tested by Google as a possible successor of ECC in TLS. (Personally I find this to be one of the likelier algorithms to see use, but I would not use it – alone – for anything important yet.)
For file encryption, or anything that works with a secret key, you can use existing symmetric algorithms. You may want to choose a key size of at least 256-bits, though, to account for the quantum Grover's attack. SNOW 3G in particular isn't post quantum secure for that reason – it has a 128-bit key. Other standardized general purpose ciphers like AES-256 or something on the eSTREAM portfolio (Salsa20 at least has a 256-bit key) would work fine.
If you need security against quantum attacks, there aren't that many options. I would go for a lattice-based encryption like NTRU or something based on ring learning with errors. There are no "magic numbers" involved and the assumptions they are based on have been scrutinized by the academic community.
NTRU has been around for a decade and has pretty good implementations. If you want to go with RLWE, which is based on a slightly better cryptographic assumption, there is an open source project implementing some of the more mature ideas called HElib (besides being quantum-resistant they are also interesting because of their homomorphic properties). None of the implementations are as complete as you will get with EC crypto yet though.
There is some software available for the isogeny key exchange. It was developed by one of the designers of the key exchange (DeFeo). It is available on GitHub her:
https://github.com/defeo/ss-isogeny-software/
The key exchange was first published in late 2011 and its security has held up under analysis since then. A 2014 paper from Indocrypt supports the security of the scheme.
http://cacr.uwaterloo.ca/techreports/2014/cacr2014-24.pdf
Luiz
You can take a look at Dan Berstein's Curve25519. It's a non-NIST, non-NSA curve and he has his own adaptation of DSA that goes with it. However, I suppose it's possible to parallelize an attack on this, so it may not be resistant to quantum computing attacks.
As for symmetric encryption, it's important to note that AES was developed by the international community and is considered by most to NOT have NSA fingerprints on it. As you probably already know, it is the defacto symmetric encryption standard of today.
