We are excited to announce the TSVP Thematic Program "Isogeny-Based Cryptography". The program will run from January 13 to February 28, 2026.
A school on "Introduction to Isogeny-based Cryptography" will be held from February 9-13, 2026.
Title: Isogeny-Based Cryptography
Theme of the program: Isogeny-based cryptography is one of the newest branches of post-quantum cryptography. It relies on the hardness of computing isogenies between supersingular elliptic curves. The field of isogeny-based cryptography has blossomed in recent years as isogeny-based assumptions allow one to build a large range of advanced protocols (ring signatures, oblivious pseudorandom functions, oblivious transfer etc. ). Furthermore, the digital signature scheme SQIsign is now competing in NIST’s second post-quantum standardization effort for digital signatures, and is one of only 14 schemes having made it to round 2. SQIsign is a very attractive candidate as it has small public keys and signatures (its downside being that it is slower than its competitors).
Isogeny-based cryptography is a highly interdisciplinary part of cryptography as it lies at the intersection of deep mathematics (higher dimensional abelian varieties, central simple algebras, algebraic number theory), theoretical computer science (building advanced cryptographic schemes from cryptographic group actions) and engineering (providing efficient software and hardware implementations).
Program coordinators
Péter Kutas (Eötvös Loránd University and University of Birmingham)
Carlos Cid (OIST)
Steven Galbraith (University of Auckland)
Jonathan Komada Eriksen (KU Leuven)
Tanja Lange (Eindhoven University of Technology)
Chloe Martindale (University of Bristol)
Tomoki Moriya (Mitsubishi Electric)
Hiroshi Onuki (University of Tokyo)
Tsuyoshi Takagi (University of Tokyo)
Invited Participants
Sarah Arpin (Virginia Tech)
Gustavo Banegas (INRIA)
Andrea Basso (IBM Research Zurich)
Sebastiano Boscardin (Eindhoven University of Technology)
Wouter Castryck (KU Leuven)
Mingjie Chen (KU Leuven)
Jolijn Cottaar (Technische Universiteit Eindhoven)
Luca De Feo (IBM Research Europe)
Thomas Decru (KU Leuven)
Adrian Dina (ELTE-Budapest and Haifa-University)
Steven Duong (University of Wollongong)
Valerie Gilchrist (Université Libre de Bruxelles)
Marc Houben (Inria Bordeaux)
Tomoyoshi Ibukiyama (Osaka University)
Muhammad Imran (University of Birmingham)
Suhri Kim (Sungshin Women's University)
Chelsea Komlo (Near One and University of Waterloo)
Sabrina Kunzweiler (Inria Bordeaux)
Yi-Fu Lai (KU Leuven)
Abel Laval (Université Libre de Bruxelles)
Dania Lazzarini (Université Libre de Bruxelles)
Antonin Robin Leroux (Université de Rennes)
Gioella Lorenzon (KU Leuven, COSIC)
Luciano Maino (University of Birmingham)
Michael Meyer (University of Regensburg)
Mickaël Montessinos (Eötvös Loránd University)
Travis Morrison (Virginia Tech)
Kohei Nakagawa (NTT Social Informatics Laboratories)
Ryo Ohashi (The University of Tokyo)
Massimo Ostuzzi (Ruhr University Bochum)
Lorenz Panny (Technische Universität München)
Ilinca Maria Radulescu (ENS de Lyon and CNRS)
Krijn Reijnders (COSIC, KU Leuven)
Sina Schaeffler (IBM Research Europe and ETH Zurich)
André Schrottenloher (Inria)
Sebastian Spindler (University of the Bundeswehr Munich)
Bruno Sterner (University of Waterloo)
Katsuyuki Takashima (Waseda University)
Ha Tran (University of Alberta)
Monika Trimoska (Eindhoven University of Technology)
Week 1 – Mathematical Foundations
This research group will tackle mathematical problems arising from isogeny-based cryptography, such as: hashing to the supersingular isogeny graph, optimal pathfinding in dimension 1 and 2, Hermitian modules etc.
- Tuesday, January 13 -
10:00 Welcome activity/ice breaker
10:15 Talk: "Shimura class groups" by Adrian Dina
11:00 Introduction of Brainstorming Topics
PM: Brainstorming group discussions
16:00 Teatime
- Wednesday -
10:00: Talk: "Modular polynomials in cryptography" by Sebastian Spindler
PM: Brainstorming group discussions
- Thursday -
10:00: Talk: "Isogeny graphs of abelian varieties and singular ideals in orders" by Sarah Arpin
Abstract: This is joint work with Stefano Marseglia and Caleb Springer. Kohel proved that isogeny graphs of ordinary elliptic curves are beautifully structured objects, now called volcanos. We prove graph structural theorems for abelian varieties of any dimension with commutative endomorphism ring and containing a fixed locally Bass order, leveraging an ideal-theoretic perspective on isogeny graphs. This generalizes previous results, which relied on restrictive additional assumptions, such as maximal real multiplication, ordinary, and absolutely simple (Brooks, Jetchev, Wesolowski 2017). In particular, our work also applies to non-simple and non-ordinary isogeny classes. To obtain our results, we first prove a structure theorem for the lattice of inclusion of the overorders of a locally Bass order in an étale algebra which is of independent interest. This analysis builds on a careful study of local singularities of the orders. We include several examples of volcanoes and isogeny graphs exhibiting unexpected properties ultimately due to our more general setting.
PM: Brainstorming group discussions
15:00 General-audience Talk: "Kangaroos, Card Tricks and Discrete Logarithms" by Steven Galbraith in L5D23
- Friday -
10:00: Talk "Zeta functions of isogeny graphs and modular curves" by Travis Morrison
Abstract: Isogeny graphs of supersingular elliptic curves have broad application, from the study and computation of modular forms to post-quantum cryptography. This is in part because the family of q-isogeny graphs in characteristic p (with prime p varying, for a fixed prime q) is Ramanujan. One tool for studying a graph is its Ihara zeta function, defined as an Euler product over the primes of the graph. Defining the zeta function formally requires a graph in the sense of Serre and Bass, i.e. a directed graph equipped with a fixed-point free involution on the edge set. In general, isogeny graphs fail to be graphs in this sense. In this talk, I will discuss joint work with Lau, Orvis, Scullard, and Zobernig in which we introduce abstract isogeny graphs along with their zeta functions; these graphs capture the combinatorial structure of supersingular isogeny graphs (with level structure) . I will survey some of our results, including an analogue of Ihara’s determinant formula, showing in particular that the zeta function is rational. We use this formula and the Eichler-Shimura relation to give a formula relating the zeta function of a q-isogeny graph with level-H structure (for certain H, including B0(N) and B1(N)) to the Hasse-Weil zeta functions of two associated modular curves over the finite field Fq, generalizing results of Hashimoto, Sugiyama, and Lei-Muller.
all activities will be held in the Visiting Program area Lab5 EF03
Week 2 – Cryptanalysis
This research group will cryptanalyze advanced cryptographic constructions from isogenies such as verifiable random functions, OPRFs and blind signatures. The exact targets will depend on the schemes available at that time as the field is rapidly growing. On the constructive side this group will provide new reductions between hard problems.
- Monday, January 19, in L5EF03 -
10:00 Welcome activity/ice breaker
10:15 Massimo Ostuzzi: "Just Guess - Improved Quantum Algorithm for the Underdetermined MQ Problem"
11:00 Brainstorming topics
PM: Group discussions
16:00 Teatime
- Tuesday, in L5EF03 -
10:00: Mingjie Chen: "Lie algebras and security of cryptosystems based on classical varieties in disguise"
PM: Brainstorming group discussions
15:00 General-audience Talk in L5D23: "Standardization Effort of Post-Quantum Cryptography" by Péter Kutas
- Wednesday, in L5EF03 -
10:00 Mickael Montessinos: "Equivalent computational problems for superspecial surfaces"
PM: Brainstorming group discussions
- Thursday, in L5D23 -
10:00 Career panel in L5D23 with Steven Galbraith (University of Auckland), Hiroshi Onuki (University of Tokyo) and Monika Trimoska (TU Eindhoven)
PM: Brainstorming group discussions
- Friday, in L5EF11 -
10:00 Sabrina Kunzweiler: "Endomorphisms of elliptic curves and the splitting problem"
PM: Brainstorming group discussions
Week 3 – Efficient isogeny computations
This research group will look into more efficient algorithms for evaluating isogenies between elliptic curves and, more generally, between abelian varieties. This is a highly important technical challenge in isogeny-based cryptography and breakthroughs require a multidisciplinary approach (theoretical advances and optimized implementations)
- Monday, January 26, in L5DE13 -
10:00 Welcome activity/ice breaker
10:15 Talk: "Abelian surfaces in Hesse form and explicit isogeny formulas" by Sabrina Kunzweiler
Abstract: In this talk, I will present a novel method for the computation of (3, 3)-isogenies between principally polarized abelian surfaces. The idea is to work with models in 8-dimensional projective space induced by a symmetric level-3 theta structure. In this setting, the action of three-torsion points is linear, and the isogeny formulas can be described in a simple way as the composition of easy-to-evaluate maps. In the description of these formulas, the relation with the Burkhardt quartic threefold plays an important role. Furthermore, we discuss generalizations of the idea to higher dimensions as well as different isogeny degrees. This is joint work with Thomas Decru.
PM: Brainstorming group discussions
16:00 Teatime
- Tuesday, in L5DE13 -
10:00 Green zone
A low-risk, high-freedom session for exploringing ideas, and asking questions. Participants are encouraged to propose bold, unconventional ideas, and ask "stupid" questions which they have not dared to ask before. The wildest ideas will be rewarded.
PM: Brainstorming group discussions
- Wednesday, in L5DE13 -
10:00: Group reports from brainstorming
PM: Brainstorming group discussions
- Thursday, in L5D23 -
10:00 Lightning talks
A series of short (5-20 minute) talks, prepared by participants in advance. We also encurage participants to request specific lightning talks from other workshop participants.
PM: Brainstorming group discussions
- Friday, in L5EF03 -
10:00: Brainstorming group discussions
PM: Final group reports, concluding the brainstorming
Week 4 – Protocols
This research group will investigate designing advanced protocols from isogenies. Post-quantum standardization only focuses on signatures and KEMs but real-world applications often require more specialized primitives. This could be a great collaboration opportunity with the Applied Cryptography group of OIST.
- Monday in L5DE13 -
10:00 Welcome activity/ice breaker
10:15 Bruno Sterner: "Large Smooth Twins from Short Lattice Vectors"
PM: Brainstorming group discussions
16:00 Teatime in L5EF03
- Tuesday in L5DE13 -
10:00: Kohei Nakagawa: "Attacks on PRISM-id via Torsion over Small Extension Fields"
PM: Brainstorming group discussions
- Wednesday in L5DE13 -
10:00: Group reports from brainstorming
PM: Brainstorming group discussions
- Thursday in L5D23 -
10:00 Wouter Castryck: "Kernel-to-ideal conversion in higher dimension"
PM: Brainstorming group discussions
- Friday in L5D23 -
10:00 Talk by Andrea Basso
PM: Brainstorming group discussions
Week 5 – School: "Introduction to Isogeny-based Cryptography"
Isogeny-based cryptography is a fast-moving field, and recent developments have introduced several new techniques, making the barrier of entry particularly high for young researchers wishing to work in the field. To aid new researchers in the field is the aim of this "summer" school, which introduces all of the many essential tools that are used today. Among the topics to be covered are the correspondences between ideals and isogenies that give rise to both the Deuring correspondence, which is an essential part of protocols such as SQIsign, and the class group action on CM curves and oriented supersingular curves, which gives other cryptographic primitives such as CSIDH and SCALLOP. Further, higher dimensional abelian varieties and isogenies between these have recently become an integral part of isogeny-based cryptography, providing huge improvements to many existing protocols, as well as creating new protocols.
Week 6 – Efficient implementations
This research group will tackle the problem of efficient software and hardware implementations of isogeny-based protocols. Potential projects could include hardware acceleration for isogenies or side-channel resistant implementations of SQIsign.
Week 7 – Quantum cryptanalysis
This research group will focus on quantum algorithms related to isogeny-based cryptography. This requires again a diverse collaboration between researchers in algebraic quantum algorithms and cryptographers. This is also a great area for collaboration with several OIST research groups focused on quantum.
