A note on the security of CSIDH

Abstract

We propose a quantum algorithm for computing an isogeny between two elliptic curves E1,E2 defined over a finite field such that there is an imaginary quadratic order O satisfying O ≃ End(E i ) for i = 1,2. This concerns ordinary curves and supersingular curves defined over F p (the latter used in the recent CSIDH proposal). Our algorithm has heuristic asymptotic run time (Formula Presented) and requires polynomial quantum memory and (Formula Presented) quantumly accessible classical memory, where Δ is the discriminant of O. This asymptotic complexity outperforms all other available methods for computing isogenies. We also show that a variant of our method has asymptotic run time (Formula Presented) while requesting only polynomial memory (both quantum and classical).