CSIDH: Commutative Supersingular Isogeny DH

• CSIDH is a post-quantum Diffie–Hellman protocol built on a commutative ideal-class-group action on supersingular elliptic curves defined over prime fields.
• It encodes secrets as short exponent vectors on split prime ideals while generating exceptionally small public keys through low-degree isogeny compositions.
• Implementations require constant-time algorithms to mitigate side-channel attacks and face subexponential quantum attack challenges inherent to the commutative structure.

Commutative supersingular isogeny Diffie–Hellman (CSIDH) is a post-quantum Diffie–Hellman protocol built from a commutative ideal-class-group action on supersingular elliptic curves defined over the prime field $\mathbb{F}_p$. In the standard construction one chooses a prime of the form $p = 4\prod_i \ell_i - 1$, encodes a secret as a short exponent vector on split prime ideals of norm $\ell_i$, and computes public and shared curves by composing low-degree isogenies. The scheme combines a principal-homogeneous-space formulation with exceptionally small public keys, but the literature also emphasizes three enduring constraints: expensive group-action evaluation, the need for constant-time execution under side-channel attack models, and subexponential quantum attacks specific to the commutative setting (Smith, 2018, Bagheri et al., 14 Aug 2025).

1. Algebraic framework

CSIDH works with supersingular elliptic curves over $\mathbb{F}_p$ in Montgomery form

$$E_A: y^2 = x^3 + A x^2 + x,\qquad A\in\mathbb{F}_p.$$

For a supersingular curve $E/\mathbb{F}_p$, the Frobenius endomorphism satisfies $\pi^2=-p$ in $\operatorname{End}(E)$, and restricting to $\mathbb{F}_p$-endomorphisms yields a commutative quadratic order, written in the sources as either $\mathbb{Z}[\pi]$ or $p = 4\prod_i \ell_i - 1$0. The public space is the set of supersingular Montgomery curves over $p = 4\prod_i \ell_i - 1$1, and the relevant algebraic structure is the ideal class group $p = 4\prod_i \ell_i - 1$2 of the corresponding imaginary quadratic order $p = 4\prod_i \ell_i - 1$3 (Cervantes-Vázquez et al., 2019, Smith, 2018).

The action is expressed by ideal-quotient isogenies. For an invertible ideal $p = 4\prod_i \ell_i - 1$4, one defines

$p = 4\prod_i \ell_i - 1$5

Because $p = 4\prod_i \ell_i - 1$6 is abelian, the action is commutative; because it is faithful and transitive on the relevant set of isomorphism classes, the curve set can be viewed as a principal homogeneous space for the class group. In the CSIDH parameterization, each split prime $p = 4\prod_i \ell_i - 1$7 corresponds to conjugate ideals, and a secret is represented by exponents applied to those prime-ideal classes (Cervantes-Vázquez et al., 2019, Smith, 2018).

A complementary description uses binary quadratic forms. Xiao, Zhou, Deng, and Qu establish a one-to-one correspondence between $p = 4\prod_i \ell_i - 1$8-isomorphism classes of supersingular elliptic curves and primitive reduced binary quadratic forms with discriminant $p = 4\prod_i \ell_i - 1$9 or $\ell_i$0, and they show that $\ell_i$1-isogeny operations are compatible with composition of quadratic forms (Xiao et al., 2022). This places the CSIDH action inside the classical arithmetic of imaginary quadratic orders rather than treating it as an isolated cryptographic construction.

2. Protocol mechanics and isogeny evaluation

In the formulation used for CSIDH-512 hardware, one fixes the base curve

$\ell_i$2

lets the prime have the form

$\ell_i$3

and represents a private key by an exponent vector

$\ell_i$4

corresponding to the class

$\ell_i$5

The public key is obtained by applying $\ell_i$6 to $\ell_i$7 through a chain of isogenies of degrees $\ell_i$8, yielding a new Montgomery parameter $\ell_i$9. If Alice publishes $\mathbb{F}_p$0 and Bob publishes $\mathbb{F}_p$1, then Alice computes $\mathbb{F}_p$2 and Bob computes $\mathbb{F}_p$3; commutativity gives $\mathbb{F}_p$4, and the shared secret is extracted from the common resulting curve (Bagheri et al., 14 Aug 2025).

The standard protocol description in the side-channel literature is equivalent: public parameters are $\mathbb{F}_p$5, the factor base $\mathbb{F}_p$6, and the base curve $\mathbb{F}_p$7; each party samples a short exponent vector $\mathbb{F}_p$8 with $\mathbb{F}_p$9; public-key generation computes the class-group action by iteratively finding points of order $$E_A: y^2 = x^3 + A x^2 + x,\qquad A\in\mathbb{F}_p.$$0 in the appropriate kernel and applying low-degree quotient isogenies; and the shared key is the common curve obtained by applying each secret action to the other party’s public curve (Cervantes-Vázquez et al., 2019).

The computational core is odd-degree isogeny evaluation. For an isogeny $$E_A: y^2 = x^3 + A x^2 + x,\qquad A\in\mathbb{F}_p.$$1 of degree $$E_A: y^2 = x^3 + A x^2 + x,\qquad A\in\mathbb{F}_p.$$2, one chooses a kernel point $$E_A: y^2 = x^3 + A x^2 + x,\qquad A\in\mathbb{F}_p.$$3 and writes $$E_A: y^2 = x^3 + A x^2 + x,\qquad A\in\mathbb{F}_p.$$4 in projective $$E_A: y^2 = x^3 + A x^2 + x,\qquad A\in\mathbb{F}_p.$$5 coordinates. Then for $$E_A: y^2 = x^3 + A x^2 + x,\qquad A\in\mathbb{F}_p.$$6,

$$E_A: y^2 = x^3 + A x^2 + x,\qquad A\in\mathbb{F}_p.$$7

The same source gives a more efficient projective update for the curve parameter:

$$E_A: y^2 = x^3 + A x^2 + x,\qquad A\in\mathbb{F}_p.$$8

with $$E_A: y^2 = x^3 + A x^2 + x,\qquad A\in\mathbb{F}_p.$$9 and $E/\mathbb{F}_p$0 (Bagheri et al., 14 Aug 2025).

3. Security assumptions, attacks, and structural reductions

The basic hard problem is vectorization: given two curves in the same class-group orbit, recover the hidden ideal class that maps one to the other. In CSIDH notation this is the problem of recovering $E/\mathbb{F}_p$1 from $E/\mathbb{F}_p$2 and $E/\mathbb{F}_p$3. The related Diffie–Hellman problem is parallelization: given public outputs corresponding to $E/\mathbb{F}_p$4 and $E/\mathbb{F}_p$5, compute the common output corresponding to $E/\mathbb{F}_p$6. The survey literature explicitly distinguishes these problems and emphasizes that they are the class-group-action analogues of discrete logarithm and computational Diffie–Hellman in ordinary group-based cryptography (Smith, 2018).

Biasse, Iezzi, and Jacobson describe the fastest known asymptotic quantum algorithms in the commutative setting. Their “high-memory” method has heuristic running time

$E/\mathbb{F}_p$7

with polynomial quantum memory and $E/\mathbb{F}_p$8 classical memory, while their “low-memory” method has heuristic running time

$E/\mathbb{F}_p$9

with polynomial memory on both the quantum and classical sides. Applied to CSIDH, their analysis concludes that the original CSIDH-512, CSIDH-1024, and CSIDH-1792 parameter sets no longer achieve their claimed quantum-security levels, and that restoring $\pi^2=-p$0 bits of quantum security requires choosing $\pi^2=-p$1 with bit-length on the order of $\pi^2=-p$2 (Biasse et al., 2018).

A different structural reduction is given by Xiao–Zhou–Deng–Qu. They show that operations of $\pi^2=-p$3-isogenies on supersingular curves are compatible with composition in the form class group, and they reduce CSIDH security to explicitly computing the correspondence between a supersingular curve over $\pi^2=-p$4 and the associated reduced binary quadratic form (Xiao et al., 2022). A plausible implication is that CSIDH security can be studied not only through isogeny-path algorithms and hidden-shift methods, but also through the computability of curve-to-form and form-to-curve translations.

4. Constant-time algorithms and side-channel hardening

Naive CSIDH is not constant-time. In the original variable-time version, the number of isogeny steps and the running time depend on the secret vector, leaking the distribution of positive and negative exponents and the absolute values $\pi^2=-p$5 through timing or power analysis. Two constant-time strategies were proposed before the 2019 refinements: the Meyer–Campos–Reith approach re-parameterized all exponents into $\pi^2=-p$6 and used dummy isogenies to ensure a fixed number of steps, while the Onuki–Aikawa–Yamazaki–Takagi approach returned to signed exponents in $\pi^2=-p$7 and executed exactly five real or dummy isogenies per prime according to the sign of the secret (Cervantes-Vázquez et al., 2019).

Cervantes-Vélez et al. identified two oversights in those constant-time designs. First, deterministic reuse of a small set of Elligator inputs caused the number of Elligator trials to depend on the curve parameter $\pi^2=-p$8, which is secret-dependent. Second, special-case handling of $\pi^2=-p$9 created a small but observable timing difference if a walk visited that curve. Their repair uses randomized projective Elligator, uniform treatment of all curves, Edwards arithmetic in place of repeated Montgomery/Edwards conversions, and precomputed optimal differential addition chains for the known products of small primes. They report that the combined chain length is approximately $\operatorname{End}(E)$0 rather than $\operatorname{End}(E)$1 for the Montgomery ladder, giving about $\operatorname{End}(E)$2 savings in scalar multiplication cost, and they state that Edwards arithmetic and differential addition chains yield up to $\operatorname{End}(E)$3 speed-up in constant-time CSIDH (Cervantes-Vázquez et al., 2019).

The same paper also treats fault injection, especially for static keys in embedded hardware. Its dummy-free algorithm samples exponents from a parity-constrained set so that each exponent can be rewritten as the sum of exactly $\operatorname{End}(E)$4 signs $\operatorname{End}(E)$5, eliminating secret-dependent dummy operations. The authors report field-operation counts per CSIDH action of $\operatorname{End}(E)$6 million multiplications, $\operatorname{End}(E)$7 million squarings, and $\operatorname{End}(E)$8 million additions for their OAYT-style variant, versus $\operatorname{End}(E)$9 million multiplications, $\mathbb{F}_p$0 million squarings, and $\mathbb{F}_p$1 million additions for the dummy-free variant. On an Intel i7-6700K at $\mathbb{F}_p$2 with Turbo off, they report $\mathbb{F}_p$3 cycles for the OAYT-style implementation, $\mathbb{F}_p$4 cycles for the MCR-style implementation, and $\mathbb{F}_p$5 cycles for the dummy-free implementation (Cervantes-Vázquez et al., 2019).

The paper further discusses a derandomized variant that restricts exponents to $\mathbb{F}_p$6, removes Elligator and runtime randomness, and uses larger primes. Its stated performance trade-off is an overall slowdown of approximately $\mathbb{F}_p$7–$\mathbb{F}_p$8, together with a larger field size of approximately $\mathbb{F}_p$9 bits at $\mathbb{Z}[\pi]$0-bit classical security (Cervantes-Vázquez et al., 2019). This places constant-time CSIDH on a continuum from faster randomized constant-time implementations to dummy-free and fully derandomized designs.

5. Hardware realization and performance baselines

The 2025 hardware study describes itself as the first comprehensive hardware study of CSIDH and establishes a public baseline on both FPGA and ASIC platforms. Its architecture has two major blocks: a control unit implemented as a hierarchy of finite-state machines and a shared arithmetic logic unit containing a $\mathbb{Z}[\pi]$1-bit modular adder, subtractor, and Montgomery multiplier. The top-level FSM executes constant-time CSIDH public-key generation and invokes five sub-FSMs—xDBLADD, xMul, xISOG, xAffinize, and xTwist—each of which sequences ALU operations and returns control to the top FSM on completion (Bagheri et al., 14 Aug 2025).

At the datapath level, $\mathbb{Z}[\pi]$2-bit operands are partitioned into $\mathbb{Z}[\pi]$3 words of $\mathbb{Z}[\pi]$4 bits. The adder/subtractor uses a two-cycle carry-select pipeline. The multiplier is a parallelized schoolbook design that processes $\mathbb{Z}[\pi]$5-bit chunks against all $\mathbb{Z}[\pi]$6 words of the other operand in parallel, completing a $\mathbb{Z}[\pi]$7-bit multiplication in $\mathbb{Z}[\pi]$8 cycles on FPGA and $\mathbb{Z}[\pi]$9 cycles on the $p = 4\prod_i \ell_i - 1$00 ASIC flow. Montgomery reduction adds approximately $p = 4\prod_i \ell_i - 1$01 cycles, for a total of approximately $p = 4\prod_i \ell_i - 1$02 cycles per Montgomery modular multiplication (Bagheri et al., 14 Aug 2025).

Platform	Clock cycles and frequency	Key-generation latency
Xilinx Zynq UltraScale+ FPGA	$p = 4\prod_i \ell_i - 1$03 cycles at $p = 4\prod_i \ell_i - 1$04	$p = 4\prod_i \ell_i - 1$05
ASIC ($p = 4\prod_i \ell_i - 1$06 process)	$p = 4\prod_i \ell_i - 1$07 cycles at approximately $p = 4\prod_i \ell_i - 1$08	$p = 4\prod_i \ell_i - 1$09

The same study reports a $p = 4\prod_i \ell_i - 1$10-bit multiply time of $p = 4\prod_i \ell_i - 1$11 and a Montgomery multiply time of $p = 4\prod_i \ell_i - 1$12 at $p = 4\prod_i \ell_i - 1$13. Resource utilization for the $p = 4\prod_i \ell_i - 1$14-bit design is $p = 4\prod_i \ell_i - 1$15 LUTs, $p = 4\prod_i \ell_i - 1$16 FF, and $p = 4\prod_i \ell_i - 1$17 DSPs on FPGA, and $p = 4\prod_i \ell_i - 1$18 gates with area $p = 4\prod_i \ell_i - 1$19 on ASIC, corresponding to a $p = 4\prod_i \ell_i - 1$20 die. Constant-time enforcement is explicit: the exponent vector stores $p = 4\prod_i \ell_i - 1$21 for every $p = 4\prod_i \ell_i - 1$22, the FSM always performs exactly $p = 4\prod_i \ell_i - 1$23 isogenies of degree $p = 4\prod_i \ell_i - 1$24, dummy steps still run full isogeny evaluation before discarding outputs, and a masked ALU toggles the add, subtract, and multiply sub-units every cycle with random inputs on inactive units to equalize switching activity (Bagheri et al., 14 Aug 2025).

The paper situates these results against other post-quantum designs. It reports that Kyber key generation is below $p = 4\prod_i \ell_i - 1$25 and uses $p = 4\prod_i \ell_i - 1$26 LUTs, while SIDH/SIKE is approximately $p = 4\prod_i \ell_i - 1$27 at $p = 4\prod_i \ell_i - 1$28 LUTs; by that comparison, CSIDH key generation is approximately $p = 4\prod_i \ell_i - 1$29 slower but offers $p = 4\prod_i \ell_i - 1$30-byte public keys rather than approximately $p = 4\prod_i \ell_i - 1$31 for Kyber (Bagheri et al., 14 Aug 2025). The significance of the study is therefore not raw speed but the establishment of a constant-time, sub-second hardware baseline for a commutative isogeny protocol.

6. Related constructions, extensions, and distinctions

CSIDH is often discussed alongside SIDH and SIKE, but the survey literature draws a sharp distinction. CSIDH works over $p = 4\prod_i \ell_i - 1$32, uses a commutative class-group action, and publishes a single curve invariant in $p = 4\prod_i \ell_i - 1$33; SIDH works over $p = 4\prod_i \ell_i - 1$34, uses a non-commutative supersingular endomorphism-ring setting with an asymmetric two-prime structure, and publishes extra torsion images. The same survey notes that CSIDH implementations are more compact and require less memory, while optimized SIDH offers different performance trade-offs (Smith, 2018).

The higher-degree supersingular group actions studied by De Feo and collaborators generalize the CSIDH model from $p = 4\prod_i \ell_i - 1$35 over $p = 4\prod_i \ell_i - 1$36 to supersingular $p = 4\prod_i \ell_i - 1$37-structures over $p = 4\prod_i \ell_i - 1$38. In that setting one has a free transitive action of $p = 4\prod_i \ell_i - 1$39 on the set $p = 4\prod_i \ell_i - 1$40, where $p = 4\prod_i \ell_i - 1$41, and key generation again proceeds by forming a class

$p = 4\prod_i \ell_i - 1$42

and applying successive low-degree isogenies. Their analysis states that each $p = 4\prod_i \ell_i - 1$43-isogeny step costs $p = 4\prod_i \ell_i - 1$44 field operations in $p = 4\prod_i \ell_i - 1$45 together with extra $p = 4\prod_i \ell_i - 1$46 work to push the $p = 4\prod_i \ell_i - 1$47-isogeny through the step, so the per-step cost is about $p = 4\prod_i \ell_i - 1$48 times that of CSIDH. The stated attack costs are approximately $p = 4\prod_i \ell_i - 1$49 classically and subexponential $p = 4\prod_i \ell_i - 1$50 quantumly (Chenu et al., 2021).

OSIDH extends the same line of thought by replacing the trivial $p = 4\prod_i \ell_i - 1$51 orientation with a hidden nontrivial orientation in an imaginary quadratic order and using modular-polynomial paths on supersingular isogeny graphs over $p = 4\prod_i \ell_i - 1$52. The OSIDH paper explicitly presents the construction as generalizing CSIDH while altering the implementation model and security assumptions around hidden orientations and descending $p = 4\prod_i \ell_i - 1$53-chains (Colò et al., 2020).

A more implementation-driven branch is represented by CTIDH, dCTIDH, and the 2025 hardened dummy-free deterministic variant. Banegas, Hellenbrand, and Saldanha describe CTIDH and dCTIDH as CSIDH-like group-action protocols, then give what they describe as the first dummy-free implementation of deterministic CTIDH. Their reported costs are roughly $p = 4\prod_i \ell_i - 1$54–$p = 4\prod_i \ell_i - 1$55 $p = 4\prod_i \ell_i - 1$56-multiplications and median times of $p = 4\prod_i \ell_i - 1$57–$p = 4\prod_i \ell_i - 1$58 Gcyc for dCTIDH-2048-194 and dCTIDH-2048-205, approximately $p = 4\prod_i \ell_i - 1$59 faster than CTIDH and more than $p = 4\prod_i \ell_i - 1$60 faster than dCSIDH, while remaining deterministic, constant-time, and fully dummy-free (Banegas et al., 16 Sep 2025). This suggests a broader design space in which CSIDH serves as the base commutative class-group-action template, while later constructions explore different positions in the trade-off space among determinism, dummy-freeness, batching structure, and performance.