---
title: 'CSIDH: Commutative Supersingular Isogeny DH'
url: https://www.emergentmind.com/topics/commutative-supersingular-isogeny-diffie-hellman-csidh-93be134c-2985-40d3-8768-8e9b84be8a24
type: topic
---

# CSIDH: Commutative Supersingular Isogeny DH

Commutative supersingular isogeny Diffie–Hellman (CSIDH) is a post-quantum Diffie–Hellman protocol built from a commutative ideal-class-group action on supersingular elliptic curves defined over the prime field $\mathbb{F}_p$. In the standard construction one chooses a prime of the form $p = 4\prod_i \ell_i - 1$, encodes a secret as a short exponent vector on split prime ideals of norm $\ell_i$, and computes public and shared curves by composing low-degree isogenies. The scheme combines a principal-homogeneous-space formulation with exceptionally small public keys, but the literature also emphasizes three enduring constraints: expensive group-action evaluation, the need for constant-time execution under side-channel attack models, and subexponential quantum attacks specific to the commutative setting [1809.04803, 2508.11082].

## 1. Algebraic framework

CSIDH works with supersingular elliptic curves over $\mathbb{F}_p$ in Montgomery form
$$
E_A: y^2 = x^3 + A x^2 + x,\qquad A\in\mathbb{F}_p.
$$
For a supersingular curve $E/\mathbb{F}_p$, the Frobenius endomorphism satisfies $\pi^2=-p$ in $\operatorname{End}(E)$, and restricting to $\mathbb{F}_p$-endomorphisms yields a commutative quadratic order, written in the sources as either $\mathbb{Z}[\pi]$ or $\mathbb{Z}[\sqrt{-p}]$. The public space is the set of supersingular Montgomery curves over $\mathbb{F}_p$, and the relevant algebraic structure is the ideal class group $\mathrm{Cl}(\mathcal{O})$ of the corresponding imaginary quadratic order $\mathcal{O}$ [1907.08704, 1809.04803].

The action is expressed by ideal-quotient isogenies. For an invertible ideal $\mathfrak{a}\subset\mathcal{O}$, one defines
$$
[\mathfrak a] * E = E/E[\mathfrak a],\qquad
E[\mathfrak a] = \bigcap_{\alpha\in\mathfrak a}\ker(\alpha).
$$
Because $\mathrm{Cl}(\mathcal{O})$ is abelian, the action is commutative; because it is faithful and transitive on the relevant set of isomorphism classes, the curve set can be viewed as a principal homogeneous space for the class group. In the CSIDH parameterization, each split prime $\ell_i$ corresponds to conjugate ideals, and a secret is represented by exponents applied to those prime-ideal classes [1907.08704, 1809.04803].

A complementary description uses binary quadratic forms. Xiao, Zhou, Deng, and Qu establish a one-to-one correspondence between $\mathbb{F}_p$-isomorphism classes of supersingular elliptic curves and primitive reduced binary quadratic forms with discriminant $-p$ or $-16p$, and they show that $\mathbb{F}_p$-isogeny operations are compatible with composition of quadratic forms [2203.02097]. This places the CSIDH action inside the classical arithmetic of imaginary quadratic orders rather than treating it as an isolated cryptographic construction.

## 2. Protocol mechanics and isogeny evaluation

In the formulation used for CSIDH-512 hardware, one fixes the base curve
$$
E_0: y^2 = x^3 + x,
$$
lets the prime have the form
$$
p = 4\cdot \ell_1\cdot \ell_2\cdots \ell_n - 1,
$$
and represents a private key by an exponent vector
$$
e=(e_1,\ldots,e_n),\qquad e_i\in[-m,+m],
$$
corresponding to the class
$$
[a]=\prod_i \ell_i^{e_i}\in \mathrm{Cl}(\mathbb{Z}[\pi]).
$$
The public key is obtained by applying $[a]$ to $E_0$ through a chain of isogenies of degrees $\ell_i$, yielding a new Montgomery parameter $A_{\text{pub}}\in\mathbb{F}_p$. If Alice publishes $A=[a]\cdot E_0$ and Bob publishes $B=[b]\cdot E_0$, then Alice computes $S_A=[a]\cdot E_B$ and Bob computes $S_B=[b]\cdot E_A$; commutativity gives $S_A=S_B=E_{AB}$, and the shared secret is extracted from the common resulting curve [2508.11082].

The standard protocol description in the side-channel literature is equivalent: public parameters are $p$, the factor base $\{\ell_i\}$, and the base curve $E_0:y^2=x^3+x$; each party samples a short exponent vector $e=(e_i)$ with $e_i\in[-m_i,m_i]$; public-key generation computes the class-group action by iteratively finding points of order $\ell_i$ in the appropriate kernel and applying low-degree quotient isogenies; and the shared key is the common curve obtained by applying each secret action to the other party’s public curve [1907.08704].

The computational core is odd-degree isogeny evaluation. For an isogeny $\phi:E\to E'$ of degree $\ell=2d+1$, one chooses a kernel point $K\in E[\ell]$ and writes $(X_i:Z_i)=[i]K$ in projective $X:Z$ coordinates. Then for $P=(X:Z)$,
$$
\phi(P)=
\Bigl(
X \cdot \bigl(\prod_{i=1}^d ((X-Z)(X_i+Z_i) + (X+Z)(X_i-Z_i))\bigr)^2 :
Z \cdot \bigl(\prod_{i=1}^d ((X-Z)(X_i+Z_i) - (X+Z)(X_i-Z_i))\bigr)^2
\Bigr).
$$
The same source gives a more efficient projective update for the curve parameter:
$$
(A_x' : A_z') =
\Bigl(2\cdot((A+2)^\ell \cdot \pi_+^8 + (A-2)^\ell \cdot \pi_-^8)^2 :
((A+2)^\ell \cdot \pi_+^8 - (A-2)^\ell \cdot \pi_-^8)\Bigr),
$$
with $\pi_+ = \prod (X_i+Z_i)$ and $\pi_- = \prod (X_i-Z_i)$ [2508.11082].

## 3. Security assumptions, attacks, and structural reductions

The basic hard problem is vectorization: given two curves in the same class-group orbit, recover the hidden ideal class that maps one to the other. In CSIDH notation this is the problem of recovering $[\mathfrak a]$ from $E_0$ and $[\mathfrak a]*E_0$. The related Diffie–Hellman problem is parallelization: given public outputs corresponding to $[\mathfrak a]$ and $[\mathfrak b]$, compute the common output corresponding to $[\mathfrak a\mathfrak b]$. The survey literature explicitly distinguishes these problems and emphasizes that they are the class-group-action analogues of discrete logarithm and computational Diffie–Hellman in ordinary group-based cryptography [1809.04803].

Biasse, Iezzi, and Jacobson describe the fastest known asymptotic quantum algorithms in the commutative setting. Their “high-memory” method has heuristic running time
$$
T_1(\Delta)=\exp(O(\sqrt{\log|\Delta|})),
$$
with polynomial quantum memory and $\exp(O(\sqrt{\log|\Delta|}))$ classical memory, while their “low-memory” method has heuristic running time
$$
T_2(\Delta)=\exp\!\left(\left(\frac{1}{\sqrt 2}+o(1)\right)\sqrt{\ln|\Delta|\,\ln\ln|\Delta|}\right)
$$
with polynomial memory on both the quantum and classical sides. Applied to CSIDH, their analysis concludes that the original CSIDH-512, CSIDH-1024, and CSIDH-1792 parameter sets no longer achieve their claimed quantum-security levels, and that restoring $\lambda$ bits of quantum security requires choosing $p$ with bit-length on the order of $\lambda^2$ [1806.03656].

A different structural reduction is given by Xiao–Zhou–Deng–Qu. They show that operations of $\mathbb{F}_p$-isogenies on supersingular curves are compatible with composition in the form class group, and they reduce CSIDH security to explicitly computing the correspondence between a supersingular curve over $\mathbb{F}_p$ and the associated reduced binary quadratic form [2203.02097]. A plausible implication is that CSIDH security can be studied not only through isogeny-path algorithms and hidden-shift methods, but also through the computability of curve-to-form and form-to-curve translations.

## 4. Constant-time algorithms and side-channel hardening

Naive CSIDH is not constant-time. In the original variable-time version, the number of isogeny steps and the running time depend on the secret vector, leaking the distribution of positive and negative exponents and the absolute values $|e_i|$ through timing or power analysis. Two constant-time strategies were proposed before the 2019 refinements: the Meyer–Campos–Reith approach re-parameterized all exponents into $[0,10]$ and used dummy isogenies to ensure a fixed number of steps, while the Onuki–Aikawa–Yamazaki–Takagi approach returned to signed exponents in $[-5,5]$ and executed exactly five real or dummy isogenies per prime according to the sign of the secret [1907.08704].

Cervantes-Vélez et al. identified two oversights in those constant-time designs. First, deterministic reuse of a small set of Elligator inputs caused the number of Elligator trials to depend on the curve parameter $A$, which is secret-dependent. Second, special-case handling of $A=0$ created a small but observable timing difference if a walk visited that curve. Their repair uses randomized projective Elligator, uniform treatment of all curves, Edwards arithmetic in place of repeated Montgomery/Edwards conversions, and precomputed optimal differential addition chains for the known products of small primes. They report that the combined chain length is approximately $1.5\log_2(k)$ rather than $2\log_2(k)$ for the Montgomery ladder, giving about $25\%$ savings in scalar multiplication cost, and they state that Edwards arithmetic and differential addition chains yield up to $40\%$ speed-up in constant-time CSIDH [1907.08704].

The same paper also treats fault injection, especially for static keys in embedded hardware. Its dummy-free algorithm samples exponents from a parity-constrained set so that each exponent can be rewritten as the sum of exactly $m_i$ signs $\pm1$, eliminating secret-dependent dummy operations. The authors report field-operation counts per CSIDH action of $0.657$ million multiplications, $0.210$ million squarings, and $0.691$ million additions for their OAYT-style variant, versus $1.319$ million multiplications, $0.423$ million squarings, and $1.389$ million additions for the dummy-free variant. On an Intel i7-6700K at $4\,\mathrm{GHz}$ with Turbo off, they report $239\,\mathrm{k}$ cycles for the OAYT-style implementation, $337\,\mathrm{k}$ cycles for the MCR-style implementation, and $481\,\mathrm{k}$ cycles for the dummy-free implementation [1907.08704].

The paper further discusses a derandomized variant that restricts exponents to $\{-1,0,1\}$, removes Elligator and runtime randomness, and uses larger primes. Its stated performance trade-off is an overall slowdown of approximately $5$–$10\times$, together with a larger field size of approximately $1500$ bits at $128$-bit classical security [1907.08704]. This places constant-time CSIDH on a continuum from faster randomized constant-time implementations to dummy-free and fully derandomized designs.

## 5. Hardware realization and performance baselines

The 2025 hardware study describes itself as the first comprehensive hardware study of CSIDH and establishes a public baseline on both FPGA and ASIC platforms. Its architecture has two major blocks: a control unit implemented as a hierarchy of finite-state machines and a shared arithmetic logic unit containing a $512$-bit modular adder, subtractor, and Montgomery multiplier. The top-level FSM executes constant-time CSIDH public-key generation and invokes five sub-FSMs—xDBLADD, xMul, xISOG, xAffinize, and xTwist—each of which sequences ALU operations and returns control to the top FSM on completion [2508.11082].

At the datapath level, $512$-bit operands are partitioned into $16$ words of $32$ bits. The adder/subtractor uses a two-cycle carry-select pipeline. The multiplier is a parallelized schoolbook design that processes $32$-bit chunks against all $16$ words of the other operand in parallel, completing a $512\times512$-bit multiplication in $22$ cycles on FPGA and $23$ cycles on the $180\,\mathrm{nm}$ ASIC flow. Montgomery reduction adds approximately $65$ cycles, for a total of approximately $87$ cycles per Montgomery modular multiplication [2508.11082].

| Platform | Clock cycles and frequency | Key-generation latency |
|---|---:|---:|
| Xilinx Zynq UltraScale+ FPGA | $1.03\times10^8$ cycles at $200\,\mathrm{MHz}$ | $515\,\mathrm{ms}$ |
| ASIC ($180\,\mathrm{nm}$ process) | $1.065\times10^8$ cycles at approximately $180\,\mathrm{MHz}$ | $591\,\mathrm{ms}$ |

The same study reports a $512\times512$-bit multiply time of $110\,\mathrm{ns}$ and a Montgomery multiply time of $435\,\mathrm{ns}$ at $200\,\mathrm{MHz}$. Resource utilization for the $512$-bit design is $66.3\,\mathrm{k}$ LUTs, $47\,\mathrm{k}$ FF, and $128$ DSPs on FPGA, and $566\,\mathrm{k}$ gates with area $12.75\,\mathrm{mm}^2$ on ASIC, corresponding to a $4.1\times4.1\,\mathrm{mm}^2$ die. Constant-time enforcement is explicit: the exponent vector stores $\pm m$ for every $\ell_i$, the FSM always performs exactly $|e^{\mathrm{ct}}_i|$ isogenies of degree $\ell_i$, dummy steps still run full isogeny evaluation before discarding outputs, and a masked ALU toggles the add, subtract, and multiply sub-units every cycle with random inputs on inactive units to equalize switching activity [2508.11082].

The paper situates these results against other post-quantum designs. It reports that Kyber key generation is below $10\,\mu\mathrm{s}$ and uses $14\,\mathrm{k}$ LUTs, while SIDH/SIKE is approximately $9\,\mathrm{ms}$ at $90\,\mathrm{k}$ LUTs; by that comparison, CSIDH key generation is approximately $10^3\times$ slower but offers $64$-byte public keys rather than approximately $1\,\mathrm{kB}$ for Kyber [2508.11082]. The significance of the study is therefore not raw speed but the establishment of a constant-time, sub-second hardware baseline for a commutative isogeny protocol.

## 6. Related constructions, extensions, and distinctions

CSIDH is often discussed alongside SIDH and SIKE, but the survey literature draws a sharp distinction. CSIDH works over $\mathbb{F}_p$, uses a commutative class-group action, and publishes a single curve invariant in $\mathbb{F}_p$; SIDH works over $\mathbb{F}_{p^2}$, uses a non-commutative supersingular endomorphism-ring setting with an asymmetric two-prime structure, and publishes extra torsion images. The same survey notes that CSIDH implementations are more compact and require less memory, while optimized SIDH offers different performance trade-offs [1809.04803].

The higher-degree supersingular group actions studied by De Feo and collaborators generalize the CSIDH model from $d=1$ over $\mathbb{F}_p$ to supersingular $(d,\varepsilon)$-structures over $\mathbb{F}_{p^2}$. In that setting one has a free transitive action of $\mathrm{Cl}(\mathcal{O})$ on the set $\mathcal{D}_{d,\varepsilon}$, where $\mathcal{O}=\mathbb{Z}[\sqrt{-dp}]$, and key generation again proceeds by forming a class
$$
[\mathfrak a]=\prod_i \mathfrak l_i^{\,e_i}
$$
and applying successive low-degree isogenies. Their analysis states that each $\ell$-isogeny step costs $O(\ell)$ field operations in $\mathbb{F}_{p^2}$ together with extra $O(d)$ work to push the $d$-isogeny through the step, so the per-step cost is about $d$ times that of CSIDH. The stated attack costs are approximately $O((pd)^{1/4})$ classically and subexponential $L_{dp}[1/2,\sqrt 2]$ quantumly [2107.08832].

OSIDH extends the same line of thought by replacing the trivial $\mathbb{Z}[\pi]$ orientation with a hidden nontrivial orientation in an imaginary quadratic order and using modular-polynomial paths on supersingular isogeny graphs over $\mathbb{F}_{p^2}$. The OSIDH paper explicitly presents the construction as generalizing CSIDH while altering the implementation model and security assumptions around hidden orientations and descending $\ell$-chains [2012.10803].

A more implementation-driven branch is represented by CTIDH, dCTIDH, and the 2025 hardened dummy-free deterministic variant. Banegas, Hellenbrand, and Saldanha describe CTIDH and dCTIDH as CSIDH-like group-action protocols, then give what they describe as the first dummy-free implementation of deterministic CTIDH. Their reported costs are roughly $357{,}000$–$362{,}000$ $\mathbb{F}_p$-multiplications and median times of $1.59$–$1.60$ Gcyc for dCTIDH-2048-194 and dCTIDH-2048-205, approximately $5\%$ faster than CTIDH and more than $4\times$ faster than dCSIDH, while remaining deterministic, constant-time, and fully dummy-free [2509.12877]. This suggests a broader design space in which CSIDH serves as the base commutative class-group-action template, while later constructions explore different positions in the trade-off space among determinism, dummy-freeness, batching structure, and performance.

Source: https://www.emergentmind.com/topics/commutative-supersingular-isogeny-diffie-hellman-csidh-93be134c-2985-40d3-8768-8e9b84be8a24