Prof. Dr. rer. nat. Osmanbey Uzunkol

Recently, Daghigh et al. proposed some isogeny-based key agreement protocols in Bull. Iran. Math. Soc. 43 (2017), no. 4, 77-88. They claimed that their key exchange protocols based on supersingular isogenies provide the same security level as the Jao et al.’s protocol SIDH. This paper addresses first a vulnerability of these protocols to a key manipulation attack. Hence, unlike the security claims of Daghigh et al., these protocols unfortunately do not provide the same security when compared with SIDH. Second, we show in particular that the secret dual isogenies of the protocols can easily be retrieved by applying our key manipulation attack. We also discuss lastly the countermeasures to this attack.