Two mathematicians broke SIKE post-quantum crypto in an hour on a single PC

In August 2022, weeks after NIST selected four post-quantum encryption algorithms to eventually replace RSA and Diffie-Hellman, researchers at KU Leuven's Computer Security and Industrial Cryptography group published 'An Efficient Key Recovery Attack on SIDH' — a technique that recovers the keys protecting SIKE-protected transactions using complex mathematics and a single traditional PC, in about an hour. Wouter Castryck and Thomas Decru, the paper's authors, became eligible for a $50,000 reward from Microsoft.

SIKE — Supersingular Isogeny Key Encapsulation — was one of four additional algorithms NIST advanced as potential backups, and was thought to resist quantum computers by encoding secrets in a supersingular isogeny graph, a construction long considered elegantly hard. The new attack shows its cornerstone protocol, SIDH (Supersingular Isogeny Diffie-Hellman), is vulnerable to glue-and-split, a theorem proved by mathematician Ernst Kani in 1997, plus tools from Howe, Leprévost and Poonen in 2000, building on the known GPST adaptive attack.

The significance was immediate: SIKE was likely out of the running for standardization, while the four algorithms NIST had selected as standards — built on completely different mathematics — were unaffected. David Jao, a University of Waterloo professor and co-inventor of SIKE, called the weakness 'clearly a major blow' and the attack 'really unexpected.'

SIDH always shipped auxiliary points with a known isogeny degree; a 1997 theorem (glue-and-split) turns that designer convenience into a key-recovery machine.

The attack repurposed mathematics a quarter-century old, hiding in plain sight since 1997.

It needed no quantum computer — the threat SIKE was designed for — just one core and an hour.

The flaw was structural: auxiliary points and a known isogeny degree were baked into the protocol's design.

The result re-ranked a government standardization competition within days of publication.

Conveniences designed into a protocol are latent vulnerabilities: the auxiliary data a scheme exposes for usability can be exactly the handle an attacker needs.

SIKE, a NIST alternate candidate, was effectively eliminated from consideration; the four already-selected post-quantum standards relied on different mathematics and were untouched. The researchers stood to collect Microsoft's $50,000 bounty, and SIKE co-inventor David Jao publicly confirmed the attack's severity.