(i.e. that there is a nice isogeny $E_0^2 \to W_{\bar{\mathfrak{F}}_{p^2}/\bar{\mathfrak{F}}_p}(E_0)$). This means that if $W_{\bar{\mathfrak{F}}_{p^2}/\bar{\mathfrak{F}}_p}(E) = M \cdot E_0$, then to compute $M \cdot A$ for $A/\mathfrak{F}_p$ using Remark 6.1, we would need to first compute an effective orientation on $W \cdot A$. If $E_0$ is the special curve $y^2 = x^3 - x$ (and using $W'_{\bar{\mathfrak{F}}_{p^2}/\bar{\mathfrak{F}}_p}$ rather than $W_{\bar{\mathfrak{F}}_{p^2}/\bar{\mathfrak{F}}_p$), we are saved because $W'_{\bar{\mathfrak{F}}_{p^2}/\bar{\mathfrak{F}}_p}(E_0) = E_0^2$, so $W = R^2!$ This is similar to what happens in CSIDH (see [CPV20]): there is no reason to expect to have a nice ideal $I$ linking $E/\mathfrak{F}_p$ and $E^t/\mathfrak{F}_p$, except when $E = E_0$ is the special curve!

What we could do instead starting on a non special $E_0/\mathfrak{F}_p$, is to exploit the fact that $W_{\bar{\mathfrak{F}}_{p^2}/\bar{\mathfrak{F}}_p}(E_0)$ is always given by the Galoisian module action $R[G] \cdot E_0$ (see Remark 5.10). So we could instead use the construction of Remark 6.1, working with Galoisian modules rather than $R$-modules, and computing the corresponding kernel in $R[G] \cdot A = W_{\bar{\mathfrak{F}}_{p^2}/\bar{\mathfrak{F}}_p}(A)$, via the isomorphism $W_{\bar{\mathfrak{F}}_{p^2}/\bar{\mathfrak{F}}_p}(A) \cong A^g$ over $\mathfrak{F}_{p^2}$, and taking into account the twisted Galois actions we have when descending this isomorphism to $\mathfrak{F}_p$.

As mentioned in the remark above, we leave these Galoisian action considerations for future work, especially since there is little incentive to start with a random base curve $E_0/\mathfrak{F}_p$ rather than our special curve. Indeed, the endomorphism ring computation of $E_0$ is only quantum subexponential in that case anyway, so an attack relying on knowing the full endomorphism ring of the starting curve would still work up to an extra subexponential work. To get a quantum exponential gap for the endomorphism ring computation, we would need to start with $E_0/\mathfrak{F}_{p^2}$, or rather with $W_{\bar{\mathfrak{F}}_{p^2}/\bar{\mathfrak{F}}_p}(E_0)/\mathfrak{F}_p$, but then our base point lives in dimension 2 and when we act by rank 2 module, the common key would then be in dimension 8, and so potentially (depending on the variants used), require a dimension 16 isogeny computation...

**Remark 6.7 (Modular invariants).** One key technical difficulty that we have swept under the rug so far, is that to get a common key, Alice and Bob need to fix invariants for the common dimension 4 codomain $A_{12}$ that does not depend on the isomorphism class. Theta constants are not good enough because they depend on a level structure. A solution is to take all equivalent level 2 theta null points under the action of $\Gamma/\Gamma(2, 4)$, and use the smallest one for the lexicographic order. This takes $O(1)$ (this only depends on the dimension $g=4$, not on the security parameter), but this hides a large constant and would be ineffective.

The best solution would be to use a full set of modular invariants, constructed from a level 2 theta null point, which will be the output of the isogeny computation. I don't know if such a set is already given in the literature.

It is easy to build invariants as suitable symmetric polynomials in the theta constants (the difficulty is to be sure we have a full set), so maybe a solution would be to use only partial invariants. This could worsen the security through.

**Remark 6.8 (On the security).** Although we now have good signatures algorithms, like SQISign2d [BDD+24] whose security properties (essentially) reduce to the supersingular isogeny path problem, this is not the case key exchange schemes or public key encryption based on supersingular isogenies.

⊗-MIKE is a first step towards this direction, since it requires to publish neither torsion point, nor partial information on the endomorphism rings of $E_1, E_2$. There are still several gaps compared to a full security reduction though:

* The most important one is the gap between module action-CDH and module action-inversion. We know that module action inversion is harder than both CDH and the supersingular isogeny path problem by Theorem 5.22, but this gives no information on how action-CDH relates to the isogeny path problem.

* Secondly, on Alice's side, taking $2^e$-isogenies with $2^e \approx p$ is not quite long enough to get statically uniform random curves $E_i$ in the supersingular graph: even through the graph is Ramanujan, to get a provable uniform bound of $O(p^{-1/2})$ the path would need to be of degree $\approx p^2$ [DLRW24, Proposition 29].

A solution is for Alice to do as Bob, i.e., to instead sample a uniform random ideal $I_1 \subset \mathcal{D}_0$ (of large enough norm), and use Clapotis as in [BDD+24] to compute $E_1 = I_1 \cdot E_0$, via a
dimension 2 isogeny. The drawback is then that her dimension 4 common secret $A_{12}$ then needs to be computed through a dimension 8 isogeny too.

* Finally, if we don't use full modular invariants for $A_{12}$ (see Remark 6.7), then we have a weak variant of the CDH problem (where several different abelian varieties of dimension 4 could solve the CDH problem, as long as they have the same partial modular invariants). As mentioned in Remark 6.7, a solution is to use normalised theta constants under the action of $\Gamma/\Gamma(2, 4)$.

With these adaptations, we get a more inefficient scheme (but still polynomial time with respect to the security parameter), especially on Alice's side, whose security reduces to the action-CDH problem for (the Weil restriction of) random supersingular elliptic curves.

**Remark 6.9** (Higher dimensional CRS/CSIDH). It is folklore that the CRS key exchange can be extended to higher dimension: take a CM abelian variety $A/\mathbb{F}_q$, and act on it by the Shimura class group. (This is a special case of Theorem 4.7, see Section 7). In the special case that $A = E$ is an elliptic curve, the CM field is a quadratic field, and the Shimura class group is the standard class group.

Our module action, although it also involves higher dimensional abelian varieties, goes in a somewhat orthogonal direction: rather than acting by ideals in an order of higher rank than 2, we act by modules of rank > 1 over the same quadratic ring $R$ as the usual ideal action. Notably, we can still act on elliptic curves, but the result will be an abelian variety of dimension > 1.

**Remark 6.10** (Relationship with SIDH). The main difference with the SIDH key exchange, is that SIDH used the pushforward of the isogenies $E'_0 \to E_i$ as a common secret key $E_{12}$. This required to publish extra torsion information, since $E_{12}$ depends on the exact path taken from $E_0 \to E_i$, and not only on the codomains.

By contrast, in $\otimes$-MIKE the common dimension 4 abelian variety $A_{12}$ depends only on $E_1$ and $E_2$.

We remark that in the CSIDH group action, when acting by ideals of coprime degrees $I_1, I_2$, the common curve $E_{12} = I_1I_2 \cdot E'_0$ is also the pushforward of $E'_0 \to E_1$ by $E'_0 \to E_2$. But this is specific to the rank 1 case, in general the pushforward approach yields very different results from the module action approach, and we argue that the later is the more natural generalisation of the CSIDH key exchange.

There is still a link between the two approaches: let $E_{12}$ be the SIDH pushforward, and $A_{12}$ be the MIKE common key. Then $W'_{\mathbb{F}_{p^2}/\mathbb{F}_p} E_{12}$ is the pushforward of $E_0'^2 \to W'_{\mathbb{F}_{p^2}/\mathbb{F}_p} E_1$ and $E_0'^2 \to W'_{\mathbb{F}_{p^2}/\mathbb{F}_p} E_2$.

Let $M_1, M_2$ be the unimodular modules such that $M_i \cdot E'_0 = W'_{\mathbb{F}_{p^2}/\mathbb{F}_p} E_i$. We can see, using the path $E_0 \to E_i$, the $M_i$ as submodules of $O_R^2$. Then by Example 4.20, $W_{\mathbb{F}_{p^2}/\mathbb{F}_p} E_{12} = (M_1 \cap M_2) \cdot E_0$, where the intersection is taken in $\mathbb{R}^2$ (hence depends on the paths!). Now there is an injection $M_1 \cap M_2 \hookrightarrow M_1 \otimes_R M_2$, which gives a quotient $A_{12} \to W'_{\mathbb{F}_{p^2}/\mathbb{F}_p} E_{12}$. So in some sense, $A_{12}$ contains all possible SIDH key exchanges with codomains $E_1, E_2$; the corresponding quotients depending on the exact paths.

## 7. CONCLUSION

The projective module action on abelian varieties is a powerful tool. Although it has been used in number theory for a long time (see Section 1.2), it had not really been used for isogeny based cryptography until recently (see [PR23a] and this current work).

The fact that it gives an antiequivalence when applied to a base elliptic curve $E_0$ (see Theorem 4.9) allows to reformulate many questions in term of modules. We refer to [Rob24a] for some examples: level structure, going up and down isogenies, sesquilinear pairings (as introduced in [Sta24]), (un)forgetting orientations, non principal polarisations... Beside $\otimes$-MIKE, in that talk we also mention some other potential cryptographic applications of the module action.

In this paper, for simplicity we have mainly looked at the case where $R$ is an imaginary quadratic order. But we formulated Section 4.2 in the general case, and in particular Theorem 4.7 is given for $R$ an order in a CM field or totally real field (see also Appendix A to go further). Notably, we can act by a projective $R$-module $M$, endowed with a positive definite Hermitian form $H$, where in that case the positive definite condition is that $H(x, x)$ is totally positive for all $x \in M$. Notably, assuming $R$ maximal for simplicity, we can reinterpret the Shimura class group as given by the isomorphism equivalence class of projective unimodular Hermitian $R$-modules, and group law given by the tensor
product. These Hermitian CM modules have been thoroughly studied by Shimura. Whenever $R$ is Gorenstein, orthogonality behaves well, see Appendix A. Of course, the action itself is only a small part of the beautiful theory of complex multiplication, the main result being Shimura's reciprocity law!

I am optimistic about the potential performance of $\otimes$-MIKE on Alice's side. Of course we really need an implementation, but, thanks to the awesome work of the younger generation of isogenists (see Remark 6.5), what would have seemed hopelessly inefficient a few years ago (a $2^n$-isogeny in dimension 4) is not scary anymore. Unfortunately, I am more pessimistic on Bob's side (at least in the version that involves a dimension 8-isogeny on his side). Maybe there is hope, using the Galoisian $R$-modules action from Remark 5.10 rather than just the $R$-modules action, to choose parameters for the key exchange so that the second step also comes from a Weil restriction (like in the first step), which would allow us to work with varieties of half the dimension (but over $\mathbb{F}_{p^2}$ rather than $\mathbb{F}_p$).

We hope that the module action will find many other cryptographic applications, beside $\otimes$-MIKE and the ones mentioned in [Rob24a].

# APPENDIX A. BIDUALITY FOR A GORENSTEIN ORDER

Let $K/Q$ be a number field, with an involution $x \mapsto \bar{x}$, and $R \subset O_K$ an order stable by $\tau$. In view of Section 4.2, we are mainly thinking about $K$ a CM field here.

Let $(V, H)$ be a non degenerate $K$-Hermitian vector space. If $M \subset V$ is a $R$-lattice (which means that $M \otimes_R Q = V$), then as in Section 2 we define the $R$-orthogonal $M^\# = \{v \in V : H(m,v) \in R\}$ The literature on Hermitian forms often specialize to the case $R = O_K$, where it is easy to show using pseudo-basis, as in Remark 2.5, that $M^{\#\otimes} = M$.

By [Bas63, Theorem 6.2], (see also [Vas68, p.1 and Theorem A.1]), since Spec $R$ is of dimension 1, $R$ is Gorenstein iff every torsion free $R$-modules $M$ is reflexive, meaning that the biduality morphism $M \to M^{\vee}$ is an isomorphism.

In particular, this implies that if $R$ is Gorenstein, then for our lattice $M \subset V$ as above, $M^{\#\otimes} = M$. For convenience, we give a self contained proof of this fact (using the fact that $R$ is an order simplify some of the arguments from the more general case cited above).

**Proposition A.1.** With the notations above, assume furthermore that $R$ is a Gorenstein order. Let $M_2 \subset M_1 \subset V$ be two lattices. Then $M_1^\# \subset M_2^\#$ and $\#M_1/M_2 = \#M_2^\#/M_1^\#$. In particular $M^{\#\otimes} = M$.

We remark that this proposition is a particular case of [Bas63, Theorem 6.3.3].

*Proof. Step 1:* We first prove that the second statement is a corollary of the first. If $M \subset M^\#$, then $M \subset M^{\#\otimes} \subset M^\#$, but $\#M^\#/M = \#M^\#/M^{\#\otimes}$ so we have equality. For a general $M$, we can scale it to $M' = nM$ so that $M' \subset M'^\#$. We have $M'^\# = 1/nM^\#$, so $M'^{\#\otimes} = nM^{\#\otimes}$. Since $M'^{\#\otimes} = M'$, we get that $M^{\#\otimes} = M$.

*Step 2:* we have $M^\# \simeq M^\vee := \operatorname{Hom}_{\bar{R}}(M, R)$, via $m^\# \in M^\# \mapsto H(m^\# , \cdot)$. Indeed, this map is an injection since $H$ is non degenerate, and on the other hand $\operatorname{Hom}_{\bar{R}}(M, R) \subset \operatorname{Hom}_{\bar{K}}(M, K) = \operatorname{Hom}_{\bar{K}}(M \otimes_R K, K) = \operatorname{Hom}_{\bar{K}}(V, K) \simeq V$, where the last isomorphism also comes from the non degeneracy of $H$. So every element in $\operatorname{Hom}_{\bar{R}}(M, R)$ is represented by some $v \in V$, which has to be in $M^\#$ be definition.

We also note that $\operatorname{Hom}_{\bar{R}}(M, R)$ is $R$-antisomorphic to $\operatorname{Hom}_R(M, R)$, so in particular is isomorphic to it as an abelian group. So we reduce to studying duality of modules.

*Step 3:* We remark first that duality behaves differently between a torsion $R$-module $T$, where $\operatorname{Hom}_R(T, R) = 0$ and we want to define its dual as $\operatorname{Hom}_R(T, K/R)$, and torsion free $R$-modules.

If $M$ is a f.p. $R$-module, from the exact sequence $0 \to R \to K \to K/R \to 0$ we obtain $0 \to \operatorname{Hom}_R(M, R) \to \operatorname{Hom}_R(M, K) \to \operatorname{Hom}_R(M, K/R) \to \operatorname{Ext}_R^1(M, R) \to \operatorname{Ext}_R^1(M, K) = 0$ where the last equality comes from the fact that $K$ is an injective $R$-module (by [Bas63, Theorem 6.2], we remark that $K/R$ is also an injective $R$-module). If $M$ is torsion free, $\operatorname{Hom}(M, K/R) = 0$, so $\operatorname{Ext}_R^1(M, R) = 0$. On the other hand, if $M = T$ is torsion, then $\operatorname{Hom}(T, K) = 0$, so $\operatorname{Hom}(T, K/R) \simeq \operatorname{Ext}_R^1(T, R)$.

Using $\operatorname{Ext}^1$ for duality on torsion modules behaves well with quotients of torsion-free modules. Assume that $T = M_1/M_2$, $M_1, M_2$ torsion free. From the exact sequence $0 \to M_2 \to M_1 \to M_1/M_2 \to 0$, we get
$0 \to \operatorname{Hom}(M_1/M_2, R) = 0 \to \operatorname{Hom}_R(M_1, R) \to \operatorname{Hom}_R(M_2, R) \to \operatorname{Ext}^1(M_1/M_2, R) \to \operatorname{Ext}^1(M_1, R) = 0$, from which we get that $\operatorname{Hom}_R(M_1/M_2, K/R) \simeq \operatorname{Ext}_R^1(M_1/M_2, R) \simeq \operatorname{Hom}_R(M_2, R)/\operatorname{Hom}_R(M_1, R)$ is anti-isomorphic to $M_2^\vee/M_1^\vee \simeq M_2^\sharp/M_1^\sharp$.

*Step 4:* It remains to show that, for a torsion module *T* like *T* = *M*₁/*M*₂, then #Hom<sub>*R*</sub>(*T*, *K*/*R*) = #*T*.

Since $K/\mathbb{Q}$ is separable, the trace map: $\mathrm{Tr} : K \times K \to \mathbb{Q}$ is non degenerate, and we define the trace dual $R^*$ as the $\mathbb{Z}$-orthogonal of $R$ for the trace.

From $0 \to \mathbb{Z} \to \mathbb{Q} \to \mathbb{Q}/\mathbb{Z} \to 0$ we get $0 \to \operatorname{Hom}_{\mathbb{Z}}(R, \mathbb{Z}) \to \operatorname{Hom}_{\mathbb{Z}}(R, \mathbb{Q}) \to \operatorname{Hom}_{\mathbb{Z}}(R, \mathbb{Q}/\mathbb{Z}) \to \operatorname{Ext}_{\mathbb{Z}}^1(R, \mathbb{Z}) = 0$ where the last equality comes from the fact that $R$ is torsion free, so projective as a $\mathbb{Z}$-module. Since the trace is non degenerate, we have $\operatorname{Hom}_{\mathbb{Z}}(R, \mathbb{Z}) \simeq R^*$, and $\operatorname{Hom}_{\mathbb{Z}}(R, \mathbb{Q}) \simeq K$; these are isomorphisms as $R$-modules. So $\operatorname{Hom}_{\mathbb{Z}}(R, \mathbb{Q}/\mathbb{Z}) \simeq K/R^*$.

*Step 5:* If *M* is a *R*-module, $\operatorname{Hom}_{\mathbb{Z}}(M, \mathbb{Q}/\mathbb{Z}) \simeq \operatorname{Hom}_R(M, \operatorname{Hom}_{\mathbb{Z}}(R, \mathbb{Q}/\mathbb{Z}))$ by the tensor/hom ad-
junction, so $\operatorname{Hom}_{\mathbb{Z}}(M, \mathbb{Q}/\mathbb{Z}) \simeq \operatorname{Hom}_R(M, K/R^*)$. If $M = T$ is torsion, by Pontryagin duality we have
$\#T = \#\operatorname{Hom}_{\mathbb{Z}}(T, \mathbb{Q}/\mathbb{Z})$.

Step 6: We have reduced to showing that #Hom<sub>*R*</sub>(*T*, *K*/*R*<sup>*</sup>) = #Hom<sub>*R*</sub>(*T*, *K*/*R*) for a torsion module.

This is where we need that $R$ is Gorenstein: the Gorenstein condition (this is one of many equivalent definition, see [Bas63]) is that the dualizing complex is invertible; for our order $R$ this equivalent to $R^*$ being invertible. But then, if $n = \#T$, we have $R^*/nR^* \simeq R/nR$ (by localisation), hence we have an isomorphism of $R$-modules: $\operatorname{Hom}_R(T, K/R^*) \simeq \operatorname{Hom}_R(T, R^*/nR^*) \simeq \operatorname{Hom}_R(T, R/nR) \simeq \operatorname{Hom}_R(T, K/R)$. We can finally conclude that if $T$ is a torsion module, $\#\operatorname{Hom}(T, K/R) = \#T$. $\square$

**Example A.2.** If $K$ is a CM field, so $K$ is quadratic imaginary over $K_0$ totally real, then if $R$ contains the maximal order $O_{K_0}$ of $K_0$, it is Gorenstein (because its singularities are of nodal types), and even Bass (because its orverorder contains $O_{K_0}$ too so are Gorenstein).

APPENDIX B. THE GENERAL MODULE ACTION

In this section, we let $(R, \tau) \subset \mathrm{End}_k(A)$ be an orientation by a domain (hence a “CM order”) on an abelian variety $A/k$, and look at the module action for modules which are not necessarily projective.

As explained in [Wat69], since the functor $M \mapsto \mathcal{HOM}_R(M, A)$ maps right exact sequences to left
exact sequences, we can consider the derived functors $\mathcal{E}\mathcal{X}\mathcal{T}_R^i(M, A)$. Concretly, we can take a free (or
projective) resolution of $M$, apply $\mathcal{HOM}_R(\cdot, A)$ to this resolution, and take the cohomology to obtain
the $\mathcal{E}\mathcal{X}\mathcal{T}_R^i(M, A)$.

It is convenient, for these sort of cohomological considerations, to use the fact that **GroupSchemes** embeds into the category of fppf-sheafs (because the group scheme quotient is the fppf quotient, see [DA70; Ryd13, Corollary 2.17]). So we can reinterpret these $\mathcal{E}\mathcal{X}\mathcal{T}$ functors as standard $\mathcal{E}\mathit{xt}$ functors on $(R)$-oriented) fppf sheafs, and apply the general topos cohomological framework from algebraic geometry:

**Proposition B.1.** Working on the category of fppf $R$-modules over the base field $k$, (i.e. fppf sheafs that have a $R$-module structure), and embedding $A$ as a fppf-sheaf via its functor of points, and seeing the $R$-module $M$ as a locally constant fppf sheaf, then the group scheme $\mathcal{E}\mathcal{X}\mathcal{T}_R^i(M, A)$ seen as a fppf sheaf is equal to $\mathcal{E}\mathit{xt}_R^i(M, A)$.

*Proof.* The following argument was obtained thanks to help from Dajano Tossici. By definition, given two fppf $R$-modules $\mathcal{F}, \mathcal{G}$, the functor $\mathcal{E}\mathit{xt}_R^i(\mathcal{F}, \mathcal{G})$ is the derived functor of the hom sheaf $\operatorname{Hom}_{R, fppf}(\mathcal{F}, \mathcal{G})$.

But the group scheme $\mathcal{E}\mathcal{X}\mathcal{T}_R^i(M, A)$ is also defined as a derived functor of $\mathcal{HOM}_R(M, A)$. It thus suffices to check that via our embeddings these are the same functors. Taking $S$ a $k$-algebra, we have $\mathcal{H}om_{R, fppf}(\mathcal{F}, \mathcal{G})(S) = \operatorname{Hom}_R(\mathcal{F}_S, \mathcal{G}_S)$, hence $\operatorname{Hom}_{R, fppf}(M, A)(S) = \operatorname{Hom}_R(M, A(S))$ since $M_S$ is the constant sheaf over $S$. But by Lemma 4.1, we also have $\mathcal{HOM}_R(M, A)(S) = \operatorname{Hom}_R(M, A(S))$. $\square$

From the general cohomological machinery, it follows that we can also compute $\mathcal{E}\mathcal{X}\mathcal{T}_R^i(M, A)$ by taking an injective resolution of $A$ (in fppf sheafs) and applying the functor $\mathcal{H}om_{R, fppf}(M, \cdot)$ and taking the cohomology; the resulting fppf sheaf $\mathcal{E}\mathit{xt}_R^i(M, A)$ is representable by the group scheme $\mathcal{E}\mathcal{X}\mathcal{T}_R^i(M, A)$.
We can use the $\mathcal{E}\mathcal{X}\mathcal{T}_R^1$ functor to measure the obstruction to surjectivity: if $M_2 \hookrightarrow M_1$ is a monomorphism, by the usual long exact sequence in cohomology we have

$$0 \to \mathcal{H}\mathcal{O}\mathcal{M}_R(M_1/M_2, A) \to \mathcal{H}\mathcal{O}\mathcal{M}_R(M_1, A) \to \mathcal{H}\mathcal{O}\mathcal{M}_R(M_2, A) \to \mathcal{E}\mathcal{X}\mathcal{T}_R^1(M_1/M_2, A) \to \mathcal{E}\mathcal{X}\mathcal{T}_R^1(M_1, A) \to \mathcal{E}\mathcal{X}\mathcal{T}_R^1(M_2, A)$$
and so the map $M_1 \cdot A \to M_1 \cdot A$ is surjective if $\mathcal{E}\mathcal{X}\mathcal{T}_R^1(M_1/M_2, A) = 0$.

In general, if $M_2 \hookrightarrow M_1$ is an isogeny, the kernel $K = \mathcal{H}\mathcal{O}\mathcal{M}_R(M_1/M_2, A)$ is precisely given by $A_1[M_2]$, where $A_1 = M_1 \cdot A$, by the same argument as in Proposition 4.24. But the quotient $A_2 = A_1/K$, which is an abelian variety, is only the connected component of $M_2 \cdot A$ (because the quotient $(M_2 \cdot A)/A_2$ is a subgroup of $\mathcal{E}\mathcal{X}\mathcal{T}_R^1(M_1/M_2)$, which is finite because it is of torsion, since $M_1/M_2$ is of torsion). If $M_1$ is projective, $\mathcal{E}\mathcal{X}\mathcal{T}_R^1(M_1, A) = 0$, so $\mathcal{E}\mathcal{X}\mathcal{T}_R^1(M_1/M_2, A)$ is precisely the quotient of $M_2 \cdot A$ by its connected component $A_2$, hence $M_2$ is compatible with $A$ iff $\mathcal{E}\mathcal{X}\mathcal{T}_R^1(M_1, A) = 0$.

From this discussion, we see that a module $M$ is compatible with $A$ iff for any isogeny $M \to R^g$ we have $\mathcal{E}\mathcal{X}\mathcal{T}_R^1(R^g/M, A) = 0$. And Theorem 4.9 shows that for a primitively oriented elliptic curve $E_0$, $\mathcal{E}\mathcal{X}\mathcal{T}_R^1(M, E_0) = 0$ for any f.p. module $M$ (because the module action on $E_0$ is exact), hence $E_0$ behaves as an injective $R$-module.

**Theorem B.2.** Assume that we are given a $R$-orientation on $A$ as above, such that $\mathrm{End}_R(A) = R$. Assume furthermore that $R$ is Gorenstein. Let $M$ be compatible with $A$, and assume that $M^* = \mathrm{Hom}_R(M, R)$ is compatible with $A^\vee$.

Then $\mathrm{Hom}_R(M \cdot A, A) = M$, and if $M_2$ is another module compatible with $A$, and we let $M_1 = M$, then $\mathrm{Hom}_R(M_1 \cdot A, M_2 \cdot A) = \mathrm{Hom}_R(M_2, M_1)$.

We conjecture that in the conditions of Theorem B.2 (in particular, $R$ is Gorenstein), then if $M$ is compatible with $A$, then $M^*$ is automatically compatible with $A^\vee$.

*Proof.* We first prove that under the hypothesis, $(M \cdot A)^\vee \simeq M^* \cdot A^\vee$, this is a similar argument as in Theorem 4.5. Taking a presentation $R^m \to R^n \to M \to 0$, we have $0 \to M \cdot A \to A^n \to A^m$, and taking the dual abelian varieties, $A^{\vee m} \to A^{\vee n} \to (M \cdot A)^\vee \to 0$.

On the other hand, taking dual modules we have $0 \to M^* \to R^n \to R^m$, hence acting on $A^\vee$, $A^{\vee m} \to A^{\vee n} \to M^* \cdot A^\vee$. In these sequences, both maps $A^{\vee m} \to A^{\vee n}$ are the same. Now since $M^*$ is compatible with $A^\vee$, $M^* \cdot A^\vee$ is an abelian variety of dimension $rg$ where $r$ is the rank of $M$ and $g$ the dimension of $A$ by Proposition 4.2. But the image of $A^{\vee m} \to A^{\vee n}$ is of dimension $rg$, so it has to be all of $M^* \cdot A^\vee$.

Now we compute $\mathrm{Hom}_R(M \cdot A, A) = \mathrm{Hom}_R(A^\vee, (M \cdot A)^\vee) = \mathrm{Hom}_R(A^\vee, M^* \cdot A^\vee) = \mathrm{Hom}_R(M^*, \mathrm{Hom}_R(A^\vee, A^\vee)) = \mathrm{Hom}_R(M^*, \mathrm{Hom}_R(A, A)) = \mathrm{Hom}_R(M^*, R) \simeq M$ where in the second to last equality we have used the hypothesis that $R = \mathrm{End}_R(A)$, and in the last equality we have used the biduality isomorphism from Appendix A.

We also have $\mathrm{Hom}_R(M_1 \cdot A, M_2 \cdot A) = \mathrm{Hom}_R(M_2, \mathrm{Hom}_R(M_1 \cdot A, A)) = \mathrm{Hom}_R(M_2, M_1)$. $\square$

REFERENCES

[Bas63] H. Bass. "On the ubiquity of Gorenstein rings". In: *Mathematische Zeitschrift* 82.1 (1963), pp. 8–28 (cit. on pp. 6, 43, 44).

[BDD+24] A. Basso, L. De Feo, P. Dartois, A. Leroux, L. Maino, G. Pope, D. Robert, and B. Wesolowski. "SQIsign2D-West: The Fast, the Small, and the Safer". Accepted for publication at *Asiacrypt* 2024. Aug. 2024. URL: http://www.normalesup.org/~robert/pro/publications/articles/sqisign2d.pdf. eprint: 2024/760. (Cit. on pp. 34, 38, 41).

[BKM23] J. Bergström, V. Karemaker, and S. Marseglia. "Polarizations of abelian varieties over finite fields via canonical liftings". In: *International Mathematics Research Notices* 2023.4 (2023), pp. 3194–3248 (cit. on p. 3).

[BKM24] J. Bergström, V. Karemaker, and S. Marseglia. "Abelian varieties over finite fields with commutative endomorphism algebra: theory and algorithms". In: *arXiv preprint arXiv:2409.08865* (2024) (cit. on p. 3).
[BDLS20] D. Bernstein, L. De Feo, A. Leroux, and B. Smith. "Faster computation of isogenies of large prime degree". In: Algorithmic Number Theory Symposium (ANTS XIV). Vol. 4. 1. Mathematical Sciences Publishers, 2020, pp. 39–55. arXiv: 2003.10118. URL: https://msp.org/obs/2020/4/p04.xhtml (cit. on p. 40).

[BS20] X. Bonnetain and A. Schrottenloher. "Quantum security analysis of CSIDH". In: Advances in Cryptology-EUROCRYPT 2020: 39th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Zagreb, Croatia, May 10–14, 2020, Proceedings, Part II 30. Springer. 2020, pp. 493–522 (cit. on p. 1).

[CD23] W. Castryck and T. Decru. "An efficient key recovery attack on SIDH". In: Springer-Verlag (Eurocrypt 2023), Apr. 2023, pp. 423–447. DOI: 10.1007/978-3-031-30589-4_15 (cit. on p. 2).

[CDV20] W. Castryck, T. Decru, and F. Vercauteren. "Radical isogenies". In: International Conference on the Theory and Application of Cryptology and Information Security (Asiacrypt). Lecture Notes in Computer Science 12492. Springer. 2020, pp. 493–519 (cit. on p. 40).

[CLMPR18] W. Castryck, T. Lange, C. Martindale, L. Panny, and J. Renes. "CSIDH: an efficient post-quantum commutative group action". In: International Conference on the Theory and Application of Cryptology and Information Security (Asiacrypt 2018). Springer. 2018, pp. 395–427 (cit. on p. 1).

[CPV20] W. Castryck, L. Panny, and F. Vercauteren. "Rational isogenies from irrational endomorphisms". In: Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer. 2020, pp. 523–548 (cit. on pp. 28, 30, 33, 34, 41).

[CS15] T. Centeleghe and J. Stix. "Categories of abelian varieties over finite fields, I: Abelian varieties over p". In: Algebra & Number Theory 9.1 (2015), pp. 225–265 (cit. on p. 3).

[CS23] T. G. Centeleghe and J. Stix. "Categories of abelian varieties over finite fields II: Abelian varieties over F q and Morita equivalence". In: Israel Journal of Mathematics 257.1 (2023), pp. 103–170 (cit. on p. 3).

[CII+23] M. Chen, M. Imran, G. Ivanyos, P. Kutas, A. Leroux, and C. Petit. "Hidden stabilizers, the isogeny to endomorphism ring problem and the cryptanalysis of pSIDH". In: International Conference on the Theory and Application of Cryptology and Information Security. Springer. 2023, pp. 99–130 (cit. on pp. 34, 36).

[CR24] M. Corte-Real Santos and K. Reijnders. Return of the Kummer: a toolbox for genus 2 cryptography. Cryptology ePrint Archive, Paper 2024/948. 2024. URL: https://eprint.iacr.org/2024/948 (cit. on pp. 31, 40).

[Cos18] C. Costello. "Computing supersingular isogenies on Kummer surfaces". In: Advances in Cryptology-ASIACRYPT 2018: 24th International Conference on the Theory and Application of Cryptology and Information Security, Brisbane, QLD, Australia, December 2–6, 2018, Proceedings, Part III 24. Springer. 2018, pp. 428–456 (cit. on pp. 31, 40).

[Cou06] J. M. Couveignes. "Hard Homogeneous Spaces". In: IACR Cryptology ePrint Archive 2006 (2006), p. 291 (cit. on pp. 1, 4).

[Dar24] P. Dartois. "Fast computation of 2-isogenies in dimension 4 with the theta model and cryptographic applications". 2024 (cit. on p. 39).

[DLRW24] P. Dartois, A. Leroux, D. Robert, and B. Wesolowski. "SQISignHD: New Dimensions in Cryptography". In: Lecture Notes in Computer Science 14651 (May 2024). Ed. by M. Joye and G. Leander, pp. 3–32. DOI: 10.1007/978-3-031-58716-0_1. URL: http://www.normalesup.org/~robert/pro/publications/articles/SQISignHD.pdf. eprint: 2023/436, HAL: hal-04056062v1, artifact: https://artifacts.iacr.org/tches/2022/a11. (Cit. on p. 41).

[DMPR24] P. Dartois, L. Maino, G. Pope, and D. Robert. "An Algorithmic Approach to (2, 2)-isogenies in the Theta Model and Applications to Isogeny-based Cryptography". Accepted for publication at Asiacrypt 2024. Aug. 2024. URL: http://www.normalesup.org/
robert/pro/publications/articles/_2_2_isogenies_in_the_theta_model.pdf.
eprint: 2023/1747. (Cit. on p. 39).

[DDF+21] L. De Feo, C. Delpech de Saint Guilhem, T. B. Fouotsa, P. Kutas, A. Leroux, C. Petit, J. Silva, and B. Wesolowski. "Séta: Supersingular encryption from torsion attacks". In: *International Conference on the Theory and Application of Cryptology and Information Security (Asiacrypt 2021)*. Springer. 2021, pp. 249-278 (cit. on p. 4).

[DJP14] L. De Feo, D. Jao, and J. Plût. "Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies". In: *Journal of Mathematical Cryptology* 8.3 (2014), pp. 209-247 (cit. on p. 2).

[DKS18] L. De Feo, J. Kieffer, and B. Smith. "Towards practical key exchange from ordinary isogeny graphs". In: *International Conference on the Theory and Application of Cryptology and Information Security*. Springer. 2018, pp. 365-394. arXiv: 1809.07543 (cit. on p. 1).

[DKLPW20] L. De Feo, D. Kohel, A. Leroux, C. Petit, and B. Wesolowski. "SQISign: compact post-quantum signatures from quaternions and isogenies". In: *International Conference on the Theory and Application of Cryptology and Information Security (Asiacrypt 2020)*. Springer. 2020, pp. 64-93 (cit. on p. 12).

[DG16] C. Delfs and S. D. Galbraith. "Computing isogenies between supersingular elliptic curves over Fp". In: *Designs, Codes and Cryptography* 78 (2016), pp. 425-440 (cit. on p. 35).

[Del69] P. Deligne. "Variétés abéliennes ordinaires sur un corps fini". In: *Inventiones Mathematicae* 8.3 (1969), pp. 238-243 (cit. on p. 3).

[DA70] M. Demazure and M. Artin. *Schémas en groupes (SGA3)*. Springer Berlin, Heidelberg, New York, 1970 (cit. on p. 44).

[EHLMP18] K. Eisenträger, S. Hallgren, K. Lauter, T. Morrison, and C. Petit. "Supersingular isogeny graphs and endomorphism rings: reductions and solutions". In: *Advances in Cryptology-EUROCRYPT 2018: 37th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Tel Aviv, Israel, April 29-May 3, 2018 Proceedings, Part III 37*. Springer. 2018, pp. 329-368 (cit. on p. 36).

[EL24] J. K. Eriksen and A. Leroux. "Computing orientations from the endomorphism ring of supersingular curves and applications". In: *Cryptology ePrint Archive* (2024) (cit. on p. 28).

[Gir68] J. Giraud. "Remarque sur une formule de Shimura-Taniyama". In: *Inventiones matematicae* 5.3 (1968), pp. 231-236 (cit. on p. 3).

[How95] E. Howe. "Principally polarized ordinary abelian varieties over finite fields". In: *American Mathematical Society* 347.7 (1995) (cit. on p. 3).

[JD11] D. Jao and L. De Feo. "Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies". In: *International Workshop on Post-Quantum Cryptography (PQCrypto 2011)*. Springer. 2011, pp. 19-34 (cit. on p. 2).

[JKP+18] B. W. Jordan, A. G. Keeton, B. Poonen, E. M. Rains, N. Shepherd-Barron, and J. T. Tate. "Abelian varieties isogenous to a power of an elliptic curve". In: *Compositio Mathematica* 154.5 (2018), pp. 934-959 (cit. on pp. 3, 5, 6, 13-17, 19, 20, 27).

[Kan11] E. Kani. "Products of CM elliptic curves". In: *Collectanea Mathematica* 62.3 (2011), pp. 297-339 (cit. on p. 3).

[Kir16] M. Kirschmer. "Definite quadratic and hermitian forms with small class number". In: *Habilitation, RWTH Aachen University* (2016) (cit. on p. 9).

[KNRR21] M. Kirschmer, F. Narbonne, C. Ritzenthaler, and D. Robert. "Spanning the isogeny class of a power of an elliptic curve". In: *Mathematics of Computation* 91.333 (Sept. 2021), pp. 401-449. DOI: 10.1090/mcom/3672. arXiv: 2004.08315. URL: http://www.normalesup.org/~robert/pro/publications/articles/algebraic_obstruction.pdf. HAL: hal-02554714. (Cit. on pp. 3, 6, 7, 9, 10, 18, 20).

[Kup05] G. Kuperberg. "A subexponential-time quantum algorithm for the dihedral hidden subgroup problem". In: *SIAM Journal on Computing* 35.1 (2005), pp. 170-188 (cit. on p. 1).
[KMPW21] P. Kutas, S.-P. Merz, C. Petit, and C. Weitkämper. "One-way functions and malleability oracles: Hidden shift attacks on isogeny-based protocols". In: *Annual International Conference on the Theory and Applications of Cryptographic Techniques*. Springer. 2021, pp. 242-271 (cit. on p. 4).

[KP23] P. Kutas and C. Petit. "Torsion point attacks on 'SIDH-like' cryptosystems". In: *IET Information Security* 17.2 (2023), pp. 161-170 (cit. on p. 4).

[LS01] K. Lauter and J.-P. Serre. "The maximum or minimum number of rational points on curves of genus three over finite fields". In: *arXiv preprint math/0104086* (2001) (cit. on pp. 18-20).

[Len96] H. Lenstra Jr. "Complex multiplication structure of elliptic curves". In: *journal of number theory* 56.2 (1996), pp. 227-241 (cit. on p. 20).

[LW85] L. S. Levy and R. Wiegand. "Dedekind-like behavior of rings with 2-generate ideals". In: *Journal of Pure and Applied Algebra* 37 (1985), pp. 41-58 (cit. on p. 6).

[MS24] J. Macula and K. E. Stange. "Extending class group action attacks via sesquilinear pairings". In: *arXiv preprint arXiv:2406.10440* (2024) (cit. on p. 35).

[MMPPW23] L. Maino, C. Martindale, L. Panny, G. Pope, and B. Wesolowski. "A direct key recovery attack on SIDH". In: *Annual International Conference on the Theory and Applications of Cryptographic Techniques*. Springer. 2023, pp. 448-471 (cit. on p. 2).

[MW23] A. H. L. Merdy and B. Wesolowski. "The supersingular endomorphism ring problem given one endomorphism". In: *arXiv preprint arXiv:2309.11912* (2023) (cit. on p. 36).

[Mil72] J. S. Milne. "On the arithmetic of abelian varieties". In: (1972) (cit. on pp. 30, 33).

[MOT20] T. Moriya, H. Onuki, and T. Takagi. "SiGamal: a supersingular isogeny-based PKE and its application to a PRF". In: *Advances in Cryptology-ASIACRYPT 2020: 26th International Conference on the Theory and Application of Cryptology and Information Security, Daejeon, South Korea, December 7-11, 2020, Proceedings, Part II 26*. Springer. 2020, pp. 551-580 (cit. on p. 11).

[Mum70] D. Mumford. *Abelian varieties*. Tata Institute of Fundamental Research Studies in Mathematics, No. 5. Published for the Tata Institute of Fundamental Research, Bombay, 1970, pp. viii+242 (cit. on pp. 17-19).

[nLa24a] nLab authors. *action of a monoidal category*. Revision 30. Sept. 2024. URL: https://ncatlab.org/nlab/show/action+of+a+monoidal+category (cit. on p. 12).

[nLa24b] nLab authors. *stuff, structure, property*. Oct. 2024. URL: https://ncatlab.org/nlab/show/stuff%2C+structure%2C+property (cit. on p. 13).

[nLa24c] nLab authors. *symmetric monoidal category*. Revision 54. Sept. 2024. URL: https://ncatlab.org/nlab/show/symmetric+monoidal+category (cit. on p. 10).

[PR23a] A. Page and D. Robert. "Clapotis: Evaluating the isogeny class group action in polynomial time". Nov. 2023. URL: http://www.normalesup.org/~robert/pro/publications/articles/group_action.pdf. In preparation. (Cit. on pp. 3, 6, 19, 20, 23, 42).

[PR23b] A. Page and D. Robert. "Introducing Clapoti(s): Evaluating the isogeny class group action in polynomial time". Nov. 2023. URL: http://www.normalesup.org/~robert/pro/publications/articles/clapotis.pdf. eprint: 2023/1766. (Cit. on pp. 19, 20, 23).

[PW24] A. Page and B. Wesolowski. "The supersingular endomorphism ring and one endomorphism problems are equivalent". In: *Annual International Conference on the Theory and Applications of Cryptographic Techniques*. Springer. 2024, pp. 388-417 (cit. on pp. 4, 34, 35).

[Pei20] C. Peikert. "He gives C-sieves on the CSIDH". In: *Annual international conference on the theory and applications of cryptographic techniques*. Springer. 2020, pp. 463-492 (cit. on p. 1).

[Rob22a] D. Robert. "Evaluating isogenies in polylogarithmic time". Aug. 2022. URL: http://www.normalesup.org/~robert/pro/publications/articles/polylog_isogenies.pdf. eprint: 2022/1068, HAL: hal-03943970. (Cit. on p. 27).
[Rob22b] D. Robert. "Some applications of higher dimensional isogenies to elliptic curves (overview of results)". Dec. 2022. URL: http://www.normalesup.org/~robert/pro/publications/articles/isogenies_applications.pdf. eprint: 2022/1704, HAL: hal-03943973. (Cit. on p. 23).

[Rob23] D. Robert. "Breaking SIDH in polynomial time". In: *Eurocrypt 2023* (Apr. 2023). Ed. by C. Hazay and M. Stam, pp. 472-503. DOI: 10.1007/978-3-031-30589-4_17. URL: http://www.normalesup.org/~robert/pro/publications/articles/breaking sidh.pdf. eprint: 2022/1038, HAL: hal-03943959, Slides: 2023-04-Eurocrypt.pdf (15 min, Eurocrypt 2023, April 2023, Lyon, France). (Cit. on p. 2).

[Rob24a] D. Robert. "From ideals to modules for isogeny based cryptography". Leuven isogeny days 5, Leuven. Sept. 2024. URL: http://www.normalesup.org/~robert/pro/publications/slides/2024-09-Leuven.pdf (cit. on pp. 3, 6, 20, 21, 42, 43).

[Rob24b] D. Robert. "On the efficient representation of isogenies (a survey)". June 2024. URL: http://www.normalesup.org/~robert/pro/publications/articles/isogeny survey.pdf. eprint: 2024/1071. (Cit. on pp. 3, 23, 25-27).

[RS06] A. Rostovtsev and A. Stolbunov. "Public-key cryptosystem based on isogenies". In: *International Association for Cryptologic Research. Cryptology ePrint Archive* (2006). eprint: http://eprint.iacr.org/2006/145 (cit. on p. 1).

[Ryd13] D. Rydh. "Existence and properties of geometric quotients". In: *Journal of Algebraic Geometry* 22.4 (May 13, 2013), pp. 629-669. ISSN: 1056-3911, 1534-7486. DOI: 10.1090/S1056-3911-2013-00615-3. arXiv: 0708.3333 (cit. on p. 44).

[Sch03] J. Scholten. "Weil restriction of an elliptic curve over a quadratic extension". In: *Preprint, available at http://homes.esat.kuleuven.be/~jscholte/weilres.pdf* (2003) (cit. on p. 31).

[SHOR20] J.-P. Serre, E. W. Howe, J. Oesterle, and C. Ritzenthaler. *Rational points on curves over finite fields*. Société mathématique de France, 2020 (cit. on pp. 3, 18).

[Sta24] K. E. Stange. "Sesquilinear pairings on elliptic curves". In: *arXiv preprint arXiv:2405.14167* (2024) (cit. on p. 42).

[Vas68] W. V. Vasconcelos. "Reflexive modules over Gorenstein rings". In: *Proceedings of the American Mathematical Society* 19.6 (1968), pp. 1349-1355 (cit. on p. 43).

[Wat69] W. Waterhouse. "Abelian varieties over finite fields". In: *Ann. Sci. Ecole Norm. Sup* 2.4 (1969), pp. 521-560 (cit. on pp. 3, 44).

[Wes22a] B. Wesolowski. "Orientations and the supersingular endomorphism ring problem". In: *Annual International Conference on the Theory and Applications of Cryptographic Techniques*. Springer. 2022, pp. 345-371 (cit. on pp. 4, 28, 34).

[Wes22b] B. Wesolowski. "The supersingular isogeny path and endomorphism ring problems are equivalent". In: *2021 IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS)*. IEEE. 2022, pp. 1100-1111 (cit. on pp. 34, 36).

[Wes24] B. Wesolowski. "Random Walks in Number-theoretic Cryptology". HDR. Aug. 2024. URL: https://www.bweso.com/hdr.pdf (cit. on p. 34).

[Yu12] C.-F. Yu. "Superspecial abelian varieties over finite prime fields". In: *Journal of Pure and Applied Algebra* 216.6 (2012), pp. 1418-1427 (cit. on pp. 3, 5).

INRIA BORDEAUX-SUD-OUEST, 200 AVENUE DE LA VIEILLE TOUR, 33405 TALENCE CEDEX FRANCE

Email address: damien.robert@inria.fr

URL: http://www.normalesup.org/~robert/

INSTITUT DE MATHÉMATIQUES DE BORDEAUX, 351 COURS DE LA LIBERATION, 33405 TALENCE CEDEX FRANCE