# On the Performance Analysis for CSIDH-Based Cryptosystems  
[PERSON]  
1 Graduate School of Information Security, Institute of Cyber Security and Privacy (ICSP), Korea University, Seoul 02841, Korea; [EMAIL_ADDRESS] (D.H.); [EMAIL_ADDRESS] (S.K.) 2 Department of Information Security, Graduate School of Information Security, Sejong Cyber University, Seoul 05000, Korea; [EMAIL_ADDRESS]  
The CRS scheme was pointed out again by [PERSON], [PERSON], and [PERSON] in [5], and independently by [PERSON] et al. in [6]. As the CRS scheme offers efficient and safe public key validation, this makes it suitable to construct a non-interactive key exchange. In [5], they modernize the parameter selection of the CRS scheme for better performance and present an efficient way to compute the CRS group action. In [6], they propose CSIDH (commutative SIDH), which solves the parameter selection problem of the CRS scheme by restricting the use of supersingular elliptic curves over \(\mathbb{F}_{p}\). The bottleneck in the performance of [5] is that it is hard to find an ordinary elliptic curve with many small Elkies primes \(\ell\), such that both the curve and its twist have an \(\mathbb{F}_{p}\)-rational \(\ell\)-torsion point. By using the supersingular elliptic curve, every prime \(\ell\) dividing the curve order is an Elkies prime. As a result, for a full key exchange at a 128-bit classical security level, CSIDH requires about 80 ms, which is 2000 times faster than [PERSON], [PERSON], and [PERSON] [5]. Currently, the performance of CSIDH is magnitude slower than SIDH-based algorithms. However, CSIDH provides a non-interactive key change and can efficiently validate the public key, which makes it possible to reuse a key without the need for confirmation. More importantly, CSIDH provides a practical isogeny-based signature scheme called CSI-FiSh [7]. Note that SIDH and CSIDH provide relatively efficient key-exchange schemes. However, constructing an isogeny-based digital signature scheme is much harder to achieve. The first SIDH-based digital signature scheme was by [PERSON] et al. in [8]. Not only was their scheme inefficient, but the size of the signature is larger than other post-quantum signature schemes. SeaSign, a CSIDH-based digital signature scheme proposed by [PERSON] and [PERSON], alleviated this problem, although several minutes are still required to sign a message [9]. Later, by computing the class group of an imaginary quadratic field having 154-digit discriminant, CSI-FiSh [7] offers a practical digital signature scheme which requires 390 ms to sign a message. For isogeny-based cryptography, this is a remarkable result, which shed a light that various cryptographic primitives can be constructed through elliptic curve isogenies. As speed is the main drawback of the practical use of CSIDH-based algorithms, many studies focus on developing an efficient algorithm or modifying an algorithm to increase the performance. In CSIDH, as higher degree isogenies are used, computing the curve coefficient of the image curve is painstaking compared to the 3- and 4- isogenies used in SIDH-based systems. In [10], by exploiting the fact that conversion between Montgomery curves and Edwards curves are efficient, [PERSON] and [PERSON] proposed a hybrid version of implementation for CSIDH. In [11], they proposed a method to use a 2-torsion point for recovering the coefficient of the image curve for Montgomery curves. In [12], they proposed optimized odd-degree isogeny formula by using the \(w\)-coordinate on Edwards curves. By adapting the formula in [12], faster Edwards-only CSIDH can be implemented. Additionally, there are studies that focus on both security and performance enhancement. In [13], [PERSON] and [PERSON] examined that there exist collisions related to an ideal class of order 3 in CSIDH. CSIDH uses the exponents \((e_{1},e_{2},\ldots,e_{n})\) as a private key.