An introduction
Isogenies:
Quantum-Safe
Algebra for Bitcoin
Nadav Kohen · 2140 Foundation
Review
The discrete log problem
G
P
P = [x]G
x → P
easy
P → x
hard
[x] : E → E
a map from the curve to itself
Review
Computing 5G the slow way
Each addition: draw the line, find the third point, reflect. Real keys use double-and-add, a few hundred steps even for a 256-bit x.
Why we are here
A (CR) quantum computer solves the discrete log problem
Classical computer
P → x
≈ 2
128
steps
out of reach
Quantum computer · Shor's algorithm
P → x
polynomial time
feasible, once the machine exists
We need a hard problem Shor doesn't break. Isogenies still uses elliptic curves, but in a different way.
Review
Schnorr: commit, challenge, respond
Prover
knows the secret x
Verifier
knows P = [x]G
R = [k]G
1 · commit
c
2 · challenge
s = k + c·x
3 · response
Verify
[s]G = R + [c]P
Signature
c = H(R, P, m)
Review
Nonce re-use leaks x
R
nonce reuse
(c, s)
(c′, s′)
two challenges
x =
s − s′
c − c′
the secret key gets leaked
The plan
A loose dictionary
Discrete log world
Isogeny world
G
base point
↔
E
0
base curve
x
scalar
↔
φ
isogeny
P
point
↔
E
supersingular curve
DLog
hard problem
↔
OneEnd
the isogeny problem
Supersingular elliptic curves
An elliptic curve is the solutions to a cubic equation
y² = x³ + Ax + B
plus one extra point O, and a rule for adding points
secp256k1
A = 0, B = 7
over the real numbers
same equation, mod 101
Supersingular elliptic curves
"Supersingular" is a property you can compute
(x³ + Axz² + Bz³ − y²z)
p − 1
mod p
look at one coefficient: the one on
(xyz)
p − 1
= 0
supersingular
≠ 0
ordinary
y² = x³ + x
supersingular whenever p ≡ 3 (mod 4)
this will be our base curve
y² = x³ + 7
over secp256k1's prime
ordinary
What is an isogeny?
A map between curves that respects addition
E
1
E
2
φ
A
B
A + B
φ(A)
φ(B)
φ(A + B)
φ(O) = O
zero goes to zero
φ(A + B) = φ(A) + φ(B)
sums go to sums
φ(E
1
) = E
2
every point is hit
What is an isogeny?
A map between curves that respects addition
φ(O) = O
zero goes to zero
φ(A + B) = φ(A) + φ(B)
sums go to sums
φ(E
1
) = E
2
every point is hit
Isogenies
The degree counts the points sent to zero
E
1
E
2
O
1
at infinity
O
2
at infinity
T
φ
same colour, same image
Green is the kernel: both points land on zero.
deg φ = 2
Isogenies
The degree counts the points sent to zero
Green is the kernel: it flies off to zero, the point at infinity.
deg φ = 2
Example 1
Doubling is an isogeny
P
[2]P
[2] : (x, y) ↦
(
x
4
− 56x
4y²
,
x
6
+ 140x³ − 392
8y³
)
on y² = x³ + 7: tangent line, third intersection, reflect
A map from a curve to itself: an endomorphism
[n] exists on every curve. We call these "trivial" endomorphisms.
Example 1, in motion
Every point moves to its double
Same curve before and after, so [2] is an endomorphism.
deg [2] = 4
Example 2
A non-trivial endomorphism
E
0
: y² = x³ + x
ι : (x, y) ↦ (−x, iy)
Lands back on the curve
(−x)³ + (−x) = −(x³ + x) = −y² = (iy)²
ι ∘ ι = [−1]
No integer squares to −1, so ι is not multiplication by an integer.
(x, y)
(−x, iy)
(x, −y)
(−x, −iy)
ι
ι
ι
ι
= [−1] after two steps
Example 3
An isogeny to a different equation
φ
degree 2
(0, 0)
kernel
y² = x³ + x
y² = x³ − 4x
φ(x, y) =
(
x² + 1
x
,
y(x² − 1)
x²
)
Example 3
An isogeny to a different equation
φ(x, y) =
(
x² + 1
x
,
y(x² − 1)
x²
)
Example 3, unpacked
Kernel in, isogeny out
1 · Choose a kernel
{O, T}
T = (0, 0)
2 · Sum over the kernel
X = x(P) + x(P + T) = x + 1/x
Y = y(P) + y(P + T) = y − y/x²
Shift P by T and nothing changes.
3 · Read off the target
Y² = X³ − 4X
the equation X and Y satisfy
X and Y from step 2 are exactly the coordinate functions of φ:
φ(x, y) =
(
x² + 1
x
,
y(x² − 1)
x²
)
All the degree-2 isogenies
Three points of order 2, three ways out
order 2
⇒
P = −P
⇒
y = 0
⇒
x(x² + 1) = 0
⇒
x = 0, i, −i
E
0
kernel {O, (0, 0)}
kernel {O, (i, 0)}
kernel {O, (−i, 0)}
y² = x³ − 4x
y² = x³ + 11x + 14i
y² = x³ + 11x − 14i
3
degree-2 isogenies leave every curve
The supersingular 2-isogeny graph
Curves are nodes,
isogenies are edges
E
0
3
edges at every node
≈ p/12
nodes, all connected
GF(p²)
holds every curve. Only about √p fit in GF(p).
Key generation
Take a random walk.
Publish where you land.
E
0
E
pk
secret key
the path you took
public key
the curve at the end
About log p steps is enough: after that, every node is ~equally likely.
The dictionary so far
Same shape of key pair
Discrete log
Isogeny
G
P
x
E
0
E
pk
φ
Fixed base
Secret key
Public key
Operation 1 of 3 · Dual
Every isogeny can be "reversed"
E
1
E
2
φ
You Give
φ̂
you get
φ̂ ∘ φ = [deg φ]
there and back is multiplication by the degree
Operation 2 of 3 · Pushforward
Push an endomorphism through an isogeny
E
1
E
2
θ
φ
φ ∘ θ ∘ φ̂
given
you get
Operation 3 of 3 · Quaternionic magic
Two non-trivial endomorphisms let us compute an isogeny in-between ... by magic!
E
1
E
2
given
given
degree of your choosing
you get
Loops on a supersingular curve are quaternions...
Rethinking the private key
Knowing a path = knowing a loop
E
0
E
pk
ι
public
φ
secret
φ ∘ ι ∘ φ̂
secret
a path from the base curve to the public key
pushforward →
← quaternionic magic
a non-trivial loop on the public key
The hard problem
OneEnd
Given a supersingular curve, find one endomorphism that is not multiplication by an integer.
?
E
The isogeny world's discrete log problem. No efficient quantum algorithm is known.
SQIsign · 1 of 3 · Commit
Commit to a fresh random curve
E
0
E
pk
E
com
secret key
commitment
In Schnorr
R = [k]G
The prover walks from the base curve to a new curve and sends it. It looks exactly like a public key.
secret
public
SQIsign · 2 of 3 · Challenge
The challenge is a public walk
E
0
E
pk
E
com
E
chal
secret key
commitment
challenge
In Schnorr
c
The verifier picks a random isogeny leaving the public key curve.
As a signature
H(E
pk
, E
com
, m)
chooses the walk
secret
public
SQIsign · 3 of 3 · Response
Respond by closing the square
E
0
E
pk
E
com
E
chal
secret key
commitment
challenge
response
In Schnorr
s = k + c·x
An isogeny from the commitment curve to the challenge curve, with a required degree.
Verify
Follow it. Does it start and end on the right curves? Is it well-formed?
secret
public
SQIsign · Inside the prover
How the response is computed
E
0
E
pk
E
com
E
chal
ι
sk
1
2
3
1
Push ι down the commitment
a loop on the commitment curve
2
Push the secret key down the challenge
a loop on the challenge curve
3
Quaternionic magic
an isogeny between them, of the required degree
SQIsign · 2-soundness
Two responses to one commitment leak the key
E
pk
E
0
E
com
secret key
commitment
E
chal
chal
resp
E
chal′
chal′
resp′
dual
dual
a loop on the public key curve
In Schnorr: nonce reuse
x = (s − s′) / (c − c′)
A non-trivial loop on the public key curve: a OneEnd solution.
Why it matters · Size
The smallest post-quantum key + signature by far
Schnorr (today)
96
SQIsign
283
SHRINCS stateful
602 to 4,666 with reuse
Falcon-512
1,563
ML-DSA-44
3,732
SHRINCS stateless
5,824
SLH-DSA-128s
7,888
Public key + signature, in bytes.
Smallest parameter sets: NIST level I, except ML-DSA-44 (level II). Schnorr is BIP 340 (32 + 64). SQIsign 83 + 200 (round 3), Falcon 897 + 666, ML-DSA 1,312 + 2,420, SLH-DSA 32 + 7,856. SHRINCS (draft BIP, Oct 2026): 48-byte key; stateful signatures 554 bytes at first, growing with each reuse up to 4,618; stateless 5,776.
Why it matters · The price
Small on the wire, expensive to compute
CPU time, Schnorr = 1
Sign
Verify
Ed25519 (Schnorr-like)
1
1
Falcon-512
20
0.5
ML-DSA-44
6.7
0.8
SLH-DSA-128s
93,000
31
SHRINCS stateful
≈ 5,600
≈ 4
SHRINCS stateless
≈ 72,000
≈ 22
SQIsign
2,000
38
≈ 40×
a Schnorr-class verification
≈ 2,000×
a Schnorr-class signature
You sign once per spend. Every node verifies.
CPU time relative to Ed25519 (Schnorr-like), from Cloudflare's PQ signatures zoo (June 2026); bars show verification. SQIsign is the round-2 code (round 3 on x86: about 94 Mcycles to sign, 12 to verify). SHRINCS: estimates from the draft spec's SHA-256 compression counts, scaled against SLH-DSA-128s; dashed shows growth with key reuse.
Why it matters · A proven bonus
Keys you can derive, as in BIP 32
Proven
unlinkable child keys, unforgeable under SQIsign's assumptions · Basso et al., 2026
E
pk
E
child
secret key
child secret key
public walk chosen by
H(chain code, parent key, index)
Anyone
parent public key → child public key
The owner
pushes the secret loop along the same walk
Hash-based signatures cannot do this. Lattice schemes need a purpose-built design.
Open questions
What else can isogeny signatures do?
Answered
randomizable keys: BIP 32 and Taproot tweaks · Basso et al., 2026
Adaptor signatures
?
atomic swaps, PTLCs in Lightning
Blind signatures
?
ecash mints such as Cashu and Fedimint
Threshold signatures
FROST-style shared custody
In progress
Multisignatures
MuSig2-style key and signature aggregation
In progress
NUMS curves
?
script-only Taproot needs a curve whose endomorphisms nobody knows
Silent payments
?
BIP 352: needs a key exchange on the same keys
Schnorr gets all of these from one fact: keys and signatures are sums. Isogenies compose but do not add, and silent payments also need a key exchange.
TABConf 8
Thank you
Questions?
Nadav Kohen · 2140 Foundation