A Direct Key Recovery Attack on SIDH

We present an attack on SIDH utilising isogenies between polarized products of two supersingular elliptic curves. In the case arbitrary starting curve, our (discovered independently from [8]) has subexponential complexity, thus significantly reducing security and SIKE. When endomorphism ring curve is known, (here derived polynomial-time complexity assuming generalised Riemann hypothesis. Our applies to any isogeny-based cryptosystem that publishes images points under secret isogeny, for example Séta [13] B-SIDH [11]. It does not apply CSIDH [9], CSI-FiSh [3], or SQISign [14].