Constructing elliptic curve isogenies in quantum subexponential time

Given two elliptic curves over a finite field having the same cardinality and endomorphism ring, it is known that the curves admit an isogeny between them, but finding such an isogeny is believed to be computationally difficult. The fastest known classical algorithm takes exponential time, and prior to our work no faster quantum algorithm was known. Recently, public-key cryptosystems based on the presumed hardness of this problem have been proposed as candidates for post-quantum cryptography. In this paper, we give a subexponential-time quantum algorithm for constructing isogenies, assuming the Generalized Riemann Hypothesis (but with no other assumptions). This result suggests that isogeny-based cryptosystems may be uncompetitive with more mainstream quantumresistant cryptosystems such as lattice-based cryptosystems. As part of our algorithm, we also obtain a second result of independent interest: we provide a new subexponential-time classical algorithm for evaluating a horizontal isogeny given its kernel ideal, assuming (only) GRH, eliminating the heuristic assumptions required by prior algorithms.