3 ms·

From my research so far it looks like SIDH is the most promising candidate to upgrade existing protocols (relatively congruent to ECDH; "small" key sizes). For

• dsacco 9y ago
  It depends on the application. SIDH is attractive because it doesn’t throw out decades of elliptic curve mathematics because of the spectre of quantum computers. The mathematics is a bit more familiar if you squint at it, though working with isogenies themselves is still very different from normal elliptic curve cryptography. But more importantly, a codebase that implements elliptic curve arithmetic can port much of that functionality to implement SIDH. And yes - SIDH is also attractive because of the small key sizes. But it’s also significantly slower than lattice-based key exchange using something like Learning With Errors (LWE). In practice the decision comes down to time versus space constraints: if your application is space-poor and time-rich, SIDH is a good proposal for key exchange. This looks especially nice in the context of IoT devices. But if your application is space-rich and time-poor, SIDH looks less attractive in favor of other options.