3 ms·
As of the current state of the art: yes, that's correct. Isogenies are slow with very small key sizes; lattices (and Goppa codes) are fast with large key sizes.
by throwawaymath 8y ago
As of the current state of the art: yes, that's correct. Isogenies are slow with very small key sizes; lattices (and Goppa codes) are fast with large key sizes.
Isogenies are a good use case for e.g. constrained hardware that doesn't have much space but can tolerate longer key exchange turnaround times. Conversely you'd really want something like lattices for typical key exchange between a client browser and web server.
Code-based solutions have similar advantages and disadvantages lattices and are much older. McEliece is only slightly older than RSA. But because the structure of most types of error correcting codes, it has been very difficult to develop safe systems with the same versatility as lattice based systems. Code-based systems have fewer intractability problems available and virtually all types of codes tried to date have been broken - see research over the past two decades by Nicolas Sendrier, for example.