… ’s G2SIDH, we construct two attack algorithms that can recover the secret key in polynomial
time. … Finally, we conclude three types of polynomial-time attacks on high-dimensional SIDH. …

… Ti's G2SIDH, we construct two attack algorithms that can recover the secret key in polynomial
time… Finally, we conclude three types of polynomial-time attacks on high-dimensional SIDH. …

… a polynomial-time adaptive attack on the genus-2 variant of the SIDH protocol (G2SIDH) …
One of the contributions of this paper is to demonstrate an adaptive attack on G2SIDH which …

… We present a polynomial-time adaptive attack on the genus-2 variant of SIDH (G2SIDH) and
… One of the contributions of this paper is to demonstrate an adaptive attack on G2SIDH which …

… sketching out the G2SIDH protocol in Section IC. Next, the generalisation of Ti’s fault attack
to G2SIDH will be detailed in Section II, and we provide an analysis of this attack in Section III…

… G2SIDH; we took it as a black box. However, we mention the main differences between SIDH
and G2SIDH … All the above calculations can be done in polynomial time in the variable n = …

… isogeny problem with torsion point information can be solved in polynomial time [11],
thus making primitives such as the dimension 2 analogue of SIDH, G2SIDH [8], insecure. …

… Since the preparation of this work predates the publications of the attacks on SIDH, the
main application we had in mind was the G2SIDH protocol [12], where our algorithm can be …

… Secondly, we present a polynomial-time adaptive attack on … key generation algorithm for
G2SIDH which allows for uniform … Secondly, Robert shows that polynomial-time attacks can (…

… We introduce a polynomial-time attack on the onemore … attack; we also propose a second
attack that achieves the same goals but cannot be easily defended against. The second attack, …