I don’t understand much about isogenies but I’d like to use this scheme in constructions. With the relatively new attacks on SIKE in mind I wanted to ask if it was broken by now. Or is it still worth trying to build things from it?

The attacks on SIKE do not affect isogeny-based delay functions.

I thought a bit about using Kani’s theorem to break isogeny VDFs. What you would want is a way to evaluate the public isogeny chain faster. Kani’s theorem, as used in the SIDH attacks, lets you evaluate some secret isogeny by embedding it in a higher dimensional isogeny, but this HD isogeny costs at least as much to evaluate as the secret isogeny. There doesn’t seem a way to use Kani’s theorem to make isogeny evaluation cost *less*.

1 Like

Thank you very much for the response