[CFRG] Re: [pqc-forum] PQ KEM comparison tool

[John Mattsson <[e-mail]>]

Thanks Damien for the heads-up. MIKE looks very promising. If the reported key sizes and performance hold up, it seems like a major breakthrough. I also really like that it is a NIKE rather than just a KEM. It would be great if something with MIKE’s properties could eventually be standardized.


Thom Wiggers wrote:
>@John: any particular suggestions? 


No particular preference. CTIDH might be the best available option, but I have not been following all recent isogeny-based key exchange algorithms. Given that MIKE is expected to be published next month with significant improvements and a very credible team behind it, I would suggest waiting for the MIKE paper and code to become public and then including MIKE in the comparison tool.


Probably there are many people on this list who have a better understanding than I do of recent isogeny-based key exchange mechanisms.


Cheers,
John Preuß Mattsson


On 2026-07-03, 19:52, "Demi Marie Obenour" <[e-mail]> wrote:

On 7/3/26 13:37, Damien Robert wrote:
> Speaking of isogeny-based KEM, I would like to advertise our upcoming
> isogeny-based post-quantum Non-Interactive Key Exchange (NIKE), called
> **MIKE** (Module Isogeny Key Exchange), which we believe will be of great
> interest to this community.
>
> - **Compact keys:** 64B for NIST Level 1, and 128B for NIST Level 5.
> 
> - **Fast key exchange:** For NIST Level 1, our Rust implementation requires
> <1 ms for key generation and <5 ms for the full key exchange (benchmarked
> on an AMD Ryzen 7 PRO 7840U @ 3.3GHz).
>
> - **Simple Implementation:** Our implementation is simple ($$\approx 4200$$
> LoC, excluding finite field arithmetic) and constant time
>
> - **Active security:** It is an actively-secure NIKE. The timings above
> include public key validation, which is a supersingularity test over
> $$\mathbb{F}_{p^2}$$.
> 
> - **Provable security:** We prove MIKE's security (in the algebraic isogeny
> model) as a passively-secure NIKE or a KEM assuming only the supersingular
> endomorphism ring problem (the core assumption in isogeny-based
> cryptography).
> 
>
> We aim to release the paper and code by the end of August.


This looks like a drop-in replacement for ECDH, except for the messages
being twice as large. I'm very much excited!
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Cheers,
John Preuß Mattsson