ran their partially optimized code on an x86-64 processor running at 2.4 GHz. For a 768-bit modulus they were able to complete the key exchange computations in 200 milliseconds thus demonstrating that the SIDH is computationally practical. In 2016, researchers from Microsoft posted software for the SIDH which runs in constant time (thus protecting against timing attacks) and is the most efficient implementation to date. They write: "The size of public keys is only 564 bytes, which is significantly smaller than most of the popular post-quantum key exchange alternatives. Ultimately, the size and speed of our software illustrates the strong potential of SIDH as a post-quantum key exchange candidate and we hope that these results encourage a wider cryptanalytic effort." The code is open source (MIT) and is available on github: https://github.com/microsoft/PQCrypto-SIDH. In 2016, researchers from Florida Atlantic University developed efficient ARM implementations of SIDH and provided a comparison of affine and projective coordinates. In 2017, researchers from Florida Atlantic University developed the first FPGA implementations of SIDH. The supersingular isogeny Diffie-Hellman method While several steps of SIDH involve complex isogeny calculations, the overall flow of SIDH for parties A and B is straightforward for those familiar with a Diffie-Hellman key exchange or its elliptic curve variant. Setup These are public parameters that can be shared by everyone in the network, or they can be negotiated by parties A and B at the beginning of a session. A prime of the form A supersingular elliptic curve over . Fixed elliptic points on . The order of and is . The order of and is . Key exchange In the key exchange, parties A and B will each create an isogeny from a common elliptic curve E. They each will do this by creating a random point in what will be the kernel of their isogeny. The kernel of their isogeny will be spanned by and respectively. The different pairs of points used ensure that parties A and B create different, non-commuting, isogenies. A random point (, or ) in the kernel of the isogenies is created as a random linear combination of the points , and , . Using , or , parties A and B then use Velu's formulas for creating isogenies and respectively. From this they compute the image of the pairs of points , or , under the and isogenies respectively. As a result, A and B