Galbraith, Petit, Shani and Ti. A more intricate attack strategy is based on exploiting the auxiliary elliptic-curve points present in SIDH public keys, which in principle reveal a lot of additional information about the secret isogenies, but this information did not seem computationally useful for attackers at first. Petit in 2017 first demonstrated a technique making use of these points to attack some rather peculiar SIDH variants. Despite follow-up work extending the attack to much more realistic SIDH instantiations, the attack strategy still failed to break "standard" SIDH as employed by the NIST PQC submission SIKE. In July 2022, Castryck and Decru published an efficient key-recovery attack on SIKE that exploits the auxiliary points. Using a single-core computer, SIKEp434 was broken within approximately an hour, SIKEp503 within approximately 2 hours, SIKEp610 within approximately 8 hours and SIKEp751 within approximately 21 hours. The attack relies on gluing together multiple of the elliptic curves appearing in the SIDH construction, giving an abelian surface (more generally, an abelian variety), and computing a specially crafted isogeny defined by the given auxiliary points on that higher-dimensional object. It should be stressed that the attack crucially relies on the auxiliary points given in SIDH, and there is no known way to apply similar techniques to the general isogeny problem. Efficiency During a key exchange, entities A and B will each transmit information of 2 coefficients modulo p2) defining an elliptic curve and 2 elliptic curve points. Each elliptic curve coefficient requires bits. Each elliptic curve point can be transmitted in bits; hence, the transmission is bits. This is 6144 bits for a 768-bit modulus p (128-bit security). However, this can be reduced by over half to 2640 bits (330 bytes) using key-compression techniques, the latest of which appears in recent work by authors Costello, Jao, Longa, Naehrig, Renes and Urbanik. With these compression techniques, SIDH has a similar bandwidth requirement to traditional 3072-bit RSA signatures or Diffie-Hellman key exchanges. This small space requirement makes SIDH applicable to context that have a strict space requirement, such as Bitcoin or Tor. Tor's data cells must be less than 517 bytes in length, so they can hold 330-byte SIDH keys. By contrast, NTRUEncrypt must exchange approximately 600 bytes to achieve a 128-bit security and cannot be used within Tor without increasing the cell size. In 2014, researchers at the University of Waterloo developed a software implementation of SIDH. They