Can Microsoft's SIDH (Supersingular Isogeny) keypairs be reused for encryption? If not, why? I was considering using Microsoft's SIDH implementation for post-quantum public-key encryption because of its relatively small key size. I realized however, thanks to Issue #4, that it might not be as ideal as I had hoped:


  SIKE is IND-CCA2 secure, which means that it's ok to reuse the key pair generated [...] whereas SIDH is insecure with re-used keys [...]


So here we go:


Is SIDH actually insecure when keys are reused?
Is SIKE actually secure even when keys are reused?
If so, why? How can SIDH actually be broken? Can you demonstrate an attack?
What prevents an attacker from encrypting many messages with a SIDH public key and breaking it that way?
What's the difference between the two that makes it so one can securely use reused keypairs and one can't?
Is SIDH actually insecure when keys are reused?
  If so, why? How can SIDH actually be broken? Can you demonstrate an attack?
  


Yes it is. There is a well known adaptative attack, described here https://eprint.iacr.org/2016/859


  Is SIKE actually secure even when keys are reused?


Yes it is. There is a security proof, assuming the number-theoretic hardness assumptions SIDH is based upon are true. 


  What prevents an attacker from encrypting many messages with a SIDH public key and breaking it that way?


That's the definition of CPA security. SIDH is proven CPA secure.

The CCA attack works by generating faulty ciphertexts (not plaintexts) and sending them to a decryption oracle. The attacker learns something on the key by observing whether decryption succeeds or not.


  What's the difference between the two that makes it so one can securely use reused keypairs and one can't?


SIKE uses a generic transformation meant to turn a CPA secure protocol into a  CCA secure one. Essentially, it amounts to recomputing Bob's public data to check that he did not cheat in computing the ciphertext. This thwarts the attack, and indeed also any other potential CCA attack.