### `schemes.yml`

# A short lowercase identifier for the scheme. Must be unique.
sidh:

  # The scheme must have at least one of a short or long form name
  name:
    short: SIDH
    long: Supersingular Isogeny Diffie-Hellman

  # What kind of crypto primitive is this?
  type: Key Exchange
  
  # What security assumptions does it reduce to?
  # Use identifiers in `assumptions.yml`.
  # 
  # If you put more than one assumption, that's understood as an AND:
  # the scheme is broken if any of the assumptions is broken.
  # Try to keep this list minimal, and rely on `assumptions.yml`
  # for reductions between assumptions
  assumptions:
    - sidh

  # What paper(s) describe the scheme?
  # Format is `Label: link`. Use permalinks.
  references:
    JDF11: 'https://doi.org/10.1007/978-3-642-25405-5_2'
    DJP14: 'https://eprint.iacr.org/2011/506'

  # A Markdown field for extra comments. 
  # References in brackets are automatically expanded to links.
  comment: >-
    Fun fact: [JDF11] does not give a name to the scheme.

  # A dictionary of variants of the scheme above.
  # The keys of the variants need not be unique.
  # Each entry supports the same keys as the main entry.
  variants:
    random:
      name:
        long: SIDH with random starting curve
      type: Key Exchange
      assumptions:
        - cssi
      references:
        Pet17: 'https://eprint.iacr.org/2017/571'
        BB+22: 'https://eprint.iacr.org/2022/518'
      comment: >-
        Folklore version SIDH, starting from a random curve of unknown
        endomorphism ring.  First published mention in [Pet17],
        however it is currently not known how to generate such a curve
        without a trusted setup (see [BB+22]).

### `assumptions.yml`

# A short lowercase identifier for the assumption. Must be unique.
vector:

  # The assumption must have at least one of a short or long form name
  name:
    long: Vectorization

  # Other names by which the assumption may be known
  aliases:
    - short: GAIP
      long: Group Action Inverse Problem

  # What attacks break the assumption.
  # Use identifiers in `attacks.yml`.
  # 
  # Try to keep this list minimal, and rely on reduces_to
  # for additional attacks that may break weaker assumptions.
  attacks:
    - kuperberg
    - galbraith

  # What weaker assumptions this assumption reduces to.
  # If any of these is broken, the assumption is broken.
  # Use identifiers in `assumptions.yml`.
  #
  # Reductions may contain only one subkey: `quantum`, stating whether the 
  # reduction uses a quantum algorithm.
  #
  # May refer to variants of an assumption using the syntax `parent>variant`.
  #
  # May contain circular references, in case some assumptions are equivalent.
  reduces_to:
    parallelization:
      quantum: yes

  # What paper(s) define the assumption?
  # Format is `Label: link`. Use permalinks.
  references:
    BY01: 'https://doi.org/10.1007/3-540-38424-3_7'
    Cou06: 'https://eprint.iacr.org/2006/291'
    Sto10: 'https://dx.doi.org/10.3934/amc.2010.4.215'
    GP+18: 'https://eprint.iacr.org/2018/1199'

  # A Markdown field for extra comments. 
  # References in brackets are automatically expanded to links.
  comment: >-
    Given two random elements x₀, x₁ in a set acted upon transitively
    by a group G, find an element of G that maps x₀ to x₁. By random
    self-reducibility, this is equivalent to the problem where x₀ is
    fixed.

  # A dictionary of variants of the assumption above.
  # These must be special instances of the parent assumption, so they
  # are also broken by attacks on the parent.
  # Link to them using the syntax `parent>variant`.
  # Each entry supports the same keys as the main entry.
  variants:
    ordinary:
      name:
        long: Vectorization (ordinary)
      comment: >-
        The variant where the set is a set of ordinary curves with
        endomorphism ring isomorphic to an order O, and the set is the
        class group of O.
    supersingular:
      name:
        long: Vectorization (supersingular)
      references:
        CL+18: 'https://eprint.iacr.org/2018/383'
        CPV19: 'https://eprint.iacr.org/2019/1202'
        Wes21: 'https://eprint.iacr.org/2021/1583'
      reduces_to:
        ssendringfp:
      comment: >-
        The variant where the set is a set of supersingular curves
        defined over a prime field $\mathbb{F}_p$, and the set is the
        class group Cl(√-p). The reduction to the Endomorphism ring
        problem over $\mathbb{F}_p$ was done in steps in [CPV19] and
        [Wes21].

### `attacks.yml`

# A short lowercase identifier for the attack. Must be unique.
kuperberg:

  # The attack must have at least one of a short or long form name
  name:
    long: Kuperberg
    
  # The complexity of the attack. 
  #
  # This is expressed as a value of the L(a,c) complexity function
  # <https://en.wikipedia.org/wiki/L-notation>. The second argument
  # is optional (if omitted, it is interpreted as unbounded in comparisons).
  #
  # Four short-hand syntaxes are also supported:
  # - poly: shortcut for L(0)
  # - poly(c): shortcut for L(0,c)
  # - exp: shortcut for L(1)
  # - exp(c): shortcut for L(1,c)
  complexity: L(1/2)
  
  # Whether this is a quantum attack
  quantum: yes
  
  # What paper(s) describe the attack?
  # Format is `Label: link`. Use permalinks.
  references:
    Kup04: "https://arxiv.org/abs/quant-ph/0302112"
    CJS13: "https://doi.org/10.1515/jmc-2012-0016"

  # A Markdown field for extra comments. 
  # References in brackets are automatically expanded to links.
  comment: >-
    [Kup04] describes a generic quantum algorithm to solve the hidden
    shift problem (equivalently, the dihedral hidden subgroup
    problem). [CJS13] uses Kuperberg's algorithm as a subroutine to
    attack the vectorization problem.