Exact DDH leakage and sampler criteria for the CSIDH torsor

Research-attempt provenance

Definitions and mathematical statement

Shared notation.

Standard number systems are denoted by $\mathbb N,\mathbb Z,\mathbb Q,\mathbb R,\mathbb C$; index ranges, computational models and specialized notation follow the cited problem source and the definitions below.

The notation $\mathfrak a*E$ denotes the ideal-class action on an elliptic curve. The first distribution uses three independent ideal choices; the second replaces the third action by the product of the first two. Decisional Diffie--Hellman asks whether an algorithm can distinguish the resulting triple distributions.

Statement recorded in the supplied source.

Solve Decisional Diffie-Hellman (DDH) in the context of CSIDH: Let $E_0$ be a supersingular elliptic curve defined over $\mathbb F_p$ with endomorphism ring $\mathbb Z[\pi]$. Distinguish between triples $(\mathfrak a * E_0, \mathfrak b* E_0,\mathfrak c* E_0)$ and triples $(\mathfrak a * E_0, \mathfrak b* E_0,\mathfrak a\mathfrak b * E_0)$ where $\mathfrak a, \mathfrak b, \mathfrak c$ are ideals in $\mathbb Z[\pi]$ of odd norm. [S2]

Scope qualification.

The source specifies odd-norm ideals but not their sampling distribution or finite representatives; no distributional hardness claim is assumed.

Source status.

The supplied catalogue labels this record partially solved. Its source-status metadata was checked against the supplied snapshot on 2026-10-11. This import does not independently establish current open status or mathematical correctness.

Short English statement

Can independent ideal-action triples be distinguished from triples whose third component uses the product of the first two secret ideals?

Sources

• S1 Ulam AI and the UnsolvedMath Contributors, UnsolvedMath: A Curated Collection of Open Mathematics Problems, record 20001338 (AIM-CRYPTOGRAPHY-0025). Catalogue curation and metadata: CC BY 4.0. The supplied source question is retained; definitions and the English summary are editorial additions. https://huggingface.co/datasets/ulamai/UnsolvedMath.
• S2 AIM Workshop Problem Lists, original problem source linked by catalogue record AIM-CRYPTOGRAPHY-0025 http://aimpl.org/quantumalg/5/.

Preparation and review.

Original question attributed to the cited source and UnsolvedMath contributors. Codex (GPT-6; exact serving revision not exposed) assisted with definitions, English summaries, source inspection and formatting. No new human mathematical authorship or independent proof verification is asserted. Canonical ID 20001338 and source code AIM-CRYPTOGRAPHY-0025 checked against the complete supplied registry and existing repository statements; known flagged repetitions and obvious identical conjectures excluded. Full mathematical-equivalence/literature review has not been performed. Statement preparation and final review followed contribution prompts C and D; automated checks verify structure and identity, not open status.

Literature and context check

Fresh retrieval of the original AIM quantum-algorithm problem pages failed (web timeout and direct network/DNS failure; an escalated retry of the related chapter-four page also failed certificate validation). The supplied original extract remains the source text; successful fresh access to those pages is not claimed. The primary Castryck--Sotakova--Vercauteren abstract on DDH for class-group actions was read. It states that certain genus characters can be evaluated from public curves and identifies an even-class-number regime. Its actual character-evaluation algorithm and elliptic-curve hypotheses are not rederived here, so they are not assumed for every CSIDH parameter set. The supplied question does not specify how odd-norm ideals are sampled. The calculation below isolates exactly what a readable character would imply, including nonuniform sampling.

Research attempt: A character distinguisher with exact sampler dependence

Let a finite abelian group $G$ act freely and transitively on $\mathcal X$, and fix $E_0$. Assume there is a homomorphism $\chi:G\to\{\pm1\}$ and an available map $L:\mathcal X\to\{\pm1\}$ satisfying $L(gE_0)=\chi(g)$. Given a triple $(A,B,C)$, accept the Diffie--Hellman distribution when \[ L(C)=L(A)L(B). \tag{1} \] If $(A,B,C)=(aE_0,bE_0,(ab)E_0)$, the test always accepts, directly by the homomorphism identity. In the independent distribution, suppose $a,b,c$ are independent draws with character means $\beta_A,\beta_B,\beta_C$. Then the sign $Z=\chi(a)\chi(b)\chi(c)$ has expectation $\beta_A\beta_B\beta_C$ by independence. Since $\mathbf1\{Z=1\}=(1+Z)/2$, the acceptance probability is \[ {1+\beta_A\beta_B\beta_C\over2}, \] and the difference in acceptance probabilities is $(1-\beta_A\beta_B\beta_C)/2$. For a common sampler with mean $\beta$, this is $(1-\beta^3)/2$.

If $\chi$ is nontrivial and the group draws are uniform, multiplication by any element of character $-1$ bijects its two fibers. Thus $\beta=0$, the independent acceptance probability is $1/2$, and equal-prior classification by $1$ has success probability $3/4$. If the sampler is supported on $\ker\chi$, then $\beta=1$ and the same test has no distinguishing advantage at all. If it is supported on the other coset, $\beta=-1$ and the test distinguishes perfectly, because products return to the kernel while the independent third element does not. Hence the ideal-sampling convention can change this particular test from useless to perfect without changing its algebra.

More generally, suppose a readable surjective homomorphism $\varphi:G\to Q$ to a finite group of order $q$ is given. Under uniform independent group elements its images are uniform: each fiber is a coset of the kernel and has the same size. The analogous test $\varphi(c)=\varphi(a)\varphi(b)$ therefore accepts the independent distribution with probability $1/q$ and the DH distribution with probability one. Readability from the public orbit point is the essential computational premise; the mere existence of an abstract quotient supplies no algorithm to evaluate it.

A further boundary blocks an automatic genus-sign argument. If $|G|$ is odd, a homomorphism $G\to\{\pm1\}$ cannot be nontrivial: a nontrivial map would partition $G$ into two equally sized kernel cosets, contradicting odd cardinality. This does not rule out other distinguishers, but it proves that a nontrivial sign character must be justified before applying $1$.

Verification and adversarial audit

Acceptance differences and equal-prior success probability are distinguished. Independence of the three group draws is used only in the independent experiment; the DH third coordinate is correctly dependent. The uniform, kernel-supported and opposite-coset samplers test every extreme $\beta\in\{-1,0,1\}$.

Audit corrections.

A nontrivial readable character was made an explicit hypothesis. Odd-norm ideal sampling was not silently replaced by uniform class-group sampling, and the known even-class-number result was not asserted for every CSIDH instance.

External computation.

None; symbolic arguments and boundary checks only.

Scope and remaining gaps

The calculation is a conditional group-action distinguisher, not a construction of the needed public-curve character for the original family. The exact class group, readable invariant, ideal sampler, and relevant parameter regime remain to be established. The checked primary abstract is evidence for a known restricted attack, not a full solution claimed here.

Integration review.

Codex (GPT-6; exact serving revision not exposed) reviewed the written arguments and expanded layout and source-reference wrappers. Repository metadata and the production web renderer were checked using Python 3.13 and JavaScript with MathJax 3.2.2. This model-assisted review is not independent human proof verification; no PDF compilation or formal proof checking is asserted.

Completion Estimate

COMPLETION: 0% The calculations below the preserved source statement investigate a concrete route, but establish no substantiated new progress toward the entire original target. Known special cases and failed sufficient conditions are not credited as a solution.

References

The original source references and catalogue attribution are preserved in the Sources section above. The following URLs were actually consulted for this attempt; retention of an additional original reference does not claim fresh consultation of it.

• https://eprint.iacr.org/2020/151 (consulted 2026-10-11).

Model and contributor disclosure

OpenAI gpt-6-astra, requested reasoning configuration ultra, generated this research attempt on 2026-10-11. The exact serving revision is not exposed. Codex GPT-6 performed orchestration, repository-format review, and written mathematical review at the declared scope; its exact serving revision is also not exposed. The mathematical route, boundary checks and final adversarial self-audit followed contribution prompts A then B in docs/contribution_prompts.md, after reading CONTRIBUTING.md. Python 3.14.2 assembled the standalone documents; any mathematical computation is specified in Verification. No theorem prover was used. No human mathematical authorship, substantial human proof correction, or independent human proof checking is asserted. Model-assisted review, source retrieval, and structural checks do not establish correctness or novelty. Full private reasoning transcripts are unavailable as reproducibility artifacts; the complete arguments, inputs and outcomes actually used are stated here or in the companion batch audit.

Final status

Unresolved as a new research contribution. This is a concrete route investigation, not a claim of new complete resolution or a current-status certification. A known answer reproduced for context does not become a new contribution. The catalogue's source-status label is preserved; this attempt status does not assert that a source-labelled solved question is open.