A team of three researchers has resolved one of the longest-standing open problems in post-quantum cryptography, publishing the first-ever construction of identity-based encryption (IBE) grounded entirely in the mathematics of elliptic-curve isogenies — the same mathematical family that survived the 2022 collapse of SIKE and is now competing in NIST's standardization process through SQIsign. The preprint, authored by Shweta Agrawal of the Indian Institute of Technology Madras (IIT Madras), Andrea Basso of IBM Research Europe in Zürich, and Sikhar Patranabis of IBM Research India in Bengaluru, appeared on the IACR Cryptology ePrint Archive on July 21, 2026.

The result matters beyond "solving a puzzle." The post-quantum advanced-cryptography ecosystem — the layer of sophisticated primitives (IBE, attribute-based encryption, functional encryption, fully homomorphic encryption) that power certificate-free identity systems, private database lookups, and secure multiparty computation — has been built almost entirely on lattice mathematics. Lattices are one family of hard mathematical problems. If a future cryptanalytic breakthrough ever cracked the core lattice assumptions, every advanced primitive in that ecosystem would fall simultaneously. The new paper delivers a second, independent mathematical foundation for at least three of those primitives — one that rests on the arithmetic of supersingular elliptic curves rather than the geometry of high-dimensional lattices. A reader who works in security engineering, cryptographic standards, or post-quantum deployment now has a concrete signal that the field's dependency on a single mathematical pillar is beginning to break.

What Identity-Based Encryption Is — and Why Building It Post-Quantum Has Taken This Long

In a conventional encrypted-email system, Alice cannot send Bob a message without first obtaining his public key from a certificate authority, verifying that a trusted third party has vouched for its authenticity, and managing the lifecycle of that certificate. Identity-based encryption eliminates that infrastructure entirely. In an IBE system, the encryption algorithm takes some arbitrary identity — an email address, a username, a phone number — and a message, and produces a ciphertext; a corresponding key-generation algorithm takes a master secret and the same identity string and produces the decryption key. A sender can encrypt directly to alice@company.com without looking up anything.

The concept was first described by Adi Shamir in 1984, whose explicit motivation was to simplify public-key management across email systems. His open problem — how to actually build a working IBE scheme — remained unsolved for nearly 17 years, until 2001, when Dan Boneh and Matthew Franklin cracked it using bilinear pairings over elliptic curves, and Clifford Cocks independently published a different solution based on the quadratic-residuosity problem. Both constructions were elegant. Both were also built on mathematics that Peter Shor's 1994 quantum algorithm can break in polynomial time.

The post-quantum version of the problem — building IBE from assumptions that a quantum computer cannot trivially crack — remained open for another 18 years. In 2008, Craig Gentry, Chris Peikert, and Vinod Vaikuntanathan solved it using the Learning With Errors (LWE) problem, introducing the first lattice-based IBE scheme. That was the state of the art until this week. Among all post-quantum candidates, lattice-based IBE schemes were the only ones known to exist. Until now.

Isogeny-Based Cryptography: A Difficult History, a Resilient Foundation

Isogeny-based cryptography takes a different mathematical route from lattices. Instead of relying on the difficulty of finding short vectors in high-dimensional spaces, it leverages the hardness of computing maps — called isogenies — between supersingular elliptic curves organized in a large graph structure. The family attracted substantial research attention because it offered independent hardness assumptions, compact key sizes, and a different proof structure than anything lattice-based.

The field endured a severe blow in July 2022, when Wouter Castryck and Thomas Decru published an efficient classical attack on the SIDH problem — the mathematical core of SIKE, the most prominent isogeny-based key encapsulation mechanism in NIST's standardization process. The attack exploited auxiliary point information included in the SIDH protocol specification, enabling complete key recovery in approximately one hour on a single processor core — with no quantum computer required. NIST formally removed SIKE from its post-quantum standardization process as a result.

The cryptographic community did not abandon isogenies. The break was specific to the SIDH structure; other constructions built on different isogeny assumptions have remained unbroken. The digital signature scheme SQIsign — also isogeny-based — advanced to Round 3 of NIST's Additional Digital Signatures process in May 2026, when NIST announced nine candidates advancing from the second round of evaluation. Researchers continued to develop protocols, signatures, and cryptographic tools from isogeny foundations, remaining convinced that the mathematical setting — carefully handled — is a viable and genuinely independent source of cryptographic hardness.

The new IBE result is the strongest evidence yet that they are right.

The New Construction: CDHwMT and the Algebraic Isogeny Model

The paper introduces a novel hardness assumption, which the authors name "CDH with Mismatched Torsion," or CDHwMT. It is a carefully crafted variant of the classical Computational Diffie-Hellman problem, adapted for the supersingular isogeny setting. At a high level, the assumption posits the hardness of solving a CDH-like problem even when the adversary is given some additional "safe" leakage.

The word "mismatched" does the technical work. In isogeny-based cryptography, the torsion subgroups of an elliptic curve encode auxiliary information that has historically been exploitable — the SIDH attack used exactly this kind of information to break SIKE. CDHwMT is designed so that the auxiliary information the adversary receives comes from a different torsion structure than the one needed to break the scheme. The leakage is "safe by design": it gives the adversary something, but not the right something.

The authors justify the new assumption by proving that, in the Algebraic Isogeny Model — a formal idealized model for reasoning about isogeny computations, analogous to the generic group model used in classical cryptographic proofs — CDHwMT reduces to well-known assumptions from the existing literature. This is standard practice when introducing a new hardness assumption: demonstrating that it is no harder to break than problems the community already trusts gives security evaluators a principled starting point.

A bonus feature of the resulting IBE scheme is anonymity — ciphertexts hide not only the message but also the target identity. Anonymous IBE is a strictly stronger property than standard IBE and is useful in settings where the recipient's identity itself must remain confidential, such as certain whistleblower systems, sealed medical-records access protocols, and ballot verification systems.

What Efficiency Limitations Does the Paper Acknowledge?

The CDHwMT construction is explicitly a proof of concept for theoretical possibility, not a deployment-ready engineering artifact. The authors state openly that their research agenda for now concerns achieving new plausibly post-quantum constructions of advanced primitives without worrying about efficiency. The scheme uses non-black-box techniques that are not optimized for speed or key size. Turning it into a practical IBE system for real-world deployment would require further engineering work, likely including efficiency-focused follow-on research analogous to the progression from Gentry's first fully homomorphic encryption scheme (2009) to the practical FHE libraries available today.

This is not a criticism — it is a characteristic shared by virtually every first construction of a new cryptographic primitive. The Boneh-Franklin IBE was also not immediately deployment-ready in 2001. The significance of a first construction is in establishing that the primitive is achievable from the given assumptions at all; optimization follows.

Two Further Firsts: Laconic Oblivious Transfer and Leakage-Resilient PKE

The same CDHwMT machinery yields two additional firsts for the isogeny-based cryptographic world.

Laconic oblivious transfer. Standard oblivious transfer (OT) is a foundational primitive in secure multiparty computation: it allows a sender to transfer one of several messages to a receiver without learning which message was chosen, and without the receiver learning the unchosen messages. The challenge at scale is communication: in most OT protocols, the receiver's outgoing message must grow with the size of the entire dataset being queried. Laconic OT solves this. It allows a receiver to commit to a large database via a short message; subsequently, a single short message by the sender allows the receiver to learn a specific entry from that dataset, where the location is chosen by the sender. The "laconic" property means the receiver's outgoing message is independent of the database size — enabling secure two-party computation on unbalanced inputs with asymptotically optimal communication in just two rounds. Applications include private database lookup, non-interactive secure computation over large datasets, and certain types of private information retrieval. The new paper provides the first isogeny-based laconic OT construction.

Leakage-resilient and KDM-secure public-key encryption. Key leakage resilience addresses a practical concern: in real deployments, side-channel attacks, firmware vulnerabilities, and related techniques can expose partial information about a secret key even without breaking the underlying cryptographic algorithm outright. A leakage-resilient scheme remains secure even when the adversary learns a bounded fraction of the bits in the secret key — a meaningful guarantee for high-stakes implementations on hardware susceptible to physical probing or power-analysis attacks. Key-dependent message (KDM) security, also called circular security, addresses a subtler problem that arises naturally in disk encryption and in bootstrapping fully homomorphic encryption: what happens when a message that is encrypted may itself depend on the secret key used to encrypt it? The new paper delivers the first isogeny-based construction satisfying both properties simultaneously.

Why Lattice Monoculture Is a Systemic Risk — and Why This Paper Reduces It

The cryptographic community has spent most of the past decade building a post-quantum toolkit whose advanced end is almost entirely dependent on lattices. The NIST-standardized key encapsulation mechanism (ML-KEM) and signature schemes (ML-DSA, FN-DSA) all rest on lattice hardness. The entire ecosystem of advanced post-quantum primitives — IBE, attribute-based encryption, functional encryption, fully homomorphic encryption, broadcast encryption — has been constructed almost exclusively on lattice foundations.

This concentration is a documented systemic risk. If a future advance in algorithm design, quantum algorithms, or algebraic cryptanalysis were to crack the core lattice hardness assumptions, the simultaneous consequence would not be the fall of a single scheme — it would be the collapse of every advanced primitive built on lattices. The same mathematical break that compromised ML-KEM would invalidate the lattice-based IBE that powers certificate-free identity systems, the functional encryption that underlies certain privacy-preserving machine learning deployments, and the FHE constructions that are just beginning to appear in cloud computing products. This is the single-point-of-failure problem the paper's authors name explicitly as their research motivation.

Isogeny-based assumptions rest on entirely different mathematics — the arithmetic of supersingular elliptic curves and their isogeny graphs — and are believed to offer a genuinely independent source of cryptographic hardness. A scheme proven secure under isogeny assumptions does not fall if lattice problems are ever found to be easier than currently believed, and vice versa. The new IBE construction therefore represents more than an answer to a decade-old puzzle: it demonstrates that the rich ecosystem of advanced primitives can in principle be rebuilt on a second foundation, reducing the systemic risk that comes from mathematical monoculture.

All three constructions in the paper — the IBE scheme, the laconic OT, and the leakage-resilient PKE — can be conjectured to be post-quantum secure. The authors describe the techniques developed in this work as building blocks they expect to enable further advanced constructions in the isogeny-based framework — what they call "isogeny-land."

That framework's expansion is now live on the IACR Cryptology ePrint Archive at eprint.iacr.org/2026/1457, one day after NIST's deadline clock for quantum-resistant migration is ticking louder than ever.

About the Authors

The paper is the work of Shweta Agrawal of IIT Madras, Andrea Basso of IBM Research Europe in Zürich, and Sikhar Patranabis of IBM Research India in Bengaluru. Agrawal is a professor in the Department of Computer Science and Engineering at IIT Madras, where her research focuses on theoretical and post-quantum cryptography, particularly advanced encryption primitives. Basso and Patranabis are research scientists at IBM Research whose prior joint work includes contributions to the SQIsign signature scheme and the EUROCRYPT 2023 paper "Supersingular Curves You Can Trust," which addressed trusted setup problems in isogeny-based cryptography.

The preprint has not yet undergone formal peer review. It is available at eprint.iacr.org/2026/1457 under a CC BY license.

Frequently Asked Questions

What is identity-based encryption, and why does it matter for post-quantum security?

Identity-based encryption (IBE) is a system where any arbitrary string — an email address, a username, a phone number — can serve directly as someone's encryption key. In a traditional public-key system, Alice and Bob need a certificate authority to vouch for each other's keys. IBE eliminates that infrastructure: a sender can encrypt directly to a recipient's identity, and the recipient's private key is derived from that identity by a trusted key-generation authority. The reason this matters for post-quantum security is that IBE enables a family of more powerful primitives — attribute-based encryption, functional encryption, hierarchical IBE — that can power fine-grained access control, privacy-preserving computation, and certificate-free identity systems. Before this paper, all post-quantum IBE constructions depended exclusively on lattice mathematics. Now there is a second option.

What happened to SIKE, and does its failure mean isogeny-based cryptography is broken?

SIKE (Supersingular Isogeny Key Encapsulation) was the most prominent isogeny-based scheme in NIST's post-quantum standardization process. In July 2022, researchers Wouter Castryck and Thomas Decru published an attack that could recover the secret key in roughly one hour on a single processor, using only classical computation — no quantum computer required. The attack exploited a specific structural weakness in the SIDH problem: auxiliary torsion-point information that SIDH's specification required to be published as part of the public key. That specific structural weakness is not present in all isogeny-based constructions. SQIsign — an isogeny-based digital signature scheme — uses different mathematics and has advanced to Round 3 of NIST's Additional Digital Signatures standardization process as of May 2026. The new IBE construction uses the CDHwMT assumption, which is specifically designed so that any auxiliary information available to an adversary comes from a different torsion structure than the one needed to break the scheme. The lesson of SIKE is not that isogeny cryptography is broken — it is that assumption design in this area requires extreme care.

Why does it matter that the new IBE is built from isogenies rather than lattices?

Almost every advanced post-quantum cryptographic primitive — IBE, attribute-based encryption, functional encryption, fully homomorphic encryption — currently exists only in lattice-based form. If a future mathematical breakthrough rendered the core lattice assumptions easier to solve than expected, every one of those primitives would be compromised simultaneously. This is what cryptographers call a single-point-of-failure or monoculture risk. Isogeny-based assumptions rest on entirely different mathematics: the difficulty of computing maps between supersingular elliptic curves. A scheme proven secure from isogeny assumptions does not fall if lattice problems are broken — and vice versa. By demonstrating that IBE is achievable from isogeny assumptions, this paper opens a second independent mathematical pillar for the advanced-primitive layer of post-quantum cryptography, directly reducing that monoculture risk.

What is laconic oblivious transfer, and what is the practical relevance of the paper's new construction?

Oblivious transfer is a foundational building block for private computation: it lets a sender transmit one of several possible items to a receiver without learning which item was chosen, and without the receiver learning the unchosen items. The limitation of standard oblivious transfer is communication overhead — the receiver's outgoing message typically scales with the entire dataset. Laconic OT solves this by allowing the receiver to commit to a large database with a single short message, after which the sender can retrieve a specific entry with another short message, regardless of how large the database is. This enables private database lookups, secure genomic matching, and non-interactive secure computation over datasets that would otherwise generate prohibitive communication costs. The paper provides the first isogeny-based laconic OT construction — meaning this capability is now achievable from an assumption family independent of lattices, for the first time.