Module isogeny 

Certified isogeny torsion-image witnesses — the SIDH/SIKE public-data structure, in the prover

An SIDH/SIKE public key is not merely the codomain curve E' = φ(E₀): to make the scheme a key exchange it also publishes the images of a public torsion basis, φ(P), φ(Q). That auxiliary torsion data is exactly what the 2022 Castryck–Decru attack weaponized. Its internal consistency is governed by the Weil pairing’s isogeny-compatibility law:

    e_N(φ(P), φ(Q)) = e_N(P, Q)^{deg φ}.

This module bakes that relation into the prover as a re-checkable certificate — the same discipline as the rest of the campaign (crate::ait::DescriptionBound, LinearRigidityCert, …): a TorsionImageWitness whose verify re-derives the pairings on both curves from scratch and checks the law. It is the exact check an SIDH verifier performs, and the structural symmetry the break pulls on.

Structs

KaniDiamond

A Castryck–Decru Kani diamond: a secret isogeny φ: E₀ → E of degree d and an auxiliary isogeny γ: E₀ → C of degree c, chosen so c + d = 2^e. Kani’s lemma then supplies a (2^e, 2^e)-isogeny of the abelian surface E × C — a length-e Richelot chain — whose codomain splits into a product of elliptic curves iff the diamond is consistent. The split-test (crate::hyperelliptic::surface_is_reducible) is the per-digit oracle that reads that splitting off. Honest boundary: this builds and validates the diamond’s degree structure and both isogeny sides; constructing the surface’s 2^e-torsion kernel from the diamond and the torsion images — the input the split-oracle consumes — is the remaining SageMath-scale research core and is not fabricated here.

KaniGlue

A Kani glue kernel: the graph {(T, φ(T))} of an isogeny on the N-torsion, the candidate kernel of an (N,N)-isogeny of the abelian surface E × E'.

SecretRecovery

A recovered SIDH secret together with the self-checking record of the laws its recovery invoked. The certificate carries everything needed to re-derive itself: verify re-runs every law from scratch, trusting nothing about how the answer was produced. This is the auto-formalizing recovery — it inverts images → generator and emits the re-checkable mathematics it stands on.

TorsionImageWitness

A re-checkable witness that an isogeny φ: E → E' is consistently specified by its action on an N-torsion basis — the SIDH/SIKE public-key format.

Enums

RecoveryLaw

A law the recovery invoked — auto-formalized as a re-checkable obligation, not prose. The recovery engine does not merely return an answer; it pops out the rules and laws it relied on, each of which SecretRecovery::verify re-derives from scratch.

SidhAudit

The structural verdict on SIDH/SIKE-style public data.

Functions

audit

Audit an isogeny public key: consistent, and what does it structurally expose?

build_kani_diamond

Build a Kani diamond over 𝔽_{p²}: the secret side φ is an ell_phi^a-isogeny with kernel ⟨phi_gen⟩; the auxiliary side γ is a c-isogeny (c an odd prime) with kernel ⟨gamma_gen⟩. Succeeds only when c + ell_phi^a is a power of two — the Kani degree condition.

build_kani_glue

Build a genuine Kani glue kernel over 𝔽_{p²} from a real ell-isogeny and an N-torsion basis.

certify_isogeny

Build a genuine certified witness: the real ell-isogeny with kernel ⟨kernel_gen⟩ on domain, together with the images of an actual E[n] basis (n coprime to ell, so φ is an isomorphism on the n-torsion). Its verify() passes by construction. None if the isogeny or basis cannot be formed.

certify_recovery

Certify an images → generator recovery, emitting the answer with its self-checking law record. Runs the flat recovery for the answer, then attaches the full set of re-checkable laws (order, descent, image reproduction, the faithful ℓ-adic tree partition, and the Aut-orbit closure rule).

is_smooth

Whether n is bound-smooth (every prime factor ≤ bound) — the auxiliary isogeny degree of a Kani diamond must be smooth to be efficiently computable.

kani_diamond_degrees

The Kani degree condition. To embed a degree-d secret isogeny in a (2,2)-isogeny chain of an abelian surface (the Castryck–Decru diamond), pick an exponent e and an auxiliary isogeny of degree c = 2^e − d, so the two sides of the diamond sum to 2^e — the surface isogeny is then a length-e Richelot chain. c must be positive and smooth (efficiently computable). Returns the smallest such (e, c). This is the diamond’s number-theoretic bookkeeping.