1: \begin{abstract}

2: We propose an algorithm for computing an isogeny between two elliptic curves $E_1,E_2$ 

3: defined over a finite field such that there is an imaginary quadratic order $\OO$ 

4: satisfying $\OO\simeq \End(E_i)$ for $i = 1,2$. This concerns ordinary curves and 

5: supersingular curves defined over $\F_p$ (the latter used in the recent CSIDH proposal). Our 

6: algorithm has heuristic asymptotic run time $e^{O\left(\sqrt{\log(|\Delta|)}\right)}$ and 

7: requires polynomial quantum memory and $e^{O\left(\sqrt{\log(|\Delta|)}\right)}$ classical memory, 

8: where $\Delta$ is the discriminant of 

9: $\OO$. This asymptotic complexity outperforms all other available method for computing isogenies. 

10: 

11: We also show that a variant of our method has asymptotic run time 

12: $e^{\tilde{O}\left(\sqrt{\log(|\Delta|)}\right)}$ while requesting only polynomial memory 

13: (both quantum and classical). 

14: \begin{comment}

15: We also describe a probabilistic attack against CSIDH that takes advantage of the 

16: structure of the ideal class group $\Cl(\OO)$ of $\OO$. Suppose $M$ satisfies 

17: $M\mid N$ where $N := \#\Cl(\OO)$, then there is a quantum attack with run time 

18: $e^{O\left( \sqrt{\log(N')} \right)}$ and a classical attack in time $O(\sqrt{N'})$, where $N' := N/M$, that 

19: succeeds with probability $1/M$. 

20: \end{comment}

21: 

22: \end{abstract}

23: