CSIDH Ring Walk 2D: Isogeny Key Exchange Cross-Section

Isogeny Key Exchange

Walk speed 3 steps/s

Live State

Alice's public curve E_A (class-group vector)

—

Bob's public curve E_B (class-group vector)

—

Shared secret curve

not exchanged yet

Isogeny steps computed

How it works

This is the 2D cross-section companion to the 3D CSIDH simulator: instead of one point moving through a 3D basis embedding, each of the six small primes ℓ₁,…,ℓ₆ gets its own concentric ring drawn flat, and a private key is a vector of small integers e = (e₁,…,e₆) — one signed step count per ring:

public curve:  E_A = [e_A] * E0
               E_B = [e_B] * E0
shared secret: [e_A] * E_B = [e_A + e_B] * E0
             = [e_B] * E_A   (class group is abelian → order doesn't matter)

Applying a key means walking |e_i| steps around ring i (direction by sign of e_i) for every prime, independently. Because each ring's position is just addition modulo its own cyclic order, the six additions commute individually, so the combined class-group action is commutative too — Alice applying her walk to Bob's public curve lands on exactly the same six ring positions as Bob applying his walk to Alice's, without either exposing their private vector.

Rings — each colored ring is the cyclic walk for one small prime ℓ_i; a step moves that ring's marker one node around it.
Green / blue arc — Alice's / Bob's private walk from the base curve E0 (center) to their public curve, traced per ring.
Gold marker — the shared secret curve both parties independently reach on every ring.

This demo uses 6 small primes with tiny cyclic orders so the walk is visible; real CSIDH-512 uses 74 primes and a class group with roughly 2²⁵⁶ elements.

Drag to pan, scroll/pinch to zoom — inspect any single ring up close; the underlying commutative walk keeps running regardless of view.

Initializing…

Alice's walk Bob's walk Shared secret Base curve E0

drag to pan · scroll to zoom