Mathematics of Post-Quantum Cryptography

TL;DR

• What? A workshop on the Mathematics of Post-Quantum Cryptography
• When? September 7–11, 2026
• Where? Raitenhaslach, Germany (about 100 km east of Munich)
• Registration deadline? August 7, 2026 (Note: We may be able to accept later registrations, but we can no longer guarantee discounted hotel rooms past this date.)

This event is the second edition of the workshop of the same name held in June 2025 at the University of Zürich.

Invited speakers

• Monika Trimoska, Eindhoven University of Technology, NL

  Graphs and cycles in curve-based collision walks show abstract

  The Parallel Collision Search algorithm by van Oorschot and Wiener remains the state-of-the-art for solving the elliptic curve discrete logarithm problem. The van Oorschot and Wiener framework has also been used to solve constrained variants of the isogeny pathfinding problem. For the generic version of the problem, however, it seemed for a long time that this approach, burdened by its huge memory requirements, can not outperform the simple yet brilliant ideas that form the Delfs–Galbraith algorithm. Recent results have reopened this question. In this talk, we go through the timeline of collision search algorithms in the isogeny setting. We explain algorithmic choices for solving the problem under some constraints before proposing a generic variant. We then play with these algorithmic tools in the multi-user setting. Here, the goal is to solve a certain number of given instances of the problem in less time than a straightforward approach where we solve each instance one by one.
• André Schrottenloher, CAPSULE, Inria Rennes, FR

  Quantum Programming for Cryptanalysts: Principles and Applications show abstract

  While asymptotic analyses of quantum attacks can often be carried out with pen and paper, estimating their concrete cost—and therefore their practical impact on modern cryptosystems—requires a much more detailed study.

  In the quantum circuit model, we translate complete algorithms into quantum circuits and optimize their resource requirements, primarily qubit count and gate count. Unlike classical computation, quantum circuits must be reversible, leading to a range of dedicated optimization techniques. Furthermore, many quantum algorithms can tolerate approximate arithmetic, enabling additional reductions in resource usage.

  In this talk, I will present the key principles behind quantum circuit programming, introduce software tools that support this process, and illustrate their use through recent work on optimizing Shor's algorithm.

• Paolo Santini, DII, Università Politecnica delle Marche, IT

  On the Hardness of Finding Permutation Automorphisms of Linear Codes show abstract

  This talk is based on a joint (and upcoming) work with Michele Battagliola, Giuseppe D'Alconzo, Laura Mattiuz and Federica Zanetti.

  The talk focuses on the hardness of finding permutation automorphisms of liner codes defined over finite fields. Let AUT-gen refer to the problem of finding generators for the automrphism group (in the talk, we briefly mention also related problems, such as that of finding one non trivial automorphism). We show that AUT-gen is, unsurprisingly, related to the Permutation Equivalence Problem (PEP). Since PEP is known to be easy for codes having a small hull dimension, one expects that for automorphism problems analogous considerations hold. We show that this is indeed true. In particular, we prove that any solver for AUT-gen can (in worst case quasi-polynomial time) be turned into a solver for PEP. Moreover, we adapt a reduction from PEP to the Graph Isomorphism Problem (GIP) and make it work also for automorphisms. By doing this, we get a solver for AUT-gen which runs in worst case time O(n^(ω+h) T_Graph), with n being the code length, h the hull dimension, ω the exponent for matrix inversion and T_Graph the (worst case) cost for solving the resulting graph automorphism problem. For hull dimension h = O(log(n)), this implies AUT-gen can be solved in worst-case quasi-polynomial time. A proof-of-concept implementation of our algorithms show that they are much faster than Sagemath and Magma implementations for the state-of-the-art solvers (Leon's and Feulner's algorithms).

• Luca De Feo, IBM Research Zürich, CH

  How to solve the supersingular endomorphism ring problem show abstract

  I will present the state on the art on finding isogenies between supersingular elliptic curves and computing their endomorphism rings, with applications to cryptanalysis.

• Wessel van Woerden, PQShield

  A Survey of Lattice-Isomorphism-Based Cryptography show abstract

  Almost five years ago, the Lattice Isomorphism Problem (LIP) was introduced as a new hardness assumption in cryptography. Since then, many follow-up works have appeared, and in this talk I will survey these developments. We will dive into LIP variants, their cryptanalysis, basic and advanced cryptographic schemes based on LIP, and some foundational results.

Program (preliminary!)

Note: We will have a number of research/brainstorming/working/study groups during the workshop. If you would like to lead such a group relating to a research topic or open problem you are interested in, please let us know in the registration form or by email.

Note: We also have a limited number of time slots for contributed talks during the workshop. If you'd like to present anything, please let us know in the registration form or by email.

Organizers: Violetta Weger and Lorenz Panny.