 Who's going to talk about seaside and fishing, what was one community current action? So, yeah, indeed I'm going to talk about seaside, which is a new key exchange protocol that we designed in Tenerif, or at least started designing in Tenerif together with Tania Lana, where we martin, Dale, Lorenz, Pani, and Jost, Verenas, or Verenas, you never know how to pronounce his last name. And we called it, so it's called CSIDH, but I prefer to pronounce it like seaside because it was in Tenerif. And so, if you noticed, at the back we have Alice and Bob on the islands. So Eve is sitting on the beach, Eve's dropping. So Alice starts shouting to Bob, but then Bob realizes that Eve is sitting there. And so then Alice decides, okay, let's agree on a commutative group acting on a set X. So she shouts that to the other end. Bob, okay, yes, he's considering. Oh, actually we've got to say we also need a base element of the group. Of the set, sorry, on which the group is acting. Bob got it. Then they both sample a random element of the group, A and B. You will know this. Alice computes the action of A on this base element X0. Bob says the same with this B on X0. Then they shout this to each other. Then they both compute. So Alice received the action of B on X0 and she lets A act on that. And Bob does the other way around. And both they compute the action of A composed with B on X0. And Eve counts Eve's drop entity. Okay, so this is a general mechanism which you might recognize from the Diffie-Hellman protocol. And indeed, this is the most famous instantiation. So here to stay in the formalism of before, the group acting is the invertible integer modulo n. And the set on which it's acting is actually the base group in Diffie-Hellman, which is basically group of order n. And the action, so this star that we have, this is an exponentiation. So the action of A on G is G to the power A, as you are used to in classical Diffie-Hellman. So this is from 1976. But in a post quantum context, as we all know in the meantime, this is not secure because there is this polynomial time attack by Scholl designed in 1994. So actually there's only one other instantiation known of this protocol. And this is due to Covenier. And what does it do? Well, it's a bit more advanced mathematical side, but just the idea. We then have a group acting on a set. And the group here is the class group of an imaginary quadratic order. And the set is the set of elliptic curves having some pre-scribed endomorphism ring. And the action, this is the most important message is isogenic computation. So the action of an element on a set is computing the image under an isogenic. So I said this is due to Covenier from 1997. This was rediscovered by Stolbanov and Rostovtsev in 2006. So now typically it's attributed to the three of them. And what about post-quantum? Well, here there's also a sub-exponential attack. So it's not as good as you might hope. There is an L1-1-1 algorithm by Kupperberg because it translates into a version of the hidden subgroup problem. But this is not disastrous. This sub-exponential quantum attack doesn't stop us from having very short keys. So 64 kilobytes. This is a factor shorter than, for instance, SIDH, which has more or less the shortest keys of all post-quantum submissions. It's also non-interactive. This is a feature that none of the submissions have. But the disadvantage is that it's unacceptably slow. It takes several minutes for a single key exchange. And this is even incorporating recent speed-ups that were found by DeFeo, Kiefer and Schmitt. So what did we do? Well, we followed the same layout. We only changed the right-most entry. So instead of ordinary elliptic curves, we considered super-singular elliptic curves. Are you sure? 64 kilobytes? Bites. Bites. Sorry. Bites. 64 bytes. 64 bytes. Sorry. Bites. Yeah. That's a very rightful remark. And instead of looking at the full endomorphism ring, you have to look at the endomorphisms that are defined off the base field. And then this slowness disappears. You can make fast implementations. We have approved concept implementation that is not even fully optimized yet. And there's one round in 50 milliseconds. Furthermore, there's an easy key validation. So there's no need for Fuji Saki Okamoto transforms like in an SIDH. And I want to stress that it's not SIDH, despite the fact that it's about super-singular isogenes and DeFi helman. So unfortunately, that name was taken. And that's why we opt for commutative super-singular isogenes, DeFi helman, or seaside. Our article appeared on e-print this morning. So please have a look if you're interested.