C. Of, In particular, when compared to the cost of a classical key-exchange, we showed that the parameters set in [6] actually seem to provide only around half of the expected security, as summarized in Table 7. References 1. Babai, L.: On Lovász' lattice reduction and the nearest lattice point problem, Combinatorica, vol.6, issue.1, pp.1-13, 1986.

J. F. Biasse, C. Fieker, and M. J. Jacobson, Fast heuristic algorithms for computing relations in the class group of a quadratic order, with applications to isogeny evaluation, LMS Journal of Computation and Mathematics, vol.19, pp.371-390, 2016.

J. F. Biasse, M. J. Jacobson, and A. Iezzi, A note on the security of CSIDH, 2018.

J. Biasse, D. Jao, and A. Sankar, A quantum algorithm for computing isogenies between supersingular elliptic curves, Progress in Cryptology-INDOCRYPT 2014-15th International Conference on Cryptology in India, vol.8885, pp.428-442, 2014.

X. Bonnetain and M. Naya-plasencia, Hidden shift quantum cryptanalysis and implications. Cryptology ePrint Archive, vol.432, 2018.
URL : https://hal.archives-ouvertes.fr/hal-01953914

W. Castryck, T. Lange, C. Martindale, L. Panny, and J. Renes, CSIDH: An efficient post-quantum commutative group action. Cryptology ePrint Archive, vol.383, 2018.

Y. Chen and P. Q. Nguyen, BKZ 2.0: Better lattice security estimates, Advances in Cryptology-ASIACRYPT 2011-17th International Conference on the Theory and Application of Cryptology and Information Security, vol.7073, pp.1-20, 2011.
URL : https://hal.archives-ouvertes.fr/hal-01109961

D. Cheung, D. Maslov, J. Mathew, and D. K. Pradhan, On the design and optimization of a quantum polynomial-time attack on elliptic curve cryptography, Theory of Quantum Computation, Communication, and Cryptography, Third Workshop, vol.5106, pp.96-104, 2008.

K. K. Cheung and M. Mosca, Decomposing finite abelian groups, Quantum Information & Computation, vol.1, issue.3, pp.26-32, 2001.

A. M. Childs, D. Jao, and V. Soukharev, Constructing elliptic curve isogenies in quantum subexponential time, J. Mathematical Cryptology, vol.8, issue.1, pp.1-29, 2014.

H. Cohen and H. W. Lenstra, Heuristics on class groups of number fields, pp.33-62, 1983.

J. M. Couveignes, Hard homogeneous spaces. Cryptology ePrint Archive, 2006.

C. Delfs and S. D. Galbraith, Computing isogenies between supersingular elliptic curves over Fp, Des. Codes Cryptography, vol.78, issue.2, pp.425-440, 2016.
DOI : 10.1007/s10623-014-0010-1

M. Ettinger and P. Høyer, On quantum algorithms for noncommutative hidden subgroups, STACS 99, pp.478-487, 1999.
DOI : 10.1007/3-540-49116-3_45

URL : http://arxiv.org/pdf/quant-ph/9807029

L. D. Feo, D. Jao, and J. Plût, Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies, J. Mathematical Cryptology, vol.8, issue.3, pp.209-247, 2014.
URL : https://hal.archives-ouvertes.fr/hal-00652846

L. D. Feo, J. Kieffer, and B. Smith, Towards practical key exchange from ordinary isogeny graphs. Cryptology ePrint Archive, vol.485, 2018.
URL : https://hal.archives-ouvertes.fr/hal-01872817

S. D. Galbraith, , 2012.

S. D. Galbraith and F. Vercauteren, Computational problems in supersingular elliptic curve isogenies. IACR Cryptology ePrint Archive, vol.774, 2017.

N. Gama and P. Q. Nguyen, Predicting lattice reduction, 27th Annual International Conference on the Theory and Applications of Cryptographic Techniques, vol.4965, pp.31-51, 2008.

M. Grassl, B. Langenberg, M. Roetteler, and R. Steinwandt, Applying grover's algorithm to AES: quantum resource estimates, Post-Quantum Cryptography-7th International Workshop, vol.9606, pp.29-43, 2016.

J. L. Hafner and K. S. Mccurley, A rigorous subexponential algorithm for computation of class groups, Journal of the American mathematical society, vol.2, issue.4, pp.837-850, 1989.

S. Kepley and R. Steinwandt, Quantum circuits for 2 n-multiplication with subquadratic gate count, Quantum Information Processing, vol.14, pp.2373-2386, 2015.

G. Kuperberg, A Subexponential-Time Quantum Algorithm for the Dihedral Hidden Subgroup Problem, SIAM J. Comput, vol.35, issue.1, pp.170-188, 2005.

G. Kuperberg, Another Subexponential-time Quantum Algorithm for the Dihedral Hidden Subgroup Problem, 8th Conference on the Theory of Quantum Computation, Communication and Cryptography, TQC 2013, pp.20-34, 2013.

T. Laarhoven, M. Mosca, and J. Van-de-pol, NIST: Submission requirements and evaluation criteria for the post-quantum cryptography standardization process, Des. Codes Cryptography, vol.77, issue.2-3, pp.375-400, 2015.

O. Regev, A Subexponential Time Algorithm for the Dihedral Hidden Subgroup Problem with Polynomial Space, 2004.

C. Schnorr and M. Euchner, Lattice basis reduction: Improved practical algorithms and solving subset sum problems, Math. Program, vol.66, pp.181-199, 1994.

P. W. Shor, Algorithms for quantum computation: Discrete logarithms and factoring, 35th Annual Symposium on Foundations of Computer Science, pp.124-134, 1994.

A. Stolbunov, Cryptographic schemes based on isogenies, 2012.

, The Sage Developers: SageMath, the Sage Mathematics Software System

C. Zalka, Grover's quantum searching algorithm is optimal, Physical Review A, vol.60, issue.4, p.2746, 1999.