[DanGarcia595]

I could be reading this wrong but in the article it seems like SI has the advantage of key size and SL has the advantage of performance. I understand the sentiment of subtle bugs in elliptic-curve implementations and the new field of Supersingular-Isogenies, but in general algorithms are optimized and improved, but key sizes don't change too much.

If that's the case, why go with SL over SI?

[agl]

It's possible that new primitives based on the same SI problem might have significant performance differences, but we're basing this on the NIST round one submissions. In that setting, there's been a decent amount of optimisation done already and the performance gap is two orders of magnitude. Since elliptic-curve implementation is pretty well studied, improvements might close that gap a little, but it's unlikely to make vast differences.

So it's a balance between adding an extra ~1.5 kB to the transaction, verses that CPU difference. In different contexts those two costs will have different weights, of course, but my feeling is that in TLS, we probably want to pay for the extra bytes.

[chasil]

If I am reading this correctly, there is one SI submission, SIKE. Microsoft is intimately involved, although it appears that Amazon, Texas Instruments, and Infosec have made major contributions.

https://github.com/Microsoft/PQCrypto-SIKE

[tptacek]

A bunch of work on making Supersingular Isogeny DH (what SIKE is based on) viable was done at Microsoft Research.