  SIDH is a post-quantum key exchange algorithm based on the presumed
difficulty of finding isogenies between supersingular elliptic curves. However,
SIDH and related cryptosystems also reveal additional information: the
restriction of a secret isogeny to a subgroup of the curve (torsion point
information). Petit (2017) was the first to demonstrate that torsion point
information could noticeably lower the difficulty of finding secret isogenies.
In particular, Petit showed that "overstretched" parameterizations of SIDH
could be broken in polynomial time. However, this did not impact the security
of any cryptosystems proposed in the literature. The contribution of this paper
is twofold: First, we strengthen the techniques of Petit by exploiting
additional information coming from a dual and a Frobenius isogeny. This extends
the impact of torsion point attacks considerably. In particular, our techniques
yield a classical attack that completely breaks the n-party group key exchange
of Azarderakhsh et al. for 6 parties or more, and a quantum attack for 3
parties or more that improves on the best known asymptotic complexity. We also
provide a Magma implementation of our attack for 6 parties. We give the full
range of parameters for which our attacks apply. Second, we construct SIDH
variants designed to be weak against our attacks; this includes backdoor
choices of starting curve, as well as backdoor choices of base-field prime. We
stress that our results do not degrade the security of, or reveal any weakness
in, the NIST submission SIKE.
