A quantum-safe encryption that reached NIST's final round, then fell in 2022 to an attack running in about an hour on one computer core.
The idea: SIKE did a Diffie-Hellman-style exchange in which each side takes a secret walk of isogenies from a shared starting curve. For both walks to end at the same curve, each side also had to publish where some extra points landed. That extra information turned out to be enough: in 2022 a method built on a 1997 theorem recovered the secret walk from it, in about an hour on one core.
Why it matters: Shows why new schemes need years of scrutiny.
On the map: ✗ NIST round-4 KEM, key recovered in ~1 hour on a single core
The key encapsulation scheme built on SIDH, in round 4 of NIST's post-quantum competition[1, 2]. Its level-1 parameter set (SIKEp434) fell in about an hour on a single core (Castryck-Decru, 2022)[3], which ended it.
The lesson: maturity and diversity of assumptions matter as much as elegance.
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.