A trade-off between classical and quantum circuit size for an attack against CSIDH

We propose a heuristic algorithm to solve the underlying hard problem of the CSIDH cryptosystem (and other isogeny-based cryptosystems using elliptic curves with endomorphism ring isomorphic to an imaginary quadratic order ). Let Δ = Disc() (in CSIDH, Δ = −4p for p the security parameter). Let 0 < α < 1/2, our algorithm requires