# Claw attack with p=62207

p = 2^{8} 3^{5} - 1 = 62207. Number of supersingular j-invariants: 5185, only showing 907 of them.

Color legend: 2-isogenies, 3-isogenies, E_{0}: y^{2} = x^{3} + x, Alice, Intermediate curves, E_{1}.

## Explanation

If we wanted to brute-force attack an SIDH public key, we could try every possible private key (m, n). In our example, there are 2^{8} + 2^{7} possible private keys for Alice. The **claw attack** is an improvement on this.

What we can do is explore all curves connected to E_{0} via isogenies of degree 2^{4} and store them in a hash table. After that, we may start a DFS exploration from E_{A} bounded to depth 2^{4} until we find a collision with the stored values, E_{1}.

This way, we will recover the secret isogeny that Alice has as secret.