# Claw attack with p=17915903

p = 2^{13} 3^{7} - 1 = 17915903. Number of supersingular j-invariants: 1492993, only showing 1312 of them.

Color legend: 2-isogenies, 3-isogenies, E_{0}: y^{2} = x^{3} + x, Alice, Intermediate curves, E_{1}.

## Explanation

If we wanted to brute-force attack an SIDH public key, we could try every possible private key (m, n). In our example, there are 2^{13} + 2^{12} possible private keys for Alice. The **claw attack** is an improvement on this.

What we can do is explore all curves connected to E_{0} via isogenies of degree 2^{6} and store them in a hash table. After that, we may start a DFS exploration from E_{A} bounded to depth 2^{7} until we find a collision with the stored values, E_{1}.

This way, we will recover the secret isogeny that Alice has as secret.