We study the problem of generating the endomorphism ring of a supersingular elliptic curve by two cycles in $\ell$-isogeny graphs. We prove a necessary and sufficient condition for the two endomorphisms corresponding to two cycles to be linearly independent, expanding on the work in Kohel's thesis. We also give a criterion under which the order generated by two cycles is not a maximal order. We give some examples in which we compute cycles which generate the full endomorphism ring. The most difficult part of these computations is the calculation of the trace of these cycles. We show that a generalization of Schoof's algorithm can accomplish this computation efficiently.
We introduce a category of $\mathcal{O}$-orientedsupersingularellipticcurves and derive properties of the associated oriented and nonoriented $\ell$-isogeny supersingular isogeny graphs. As an application we introduce an oriented super-singular isogeny Diffie-Hellman protocol (OSIDH), analogous to the supersingular isogeny Diffie-Hellman (SIDH) protocol and generalizing the commutative supersingular isogeny Diffie-Hellman (CSIDH) protocol.
We describe the neighborhood of the vertex $[E_0]$ (resp. $[E_{1728}]$) in the $\ell$-isogeny graph $\mathcal{G}_\ell(\mathbb{F}_{p^2}, -2p)$ of supersingular elliptic curves over the finite field $\mathbb{F}_{p^2}$ when $p>3\ell^2$ (resp. $p>4\ell^2$) with $E_0: y^2=x^3+1$ (resp. $E_{1728}: y^2=x^3+x$) supersingular.
Supersingular isogeny graphs are known to have very few loops and multi-edges. We formalize this idea by studying and finding bounds for the number of loops and multi-edges in such graphs. We also find conditions under which the supersingular isogeny graph $Λ_p(\ell)$ is simple. The methods presented in this paper can be used to study many kinds of collisions in supersingular isogeny graphs. As an application, we introduce the notion of bi-route number for two graphs $Λ_p(\ell_1),Λ_p(\ell_2)$ and compute bounds for it. We also study the number of edges in common between the graphs $Λ_p(\ell_1)…
We describe an algorithm that we used to compute the q-expansions of all weight 2 cusp forms of prime level at most 2,000,000 and dimension at most 6. We also present an algorithm that we used to verify that there was only one cusp form of dimension 7 or more per Atkin-Lehner eigenspace for prime levels between 10,000 and 1,000,000. Our algorithm is based on Mestre's Méthode des Graphes, and involves supersingular isogeny graphs and Wiedemann's algorithm for finding the minimal polynomial of sparse matrices over finite fields.
Computing endomorphism rings of supersingular elliptic curves is an important problem in computational number theory, and it is also closely connected to the security of some of the recently proposed isogeny-based cryptosystems. In this paper we give a new algorithm for computing the endomorphism ring of a supersingular elliptic curve $E$ that runs, under certain heuristics, in time $O((\log p)^2p^{1/2})$. The algorithm works by first finding two cycles of a certain form in the supersingular $\ell$-isogeny graph $G(p,\ell)$, generating an order $Λ\subseteq \operatorname{End}(E)$. Then all maxi…
Minimal degree of an isogeny between a supersingular elliptic curve and its conjugate
Université de Toulon（土伦大学）；Aix Marseille Univ, UMR 7373 CNRS（艾克斯-马赛大学，法国国家科学研究中心联合研究单位7373）；University of French Polynesia（法属波利尼西亚大学）；University of Vermont（佛蒙特大学）
We prove that the path-finding problem in $\ell$-isogeny graphs and the endomorphism ring problem for supersingular elliptic curves are equivalent under reductions of polynomial expected time, assuming the generalised Riemann hypothesis. The presumed hardness of these problems is foundational for isogeny-based cryptography. As an essential tool, we develop a rigorous algorithm for the quaternion analog of the path-finding problem, building upon the heuristic method of Kohel, Lauter, Petit and Tignol. This problem, and its (previously heuristic) resolution, are both a powerful cryptanalytic too…
We investigate the isogeny graphs of supersingular elliptic curves over $\mathbb{F}_{p^2}$ equipped with a $d$-isogeny to their Galois conjugate. These curves are interesting because they are, in a sense, a generalization of curves defined over $\mathbb{F}_p$, and there is an action of the ideal class group of $\mathbb{Q}(\sqrt{-dp})$ on the isogeny graphs. We investigate constructive and destructive aspects of these graphs in isogeny-based cryptography, including generalizations of the CSIDH cryptosystem and the Delfs-Galbraith algorithm.
The question we propose to answer throughout this paper is the following: Given an isogeny class of Drinfeld modules over a finite field, what are the orders of the corresponding endomorphism algebra (which is an isogeny invariant) that occur as endomorphism ring of a Drinfeld module in that isogeny class? It is worth mentioning that this question is different from the ones investigated by the authors Kuhn, Pink in [6] and Garai, Papikian in [3]. The former authors rather provided an answer to the question, given a Drinfeld module ϕ, how does one efficiently compute the endomorphism ring of ϕ?…
Let $p$ and $q$ be distinct primes, and let $X_{p,q}$ be the $(q+1)$-regular graph whose nodes are supersingular elliptic curves over $\overline{\mathbb{F}}_p$ and whose edges are $q$-isogenies. For fixed $p$, we compute the distribution of the $\ell$-Sylow subgroup of the sandpile group (i.e.\ Jacobian) of $X_{p,q}$ as $q \to \infty$. We find that the distribution disagrees with the Cohen-Lenstra heuristic in this context. Our proof is via Galois representations attached to modular curves. As a corollary of our result, we give an upper bound on the probability that the Jacobian is cyclic, whi…
We explain why the first Galbraith-Petit-Shani-Ti attack on the Supersingular Isogeny Diffie-Hellman and the Supersingular Isogeny Key Encapsulation fails in some cases.
Ordinary 3-Isogeny Graphs and Improvement of Supersingularity Testing for Twisted Hessian Curves over Prime Fields
School of Science and Engineering, Tokyo Denki University（东京电机大学理工学部）；Institute of Mathematics for Industry (IMI), Kyushu University（九州大学产业数学研究院）；Cyber Physical Security Research Institute (CPSEC)National Institute of Advanced Industrial Science and Technology (AIST)（先进工业科学技术研究所网络物理安全研究所）
本文利用扭曲Hessian曲线的3-同源性质，证明当p≡2 mod 3时普通曲线位于3-火山表面，并据此改进Sutherland超奇异检测算法，同时推广了超奇异j-不变量为立方的结论。
An isogeny graph is a graph whose vertices are principally polarized abelian varieties and whose edges are isogenies between these varieties. In his thesis, Kohel described the structure of isogeny graphs for elliptic curves and showed that one may compute the endomorphism ring of an elliptic curve defined over a finite field by using a depth first search algorithm in the graph. In dimension 2, the structure of isogeny graphs is less understood and existing algorithms for computing endomorphism rings are very expensive. Our setting considers genus 2 jacobians with complex multiplication, with …
We revisit theoretical background on OSIDH, that is an isogeny-based key-exchange protocol proposed by Colò and Kohel at NutMiC 2019. We give a proof of a fundamental theorem for OSIDH. The theorem was stated by Colò and Kohel without proof. Furthermore, we consider parameters of OSIDH, give a sufficient condition on the parameters that the protocol works, and estimate the size of the parameters for a certain security level.
Let $A/\overline{\mathbb{F}}\_p$ and $A'/\overline{\mathbb{F}}\_p$ be supersingular principally polarized abelian varieties of dimension $g>1$. For any prime $\ell \ne p$, we give an algorithm that finds a path $ϕ\colon A \rightarrow A'$ in the $(\ell, \dots , \ell)$-isogeny graph in $\widetilde{O}(p^{g-1})$ group operations on a classical computer, and $\widetilde{O}(\sqrt{p^{g-1}})$ calls to the Grover oracle on a quantum computer. The idea is to find paths from $A$ and $A'$ to nodes that correspond to products of lower dimensional abelian varieties, and to recurse down in dimension until an…
Distributions of Iwasawa $λ$-invariants of $\mathbf{Z}_p$-towers over supersingular isogeny graphs
Joint Graduate School of Mathematics for Innovation, Kyushu University（九州大学数学创新联合研究生院）；Graduate School of Mathematics, Nagoya University（名古屋大学大学院理学研究科）；Graduate School of Natural Science & Technology, Kanazawa University（金泽大学自然科学与技术大学院）
Let $p>3$ be a fixed prime. For a supersingular elliptic curve $E$ over $\mathbb{F}_p$ with $j$-invariant $j(E)\in \mathbb{F}_p\backslash\{0, 1728\}$, it is well known that the Frobenius map $π=((x,y)\mapsto (x^p, y^p))\in \mathrm{End}(E)$ satisfies $π^2=-p$. A result of Ibukiyama tells us that $\mathrm{End}(E)$ is a maximal order in $\mathrm{End}(E)\otimes \mathbb{Q}$ associated to a (minimal) prime $q$ satisfying $q\equiv 3 \bmod 8$ and the quadratic residue $\bigl(\frac{p}{q}\bigr)=-1$ according to $\frac{1+π}{2}\notin \mathrm{End}(E)$ or $\frac{1+π}{2}\in \mathrm{End}(E)$. Let $q_j$ denote…
We study isogeny classes of Drinfeld $A$-modules over finite fields $k$ with commutative endomorphism algebra $D$, in order to describe the isomorphism classes in a fixed isogeny class. We study when the minimal order $A[π]$ of $D$ occurs as an endomorphism ring by proving when it is locally maximal at $π$, and show that this happens if and only if the isogeny class is ordinary or $k$ is the prime field. We then describe how the monoid of fractional ideals of the endomorphism ring $\mathcal{E}$ of a Drinfeld module $ϕ$ up to $D$-linear equivalence acts on the isomorphism classes in the isogeny…
We introduce a special class of supersingular curves over $\mathbb{F}_{p^2}$, characterized by the existence of non-integer endomorphisms of small degree. A number of properties of this set is proved. Most notably, we show that when this set partitions into subsets in such a way that curves within each subset have small-degree isogenies between them, but curves in distinct subsets have no small-degree isogenies between them. Despite this, we show that isogenies between these curves can be computed efficiently, giving a technique for computing isogenies between certain prescribed curves that ca…
