Computing endomorphism rings of supersingular elliptic curves is an important problem in computational number theory, and it is also closely connected to the security of some of the recently proposed isogeny-based cryptosystems. In this paper we give a new algorithm for computing the endomorphism ring of a supersingular elliptic curve $E$ that runs, under certain heuristics, in time $O((\log p)^2p^{1/2})$. The algorithm works by first finding two cycles of a certain form in the supersingular $\ell$-isogeny graph $G(p,\ell)$, generating an order $Λ\subseteq \operatorname{End}(E)$. Then all maximal orders containing $Λ$ are computed, extending work of Voight. The final step is to determine which of these maximal orders is the endomorphism ring. As part of the cycle finding algorithm, we give a lower bound on the set of all $j$-invariants $j$ that are adjacent to $j^p$ in $G(p,\ell)$, answering a question in arXiv:1909.07779.
We introduce a category of $\mathcal{O}$-orientedsupersingularellipticcurves and derive properties of the associated oriented and nonoriented $\ell$-isogeny supersingular isogeny graphs. As an application we introduce an oriented super-singular isogeny Diffie-Hellman protocol (OSIDH), analogous to the supersingular isogeny Diffie-Hellman (SIDH) protocol and generalizing the commutative supersingular isogeny Diffie-Hellman (CSIDH) protocol.
We describe the neighborhood of the vertex $[E_0]$ (resp. $[E_{1728}]$) in the $\ell$-isogeny graph $\mathcal{G}_\ell(\mathbb{F}_{p^2}, -2p)$ of supersingular elliptic curves over the finite field $\mathbb{F}_{p^2}$ when $p>3\ell^2$ (resp. $p>4\ell^2$) with $E_0: y^2=x^3+1$ (resp. $E_{1728}: y^2=x^3+x$) supersingular.
Supersingular isogeny graphs are known to have very few loops and multi-edges. We formalize this idea by studying and finding bounds for the number of loops and multi-edges in such graphs. We also find conditions under which the supersingular isogeny graph $Λ_p(\ell)$ is simple. The methods presented in this paper can be used to study many kinds of collisions in supersingular isogeny graphs. As an application, we introduce the notion of bi-route number for two graphs $Λ_p(\ell_1),Λ_p(\ell_2)$ and compute bounds for it. We also study the number of edges in common between the graphs $Λ_p(\ell_1)…
Let p>3 be a prime and let E, E' be supersingular elliptic curves over F_p. We want to construct an isogeny phi: E --> E'. The currently fastest algorithm for finding isogenies between supersingular elliptic curves solves this problem by performing a "meet-in-the-middle" breadth-first search in the full supersingular 2-isogeny graph over F_{p^2}. In this paper we consider the structure of the isogeny graph of supersingular elliptic curves over F_p. We give an algorithm to construct isogenies between such supersingular elliptic curves that works faster than the usual algorithm. We then discuss …
We describe an algorithm that we used to compute the q-expansions of all weight 2 cusp forms of prime level at most 2,000,000 and dimension at most 6. We also present an algorithm that we used to verify that there was only one cusp form of dimension 7 or more per Atkin-Lehner eigenspace for prime levels between 10,000 and 1,000,000. Our algorithm is based on Mestre's Méthode des Graphes, and involves supersingular isogeny graphs and Wiedemann's algorithm for finding the minimal polynomial of sparse matrices over finite fields.
We study the problem of generating the endomorphism ring of a supersingular elliptic curve by two cycles in $\ell$-isogeny graphs. We prove a necessary and sufficient condition for the two endomorphisms corresponding to two cycles to be linearly independent, expanding on the work in Kohel's thesis. We also give a criterion under which the order generated by two cycles is not a maximal order. We give some examples in which we compute cycles which generate the full endomorphism ring. The most difficult part of these computations is the calculation of the trace of these cycles. We show that a gen…
We exhibit the isogeny classes of supersingular abelian threefolds over F_{2^n} containing the Jacobian of a genus 3 curve. In particular, we prove that for even n>6 there always exist a maximal and a minimal curve over F_{2^n}. All the curves can be obtained explicitly.
Minimal degree of an isogeny between a supersingular elliptic curve and its conjugate
Université de Toulon（土伦大学）；Aix Marseille Univ, UMR 7373 CNRS（艾克斯-马赛大学，法国国家科学研究中心联合研究单位7373）；University of French Polynesia（法属波利尼西亚大学）；University of Vermont（佛蒙特大学）
We prove that the path-finding problem in $\ell$-isogeny graphs and the endomorphism ring problem for supersingular elliptic curves are equivalent under reductions of polynomial expected time, assuming the generalised Riemann hypothesis. The presumed hardness of these problems is foundational for isogeny-based cryptography. As an essential tool, we develop a rigorous algorithm for the quaternion analog of the path-finding problem, building upon the heuristic method of Kohel, Lauter, Petit and Tignol. This problem, and its (previously heuristic) resolution, are both a powerful cryptanalytic too…
We investigate the isogeny graphs of supersingular elliptic curves over $\mathbb{F}_{p^2}$ equipped with a $d$-isogeny to their Galois conjugate. These curves are interesting because they are, in a sense, a generalization of curves defined over $\mathbb{F}_p$, and there is an action of the ideal class group of $\mathbb{Q}(\sqrt{-dp})$ on the isogeny graphs. We investigate constructive and destructive aspects of these graphs in isogeny-based cryptography, including generalizations of the CSIDH cryptosystem and the Delfs-Galbraith algorithm.
Let $p$ and $q$ be distinct primes, and let $X_{p,q}$ be the $(q+1)$-regular graph whose nodes are supersingular elliptic curves over $\overline{\mathbb{F}}_p$ and whose edges are $q$-isogenies. For fixed $p$, we compute the distribution of the $\ell$-Sylow subgroup of the sandpile group (i.e.\ Jacobian) of $X_{p,q}$ as $q \to \infty$. We find that the distribution disagrees with the Cohen-Lenstra heuristic in this context. Our proof is via Galois representations attached to modular curves. As a corollary of our result, we give an upper bound on the probability that the Jacobian is cyclic, whi…
We explain why the first Galbraith-Petit-Shani-Ti attack on the Supersingular Isogeny Diffie-Hellman and the Supersingular Isogeny Key Encapsulation fails in some cases.
Ordinary 3-Isogeny Graphs and Improvement of Supersingularity Testing for Twisted Hessian Curves over Prime Fields
School of Science and Engineering, Tokyo Denki University（东京电机大学理工学部）；Institute of Mathematics for Industry (IMI), Kyushu University（九州大学产业数学研究院）；Cyber Physical Security Research Institute (CPSEC)National Institute of Advanced Industrial Science and Technology (AIST)（先进工业科学技术研究所网络物理安全研究所）
本文利用扭曲Hessian曲线的3-同源性质，证明当p≡2 mod 3时普通曲线位于3-火山表面，并据此改进Sutherland超奇异检测算法，同时推广了超奇异j-不变量为立方的结论。
We revisit theoretical background on OSIDH, that is an isogeny-based key-exchange protocol proposed by Colò and Kohel at NutMiC 2019. We give a proof of a fundamental theorem for OSIDH. The theorem was stated by Colò and Kohel without proof. Furthermore, we consider parameters of OSIDH, give a sufficient condition on the parameters that the protocol works, and estimate the size of the parameters for a certain security level.
Let $A/\overline{\mathbb{F}}\_p$ and $A'/\overline{\mathbb{F}}\_p$ be supersingular principally polarized abelian varieties of dimension $g>1$. For any prime $\ell \ne p$, we give an algorithm that finds a path $ϕ\colon A \rightarrow A'$ in the $(\ell, \dots , \ell)$-isogeny graph in $\widetilde{O}(p^{g-1})$ group operations on a classical computer, and $\widetilde{O}(\sqrt{p^{g-1}})$ calls to the Grover oracle on a quantum computer. The idea is to find paths from $A$ and $A'$ to nodes that correspond to products of lower dimensional abelian varieties, and to recurse down in dimension until an…
Let E be an elliptic curve over a number field K which admits a cyclic p-isogeny with p odd and semistable at primes above p. We determine the root number and the parity of the p-Selmer rank for E/K, in particular confirming the parity conjecture for such curves. We prove the analogous results for p=2 under the additional assumption that E is not supersingular at primes above 2.
Given an elliptic curve E over a field of positive characteristic p, we consider how to efficiently determine whether E is ordinary or supersingular. We analyze the complexity of several existing algorithms and then present a new approach that exploits structural differences between ordinary and supersingular isogeny graphs. This yields a simple algorithm that, given E and a suitable non-residue in F_p^2, determines the supersingularity of E in O(n^3 log^2 n) time and O(n) space, where n=O(log p). Both these complexity bounds are significant improvements over existing methods, as we demonstrat…
Distributions of Iwasawa $λ$-invariants of $\mathbf{Z}_p$-towers over supersingular isogeny graphs
Joint Graduate School of Mathematics for Innovation, Kyushu University（九州大学数学创新联合研究生院）；Graduate School of Mathematics, Nagoya University（名古屋大学大学院理学研究科）；Graduate School of Natural Science & Technology, Kanazawa University（金泽大学自然科学与技术大学院）
An elliptic curve $E$ defined over a $p$-adic field $K$ with a $p$-isogeny $ϕ:E\rightarrow E^\prime$ comes equipped with an invariant $α_{ϕ/K}$ that measures the valuation of the leading term of the formal group homomorphism $Φ:\hat E \rightarrow \hat E^\prime$. We prove that if $K/\mathbb{Q}_p$ is unramified and $E$ has additive, potentially supersingular reduction, then $α_{ϕ/K}$ is determined by the number of distinct geometric components on the special fibers of the minimal proper regular models of $E$ and $E^\prime$.
Let $F$ be a totally real field with ring of integers $O_F$, and $D$ be a totally definite quaternion algebra over $F$. A well-known formula established by Eichler and then extended by Körner computes the class number of any $O_F$-order in $D$. In this paper we generalize the Eichler class number formula so that it works for arbitrary $\mathbb{Z}$-orders in $D$. The motivation is to count the isomorphism classes of supersingular abelian surfaces in a simple isogeny class over a prime finite field $\mathbb{F}_p$. We give explicit formulas for the number of these isomorphism classes for all prim…
We determine what isogeny classes of supersingular abelian surfaces over a finite field k of characteristic 2 contain jacobians. We deal with this problem in a direct way by computing explicitly the zeta function of all supersingular curves of genus 2. Our procedure is constructive, so that we are able to exhibit curves with prescribed zeta function and to count the number of curves, up to k-isomorphism, leading to the same zeta function.
Let $\cO$ be a maximal order in a definite quaternion algebra over $\mathbb{Q}$ of prime discriminant $p$, and $\ell$ a small prime. We describe a probabilistic algorithm, which for a given left $O$-ideal, computes a representative in its left ideal class of $\ell$-power norm. In practice the algorithm is efficient, and subject to heuristics on expected distributions of primes, runs in expected polynomial time. This breaks the underlying problem for a quaternion analog of the Charles-Goren-Lauter hash function, and has security implications for the original CGL construction in terms of supersi…
In this paper we study the security of a proposal for Post-Quantum Cryptography from both a number theoretic and cryptographic perspective. Charles-Goren-Lauter in 2006 [CGL06] proposed two hash functions based on the hardness of finding paths in Ramanujan graphs. One is based on Lubotzky-Phillips-Sarnak (LPS) graphs and the other one is based on Supersingular Isogeny Graphs. A 2008 paper by Petit-Lauter-Quisquater breaks the hash function based on LPS graphs. On the Supersingular Isogeny Graphs proposal, recent work has continued to build cryptographic applications on the hardness of finding …
Let $p>3$ be a fixed prime. For a supersingular elliptic curve $E$ over $\mathbb{F}_p$ with $j$-invariant $j(E)\in \mathbb{F}_p\backslash\{0, 1728\}$, it is well known that the Frobenius map $π=((x,y)\mapsto (x^p, y^p))\in \mathrm{End}(E)$ satisfies $π^2=-p$. A result of Ibukiyama tells us that $\mathrm{End}(E)$ is a maximal order in $\mathrm{End}(E)\otimes \mathbb{Q}$ associated to a (minimal) prime $q$ satisfying $q\equiv 3 \bmod 8$ and the quadratic residue $\bigl(\frac{p}{q}\bigr)=-1$ according to $\frac{1+π}{2}\notin \mathrm{End}(E)$ or $\frac{1+π}{2}\in \mathrm{End}(E)$. Let $q_j$ denote…
We investigate how various invariants of elliptic curves, such as the discriminant, Kodaira type, Tamagawa number and real and complex periods, change under an isogeny of prime degree p. For elliptic curves over l-adic fields, the classification is almost complete (the exception is wild potentially supersingular reduction when l=p), and is summarised in a table.
In supersingular isogeny-based cryptography, the path-finding problem reduces to the endomorphism ring problem. Can path-finding be reduced to knowing just one endomorphism? It is known that a small endomorphism enables polynomial-time path-finding and endomorphism ring computation (Love-Boneh [36]). An endomorphism gives an explicit orientation of a supersingular elliptic curve. In this paper, we use the volcano structure of the oriented supersingular isogeny graph to take ascending/descending/horizontal steps on the graph and deduce path-finding algorithms to an initial curve. Each altitude …
We introduce a special class of supersingular curves over $\mathbb{F}_{p^2}$, characterized by the existence of non-integer endomorphisms of small degree. A number of properties of this set is proved. Most notably, we show that when this set partitions into subsets in such a way that curves within each subset have small-degree isogenies between them, but curves in distinct subsets have no small-degree isogenies between them. Despite this, we show that isogenies between these curves can be computed efficiently, giving a technique for computing isogenies between certain prescribed curves that ca…
