We introduce a category of $\mathcal{O}$-orientedsupersingularellipticcurves and derive properties of the associated oriented and nonoriented $\ell$-isogeny supersingular isogeny graphs. As an application we introduce an oriented super-singular isogeny Diffie-Hellman protocol (OSIDH), analogous to the supersingular isogeny Diffie-Hellman (SIDH) protocol and generalizing the commutative supersingular isogeny Diffie-Hellman (CSIDH) protocol.
We describe the neighborhood of the vertex $[E_0]$ (resp. $[E_{1728}]$) in the $\ell$-isogeny graph $\mathcal{G}_\ell(\mathbb{F}_{p^2}, -2p)$ of supersingular elliptic curves over the finite field $\mathbb{F}_{p^2}$ when $p>3\ell^2$ (resp. $p>4\ell^2$) with $E_0: y^2=x^3+1$ (resp. $E_{1728}: y^2=x^3+x$) supersingular.
Supersingular isogeny graphs are known to have very few loops and multi-edges. We formalize this idea by studying and finding bounds for the number of loops and multi-edges in such graphs. We also find conditions under which the supersingular isogeny graph $Λ_p(\ell)$ is simple. The methods presented in this paper can be used to study many kinds of collisions in supersingular isogeny graphs. As an application, we introduce the notion of bi-route number for two graphs $Λ_p(\ell_1),Λ_p(\ell_2)$ and compute bounds for it. We also study the number of edges in common between the graphs $Λ_p(\ell_1)…
Let p>3 be a prime and let E, E' be supersingular elliptic curves over F_p. We want to construct an isogeny phi: E --> E'. The currently fastest algorithm for finding isogenies between supersingular elliptic curves solves this problem by performing a "meet-in-the-middle" breadth-first search in the full supersingular 2-isogeny graph over F_{p^2}. In this paper we consider the structure of the isogeny graph of supersingular elliptic curves over F_p. We give an algorithm to construct isogenies between such supersingular elliptic curves that works faster than the usual algorithm. We then discuss …
We describe an algorithm that we used to compute the q-expansions of all weight 2 cusp forms of prime level at most 2,000,000 and dimension at most 6. We also present an algorithm that we used to verify that there was only one cusp form of dimension 7 or more per Atkin-Lehner eigenspace for prime levels between 10,000 and 1,000,000. Our algorithm is based on Mestre's Méthode des Graphes, and involves supersingular isogeny graphs and Wiedemann's algorithm for finding the minimal polynomial of sparse matrices over finite fields.
Computing endomorphism rings of supersingular elliptic curves is an important problem in computational number theory, and it is also closely connected to the security of some of the recently proposed isogeny-based cryptosystems. In this paper we give a new algorithm for computing the endomorphism ring of a supersingular elliptic curve $E$ that runs, under certain heuristics, in time $O((\log p)^2p^{1/2})$. The algorithm works by first finding two cycles of a certain form in the supersingular $\ell$-isogeny graph $G(p,\ell)$, generating an order $Λ\subseteq \operatorname{End}(E)$. Then all maxi…
We study the problem of generating the endomorphism ring of a supersingular elliptic curve by two cycles in $\ell$-isogeny graphs. We prove a necessary and sufficient condition for the two endomorphisms corresponding to two cycles to be linearly independent, expanding on the work in Kohel's thesis. We also give a criterion under which the order generated by two cycles is not a maximal order. We give some examples in which we compute cycles which generate the full endomorphism ring. The most difficult part of these computations is the calculation of the trace of these cycles. We show that a gen…
We exhibit the isogeny classes of supersingular abelian threefolds over F_{2^n} containing the Jacobian of a genus 3 curve. In particular, we prove that for even n>6 there always exist a maximal and a minimal curve over F_{2^n}. All the curves can be obtained explicitly.
Minimal degree of an isogeny between a supersingular elliptic curve and its conjugate
Université de Toulon（土伦大学）；Aix Marseille Univ, UMR 7373 CNRS（艾克斯-马赛大学，法国国家科学研究中心联合研究单位7373）；University of French Polynesia（法属波利尼西亚大学）；University of Vermont（佛蒙特大学）
We prove that the path-finding problem in $\ell$-isogeny graphs and the endomorphism ring problem for supersingular elliptic curves are equivalent under reductions of polynomial expected time, assuming the generalised Riemann hypothesis. The presumed hardness of these problems is foundational for isogeny-based cryptography. As an essential tool, we develop a rigorous algorithm for the quaternion analog of the path-finding problem, building upon the heuristic method of Kohel, Lauter, Petit and Tignol. This problem, and its (previously heuristic) resolution, are both a powerful cryptanalytic too…
We investigate the isogeny graphs of supersingular elliptic curves over $\mathbb{F}_{p^2}$ equipped with a $d$-isogeny to their Galois conjugate. These curves are interesting because they are, in a sense, a generalization of curves defined over $\mathbb{F}_p$, and there is an action of the ideal class group of $\mathbb{Q}(\sqrt{-dp})$ on the isogeny graphs. We investigate constructive and destructive aspects of these graphs in isogeny-based cryptography, including generalizations of the CSIDH cryptosystem and the Delfs-Galbraith algorithm.
Let $p$ and $q$ be distinct primes, and let $X_{p,q}$ be the $(q+1)$-regular graph whose nodes are supersingular elliptic curves over $\overline{\mathbb{F}}_p$ and whose edges are $q$-isogenies. For fixed $p$, we compute the distribution of the $\ell$-Sylow subgroup of the sandpile group (i.e.\ Jacobian) of $X_{p,q}$ as $q \to \infty$. We find that the distribution disagrees with the Cohen-Lenstra heuristic in this context. Our proof is via Galois representations attached to modular curves. As a corollary of our result, we give an upper bound on the probability that the Jacobian is cyclic, whi…
We explain why the first Galbraith-Petit-Shani-Ti attack on the Supersingular Isogeny Diffie-Hellman and the Supersingular Isogeny Key Encapsulation fails in some cases.
Ordinary 3-Isogeny Graphs and Improvement of Supersingularity Testing for Twisted Hessian Curves over Prime Fields
School of Science and Engineering, Tokyo Denki University（东京电机大学理工学部）；Institute of Mathematics for Industry (IMI), Kyushu University（九州大学产业数学研究院）；Cyber Physical Security Research Institute (CPSEC)National Institute of Advanced Industrial Science and Technology (AIST)（先进工业科学技术研究所网络物理安全研究所）
本文利用扭曲Hessian曲线的3-同源性质，证明当p≡2 mod 3时普通曲线位于3-火山表面，并据此改进Sutherland超奇异检测算法，同时推广了超奇异j-不变量为立方的结论。
We revisit theoretical background on OSIDH, that is an isogeny-based key-exchange protocol proposed by Colò and Kohel at NutMiC 2019. We give a proof of a fundamental theorem for OSIDH. The theorem was stated by Colò and Kohel without proof. Furthermore, we consider parameters of OSIDH, give a sufficient condition on the parameters that the protocol works, and estimate the size of the parameters for a certain security level.
Let $A/\overline{\mathbb{F}}\_p$ and $A'/\overline{\mathbb{F}}\_p$ be supersingular principally polarized abelian varieties of dimension $g>1$. For any prime $\ell \ne p$, we give an algorithm that finds a path $ϕ\colon A \rightarrow A'$ in the $(\ell, \dots , \ell)$-isogeny graph in $\widetilde{O}(p^{g-1})$ group operations on a classical computer, and $\widetilde{O}(\sqrt{p^{g-1}})$ calls to the Grover oracle on a quantum computer. The idea is to find paths from $A$ and $A'$ to nodes that correspond to products of lower dimensional abelian varieties, and to recurse down in dimension until an…
Distributions of Iwasawa $λ$-invariants of $\mathbf{Z}_p$-towers over supersingular isogeny graphs
Joint Graduate School of Mathematics for Innovation, Kyushu University（九州大学数学创新联合研究生院）；Graduate School of Mathematics, Nagoya University（名古屋大学大学院理学研究科）；Graduate School of Natural Science & Technology, Kanazawa University（金泽大学自然科学与技术大学院）
We determine what isogeny classes of supersingular abelian surfaces over a finite field k of characteristic 2 contain jacobians. We deal with this problem in a direct way by computing explicitly the zeta function of all supersingular curves of genus 2. Our procedure is constructive, so that we are able to exhibit curves with prescribed zeta function and to count the number of curves, up to k-isomorphism, leading to the same zeta function.
In this paper we study the security of a proposal for Post-Quantum Cryptography from both a number theoretic and cryptographic perspective. Charles-Goren-Lauter in 2006 [CGL06] proposed two hash functions based on the hardness of finding paths in Ramanujan graphs. One is based on Lubotzky-Phillips-Sarnak (LPS) graphs and the other one is based on Supersingular Isogeny Graphs. A 2008 paper by Petit-Lauter-Quisquater breaks the hash function based on LPS graphs. On the Supersingular Isogeny Graphs proposal, recent work has continued to build cryptographic applications on the hardness of finding …
