Supersingular Isogeny Graphs and Endomorphism Rings: Reductions and Solutions

  • Kirsten Eisenträger
  • Sean Hallgren
  • Kristin Lauter
  • Travis Morrison
  • Christophe Petit
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10822)


In this paper, we study several related computational problems for supersingular elliptic curves, their isogeny graphs, and their endomorphism rings. We prove reductions between the problem of path finding in the \(\ell \)-isogeny graph, computing maximal orders isomorphic to the endomorphism ring of a supersingular elliptic curve, and computing the endomorphism ring itself. We also give constructive versions of Deuring’s correspondence, which associates to a maximal order in a certain quaternion algebra an isomorphism class of supersingular elliptic curves. The reductions are based on heuristics regarding the distribution of norms of elements in quaternion algebras.

We show that conjugacy classes of maximal orders have a representative of polynomial size, and we define a way to represent endomorphism ring generators in a way that allows for efficient evaluation at points on the curve. We relate these problems to the security of the Charles-Goren-Lauter hash function. We provide a collision attack for special but natural parameters of the hash function and prove that for general parameters its preimage and collision resistance are also equivalent to the endomorphism ring computation problem.



We thank John Voight for many helpful discussions regarding orders in quaternion algebras and their connection with supersingular elliptic curves. We would also like to thank the anonymous referees for their helpful suggestions and corrections.


  1. [ACC+17]
    Azarderakhsh, R., Campagna, M., Costello, C., De Feo, L., Hess, B., Jalali, A., Jao, D., Koziel, B., LaMacchia, B., Longa, P., Naehrig, M., Renes, J., Soukharev, V., Urbanik, D.: Supersingular isogeny key encapsulation. Submission to the NIST Post-Quantum Standardization Project (2017).
  2. [BJS14]
    Biasse, J.-F., Jao, D., Sankar, A.: A quantum algorithm for computing isogenies between supersingular elliptic curves. In: Meier, W., Mukhopadhyay, D. (eds.) INDOCRYPT 2014. LNCS, vol. 8885, pp. 428–442. Springer, Cham (2014). Scholar
  3. [Brö09]
    Bröker, R.: Constructing supersingular elliptic curves. J. Comb. Number Theory 1(3), 269–273 (2009)MathSciNetzbMATHGoogle Scholar
  4. [Cer04]
    Cerviño, J.M.: Supersingular elliptic curves and maximal quaternionic orders. Mathematisches Institut. Georg-August-Universität Göttingen: Seminars Summer Term 2004, pp. 53–60. Universitätsdrucke Göttingen, Göttingen (2004)Google Scholar
  5. [CG14]
    Chevyrev, I., Galbraith, S.D.: Constructing supersingular elliptic curves with a given endomorphism ring. LMS J. Comput. Math. 1(suppl. A), 71–91 (2014)MathSciNetCrossRefzbMATHGoogle Scholar
  6. [CGL06]
    Charles, D., Goren, E., Lauter, K.: Cryptographic hash functions from expander graphs. Cryptology ePrint Archive, Report 2006/021 (2006).
  7. [CGL09]
    Charles, D.X., Goren, E.Z., Lauter, K.: Cryptographic hash functions from expander graphs. J. Cryptol. 22(1), 93–113 (2009)MathSciNetCrossRefzbMATHGoogle Scholar
  8. [Cor08]
    Cornacchia, G.: Su di un metodo per la risoluzione in numeri interi dell’ equazione \(\sum _{h=0}^nc_hx^{n-h}y^h=p\). Giornale di Matematiche di Battaglini 46, 33–90 (1908)zbMATHGoogle Scholar
  9. [Deu41]
    Deuring, M.: Die Typen der Multiplikatorenringe elliptischer Funktionenkörper. Abh. Math. Sem. Univ. Hambg. 14(1), 197–272 (1941)CrossRefzbMATHGoogle Scholar
  10. [DFJP14]
    De Feo, L., Jao, D., Plût, J.: Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. J. Math. Cryptol. 3(3), 209–247 (2014)MathSciNetzbMATHGoogle Scholar
  11. [DG16]
    Delfs, C., Galbraith, S.D.: Computing isogenies between supersingular elliptic curves over \({\mathbb{F}}_p\). Des. Codes Cryptogr. 78(2), 425–440 (2016)MathSciNetCrossRefzbMATHGoogle Scholar
  12. [EHM17]
    Eisenträger, K., Hallgren, S., Morrison, T.: On the hardness of computing endomorphism rings of supersingular elliptic curves. Cryptology ePrint Archive, Report 2017/986 (2017).
  13. [Gal99]
    Galbraith, S.D.: Constructing isogenies between elliptic curves over finite fields. LMS J. Comput. Math. 2, 118–138 (1999)MathSciNetCrossRefzbMATHGoogle Scholar
  14. [GPS17]
    Galbraith, S.D., Petit, C., Silva, J.: Identification protocols and signature schemes based on supersingular isogeny problems. In: Takagi, T., Peyrin, T. (eds.) ASIACRYPT 2017. LNCS, vol. 10624, pp. 3–33. Springer, Cham (2017). Scholar
  15. [GPST16]
    Galbraith, S.D., Petit, C., Shani, B., Ti, Y.B.: On the security of supersingular isogeny cryptosystems. In: Cheon, J.H., Takagi, T. (eds.) ASIACRYPT 2016, Part I. LNCS, vol. 10031, pp. 63–91. Springer, Heidelberg (2016). Scholar
  16. [Gro87]
    Gross, B.H.: Heights and the special values of \(L\)-series. In: Number Theory, Montreal, QC, 1985. CMS Conference Proceedings, vol. 7, pp. 115–187. American Mathematical Society, Providence (1987)Google Scholar
  17. [GW17]
    Gélin, A., Wesolowski, B.: Loop-abort faults on supersingular isogeny cryptosystems. In: Lange, T., Takagi, T. (eds.) PQCrypto 2017. LNCS, vol. 10346, pp. 93–106. Springer, Cham (2017). Scholar
  18. [HLW06]
    Hoory, S., Linial, N., Wigderson, A.: Expander graphs and their applications. Bull. Amer. Math. Soc. (N.S.) 43(4), 439–561 (2006)MathSciNetCrossRefzbMATHGoogle Scholar
  19. [JDF11]
    Jao, D., De Feo, L.: Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. In: Yang, B.-Y. (ed.) PQCrypto 2011. LNCS, vol. 7071, pp. 19–34. Springer, Heidelberg (2011). Scholar
  20. [KLPT14]
    Kohel, D., Lauter, K., Petit, C., Tignol, J.-P.: On the quaternion \(\ell \)-isogeny path problem. LMS J. Comput. Math. 17, 418–432 (2014)MathSciNetCrossRefzbMATHGoogle Scholar
  21. [Koh96]
    Kohel, D.: Endomorphism rings of elliptic curves over finite fields. Ph.D. thesis, University of California, Berkeley (1996)Google Scholar
  22. [KV10]
    Kirschmer, M., Voight, J.: Algorithmic enumeration of ideal classes for quaternion orders. SIAM J. Comput. 39(5), 1714–1747 (2010)MathSciNetCrossRefzbMATHGoogle Scholar
  23. [Lan87]
    Lang, S.: Elliptic Functions. Graduate Texts in Mathematics, vol. 112, 2nd edn. Springer, New York (1987). With an appendix by J. TateCrossRefzbMATHGoogle Scholar
  24. [LM04]
    Lauter, K., McMurdy, K.: Explicit generators of endomorphism rings of supersingular elliptic curves. Preprint (2004)Google Scholar
  25. [LO77]
    Lagarias, J.C., Odlyzko, A.M.: Effective versions of the Chebotarev density theorem. In: Algebraic Number Fields: \(L\)-functions and Galois Properties: Proceedings of Symposium, Durham University, Durham, 1975, pp. 409–464. Academic Press, London (1977)Google Scholar
  26. [Mes86]
    Mestre, J.-F.: La méthode des graphes. Exemples et applications. In: Proceedings of the International Conference on Class Numbers and Fundamental Units of Algebraic Number Fields, Katata, 1986, pp. 217–242. Nagoya University, Nagoya (1986)Google Scholar
  27. [NIS16]
    NIST: Post-quantum cryptography (2016). Accessed 30 Sept 2017
  28. [NS09]
    Nguyen, P.Q., Stehlé, D.: Low-dimensional lattice basis reduction revisited. ACM Trans. Algorithms 5(4), 48 (2009). Article No. 46MathSciNetCrossRefzbMATHGoogle Scholar
  29. [Pet17]
    Petit, C.: Faster algorithms for isogeny problems using torsion point images. In: Takagi, T., Peyrin, T. (eds.) ASIACRYPT 2017. LNCS, vol. 10625, pp. 330–353. Springer, Cham (2017). Scholar
  30. [Piz80]
    Pizer, A.: An algorithm for computing modular forms on \(\varGamma _{0}(N)\). J. Algebra 64(2), 340–390 (1980)MathSciNetCrossRefzbMATHGoogle Scholar
  31. [PL17]
    Petit, C., Lauter, K.: Hard and easy problems for supersingular isogeny graphs. Cryptology ePrint Archive, Report 2017/962 (2017).
  32. [Rón92]
    Rónyai, L.: Algorithmic properties of maximal orders in simple algebras over \({ Q}\). Comput. Complex. 2(3), 225–243 (1992)MathSciNetCrossRefzbMATHGoogle Scholar
  33. [Sil09]
    Silverman, J.H.: The Arithmetic of Elliptic Curves. Springer, New York (2009). Scholar
  34. [Sim05]
    Simon, D.: Quadratic equations in dimensions 4, 5 and more. Preprint (2005)Google Scholar
  35. [Ti17]
    Ti, Y.B.: Fault attack on supersingular isogeny cryptosystems. In: Lange, T., Takagi, T. (eds.) PQCrypto 2017. LNCS, vol. 10346, pp. 107–122. Springer, Cham (2017). Scholar
  36. [Vél71]
    Vélu, J.: Isogénies entre courbes elliptiques. C. R. Acad. Sci. Paris Sér. A-B 273, A238–A241 (1971)zbMATHGoogle Scholar
  37. [Vig80]
    Vignéras, M.-F.: Arithmétique des Algèbres de Quaternions. LNM, vol. 800. Springer, Heidelberg (1980). Scholar
  38. [Voi]
    Voight, J.: Quaternion Algebras. Version v0.9.7, 3 September 2017Google Scholar
  39. [Wat69]
    Waterhouse, W.C.: Abelian varieties over finite fields. Ann. Sci. École Norm. Sup. 4(2), 521–560 (1969)MathSciNetCrossRefzbMATHGoogle Scholar
  40. [YAJ+17]
    Yoo, Y., Azarderakhsh, R., Jalali, A., Jao, D., Soukharev, V.: A post-quantum digital signature scheme based on supersingular isogenies. In: Kiayias, A. (ed.) FC 2017. LNCS, vol. 10322, pp. 163–181. Springer, Cham (2017). Scholar

Copyright information

© International Association for Cryptologic Research 2018

Authors and Affiliations

  • Kirsten Eisenträger
    • 1
  • Sean Hallgren
    • 2
  • Kristin Lauter
    • 3
  • Travis Morrison
    • 1
  • Christophe Petit
    • 4
  1. 1.Department of MathematicsThe Pennsylvania State UniversityUniversity ParkUSA
  2. 2.Department of Computer Science and EngineeringThe Pennsylvania State UniversityUniversity ParkUSA
  3. 3.Microsoft ResearchRedmondUSA
  4. 4.University of BirminghamBirminghamUK

Personalised recommendations