Supersingular Isogeny Graphs and Endomorphism Rings: Reductions and Solutions
In this paper, we study several related computational problems for supersingular elliptic curves, their isogeny graphs, and their endomorphism rings. We prove reductions between the problem of path finding in the \(\ell \)-isogeny graph, computing maximal orders isomorphic to the endomorphism ring of a supersingular elliptic curve, and computing the endomorphism ring itself. We also give constructive versions of Deuring’s correspondence, which associates to a maximal order in a certain quaternion algebra an isomorphism class of supersingular elliptic curves. The reductions are based on heuristics regarding the distribution of norms of elements in quaternion algebras.
We show that conjugacy classes of maximal orders have a representative of polynomial size, and we define a way to represent endomorphism ring generators in a way that allows for efficient evaluation at points on the curve. We relate these problems to the security of the Charles-Goren-Lauter hash function. We provide a collision attack for special but natural parameters of the hash function and prove that for general parameters its preimage and collision resistance are also equivalent to the endomorphism ring computation problem.
We thank John Voight for many helpful discussions regarding orders in quaternion algebras and their connection with supersingular elliptic curves. We would also like to thank the anonymous referees for their helpful suggestions and corrections.
- [ACC+17]Azarderakhsh, R., Campagna, M., Costello, C., De Feo, L., Hess, B., Jalali, A., Jao, D., Koziel, B., LaMacchia, B., Longa, P., Naehrig, M., Renes, J., Soukharev, V., Urbanik, D.: Supersingular isogeny key encapsulation. Submission to the NIST Post-Quantum Standardization Project (2017). https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Round-1-Submissions
- [Cer04]Cerviño, J.M.: Supersingular elliptic curves and maximal quaternionic orders. Mathematisches Institut. Georg-August-Universität Göttingen: Seminars Summer Term 2004, pp. 53–60. Universitätsdrucke Göttingen, Göttingen (2004)Google Scholar
- [CGL06]Charles, D., Goren, E., Lauter, K.: Cryptographic hash functions from expander graphs. Cryptology ePrint Archive, Report 2006/021 (2006). https://eprint.iacr.org/2006/021
- [EHM17]Eisenträger, K., Hallgren, S., Morrison, T.: On the hardness of computing endomorphism rings of supersingular elliptic curves. Cryptology ePrint Archive, Report 2017/986 (2017). https://eprint.iacr.org/2017/986
- [Gro87]Gross, B.H.: Heights and the special values of \(L\)-series. In: Number Theory, Montreal, QC, 1985. CMS Conference Proceedings, vol. 7, pp. 115–187. American Mathematical Society, Providence (1987)Google Scholar
- [Koh96]Kohel, D.: Endomorphism rings of elliptic curves over finite fields. Ph.D. thesis, University of California, Berkeley (1996)Google Scholar
- [LM04]Lauter, K., McMurdy, K.: Explicit generators of endomorphism rings of supersingular elliptic curves. Preprint (2004)Google Scholar
- [LO77]Lagarias, J.C., Odlyzko, A.M.: Effective versions of the Chebotarev density theorem. In: Algebraic Number Fields: \(L\)-functions and Galois Properties: Proceedings of Symposium, Durham University, Durham, 1975, pp. 409–464. Academic Press, London (1977)Google Scholar
- [Mes86]Mestre, J.-F.: La méthode des graphes. Exemples et applications. In: Proceedings of the International Conference on Class Numbers and Fundamental Units of Algebraic Number Fields, Katata, 1986, pp. 217–242. Nagoya University, Nagoya (1986)Google Scholar
- [NIS16]NIST: Post-quantum cryptography (2016). http://csrc.nist.gov/Projects/Post-Quantum-Cryptography. Accessed 30 Sept 2017
- [PL17]Petit, C., Lauter, K.: Hard and easy problems for supersingular isogeny graphs. Cryptology ePrint Archive, Report 2017/962 (2017). https://eprint.iacr.org/2017/962
- [Sim05]Simon, D.: Quadratic equations in dimensions 4, 5 and more. Preprint (2005)Google Scholar
- [Voi]Voight, J.: Quaternion Algebras. Version v0.9.7, 3 September 2017Google Scholar