Vol. 4, No. 1, 2020

Download this article
Download this article For screen
For printing
Recent Volumes
5: Gauge Theory and Low-Dimensional Topology
3: Hillman: Poincaré Duality
The Open Book Series
All Volumes
About the Series
Ethics Statement
Purchase Printed Copies
Author Index
ISSN (electronic): 2329-907X
ISSN (print): 2329-9061
MSP Books and Monographs
Other MSP Publications
Computing endomorphism rings of supersingular elliptic curves and connections to path-finding in isogeny graphs

Kirsten Eisenträger, Sean Hallgren, Chris Leonardi, Travis Morrison and Jennifer Park

Vol. 4 (2020), No. 1, 215–232

Computing endomorphism rings of supersingular elliptic curves is an important problem in computational number theory, and it is also closely connected to the security of some of the recently proposed isogeny-based cryptosystems. We give a new algorithm for computing the endomorphism ring of a supersingular elliptic curve E defined over 𝔽p2 that runs, under certain heuristics, in time O((logp)2p12). The algorithm works by first finding two cycles of a certain form in the supersingular -isogeny graph G(p,), generating an order Λ End(E). Then all maximal orders containing Λ are computed, extending work of Voight (2013). The final step is to determine which of these maximal orders is the endomorphism ring. As part of the cycle-finding algorithm, we give a lower bound on the set of all j-invariants j that are adjacent to jp in G(p,), answering a question of Arpin et al. (2019).

We also give a polynomial-time reduction from computing End(E) to path-finding in the -isogeny graph which is simpler in several ways than previous ones. We show that this reduction leads to another algorithm for computing endomorphism rings which runs in time Õ(p12). This allows us to break the second preimage resistance of a hash function in the family constructed by Charles, Goren and Lauter.

supersingular elliptic curves, endomorphism ring, isogeny-based cryptography, quaternion algebras, isogeny graph
Mathematical Subject Classification 2010
Primary: 11T71, 14G50, 14H52, 14Q05
Received: 27 February 2020
Revised: 31 July 2020
Accepted: 30 August 2020
Published: 29 December 2020
Kirsten Eisenträger
Department of Mathematics
The Pennsylvania State University
University Park, PA
United States
Sean Hallgren
Department of Computer Science and Engineering
Penn State University
University Park, PA
United States
Chris Leonardi
Department of Combinatorics and Optimization
The University of Waterloo
Waterloo, ON
Travis Morrison
Institute for Quantum Computing
The University of Waterloo
Waterloo, ON
Jennifer Park
Department of Mathematics
The Ohio State University
Columbus, OH
United States