[Paper Review] Adding Level Structure to Supersingular Elliptic Curve Isogeny Graphs

Sarah Arpin|arXiv (Cornell University)|Mar 7, 2022

Cryptography and Residue Arithmetic4 citations

TL;DR

This paper extends the classical Deuring correspondence to supersingular elliptic curves with level-$N$ structure by showing their endomorphism rings form Eichler orders of level $N$ in a quaternion algebra. It establishes an equivalence of categories between supersingular elliptic curves with level structure and invertible left modules over these Eichler orders, and proves that the $\ ext{\ell}$-isogeny graph with level structure is connected for pairwise coprime $p$, $N$, and $\ell$, providing a foundation for enhanced isogeny-based cryptography resistant to recent breaks.

ABSTRACT

In this paper, we add the information of level structure to supersingular elliptic curves and study these objects with the motivation of isogeny-based cryptography. Supersingular elliptic curves with level structure map to Eichler orders in a quaternion algebra, just as supersingular elliptic curves map to maximal orders in a quaternion algebra via the classical Deuring correspondence. We study this map and the Eichler orders themselves. We also look at isogeny graphs of supersingular elliptic curves with level structure, and how they relate to graphs of Eichler orders.

Motivation & Objective

• To extend the Deuring correspondence to supersingular elliptic curves with level-$N$ structure by characterizing their endomorphism rings as Eichler orders.
• To understand the failure of injectivity in the map from isomorphism classes of supersingular curves with level structure to Eichler orders, particularly via involutions on the isomorphism classes.
• To establish a formal equivalence of categories between the category of supersingular elliptic curves with level-$N$ structure and the category of invertible left modules over their endomorphism rings.
• To analyze the structure of $\\ell$-isogeny graphs with level-$N$ structure and prove their connectedness, motivated by applications in isogeny-based cryptography.
• To provide a framework for constructing more secure isogeny-based cryptographic protocols by incorporating level structure to avoid vulnerabilities exposed in protocols like SIKE.

Proposed method

• Define supersingular elliptic curves with level-$N$ structure as pairs $(E, G)$, where $E$ is supersingular over $\overline{\mathbb{F}}_p$ and $G \subseteq E[N]$ is a cyclic subgroup of order $N$.
• Characterize the endomorphism ring $\mathcal{O}(E,G) = \{\alpha \in \text{End}(E) \mid \alpha(G) \subseteq G\}$ as an Eichler order of level $N$ in the quaternion algebra $\text{End}(E) \otimes_\mathbb{Z} \mathbb{Q}$.
• Use the theory of two-sided ideal class groups of Eichler orders to describe the fiber size of the map from $(E,G)$ to $\mathcal{O}(E,G)$, showing it equals $2^k$ for $k \in \{0,1,\dots,r+1\}$ when $N = q_1 \cdots q_r$ is squarefree.
• Construct a contravariant functor $\mathcal{h}_{(E,G)}$ from the category of supersingular elliptic curves with level-$N$ structure to the category of invertible left $\mathcal{O}(E,G)$-modules, proving it is an equivalence of categories.
• Define the graph $\mathcal{E}^{N}_{p,\ell}$ of $\ell$-isogenies between supersingular curves with level-$N$ structure, with vertices labeled by isomorphism classes $(E,G)$ and edges by isogenies of degree $\ell$.
• Prove the connectedness of $\mathcal{E}^{N}_{p,\ell}$ using surjective maps from the Goren–Kassaei graph and conditions from Roda (2019), showing all components are linked under pairwise coprime $p$, $N$, $\ell$.

Experimental results

Research questions

• RQ1 How do endomorphism rings of supersingular elliptic curves with level-$N$ structure relate to orders in quaternion algebras?
• RQ2 What is the structure of the fiber of the map from isomorphism classes of supersingular curves with level-$N$ structure to isomorphism classes of Eichler orders of level $N$?
• RQ3 Can an equivalence of categories be established between supersingular elliptic curves with level-$N$ structure and modules over their endomorphism rings?
• RQ4 How does the inclusion of level structure affect the connectivity and structure of $\\ell$-isogeny graphs in the supersingular setting?
• RQ5 Can level structure be used to construct more secure isogeny-based cryptographic protocols by avoiding information leakage that led to the break of SIKE?

Key findings

• The endomorphism ring $\mathcal{O}(E,G)$ of a supersingular elliptic curve with level-$N$ structure is isomorphic to an Eichler order of level $N$ in the quaternion algebra $\text{End}(E) \otimes_\mathbb{Z} \mathbb{Q}$.
• The number of isomorphism classes of supersingular elliptic curves with level-$N$ structure having a given Eichler order $\mathcal{O}$ as endomorphism ring equals the size of the two-sided ideal class group of $\mathcal{O}$, which is $2^k$ for some $k \in \{0,1,\dots,r+1\}$ when $N = q_1 \cdots q_r$ is squarefree.
• An equivalence of categories is established between the category of supersingular elliptic curves with level-$N$ structure and the category of invertible left modules over their endomorphism ring $\mathcal{O}(E,G)$.
• The $\\ell$-isogeny graph $\mathcal{E}^{N}_{p,\ell}$ with level-$N$ structure is connected for all pairwise coprime $p$, $N$, and $\ell$, as shown via surjective maps from the Goren–Kassaei graph and conditions from Roda (2019).
• For $p \equiv 1 \pmod{12}$, the graph $\mathcal{E}^{N}_{p,\ell}$ can be drawn as undirected by identifying isogenies with their duals, due to the action of automorphisms on kernels.
• The graph $\mathcal{E}^{N}_{p,\ell}$ has $N+1$ vertices per supersingular $j$-invariant away from $j=0,1728$, and the vertex map from $\mathcal{E}^{N}_{p,\ell}$ to the classical $\ell$-isogeny graph is $(N+1)$-to-$1$ at non-anomalous $j$-invariants.