[Paper Review] Computing endomorphism rings of supersingular elliptic curves and connections to pathfinding in isogeny graphs

Kirsten Eisentraeger, Sean Hallgren+3 more|arXiv (Cornell University)|Apr 24, 2020

Cryptography and Residue Arithmetic24 references4 citations

TL;DR

This paper presents a new algorithm for computing the endomorphism ring of a supersingular elliptic curve over $ℝ_{p^2}$, running in time $O((\log p)^2 p^{1/2})$ under heuristics. It constructs a Bass order via cycles in the $\ell$-isogeny graph, computes all maximal orders containing it using local-global principles, and identifies the correct endomorphism ring, enabling a polynomial-time reduction to pathfinding and breaking second preimage resistance of the CGL hash function.

ABSTRACT

Computing endomorphism rings of supersingular elliptic curves is an important problem in computational number theory, and it is also closely connected to the security of some of the recently proposed isogeny-based cryptosystems. In this paper we give a new algorithm for computing the endomorphism ring of a supersingular elliptic curve $E$ that runs, under certain heuristics, in time $O((\log p)^2p^{1/2})$. The algorithm works by first finding two cycles of a certain form in the supersingular $\ell$-isogeny graph $G(p,\ell)$, generating an order $Λ\subseteq \operatorname{End}(E)$. Then all maximal orders containing $Λ$ are computed, extending work of Voight. The final step is to determine which of these maximal orders is the endomorphism ring. As part of the cycle finding algorithm, we give a lower bound on the set of all $j$-invariants $j$ that are adjacent to $j^p$ in $G(p,\ell)$, answering a question in arXiv:1909.07779.

Motivation & Objective

• To develop an efficient algorithm for computing the endomorphism ring of a supersingular elliptic curve over $\mathbb{F}_{p^2}$, a central problem in computational arithmetic geometry and isogeny-based cryptography.
• To establish a polynomial-time reduction from endomorphism ring computation to pathfinding in the $\ell$-isogeny graph, simplifying prior approaches.
• To break second preimage resistance of the CGL hash function by leveraging the new algorithm and pathfinding oracle.
• To provide a lower bound on the number of $j$-invariants adjacent to $j^p$ in the $\ell$-isogeny graph, resolving an open question.
• To extend Voight's work on maximal superorders by computing all maximal orders containing a given Bass order using local-global principles.

Proposed method

• Construct a suborder $\Lambda \subseteq \text{End}(E)$ by finding two cycles in the $\ell$-isogeny graph $G(p,\ell)$, assuming their discriminants are randomly distributed.
• Use local methods to compute all maximal superorders of $\Lambda$ at each prime $q$, leveraging that there are at most $e+1$ such orders when $e = v_q(\text{discrd}(\Lambda))$.
• Apply a local-global principle to reconstruct all global maximal orders containing $\Lambda$, bounding their number as $O(p^\epsilon)$ for any $\epsilon > 0$ when $\text{discrd}(\Lambda)$ is square-free.
• Check each candidate maximal order for isomorphism to $\text{End}(E)$ by evaluating endomorphisms at points of $E$.
• Use a polynomial-time reduction from endomorphism ring computation to pathfinding via a powersmooth isogeny path from a curve $\tilde{E}$ with known endomorphism ring.
• Leverage efficient evaluation of endomorphisms via an isomorphism $g: \tilde{\mathcal{O}} \to \text{End}(\tilde{E})$ from prior work to compute kernel ideals and isogenies along the path.

Experimental results

Research questions

• RQ1 Can the endomorphism ring of a supersingular elliptic curve over $\mathbb{F}_{p^2}$ be computed in subexponential time, specifically $O((\log p)^2 p^{1/2})$?
• RQ2 What is the size of the set of $j$-invariants adjacent to $j^p$ in the $\ell$-isogeny graph $G(p,\ell)$, and can a lower bound be established?
• RQ3 Can a polynomial-time reduction from endomorphism ring computation to pathfinding in the $\ell$-isogeny graph be constructed that is simpler than prior reductions?
• RQ4 Does the algorithm break second preimage resistance of the CGL hash function based on Pizer's Ramanujan graphs?
• RQ5 Can the number of maximal orders containing a given Bass order be bounded globally using local data and a local-global principle?

Key findings

• The algorithm computes the endomorphism ring of a supersingular elliptic curve in time $O((\log p)^2 p^{1/2})$ under standard heuristics, improving upon prior $O(p^{1+\varepsilon})$ methods.
• A lower bound is established on the number of $j$-invariants adjacent to $j^p$ in $G(p,\ell)$, answering Question 3 in [1] in the affirmative.
• The number of maximal orders containing a given Bass order $\Lambda$ is bounded by $O(p^\epsilon)$ for any $\epsilon > 0$ when $\text{discrd}(\Lambda)$ is square-free, supporting the runtime bound.
• The algorithm enables a second preimage attack on the CGL hash function in time polynomial in $\log p$, demonstrating a critical vulnerability.
• A new polynomial-time reduction from endomorphism ring computation to pathfinding is presented, which is simpler than previous reductions and uses only one call to a pathfinding oracle.
• The method successfully extends Voight's work on local superorders to the global case via a local-global principle, enabling efficient computation of all maximal orders containing $\Lambda$.