[Paper Review] Computing isogenies between supersingular elliptic curves over F_p

Christina Delfs, Steven D. Galbraith⋆|arXiv (Cornell University)|Oct 29, 2013

Cryptography and Residue Arithmetic10 references4 citations

TL;DR

This paper presents a new algorithm to compute isogenies between supersingular elliptic curves defined over $ℝ_p$, achieving $Ϫ(p^{1/4})$ bit operations by exploiting the structure of the isogeny graph over $ℝ_p$ rather than the full $ℝ_{p^2}$-defined graph. The method enables a faster, low-storage solution to the general supersingular isogeny problem by first reducing to curves over $ℝ_p$ via random walks, then applying the new isogeny construction, significantly outperforming prior meet-in-the-middle approaches.

ABSTRACT

Let p>3 be a prime and let E, E' be supersingular elliptic curves over F_p. We want to construct an isogeny phi: E --> E'. The currently fastest algorithm for finding isogenies between supersingular elliptic curves solves this problem by performing a "meet-in-the-middle" breadth-first search in the full supersingular 2-isogeny graph over F_{p^2}. In this paper we consider the structure of the isogeny graph of supersingular elliptic curves over F_p. We give an algorithm to construct isogenies between such supersingular elliptic curves that works faster than the usual algorithm. We then discuss how this results can be used to obtain an improved algorithm for the general supersingular isogeny problem.

Motivation & Objective

• To address the challenge of efficiently computing isogenies between supersingular elliptic curves defined over $ℝ_p$, a setting that is more constrained but potentially faster than the full isogeny graph over $ℝ_{p^2}$.
• To overcome the limitations of existing algorithms, which require $Ϫ(p^{1/2})$ time and space, by exploiting the structure of the subgraph of supersingular curves over $ℝ_p$.
• To develop a practical, low-storage, and parallelizable algorithm for the general supersingular isogeny problem by combining random walks in the full graph with a fast isogeny construction over $ℝ_p$.
• To demonstrate that the subgraph of supersingular $j$-invariants in $ℝ_p$ is sufficiently connected for efficient path-finding using small prime isogenies, enabling faster isogeny computation.

Proposed method

• The algorithm constructs isogenies between supersingular elliptic curves over $ℝ_p$ by analyzing the structure of the isogeny graph restricted to $j$-invariants in $ℝ_p$, which has size $Ϫ(p^{1/2})$ but is more amenable to efficient search.
• It uses a set of small primes $\ell$ for which $\left(\frac{-p}{\ell}\right) = 1$, ensuring that $φ_\ell$-isogenies between curves over $ℝ_p$ remain defined over $ℝ_p$.
• The core algorithm performs a bidirectional search in the restricted graph $X(\u211d_p, L)$, where $L$ is the set of such small primes, reducing the search space and path length compared to the full graph.
• The method leverages the expander properties of the isogeny graph to ensure that random walks from any starting curve quickly reach the subset of $j$-invariants in $ℝ_p$ with high probability.
• The algorithm is integrated into a two-stage approach for the general isogeny problem: first, use self-avoiding random walks to reach a curve over $ℝ_p$, then apply the new isogeny construction to find the isogeny in $Ϫ(p^{1/4})$ time.
• The approach avoids complex stateless Pollard-style walks, instead using simple, distributed, self-avoiding walks that are easier to implement and parallelize.

Experimental results

Research questions

• RQ1 Can isogenies between supersingular elliptic curves over $ℝ_p$ be computed more efficiently than in the full isogeny graph over $ℝ_{p^2}$?
• RQ2 What is the minimal set of small prime degrees $\ell$ such that the subgraph of supersingular curves over $ℝ_p$ is connected?
• RQ3 Can a low-storage, parallelizable algorithm for the general supersingular isogeny problem be constructed by first reducing to curves over $ℝ_p$?
• RQ4 How does the path length and computational cost in the restricted graph $X(\u211d_p, L)$ compare to the full graph $X(\u211d_{p^2}, 2)$?

Key findings

• The proposed algorithm computes isogenies between supersingular elliptic curves over $ℝ_p$ in $Ϫ(p^{1/4})$ bit operations, a significant improvement over the $Ϫ(p^{1/2})$ complexity of the standard meet-in-the-middle approach.
• The average path length in the restricted graph $X(\u211d_p, L)$ is drastically reduced—e.g., from 53,118 to 235 for 32-bit primes—leading to faster computation.
• For 32-bit primes, the new algorithm runs in 0.720 seconds on average, compared to 325.852 seconds for the full graph method, demonstrating a speedup of over 400x.
• The method enables a simpler, low-storage, and easily parallelizable solution to the general supersingular isogeny problem by combining self-avoiding random walks with the new isogeny construction.
• The algorithm is effective because the subgraph of $j$-invariants in $ℝ_p$ is sufficiently connected and expander-like, ensuring rapid mixing and short paths.