In this paper, we revisit the general superspecial isogeny problem in dimension 2, which asks an adversary to find an isogeny \(\phi: \text{Jac}(C) \rightarrow \text{Jac}(C'),\) where $C$ and $C’$ are genus $2$ curves with superspecial Jacobians. The best known algorithm for solving this problem is due to Costello and Smith [5]. The general superspecial isogeny problem underlies the security of various isogeny-based protocols in two dimensions, such as the dimension 2 analogue of the CGL hash function [3], which was proposed by Takashima [16] and later extended by Castryck, Decru and Smith [2]. As we are studying the general problem, we do not assume any knowledge of the degree of the isogeny or any (SIDH-like) torsion point information. Indeed, the superspecial isogeny problem with torsion point information can be solved in polynomial time [11], thus making primitives such as the dimension 2 analogue of SIDH, G2SIDH [8], insecure.

Some background on dimension 2 abelian varieties

Superspecial abelian surfaces

To generalise elliptic curves to higher dimensions, we want to think of elliptic curves as one-dimensional (principally polarised) abelian varieties. In this paper, we are concerned with two-dimensional (principally polarised) abelian varieties, more commonly referred to as (principally polarised) abelian surfaces.

In isogeny-based cryptography, we usually consider supersingular elliptic curves. Supersingularity has a variety of equivalent definitions. Two of these are:

• The trace $t$ of Frobenius satisfies $t \equiv 0 \bmod p$ $(p > 3)$
• The Newton polygon is a straight line segment with slope $1/2$.

In dimension $>1$, however, these become distinct. The first property is called superspeciality and the second is supersingularity. Unfortunately (and rather confusingly), the correct generalisation of a supersingular elliptic curve over $\bar{\mathbb{F}}$_$p$ is a superspecial abelian surface over $\bar{\mathbb{F}}$_$p$.

There are two types of abelian surfaces:

• Products of elliptic curves $E \times E’$. If the abelian surface is superspecial, the elliptic curves will be supersingular;
• Jacobians $\text{Jac}(C)$ of genus 2 curves $C$.

For dimension 1 isogeny-based cryptography, we usually only consider the elliptic curves up to $\bar{\mathbb{F}}$_$p$-isomorphism and label these classes with the $j$-invariant. The same is true for dimension 2 isogeny-based cryptography. In this case, we label the $\bar{\mathbb{F}}$_$p$-isomorphism classes with the following invariants:

• Sets of $j$-invariants $\{ j(E), j(E’) \}$ (note that this is a set as the ordering of $E$ and $E’$ does not matter for our purposes).
• Igusa-Clebsch invariants $I$_$2$$(C)$, $I$_$4$$(C)$, $I$_$6$$(C)$, $I$_$10$$(C)$.

The Igusa-Clebsch invariants live in weighted projective space, and the subscript denotes the weight of the invariant.

Definition. Let $\mathbb{A}$^$n+1$ be $n$-dimensional affine space over $\bar{\mathbb{F}}$_$p$. The weighted projective space $\mathbb{P}(w$_$0$$, \dots, w$_$n$$)$ is the set of equivalence classes of $\mathbb{A}$^$n+1$$\backslash{0}$ under the equivalence relation $\sim$ defined $(a$_$0$$: \dots : a$_$n$) $ \sim (b$_$0$$: \dots : b$_$n$) if and only if there exists $\lambda \in \bar{\mathbb{F}}$_$p$ such that $(a$_$0$$, \dots, a$_$n$) $ =(\lambda$^$w$_$0$$b$_$0$$, \dots, \lambda$^$w$_$n$$b$_$n$$)$.

If we want to move these invariants to affine space (where we now have true equality, rather than equality up to some projective constant), we will have to normalise these invariants (taking into account the weight of each coordinate). There are infinitely many choices of normalisation, however some are more common or natural than others. A common choice is \(i_1 = \frac{6(I_2^2-16I_4)}{I_2^2}, \ i_2 = \frac{-12(5I_2^3 - 176I_2I_4 + 384I_6) }{I_2^3}, \ i_3 = \frac{3888I_{10}}{I_2^5}.\) Note, however, that in our paper we deviate from this choice, the reason for which will be explained later.

For superspecial abelian surfaces, these invariants lie in $\mathbb{F}$_$p$^$2$. Recall that the same holds for supersingular elliptic curves; one of reasons confirming that superspeciality is the correct generalisation.

$(N,N)$-Isogenies

For isogeny-based cryptography, we not only need elliptic curves, but also isogenies. In particular, we consider $N$-isogenies $\phi: E \rightarrow E’$ with kernel $\mathbb{Z}/N\mathbb{Z}$, generated by a point $P \in E(\bar{\mathbb{F}}$_$p$$)[N]$.

Moving to dimension 2, we consider $(N,N)$-isogenies.

Definition. An $(N,N)$-isogeny is an isogeny (i.e., a surjective group homomorphism with finite kernel) $\phi: A \rightarrow A’$ between abelian surfaces $A$ and $A’$, where:

• $\text{ker } \phi \cong (\mathbb{Z}/N\mathbb{Z})$^$2$; and
• $\text{ker } \phi $ is maximal isotropic with respect to the $N$-Weil pairing, i.e., for all $P, Q \in \text{ker } \phi$, we have $e$_$N$$(P, Q) = 1$.

The second condition is there to ensure that $A’$ comes equipped with a principal polarisation. For $N$-isogenies, this is always satisfied, and therefore this condition is usually omitted from the definition.

Let $D$_$N$ be the number of $(N,N)$-isogenies from a superspecial surface $A$. Then we have that $D$_$N$ $ = O(N$^$3$$)$ (the exact number can be found in Section 2 of our paper). This is much larger than in the dimension 1 case where there are $O(N)$ outgoing isogenies from a supersingular elliptic curve. Here we are ignoring the rare, special cases where $j(E) = 0$ or $1728$, for example.

Dimension 2 general isogeny problem

In its most general form, the superspecial isogeny problem in two dimensions asks to find an isogeny \(\phi: A \rightarrow A'\) between two superspecial abelian surfaces $A/\mathbb{F}$_$p$^$2$ and $A’/\mathbb{F}$_$p$^$2$.

The general isogeny problem can be viewed as finding a path between two nodes in the superspecial isogeny graph.

Superspecial isogeny graph

Let $p$ be a large prime not dividing $N$.

Definition. The superspecial isogeny graph, denoted $\Gamma(N; p)$, is the graph with vertex set $\mathcal{S}(p)$, defined as the set of isomorphism classes of superspecial abelian surfaces, and whose edges are $(N,N)$-isogenies over $\bar{\mathbb{F}}$_$p$.

This graph has a number of nice properties:

• Firstly, the vertex set is finite. More precisely, we have that the size of $\mathcal{S}(p)$ is $O(p^3)$. This is only true when we restrict to superspecial surfaces, and mirrors the finiteness property of the vertex set in dimension 1.
• The isomorphism classes $[A] \in \mathcal{S}(p)$ are represented by surfaces defined over $\mathbb{F}$_$p$^$2$. Again, this property is only true by restricting to superspecial abelian surfaces, and matches the situation in genus 1.
• The graph is $D$_$N$-regular (except for on a small number of special nodes).

The hardness of the general isogeny problem in dimension one is largely based on the fact that the supersingular isogeny graph is Ramanujan, i.e., has optimal expansion. In contrast, $\Gamma(N; p)$ is not quite Ramanujan, but we can still argue that the expansion is good enough to build secure cryptographic protocols [7].

As we have two types of abelian surfaces, there is a natural partition of the vertex set. Indeed, $\mathcal{S}(p)$ is equal to the disjoint union of:

• $\mathcal{J}(p) = \{ [A] \in \mathcal{S}(p) : A \cong \text{Jac}(C) \}, $ and
• $\mathcal{E}(p) = \{ [A] \in \mathcal{S}(p) : A \cong E \times E’ \text{ with } E, E’ \text{ supersingular ECs} \}.$

There are around $O(p^3)$ nodes in $\mathcal{J}(p)$ and $O(p^2)$ nodes in $\mathcal{E}(p)$, making the latter the rarer case.

We often fix the vertex set but consider multiple edge sets. We will therefore use $\Gamma(\mathcal{N}; p)$ to denote the graph with the vertex set $\mathcal{S}(p)$ and and whose edges are $(N,N)$-isogenies for all $N\in \mathcal{N}$.

We can now view the general isogeny problem as a path finding problem: given superspecial abelian surfaces $A$ and $A’$ defined over $\mathbb{F}$_$p$^$2$, find a walk in $\Gamma(\mathcal{N}; p)$ connecting them, where $\mathcal{N} = \{ N \in \mathbb{N} : p \nmid N \}$.

Attacking the isogeny problem in dimension 2

The best known algorithm for solving the general isogeny problem is due to Costello-Smith [5].

The Costello-Smith algorithm proceeds as follows. Suppose we are given a start node $A$ and end node $A’$ in $\mathcal{J}(p)$. Our goal is to find an isogeny $\phi: A \rightarrow A’$.

Step 1: find a path to the special subset

The first step is to find paths from $A, A’ \in \mathcal{J}(p)$ to nodes in $\mathcal{E}(p)$, say we find isogenies $\varphi: A \rightarrow E$_$1$$\times E$_$2$ and $\varphi’: A’ \rightarrow E$_$1$$’ \times E$_$2$$’$, where the elliptic curves here are supersingular. Due to the proportion of nodes in $\mathcal{J}(p)$ to nodes in $\mathcal{E}(p)$, we expect to find such paths in $\tilde{O}(p)$.

By finding these paths, we have now reduced the isogeny problem in $\mathcal{S}(p)$ to the isogeny problem in $\mathcal{E}(p)$.

Step 2: solve the problem in the special subset

The second step is to solve the problem in $\mathcal{E}(p)$, which is (asymptotically) equivalent to solving the problem in dimension 1. As the elliptic curves $E$_$1$, $E$_$2$, $E$_$1$$’$, and $E$_$2$$’$ are supersingular, we can use an algorithm such as Delfs–Galbraith [8] or SuperSolver [9] to output paths $\psi $_$1$$: E$_$1$$\rightarrow E$_$1$$’$ and $\psi $_$2$$: E$_$2$$\rightarrow E$_$2$$’$. If the length of these paths have the same parity, then we can patch them up to obtain the product path $\pi : E$_$1$$ \times E$_$2$$ \rightarrow E$_$1$$’ \times E$_$2$$’$ [1]. If the lengths of the paths do not have the same parity, we fail and return $\bot$, and run the algorithm again.

Note, however, only three runs are required to successfully return path $\phi$. Indeed, if we instead run the Costello-Smith algorithm to find paths $\psi_1 : E$_$1$$ \rightarrow E$_$1$$’$, $\psi$_$2,1$$ : E$_$2$$ \rightarrow E$, and $\psi$_$2,2$$ : E \rightarrow E$_$1$$’$, where $E: y^2 = x^3+x$ has an endomorphism of degree 2, say $\tau$, then we can set $\psi_2 = \psi_{2,2}\circ \psi_{2,1}$ if $\text{length}(\psi_1) \equiv \text{length}(\psi_{2,1} \circ \psi_{2,2}) \bmod 2$ and $\psi_2 = \psi_{2,2}\circ \tau \circ \psi_{2,1}$, otherwise.

Therefore, this step is expected to run in $\tilde{O}(\sqrt{p})$, as it is dominated by one run of the Delfs–Galbraith algorithm.

We can then obtain the desired path from $A$ to $A’$ as $\phi = \hat{\varphi}’ \circ \pi \circ \varphi$, where $\hat{\cdot}$ represents the dual.

Overall, the cost of the algorithm is $\widetilde{O}(p)$ bit operations, and is dominated by step 1.

Can we improve the efficiency of the bottleneck step?

The bottleneck of the attack is the first step, which can be rephrased as: walking in $\Gamma(N; p)$ until finding $A \in \mathcal{J}(p)$ which is $(N,N)$-split.

Definition. We say the Jacobian $\text{Jac}(C)$ of a genus 2 curve $C$ is $(N,N)$-split if there exists an (separable, polarised, optimal) $(N,N)$-isogeny $\text{Jac}(C) \rightarrow E \times E’$, where $E$, $E’$ are elliptic curves.

For this reason, we focus on this step.

Let’s look in more depth at this first step in the Costello-Smith algorithm:

1. Start on a node $A$₀$\in \mathcal{J}(p)$.
2. Take a step in $\Gamma(2; p)$ via a Richelot isogeny $\phi$_$1$$: A$_$0$$ \rightarrow A$_$1$.
3. From the Richelot isogeny formulae, we can determine whether $A$_$1$$\in \mathcal{E}(p)$ (at some point you compute a determinant $\delta$, and if this is zero, the $A$_$1$ is a product of elliptic curves). In this case, $A$_$0$ is $(2,2)$-split, and we terminate. Otherwise, take another step $\phi$_$2$$: A$_$1$$\rightarrow A$_$2$.
4. Repeat the previous step until finding $A$_$i$$ \in \mathcal{E}(p)$.

In summary, they use Richelot isogenies (as these are the most efficient to compute) to take walks in $\Gamma(2; p)$ and detect $(2,2)$-splittings. One of the motivations of this paper was the answer the question: by taking steps in $\Gamma(2; p)$, can we detect whether the current node $A$_$i$ is $(N,N)$-split for $N>2$?

A (naive) answer to this question would be to compute all $(N,N)$-isogenies from $A$_$i$, but this is not efficient (as it requires, at a minimum, the computation of three $N$-th roots). Can we make the detection efficient? We answer this question in the affirmative for $N \leq 11$, and apply this to improve the concrete complexity of the Costello-Smith attack.

Efficient algorithm for detection of $(N,N)$-splittings

This question is answered by moduli spaces. Informally speaking, a moduli space is a geometric object that parametrises algebraic objects.

We consider two moduli spaces:

• $\mathcal{L}$_$N$: parameterises genus 2 curves with $(N,N)$-split Jacobians up to $\bar{\mathbb{F}}$_$p$-isomorphism (which is sufficient for our cryptographic purposes). For small $N$, this is more or less a plane (more precisely, it is birational to $\mathbb{A}$^$2$), let’s say with coordinates $r,s$.
• $\mathcal{M}$_$2$: parameterises genus 2 curves up to $\bar{\mathbb{F}}$_$p$-isomorphism. There is a map from $\mathcal{M}$_$2$ to weighted projective space $\mathbb{P}(2,4,6,10)$, given by the Igusa-Celbsch invariants.

For abstract reasons, for every $N$, there is a map $\varphi$_$N$ from $\mathcal{L}$_$N$, with image inside $\mathcal{M}$_$2$. So, our question of whether $C$ (or rather the isomorphism class $[C]$) is $(N,N)$-split can be answered by whether $[C]$ lives inside $\text{Im } \varphi$_$N$ (or, more precisely, the Zariski closure of the image).

The main problem here is that we do not have explicit equations for $\varphi$_$N$ for every $N$. Kumar [9] gives us this map explicitly for $N \leq 11$. So, to determine if $[C]$ is in the image of $\varphi$_$N$, it is sufficient to determine whether there is an $(r$_$0$$,s$_$0$$) \in \mathbb{A}$^$2$_$r,s$ that map to $(I_2(C): I_4(C): I_6(C): I_{10}(C))$.

Not only this, but if we find such an $r$_$0$ and $s$_$0$ for some $N$, Kumar gives us maps that recover the elliptic curves such that there exists an $(N,N)$-isogeny $\text{Jac}(C) \rightarrow E \times E’$. Unfortunately, we don’t recover the actual isogeny, only that one exists. However, we can compute the isogeny as a post-computation using the AVIsogenies package (e.g., by computing all $(N,N)$-isogenies from $\text{Jac}(C)$, as we now know that one will land in a product).

Using the maps $\varphi$_$N$

We want to detect whether $C$ is $(N,N)$-split, i.e., in the image of $\varphi$_$N$. Let $I$_$2$$(C)$, $I$_$4$$(C)$, $I$_$6$$(C)$, $I$_$10$$(C)$ be the Igusa-Clebsch invariants of $C$.

Method 1. Compute the equation $F$_$N$ for the image of $\mathcal{L}$_$N$ in $\mathcal{M}$_$2$. Then, we can detect if $[C]$ is $(N,N)$-split by determining whether $F_N(I_2(C), I_4(C), I_6(C), I_{10}(C)) = 0.$

$F$_$N$ has been computed previously by Shaska and collaborators [12] [13] [14] [15] [10] and Bruin-Doereksen [1]. The main problem is that $F$_$N$ is large (with size growing rapidly with $N$), so the evaluation is inefficient.

As a result, we instead use elimination theory and compute resultants.

Method 2. We normalise the Igusa-Clebsch invariants $I$_$2$$(C)$, $I$_$4$$(C)$, $I$_$6$$(C)$, $I$_$10$$(C)$ as $\alpha_1(C) = \frac{I_4(C)}{I_2(C)^2}$, $\alpha_2(C) = \frac{I_2(C)I_4(C)}{I_6(C)}$, $\alpha_1(C) = \frac{I_4(C)I_6(C)}{I_{10}(C)}.$

Kumar gives us the map \(\varphi_N = \big(\mathcal{I}_2(r, s): \mathcal{I}_4(r, s): \mathcal{I}_6(r, s): \mathcal{I}_{10}(r, s)\big).\) We chose the same normalisation of the $\mathcal{I}$_$k$ to give us $i$_$1$, $i$_$2$, $i$_$3$ $ \in \mathbb{Q}(r,s)$.

To determine whether $\text{Jac}(C)$ is $(N,N)$-split, it suffices to determine whether there is a simultaneous solution $r$_$0$$, s$_$0$$\in \bar{\mathbb{F}}$_$p$ of

As the $f$_$i$ are rational maps, we also need to ensure that the solution does not make the denominators of the $f$_$i$ vanish.

We determine if there exists $(r$_$0$$, s$_$0$$)$ by computing resultants of (the numerators of) $f$_$1$, $f$_$2$ and of $f$_$2$, $f$_$3$ and then computing the gcd of these resultants. Then, if the degree is 0, $\text{Jac}(C)$ is not $(N,N)$-split, and otherwise it is (with overwhelming probability).

In fact, we actually use a more efficient method where we precompute the resultants generically, and then compute the gcd for each instance $C$.

SplitSeacher: application to the dimension 2 isogeny problem

We now discuss how efficient splitting detection can be applied to attacking the dimension 2 isogeny problem. In our paper, we construct a new algorithm SplitSeacher, which applies split detection to the first step of the Costello-Smith algorithm.

Precomputation. First we determine a set of optimal $N$’s for which we detect $(N,N)$-splittings. We do this by finding $2 \leq N \leq 11$ that minimise the following ratio \(\frac{\text{number of } \mathbb{F}_p \text{ multiplications}}{\text{number of nodes revealed and inspected}}.\) The numerator is simply the cost of taking a step in the $(2,2)$-isogeny graph plus the cost of splitting detection for $N$ in the optimal set. The denominator is trickier to compute. The number of nodes revealed by taking a step is simply 1. If $N$ is odd, then the number of nodes inspected at each step using split detection is the number of neighbours in $\Gamma(N;p)$, namely $D$_$N$. However, if $N$ is even, as we are walking in the $(2,2)$-isogeny graph, the number of nodes inspected at each step by split detection is less than $D$_$N$. We determine the precise number in Lemma 4 of our paper.

For our example, let us suppose the optimal set of $N$’s is ${2, 3, 5}$.

Step 1. We first take a step in $\Gamma(2; p)$ using Richelot isogenies. If we have walking onto a product of elliptic curves, then we terminate.

Step 2. Using the method outlined in the previous section, we apply efficient $(N,N)$-splitting detection for $N \in {2, 3, 5}$.

First, for $N = 2$, we check $14$ nodes (all nodes except the one we stepped from)

For $N = 3$, we check $D$_$3$ $= 40$ nodes.

For $N = 5$, we check $D$_$5$ $= 156$ nodes.

If at any point we detect a splitting, terminate.

Step 3. Repeat steps 1 and 2 until an $(N,N)$-splitting is found.

Comparison with SuperSolver

At a high level, SplitSeacher can be viewed as an analogue of SuperSolver [4] (joint work with Craig Costello and Jia Shi), which improves on the concrete complexity of the Delfs-Galbraith attack against the dimension 1 isogeny problem. Both attacks use random walks to find special nodes in the graph to reduce the algorithm to a comparitevely easier isogeny problem: the special nodes in the Delfs-Galbraith algorithm are the isomorphism classes of elliptic curves defined over $\mathbb{F}$_$p$, while the special nodes in the Costello-Smith algorithm are the isomorphism classes of abelian surfaces that are isomorphic to products of elliptic curves. The improvements in SuperSolver came from an efficient method for determining whether modular polynomials have subfield roots without computing any such roots explicitly. Here, our improvements come from Kumar’s parametrisations of the moduli space of dimension $2$ abelian surfaces whose Jacobians are split by an $(N,N)$-isogeny. To hear more this general framework for attacking the general isogeny problem (in dimensions 1 and 2), check out the talk I gave at the Isogeny Club.

Implementation and Experimental Results

We implemented and optimised the first step of the Costello-Smith attack with and without detection of $(N,N)$-splittings. We performed experiments for primes $p$ of bitsize $50-1000$, running the first step until reaching $10$^$8$ multiplications. We counted the number of nodes revealed and $\mathbb{F}$_$p$ multiplications per node revealed.

Comparison to SuperSolver improvements

Relatively speaking, the improvements we obtained using SplitSeacher are significantly bigger than the improvements by SuperSolver to the concrete complexity of the Delfs-Galbraith algorithm. Though our detection of $(N,N)$-splittings requires more computation that the analogous $N$-isogenous subfield curve searching in SuperSolver, in dimension 2 we reveal $O(N^3)$ neighbours simultaneously, compared to $O(N)$ in the dimension 1 search.

For primes of size 50 to 800 bits, SuperSolver [Table 6, 14] reports speedups ranging from $3.2-17.6 \texttt{x}$, while the speedups SplitSearcher gives for primes of these same sizes range from $16.5-116.3 \texttt{x}$.

References

[1] N. Bruin and K. Doerksen. The arithmetic of genus two curves with (4; 4)-split Jacobians. Canad. J.Math., 63(5):992-1024, 2011.

[2] W. Castryck, T. Decru, and B. Smith. Hash functions from superspecial genus-2 curves using Richelot isogenies. Journal of Mathematical Cryptology, 14(1):268-292, 2020.

[3] D. X. Charles, K. E. Lauter, and E. Z. Goren. Cryptographic hash functions from expander graphs. Journal of Cryptology, 22(1):93-113, 2009.

[4] M. Corte-Real Santos, C. Costello, and J. Shi. Accelerating the Delfs-Galbraith algorithm with fast subfield root detection. In Annual International Cryptology Conference, pages 285-314. Springer, 2022.

[5] C. Costello and B. Smith. The supersingular isogeny problem in genus 2 and beyond. In PQ Crypto, pages 151-168. Springer, 2020.

[6] C. Delfs and S. D. Galbraith. Computing isogenies between supersingular elliptic curves over $\mathbb{F}$_$p$. Designs, Codes and Cryptography, 78(2):425-440, 2016.

[7] E. Florit and B. Smith. Automorphisms and isogeny graphs of abelian varieties, with applications to the superspecial Richelot isogeny graph. In Arithmetic, Geometry, Cryptography, and Coding Theory 2021, 2021.

[8] E. V. Flynn and Y. B. Ti. Genus two isogeny cryptography. In PQ Crypto, pages 286-306. Springer,2019.

[9] A. Kumar. Hilbert modular surfaces for square discriminants and elliptic subfields of genus 2 function fields. Research in the Mathematical Sciences, 2(1):1-46, 2015.

[10] K. Magaard, T. Shaska, and H. Völklein. Genus 2 curves that admit a degree 5 map to an elliptic curve. Forum Math., 21(3):547-566, 2009.

[11] D. Robert. Breaking SIDH in polynomial time. eprint 2022/1068, 2022.

[12] T. Shaska. Curves of genus two covering elliptic curves. PhD thesis, University of Florida, 2001.

[13] T. Shaska. Genus 2 fields with degree 3 elliptic subfields. Forum Math., 16(2):263-280, 2004.

[14] T. Shaska and H. Völklein. Elliptic subfields and automorphisms of genus 2 function fields. In Algebra, arithmetic and geometry with applications, pages 703-723. Springer, 2004.

[15] T. Shaska, G. S. Wijesiri, S. Wolf, and L. Woodland. Degree 4 coverings of elliptic curves by genus 2 curves. Albanian J. Math., 2(4):307-318, 2008.

[16] K. Takashima. Effifient algorithms for isogeny sequences and their cryptographic applications. In Mathematical modelling for next-generation cryptography, pages 97-114. Springer, 2018.

$B$-Smooth Neighbours

In this paper, we revisit the problem of finding two consecutive $B$-smooth integers, i.e., find integers $(r, r+1)$ such that $r$, $r+1$ have no prime factors of size exceeding the smoothness bound $B$.
This problem that has emerged in the context of instantiating efficient isogeny-based public key cryptosystems. Though initially motivated in the context of key exchange¹, it has found applications in the search for parameters for SQISign², the leading isogeny-based signature scheme. For these cryptographic applications we work over the finite field $\mathbb{F}_{p^2}$ for some prime $p$, where we require $p^2-1$ to be as smooth as possible. This is because $p^2-1$ often corresponds to the rational torsion available that will be used for isogeny computations. Roughly speaking, the smaller the smoothness bound, the faster the signature scheme will be. If we have a pair of twin $B$-smooth integers $(r, r+1)$ and let $p = 2r+1$, then $p^2-1 = 4r(r+1)$ is $B$-smooth, as required.

Whilst SQISign is currently the most compact post-quantum signature scheme, its signing algorithm is orders of magnitude slower than its counterparts. Therefore, it is desirable to find primes $p$ with $p^2-1$ smooth as possible to increase SQISign’s efficiency, which would be highly beneficial for its practicality.

In this work, we introduce new ways of finding large twin smooths based on the Conrey-Holmstrom-McLaughlin (CHM) algorithm. It is a constructive algorithm which finds almost all twin smooth integers for a smoothness bound $B$. In their paper, Conrey–Holmstrom–McLaughlin run this algorithm for $B = 200$ to find a list of 346,192 twin smooths in about 2 weeks, the largest of which were 79-bit integers. We first give an optimised implementation of the CHM algorithm that allows us to run it for much larger values of $B$, thus allowing us to find larger sized twins. For example, with $B = 547$, our implementation outputs a set of 82,026,426 pairs of $B$-smooth twins, the largest of which were 122-bit integers. However, it appears infeasible to increase $B$ to the point where the twins found purely using the CHM algorithm are large enough to be used for cryptographic applications. Aided by the fact that SQISign does not require $p^2-1$ to be fully smooth, we obtain cryptographic sized primes $p$ by combining larger twins found through CHM with techniques from the literature.

The CHM Algorithm

The CHM algorithm is a simple algorithm that generates B-smooth neighbours. It works as follows:

• We start with an initial set $S^{(0)} = ${$1, 2, …, B-1$} of positive integers less than $B$, representing twin smooth pairs $(1,2), (2,3), …, (B-1, B)$.
• Set $S^{(1)} =S^{(0)}$.
• Iteratively pass through all pairs of distinct $r < s$ in $S^{(0)}$ and compute $\frac{t}{t’} = \frac{r}{r+1}\cdot \frac{s+1}{s},$ with $\frac{t}{t’}$ in lowest terms. If $t’ = t+1$, then $t$ represnts a $B$-smooth pair $(t, t+1)$ and we add it to the set $S^{(1)}$.
• The algorithm then iterates through all pairs of distinct $r,s$ in $S^{(1)}$ to form $S^{(2)}$, and so on.
• We terminate when $S^{(d)} = S^{(d+1)}$ for some $d \geq 0$.

Example: $B$ = 5

• We start with the set $S^{(0)} = ${$1,2,3,4$}.
• Going through distinct $(r,s)$ in $S^{(0)}$, the only pairs that give us a new twin smooth pair $(t, t+1)$ are $(2,3)$, $(2,4)$ and $(3,4)$: $ \frac{2}{2+1}\cdot \frac{3+1}{3} = \frac{8}{9}, \quad \frac{2}{2+1}\cdot \frac{4+1}{4} = \frac{5}{6}, \quad \frac{3}{3+1}\cdot \frac{4+1}{4} = \frac{15}{16}$. So we get $S^{(0)} = ${$1,2,3,4,5,8,15$}.
• Continuing in this way we get $S^{(2)} = ${$1,2,3,4,5,8,9,15,24$}, and $S^{(3)} = ${$1,2,3,4,5,8,9,15,24, 80$}.
• Then $S^{(4)} = S^{(3)}$, so we terminate and return $S^{(3)}$.

This is indeed the full set of twin 5-smooth integers³.

Implementing the CHM algorithm

To determine how feasible it is to run the CHM algorithm to obtain twin smooths of cryptographic size, we implement an optimised CHM algorithm. Some optimisations include:

• Parallelisation
• Avoiding multiple checks of the same pairs of twin smooths $(r,s)$
• Iterating through smoothness bounds
• For each pair $(r,s)$ considered in each CHM step, we need to check if for some $t$, the following holds: $\frac{t}{t+1} = \frac{r}{r+1}\cdot \frac{s+1}{s}.$ In the paper we show that this is equivalent to requiring $\gcd(r(s+1),(r+1)s) = s-r$. We observe that we can completely avoid the gcd calculation: instead, we check that $r(s+1) \equiv 0 \bmod (s-r)$ holds, and perform a division to compute $t$ if so. In this way, we do just one modular reduction per pair $(r,s)$ considered in each CHM step.

Despite these optimisations, using the pure CHM algorithm to produce large enough twin smooths for cryptographic purposes is infeasible in practice due to both runtime and memory limitations. Indeed, we ran this approach up to smoothness bound $B=547$ and found that to reach a twin smooth pair of size at least 256 bits requires smoothness bound of $> 5000$ for which the set of $B$-smooth twins is roughly $2^{49}$. Noting that the effort for CHM iterations grows quadratically with the set size, we deduce that it is not feasible to reach cryptographically sized smooth twins.

Therefore, we looked for variants of the CHM algorithm that restrict to checking only a certain subset of $(r,s)$ pairs without losing too many of the new smooth neighbors. Observing that similar sized $(r,s)$ are more likely to produce new twim smooths, we use the following condition to restrict the visited pairs: Let $k>1$ be a constant parameter. Then, we only check pairs $(r,s)$ if they satisfy $0 < r < s < kr$.

Compared to the full CHM algorithm, this leads to a smaller set of twin smooths, but allows for much faster running times. The two main flavours of this that we explore are:

• Global-$k$: we initially pick some $k$ with $1 < k \leq 2$, and restrict the CHM algorithm to only check $k$-balanced pairs $(r,s)$. The choice of $k$ is subtle: choosing $k$ too close to 1 may lead to missing too many twin smooths, but picking $k$ close to 2 may result in a small speedup that does not allow us to run large smoothness bounds.
• Constant-Range: In the above method, checking if a pair is $k$-balanced consumes a significant part of the overall runtime. Therefore, we can use constant ranges to avoid these checks. Sorting the set $S$ of twins by size, we can instead fix a range $R$ and for each $r$ we check the pair $(r,s)$ for the $R$ successors $s$ of $r$ in $S$.

The constant-range approach outperforms the global-$k$ approach in terms of runtime, due to the elimination of all checks for $k$-balance of twins. Additionally, while very aggressive instantiations of constant-range miss more twin smooths, they find a bigger share of the largest 100 twins compared to their global-$k$ counterpart. We therefore concluded that for larger smoothness bounds $B$, for which we cannot hope to complete the full CHM algorithm, constant-range is the most promising approach for obtaining larger twin smooths within feasible runtimes.

Finding cryptographic smooth neighbours

We now focus on finding primes $p$ suitable for isogeny-based cryptographic applications that, for efficiency reasons, need $p^2-1$ to be as smooth as possible. In particular, we target the signature scheme SQISign², which requires a prime $p$ satisfying $T’ \mid p^2-1$, where $T’ = 2^fT$ with $f$ is as large as possible and $T \approx p^{5/4}$ is smooth and odd. We note that these conditions mean we do not require $(p+1)(p-1)$ to be fully smooth, which allows for some flexibility. Therefore, we can move away from solely using CHM and, instead, use the CHM results as inputs to known method for finding such primes.

We find fully smooth twins of a smaller bit-size via CHM and boost them up using the polynomials $p_n(x) = 2x^n - 1$ (for carefully chosen $n$).

General Method. For our SQISign application, we have $\log p = ${$256, 384, 512$} for NIST Level I, III, V (respectively), $T \approx p^{5/4}$ and $f$ as large as possible. We will aim for $T’ \approx p^{3/2}$ as this is what is currently used in the SQISign implementation. We fix a smoothness bound $B$ and let $p_n(x) = 2x^n - 1$. Then, $p_n(x)^2-1 = 4x^n(x-1)f_n(x)$. If we evaluate $p_n(x)$ at $x = r$, where $(r, r-1)$ is a $B$-smooth twin pair, then $p_n(r)^2-1$ will have guaranteed smooth factor $4r^n(r-1)$. We then have to hope that the factor $f_n(r)$ has enough smoothness so that $T’ \approx p^{3/2}$.

A natural question arises: what $n$ should we choose?

• To obtain a prime of bitsize $\log(p)$ we need to evaluate $p_n(x)$ at $B$-smooth twins of bitsize $(\log(p) - 1)/n$.
• For small $n$, we require CHM to find twin smooths of large bit size. For certain bit sizes, running full CHM may be computationally out of reach, and therefore we use a variant that may not find all twins. In this case, however, we have more guaranteed smoothness in $p^2 - 1$ and so it is more likely that the remaining factors will have the required smoothness.
• For large $n$, we can obtain more twin smooths from CHM (in some cases, we can even exhaustively search for all twin smooths), however we have less guaranteed smoothness in $p^2-1$.
• The more guaranteed smootheness we have from $4r^n(r-1)$, the more likely $f_n(r)$ has the required additional smoothness. Additionally, if $f_n(x)$ factors as $g_1(x)\cdots g_m(x)$, then the smaller the degrees $\deg (g_i)$ are, the higher the probability that we have enough smoothness.

Balancing the probability of guaranteed smoothness and being able to compute enough CHM twin smooths of the required bitsize, we make the following choices of $n$ for each NIST level:

• NIST-I parameters: $n = 2,3$
• NIST-III parameters: $n = 3,4,6$
• NIST-V parameters: $n = 4,6$

We notice that for $n$ even, both $x - 1$ and $x+1$ appear in the factorisation of $p_n(x)^2-1$, and so we consider twin smooths $(r, r \pm 1)$ to give a guaranteed smooth factor $4r^n(r\pm 1)$ in $p_n(r)^2-1$. As a result, for $n$ even, we have a larger pool of twin smooths to try.

Alternative Methods. In the paper we also discuss alternative methods to construct twin smooths, which we then boost up using our $p_n(x)$ method. These methods include the XGCD approach (see e.g.²) and the PTE approach⁴.

Results

After running our constant-range variant of the CHM algorithm to obtain sufficient twin smooths of different bitsizes and smoothness $B$, we used the method described above to obtain SQISign parameters. I’ll briefly list the best primes (in terms of the signing cost metric $\sqrt{B}/f$, which we want to be as small as possible) that we found for each NIST security level. Recall that for SQISign we only require a factor $T’ \approx p^{3/2}$ of $p^2-1$ to be smooth, i.e., there may be some factors dividing $p^2-1$ that are not $B$-smooth. These rough factors will be displayed in bold.

To see more primes for each NIST level, make sure to check out the full paper.

NIST-I Parameters: The 254-bit prime $p = 2r^3-1$ with $r = 20461449125500374748856320$ has \(\begin{align*} p+1 &= 2^{46}\cdot 5^3 \cdot 13^3 \cdot 31^3 \cdot 73^3 \cdot 83^3 \cdot 103^3 \cdot 107^3 \cdot 137^3\cdot 239^3 \cdot 271^3 \cdot 523^3 \\ p - 1 &= 2 \cdot 3^3 \cdot 7\cdot 11^2\cdot 17^2\cdot 19\cdot 101\cdot 127\cdot 149\cdot 157\cdot 167\cdot 173\cdot 199\cdot 229 \\ &\quad \quad \cdot 337\cdot 457\cdot 479\cdot \mathbf{141067}\cdot \mathbf{3428098456843}\cdot \mathbf{4840475945318614791658621} \end{align*}\)

In comparison, the state-of-the-art implementation of SQISign uses a 254-bit prime $p$ with $p^2-1$ being $3923$-smooth⁵. However, their prime has a larger power of 2 and 3 compared to our prime, and most of the smooth factors are relatively small. Therefore, despite the larger smoothness bound, it may perform better in practice. Evaluating this in detail would require an implementation of our primes into the SQISign code. However, the current implementation uses specific optimisations that only apply to the particular prime that is being used, and so changing the prime would require reshaping the specific optimisations in the setting of our primes. We therefore leave this for future work.

One of the main contributions of our work is finding the first credible primes for SQISign at the NIST-III and NIST-V security level. In fact, most of the primes $p$ we found have the majority of the smooth factors of $p^2-1$ being relatively small, and therefore lend themselves well to efficient implementations.

NIST-III Parameters: The $382$-bit prime $p = 2r^6 - 1$ with $r = 11896643388662145024$ has \(\begin{align*} p+1 &= 2^{79}\cdot 3^6 \cdot 23^{12} \cdot 107^6 \cdot 127^6 \cdot 307^6 \cdot 401^6 \cdot 547^6 \\ p - 1 &= 2 \cdot 5^2 \cdot 7\cdot 11\cdot 17\cdot 19\cdot 47\cdot 71\cdot 79\cdot 109\cdot 149\cdot 229\cdot 269\cdot 283\cdot 349\cdot 449 \\ &\quad \quad \cdot 463\cdot 1019\cdot 1033\cdot 1657\cdot 2179\cdot 2293\cdot 4099\cdot 5119\cdot 10243 \cdot\mathbf{381343} \\ & \quad \quad \cdot \mathbf{19115518067}\cdot \mathbf{740881808972441233} \cdot \mathbf{8323214379148213516392} \end{align*}\)

NIST-V Parameters: The $510$-bit prime, $p = 2r^6 - 1$ where $r = 31929740427944870006521856$ has

References

The supersingular isogeny problem and the Delfs-Galbraith algorithm

The supersingular isogeny problem asks the following: given two supersingular curves $E_0/\bar{\mathbb{F}}_p$ and $E_1/\bar{\mathbb{F}}_p$, find an isogeny

The best known classical attack against it is the Delfs-Galbraith algorithm ¹. In the general case, where $E_0, E_1$ are defined over $\mathbb{F}_{p^2}$, the Delfs-Galbraith algorithm has 2 steps:

• Step 1: Compute simple self-avoiding random walks in the $\ell$-isogeny graph (for some choice of $\ell$) to find isogenies $\phi_0: E_0 \rightarrow E_0’$ and $\phi_1: E_1 \rightarrow E_1’$, such that $E_0’/\mathbb{F}_p$ and $E_1’/\mathbb{F}_p$ are subfield curves. You may be asking, what exactly is a subfield curve? In general the $j$-invariant of an elliptic curve $E$ lies in $\mathbb{F}_{p^2}$. If $j \in \mathbb{F}_p$, we say $E$ is a subfield curve. There are approximately $\lfloor p/12 \rfloor$ supersingular curves up to isomorphism and $O(p^{1/2})$ of them are subfield curves. This step, therefore, runs in $\tilde{O}(p^{1/2})$ bit operations.

• Step 2: Search for a subfield isogeny $\phi’: E_0’ \rightarrow E_1’$ that connects $\phi_0$ and $\phi_1$. This step requires $\tilde{O}(p^{1/4})$ bit operations.

A full isogeny $\phi: E_0 \rightarrow E_1$ is then found as the composition \(\phi = \hat{\phi}_1 \circ \phi' \circ \phi_0\) where $\hat{\phi}_1: E_1’ \rightarrow E_1$ is the dual of $\phi_1$.

The entire Delfs-Galbraith algorithm runs in $\tilde{O}(p^{1/2})$ operations on average, dominated by the first step.

Determining the Concrete Complexity of Delfs-Galbraith

One of our contributions is an optimised implementation of the Delfs-Galbraith algorithm, called Solver. This allows us to remove the $\tilde{O}$’s above and determine the concrete complexity of this algorithm.

In the paper, we focus on the optimisation and complexity of the bottleneck step: finding subfield curves (step 1 above). These optimisations are as follows.

Choice of $\ell$. In their description of the algorithm, Delfs and Galbraith do not specify which $\ell$-isogeny graph to walk in. In general, at each point of this walk in the $\ell$-isogeny graph, we have $j_p$ (the previous node we were on) and $j_c$ (the current node we’re on). Taking a step from $j_c$ onto a new node in the $\ell$-isogeny graph is equivalent to computing the roots of the polynomial $\Phi_{\ell,p}(X,j_c)/(X-j_p)$, where $\Phi_{\ell, p}(X,Y)$ is the modular polynomial for level $\ell$ whose coefficients have been reduced modulo $p$, as we are working over $\mathbb{F}_{p^2}$ (click here for more information on these modular polynomials). Writing $\ell$ in terms of its prime decompostion, say $\ell= \prod_{i=1}^n l_i^{e_i}$, the polynomial $\Phi_{\ell, p}(X,j_c)/(X-j_p)$ is of degree $N_\ell - 1$, where \(N_\ell = \prod_{i=1}^n (l_i + 1)l_i^{e_i -1 }.\) If $\ell$ is prime, then the polynomial $\Phi_{\ell, p}(X,j_c)/(X-j_p)$ is of degree $\ell$. We chose $\ell = 2$, as it is the simplest and most efficient choice. Note here that the first step is an exception as we do not know $j_p$, so we must instead factor an $N_\ell$-degree polynomial to find a neighbouring node.

Fast square root finding in $\mathbb{F}_{p^2}$. We use techniques presented in Michael Scott’s Tricks of the Trade paper ² to construct an optimised algorithm for finding square roots in $\mathbb{F}_{p^2}$. Our algorithm requires only two $\mathbb{F}_p$ exponentiations and a few $\mathbb{F}_p$ multiplications and additions.

Random walks in the $2$-isogeny graph. We use a depth-first search to find subfield nodes in the 2-isogeny graph. We bound the depth at $c \cdot \log(p)$ to reuse computations. This process parallelizes perfectly: for $P$ processors we can (pre)compute the leaves of a binary tree of depth $\lceil log(P)\rceil$ and assign each processor one of those as its root node.

Concrete Complexity of Delfs-Galbraith

Using Solver, for each bitlength between 21 and 40, we solved 10,000 instances of the subfield search. In each of these, we chose 100 random primes and, for each prime, 100 pseudo-random $j$-invariants in $\mathbb{F}_{p^2}$.

For all bitlengths, we find the number of $\mathbb{F}_{p}$ multiplications to be:

with $0.75 \leq c \leq 1.05$.

SuperSolver: accelerating the Delfs-Galbraith algorithm

The other contribution of our paper is an new attack, called SuperSolver, against the supersingular isogeny problem that improves on the concrete complexity of the Delfs-Galbraith algorithm. The core difference of SuperSolver lies in Step 1. Here, at each step of the random walk, SuperSolver inspects the $\ell$-isogeny graph for $\ell$ in a carefully chosen set, to efficiently detect whether $j_c$ has an $\ell$-isogenous neighbour in $\mathbb{F}_p$ ($j_c$ is the current node). We will describe how this set of optimal $\ell > 2$ is chosen below. Traditionally, conducting this inspection requires fully factorizing a degree-$(N_\ell-1)$ polynomial and determining whether any of the roots lie in $\mathbb{F}_{p}$. However, this is prohibitively costly for $\ell > 2$, especially as $p$ grows large. In the paper, we introduce a novel method of conducting this inspection in $\ell$-isogeny graphs, which requires $O(\ell^2)$ multiplications in $\mathbb{F}_p$. Crucially, this is no longer dependent on $p$, meaning that as $p$ grows large, the set of $\ell$’s that are optimal to use also grows, and the more profitable (relatively speaking) SuperSolver becomes.

We now describe

• how the rapid inspection of $\ell$-isogenous neighbours is conducted, and
• how the set of $\ell$’s to conduct this inspection on is chosen.

Fast Subfield Root Detection

In Section 4 of the paper, we derive a method for determining whether a polynomial $f(X) = a_nX^n + \dots + a_1X + a_0 \in \mathbb{F}_{q^d}[X]$ has a root in the subfield $\mathbb{F}_{q}$, where $q$ is the power of a prime $p$. Here, for simplicity, I will describe it as needed for SuperSolver, i.e., where $q = p$ and $d=2$.

We first introduce the $p$-power Frobenius map $\pi$, which for $\alpha \in \mathbb{F}_{p^2}$ acts as \(\pi(\alpha) = \alpha^{p}.\) We can extend this to polynomials as follows: if $f(X) = a_nX^n + \dots + a_1X + a_0 \in \mathbb{F}_{p^2}[X]$, then \(\pi(f) = \pi(a_n)X^n + \dots + \pi(a_1)X + \pi(a_0).\)

The greatest common divisor of $f$ and $\pi(f)$ is the largest divisor of $f$ defined over $\mathbb{F}_p$. If this divisor is of degree one, $f$ has a root in $\mathbb{F}_p$. If this divisor is a constant, $f$ does not have a root in $\mathbb{F}_p$ In our target application, with overwhleming high probability, $\gcd(f, \pi(f))$ will have degree 0 or 1. Therefore, calculating $\gcd(f, \pi(f))$ will reveal whether or not $f$ has a root defined over $\mathbb{F}_p$.

The problem with caluclating this $\gcd$ is that $f$ and $\pi(f)$ are, in general, defined over $\mathbb{F}_{p^2}$. To avoid costly multiplications in $\mathbb{F}_{p^2}$, we want to, in some way, transform these into polynomials defined over $\mathbb{F}_p$.

A key observation is that the GCD of two polynomials is invariant under an invertible linear transformation. Consider $f_1,f_2 \in \mathbb{F}_{p^2}[X]$ and define

such that $ad-bc \neq 0$, i.e., $g_1, g_2$ are given by applying an invertible linear transformation to $f_1, f_2$. Then if $h \in \mathbb{F}_{p^2}[X]$ divides $f_1$ and $f_2$, it must divide $g_1, g_2$. As the linear transformation is invertible, by swapping the roles of $f_i$ and $g_i$ we show that if $h \in \mathbb{F}_{p^2}[X]$ divides $g_1, g_2$, it must divide $f_1, f_2$. Therefore,

This means that if we can find some invertible linear transformation that sends $f, \pi(f)$ to related polynomials, say $g_1, g_2$ defined over $\mathbb{F}_p$, then we will have
\(\gcd(f, \pi(f)) = \gcd(g_1, g_2),\)

and will only have to compute the $\gcd$ in $\mathbb{F}_p$.

To find this linear transformation, consider $\beta$ such that $\mathbb{F}_{p^2} = \mathbb{F}_{p}(\beta)$ (i.e. $\beta$ is a primitive element of the extension $\mathbb{F}_{p^2}/\mathbb{F}_p$), and define

Then, the linear transformation is invertible and $g_1, g_2 \in \mathbb{F}_{p}[X]$. Note that the second statement is clear in the $d=2$ case, but for $d>2$ we need Theorem 2.24 in ³ to easily show the resulting polynomials are defined over the base field.

Concluding, we have

which will give us the largest divisor of $f$ defined over $\mathbb{F}_p$. We reiterate that, in our setting, this reveals with overwhleming probability whether $f$ has a root in $\mathbb{F}_p$.

Choosing the set of optimal $\ell$’s

Though the inspection of the neighbours of $j_c$ in the $\ell$-isogeny graph increases the total number of $\mathbb{F}_p$ multiplications at each step, more nodes are checked. We therefore choose the list of $\ell$’s to minimise the number of $\mathbb{F}_p$ multiplications per node inspected.

To do this, we first determine the cost per node inspected of taking a step in the $2$-isogeny graph, as described above. Denote this cost by $\text{cost}_2$. We then determine a list of $\ell > 2$ such that inspecting the $\ell$-isogeny graph (using the fast subfield root detection) has a lower cost per node inspected than $\text{cost}_2$. Once we have this list of $\ell$’s, we find the subset of this list which minimises the total cost of each step, calculated as:

This subset will be the list of optimal $\ell$’s used in SuperSolver.

Calculating $\text{cost}_2$ depends only on the prime $p$, and the cost of inspecting the $\ell$-isogeny graph depends only on $\ell$. Therefore, this set of optimal $\ell$’s can be determined in the precomputation.

We also note here that we can view Solver as a special instance of SuperSolver where the set of $\ell>2$ used is empty. In this way, we see that, in terms of the path length of Step 1, SuperSolver will never be outperformed by Solver: in SuperSolver either there exists an $\ell > 2$ that finds a subfield node first or the random walk in the $2$-isogeny graph finds the subfield node at the same step it would have been found in Solver.

To see exactly how SuperSolver works in comparison to Solver, have a look at the worked example in Section 6 of the paper.

Solver vs. SuperSolver

I’ll now summarise the results of our experiments in Section 7 of the paper. These experiments focused solely on the search for subfield nodes in Step 1 and showed the following:

• By conducting experiments on small primes and many $j$-invaraints, we see that SuperSolver finds a subfield node with much fewer (on average, half) $\mathbb{F}_{p}$ multiplications and by visiting less nodes. For example, averaging over 5000 pseudo-random supersingular $j$-invarants in $\mathbb{F}_{p^2}$, for $p = 2^{24}-3$, SuperSolver (with the set of optimal $\ell$’s) used 53900 $\mathbb{F}_{p}$ multiplications and walked on 318 nodes. In comparison, Solver used 112878 $\mathbb{F}_{p}$ multiplications and walked on 1897 nodes.
• We also conducted experiments on large, cryptographic sized primes and one $j$-invariant, running SuperSolver and Solver until the number of $\mathbb{F}_{p}$ multiplications used exceeded $10^8$. We recorded the total number of nodes covered, i.e., both walked and inspected nodes. In these experiments we see how the advantage of SuperSolver grows as $p$ grows. For $p=2^{50}-27$, SuperSolver covers between 3 and 4 times the number of nodes that Solver does. For the largest prime tested, $p=2^{800}-105$, SuperSolver covers between 18 and 19 times the number of nodes!

New Concrete Security

Our Solver and SuperSolver algorithms are written in Sage and Python and can be found here. By conducting experiments (as above) using our SuperSolver suite, it’s straightforward to obtain precise estimates on the concrete classical security offered by the general supersingular isogeny problem. Indeed, from these experiments, we can obtain accurate counts on the expected number of $\mathbb{F}_p$ multiplications, squarings and additions that must be carried out during a full cryptanalytic attack. These $\mathbb{F}_p$ operations can then be costed with respect to the appropriate metric, for example, bit operations, cycle counts, gate counts, or circuit depth.

Bringing it all together

The Delfs-Galbraith algorithm can be used to attack and supersingular isogeny based cryptosystem, so what does this mean for isogeny-based cryptography?

• There is no direct impact on SIDH and SIKE. There are much faster claw-finding algorithms ⁴ for solving the special problems that arise in these schemes.
• This paper does influence the classical bit security of other proposals, such as B-SIDH ⁵ and SQISign ⁶ which have Delfs-Galbraith as their best attack.

We stress that the asymptotic complexity of this algorithm has not changed. However, we give significant improvements on its concrete complexity, helping us to better understand the security of the fundamental problem underlying isogeny-based cryptography.

References

The risk with placing trust on a third party can be seen when they misbehave, causing the security of the scheme to be compromised. For example, if the trusted certificate authority of a PKI is corrupted and issues certificates for users without verifying their identities, there is no longer a guarantee on the privacy and authenticity of the communication.

Supersingular Isogeny Graph

Before discussing trusted setups in isogeny-based cryptography, we will take a slight detour and talk about the supersingular isogeny graph. For a more in depth discussion on isogenies for cryptography see my previous blogpost here.

Let $p$ be prime and consider supersingular elliptic curves defined over $\mathbb{F}_{p^2}$ (up to $\mathbb{F}_{p^2}$-isomorphism). For any prime $l \neq p$, we can construct an $l$-isogeny graph, where:

• each vertex is associated to the $j$-invariant of a supersingular elliptic curve. We note that supersingular curves have the same $j$-invariant if and only if they are $\mathbb{F}_{p^2}$-isomorphic. Therefore, each vertex actually represents all $\mathbb{F}_{p^2}$-isomorphic supersingular curves with this $j$-invariant.
• we have an edge between two vertices $j, j’$ if there is a degree $l$ isogeny $\phi: E \rightarrow E’$ where $E, E’$ have corresponding invariants $j, j’$.

We note that due to the existence of a dual isogeny $\hat{\phi}: E’ \rightarrow E$, the graph is undirected. This graph has a variety of properties that make it good for use in cryptography:

• we can walk efficiently on these graphs;
• the graph has fast mixing, which intuitively means that there is a short path to almost all nodes;
• given the end point of a path on the graph, there is no known classical or quantum efficient algorithm to recover this path;
• we can navigate the graphs as they have enough structure.

In fact, letting $p = l_A^{e_A}l_B^{e_B}\cdot f \pm 1$ as in my previous blogpost on SIDH, this key exchange can be rephrased as Alice and Bob constructing paths from $e_A$ and $e_B$ edges on the supersingular $l_A$- and $l_B$-isogeny graph, respectively.

If this seems very abstract, click here to see some wonderful visualisations of this graph and how it’s used in the SIDH key exchange, created by Enric Florit and Gerard Finol.

The Need for a Trusted Setup

In many isogeny-based protocols, the setup involves generating a supersingular elliptic curve whose endomorphism ring is unknown. Currently, the only way this can be done is by using a trusted third party that performs a random walk on the isogeny graph from a base curve and then forgets it.

The need for this trusted setup has been highlighted by the following two constructions:

• De Feo, Masson, Petit and Sanso’s Verifiable Delay Function from supersingular isogenies and pairings in ¹.

• A new primitive called ‘Delay Encryption’ introduced by Burdges and De Feo in ².

Though this is not ideal we must note that protocols with trusted setups have seen practical applications. Indeed, Ethereum is considering standardizing the verifiable delay function based on RSA, which needs a trusted setup.

Removing Trusted Setup

Removing the trusted setup in isogeny-based cryptography schemes is an active area of research and can be achieved by finding a way to ‘hash’ into a supersingular isogeny graph without revealing a path to a known base curve. This later condition is needed as it has been shown that knowing the path on the isogeny graph allows us to compute the endomorphism ring of the supersingular elliptic curve in polynomial time ^{3 4}.

Charles, Goren and Lauter (CGL) introduced a hash function ⁵ that can be used to hash any string into the supersingular isogeny graph. However, by contruction, this hash function leaks the isogeny path from a base elliptic curve and so cannot be used to remove the trusted setup.

Besides the CGL approach, an efficient algorithm used to construct elliptic curves for cryptographic schemes is the complex-multiplication (CM) method (see for example this website). It is natural to ask whether this can instead be used to hash into the supersingular isogeny graph. In ‘Rational Isogenies from Irrational Endomorphisms’, however, Castryck, Panny and Vercauteren show it can’t by proving curves constructed using the CM method can be located in the graph in a “suprisingly explicit manner” ⁶. In addition, Love and Boneh ruled another class of supersingular elliptic curves as “reasonable candidates” for constructing such a hash function (namely, roots of low-degree Hilbert class polynomials) ⁷.

Though hashing to a supersingular curve directly is preferable, another way to remove the trusted setup is by doing distributed parameter generation, as described in the paper ‘Delay Encryption’ ². The proposed setup is secure if at least one participant is honest and is updateable. However, the computation scales linearly with the number of participants.

Conclusion

Currently, finding a way to hash into the supersingular isogeny graph without leaking the path taken is an open problem and so trusted setups are still needed. There is currently no reason to believe that removing this trusted setup is not possible, but one thing is certain: any advances in this area of research would be pivotal and allow many interesting schemes to be built from isogeny-based cryptography.

References and Further Reading

What is a Pseudorandom Function?

Intuitively, a pseudorandom function (PRF) is a function that “looks like” a random function. We now define it more formally.

Firstly, we let $F: ${$0,1$}$^* \times ${$0,1$}$^* \rightarrow ${$0,1$}$^*$. We then define $F_k(x) = F(k,x)$, and the first input is called the key. For simplicitly of notation we assume $F$ is length preserving, meaning that F(k, x) is only defined if $\vert k \vert = \vert x \vert$, in which case $\vert F(k, x) \vert = \vert k \vert = \vert x \vert$. It is important to note that choosing a uniform $k \in ${$0,1$}$^n$ is equivalent to choosing the function $F_k: ${$0,1$}$^n \rightarrow ${$0,1$}$^n$.

Let $\text{Func}_n$ be the set of all functions mapping {$0,1$}$^n$ to {$0,1$}$^n$.

Definition: $F = ${$F_k$} is a pseudorandom function if $F_k$, for uniform key $k \in ${$0,1$}$^n$ is indistinguishable from a uniform function $f \in \text{Func}_n$

Formally, $F$ is a pseudorandom function if, for all polynomial time $\mathcal{D}$

where $\epsilon$ is a negligible function. Here $\mathcal{D}^{F_k}$ means $\mathcal{D}$ is given ‘oracle access’ to $F_k$ where $k$ is chosen uniformly. This means that $\mathcal{D}$ is allowed to give inputs to the fucntion and get back the corresponding outputs. $\mathcal{D}$ cannot, however, look ‘inside’ the funtion and cannot see anything about the value $k$ being used, apart from what it learns from the inputs and outputs it sees. We define $\mathcal{D}^{f(\cdot)}$ similarly.

We also want this function family to be efficiently computable, meaning that given $k$ and $x$, $F_k(x)$ can be evaluated efficietly.

Application of PRFs

PRFs can be used for encryption. Indeed, let $F_k$ be a PRF where $k$ is the private key and let $r$ be random string in the domain of $F_k$. For a message $m$, we define the ciphertext to be $(F_k(r) \oplus m, r)$. If {$F_k$} is a pseudorandom function family then this encryption scheme is semantically secure, meaning that if an adversary is allowed to choose between two plaintexts $m_0$ and $m_1$, and they receive an encryption of either plaintext, they cannot guess if it was $m_0$ or $m_1$ with probability better than $1/2$.

Other applications include key-exchange and message authentication codes (let $\text{MAC}_k(m) = F_k(m)$).

Naor-Reingold PRF

In 1997, Naor and Reingold construsted a family of pseudorandom functions [1], which take as input {$0, 1$}$^n$ (for some parameter $n$) and output an element in a multiplicative group $\mathbb{G}$ of prime order $l$, generated by $g \in \mathcal{G}$.

The construction is as follows.

Set the secret key to be the vector $\textbf{a} = (a_1, \dots, a_n) \in ((\mathbb{Z}/l\mathbb{Z})^*)^n$. The Naor-Reingold function $F_{\textbf{a}}:${$0,1$}$^n \rightarrow \mathbb{G}$ is defined by

This defines a family of functions {$F_{\textbf{a}}$}.

To lighten notation we often use an integer $x \in ${$0, 1, \dots, 2^n - 1$}, which implicitly defines $(x_1, \dots, x_n) \in ${$0, 1$}$^n$, the bit representation of $x$ with extra leading zeros if necessary.

Security

Naor and Reingold showed this function is a pseudorandom function assuming the hardness of the Decisional Diffie-Hellman (DDH) problem. This assumption states that given a cyclic group $\mathbb{G} = \langle g \rangle$ and elements $g$, $g^x$ and $g^y$, no efficient algorithm can distinguish between $g^{xy}$ and an element picked uniformly at random in $\mathbb{G}$. This assumption has been used in proving the security of other cryptographic schemes, such as the ElGamal encryption scheme ¹.

Efficiency

The evaluation of $F_{\textbf{a}}$ consists of ²:

• $n$ modular multiplications in $\mathbb{Z}/l\mathbb{Z}$, from calculating $\prod_{i=1}^n a_i^{x_i} \mod l$ in the exponent;
• 1 modular exponentiation in $\mathbb{G}$, from calculating $g^P$ where $P = \prod_{i=1}^n a_i^{x_i} \mod l$.

These can be efficiently calculated, and therefore the evaluation of $F_{\textbf{a}}$ is efficient for all $\textbf{a} \in ((\mathbb{Z}/l\mathbb{Z})^*)$.

PRFs from Isogenies

At Asiacrypt 2020 there were three papers that proposed PRFs using isogeny-based cryptography, which are conjecturally post-quantum:

• ‘Cryptographic Group Actions and Applications’ by Alamati, De Feo, Montgomery and Patranabis. ³
• ‘Oblivious Pseudorandom Functions from Isogenies’ by Boneh, Kogan and Woo. ⁴
• ‘SiGamal: A supersingular isogeny-based PKE and its application to a PRF’ by Moriya, Onuki and Takagi. ⁵

Here we will present the construction by Boneh, Kogan and Woo.

We recall the definition of a group action: $G$ acts on a set $S$ is there is a map $\star: G \times S \rightarrow S$ such that for all $s \in S$ and $g, h \in G$, we have:

• $g \star (h \star s)) =(gh) \star s$
• $1 \star s = s$, where 1 is the identity in $G$.

We say $\star$ is transitive if, for all $s, s’ \in S$, there exists $g \in G$ such that $g \star s = s’$.

We say $\star$ is faithful if $g \star s = s$ if and only if $g = 1$.

Boneh, Kogan and Woo showed how to build a Naor-Reingold-like PRF using group actions. Let $G$ be an abelian finite group that acts on $S$ transitively and faithfully. Let $s_0 \in S$ be a fixed element. Then, we define $F_k$, where $k = (k_0, \dots, k_n)$ is our secret key, with input space is {$0, 1$}$^n$ as:

This construction defines a secure PRF provided that the group-action variant of the DDH assumption holds in $G$. Namely, with $G$, $S$ as above and $s \in S$, if $a, b, c$ are sampled randomly from $G$ then the following two tuples are computationally indistinguishable:

• $(a \star s, b \star s, (ab) \star s)$
• $(a \star s, b \star s, c \star s)$

We can then instantiate this using isogenies via the CSIDH group action ⁶. More precisely, let $p = 4l_1 \cdots l_n - 1$ be prime with $l_i$ small distinct odd primes and $p \cong 3 \mod 8$. Fix a supersingular elliptic curve $E_0: y^2 = x^3 + x$ over $\mathbb{F}_p$. This will be our fixed element ‘$s_0$’. Let End$_{\mathbb{F}_p}(E_0)$ be the $\mathbb{F}_p$-rational endomorphisms of $E_0$. We will denote this as $\mathcal{O}$. Then the class group $Cl(\mathcal{O})$ is a finite abelian group that acts transitively and faithfully on $S$, the set of supersingular elliptic curves over $\mathbb{F}_p$.

We will set our key ‘$k$’ to be $([\mathfrak{a}_0], …, [\mathfrak{a}_n])$, for $[\mathfrak{a}_i] \in Cl(\mathcal{O})$. We, therefore, have

where $j(\cdot)$ means we are taking the $j$-invariant of the resulting elliptic curve.

Assuming that the Group-Action DDH is hard in the CSIDH setting, this construction gives us a PRF.

Boneh, Kogan and Woo use this PRF to build an oblivious pseudorandom function, which informally means that information is concealed from two parties involved in a PRF.

Alamati, De Feo, Montgomery and Patranabis ³ explore other cryptographic primitives that can be built from group actions, whilst Moriya, Onuki and Takagi ⁵ implement and evaluate their constriction based on the supersingular isogeny-based PKE called SiGamal, a variant of CSIDH.

References

• Preview blogpost on Isogenies for Cryptography

• Optional: Previous blogpost on SIDH

We will also need a basic understanding of ideal class groups.

Ideal Class Groups

We briefly introduce ideal class groups in the context needed for CSIDH. For a more general treatment and precise definition, the reader is encouraged to refer to ‘Primes of the form $x^2 + ny^2$: Fermat, Class Field Theory, and Complex Multiplication’ by Cox. We consider a supersingular curve $E$ over $\mathbb{F}_p$ with End($E$) having a subring $\mathcal{O} := \mathbb{Z}[\pi]$, where $\pi$ is the Frobenius endomorphism.

The norm of an $\mathcal{O}$-ideal $\mathfrak{a} \subseteq \mathcal{O}$ is defined as $N(\mathfrak{a}) = \mid \mathcal{O}/\mathfrak{a} \mid$ and is equal to gcd{$N(\alpha) \mid \alpha \in \mathfrak{a}$}. Norms are multiplicative, meaning $N(\mathfrak{a}\mathfrak{b}) = N(\mathfrak{a})N(\mathfrak{b})$.

A fractional $\mathcal{O}$-ideal is an $\mathcal{O}$-submodule of End($E$) of the form $\alpha \mathfrak{a}$, with $\alpha \in \text{End}(E)$ non-zero and $\mathfrak{a}$ an $\mathcal{O}$-ideal. A fractional $\mathcal{O}$-ideal $\mathfrak{a}$ is invertible if there exists a $\mathcal{O}$-fractional ideal $\mathfrak{b}$ such that $\mathfrak{a}\mathfrak{b} = \mathcal{O}$. All principal fractional $\mathcal{O}$-ideals, i.e. ideals of the form $\alpha \mathcal{O}$, are invertible. The sets of invertible fractional $\mathcal{O}$-ideals, $I(\mathcal{O})$, and principal fractional $\mathcal{O}$-ideals, $P(\mathcal{O})$, form groups. We can, therefore, define the ideal class group of $\mathcal{O}$ as the quotient

Hard Homogenous Spaces

A hard homogeneous space ¹ is an efficiently computable action $\star: G \times S \rightarrow S$ of a finite commutative group $G$ on a set $S$, with the following propoerties:

• it’s free: for all $s \in S$, $gs = s$ implies $g$ is the identity.

• it’s transitive: for every pair of elements $s_0$ and $s_1$, there is a group element $g$ such that $gs_0 = s_1$.

• the parallelization problem is hard: given $s_0, s_1, s_2 \in S$, it should be infeasible to find $g_1g_2 \star s_0$, where $g_1, g_2 \in S$ are such that $s_1 = g_1 \star s_0$ and $s_2 = g_2 \star s_0$.

This generalizes the notion of a cyclic group in which the Diffie-Hellman problem is hard. Indeed, any such space gives rise to a Diffie-Hellman-like protocol. The main appeal of hard homogeneous spaces is due to the potential for them to give post-quantum cryptographic schemes. This is because, whilst Shor’s developed a polynomial-time quantum attack against the exponentiation-based Diffie-Hellman, in the more general setting the best attack is Kuperberg’s subexponential-time hidden shift attack.

Apart from exponentiation, currently we only know one other candidate hard homogenous space: isogeny-based actions by ideal-class groups on sets of elliptic curves over finite fields. The first use of this to create cryptographic schemes was proposed independently by Couveignes ¹ and Rostovtsev-Stolbunov ². However, they considered ordinary elliptic curves, which led to an extremely slow scheme. Even despite speed-ups due to De Feo, Kieffer and Smith ³, several minutes are needed for one key exchange with 128-bit classical security. Due to the simplicity and flexibility of the Couveignes-Rostovtsev-Stolbunov scheme, Castryck, Lange, Martindale, Panny and Renes ⁴ constructed a similar scheme using supersingular elliptic curves called CSIDH (pronounced seaside). They let $S$ be the set of supersingular elliptic curves $E$ defined over $\mathbb{F}_p$ (up to $\mathbb{F}_{p}$-isomorphism). Then, restricting to $\mathbb{F}_p$, we get endomorphism ring End$_{\mathbb{F}_p}(E)$ whose corresponding ideal class group $G$ is commutative. For an ideal class $[\mathfrak{a}] \in G$ and $E \in S$ we get the action $[\mathfrak{a}] \star E$, which defines an elliptic curve $E/\mathfrak{a} \in S$ and an isogeny $\phi_{\mathfrak{a}}: E \rightarrow E/\mathfrak{a}$, defined over $\mathbb{F}_p$. The CSIDH paper showed this gives a hard homogeneous space ², so Couveignes’ framework ¹ can be applied to supersingular isogeny-based cryptography, giving us, for example, a non-interactive Diffie-Hellman-like key exchange.

Non-Interative Key Exchange Protocol

Set-up: Let $p = 4\cdot l_1\cdots l_n - 1$ be a large prime, with $l_i$ small distinct odd primes, such that $p \equiv 3 \mod 8$. Fix supersingular curve $E_0: y^2 = x^3 + x$ over $\mathbb{F}_{p}$. This has End$_{\mathbb{F}_p}(E_0) = \mathbb{Z}[\sqrt{-p}]$.

Key Generation: The secret key is the ideal class $\texttt{sk} = [\mathfrak{a}]$. In CSIDH, for efficient evaluation of the action, $[\mathfrak{a}]$ is a product of small norm ideals. The public key is $\texttt{pk} = [\mathfrak{a}] \star E_0 =: E_A$.

Key Exchange: Suppose Alice and Bob have public/secret key pairs $(E_A, [\mathfrak{a}])$ and $(E_B, [\mathfrak{b}])$. On receiving $E_B$, Alice verifies it is defined over $\mathbb{F}_{p}$ with End$_{\mathbb{F}_{p}}(E_B) = \mathbb{Z}[\sqrt{-p}]$. If so, she computes the action $[\mathfrak{a}]\star E_B = [\mathfrak{a}]\star [\mathfrak{b}]\star E_0$. Bob proceeds analogously to get $[\mathfrak{b}]\star [\mathfrak{a}]\star E_0$. Commutativity of $G$ ensures

so this can be used as their secret shared key.

Security

The security of CSIDH is based on the hardness of the CSSDDH problem, defined below.

Commutative SSDDH (CSSDDH) Problem:

Let $p$, $E_0$ be as the CSIDH set-up. Given a tuple sampled with probability $\frac{1}{2}$ from one of the following two distributions

• ($E_0$, $[\mathfrak{a}]\star E_0$, $[\mathfrak{b}] \star E_0$, $[\mathfrak{a}]\star [\mathfrak{b}]\star E_0$)
• ($E_0$, $[\mathfrak{a}]\star E_0$, $[\mathfrak{b}] \star E_0$, $[\mathfrak{c}]\star E_0$)

where $[\mathfrak{a}], [\mathfrak{b}], [\mathfrak{c}]$ are random elements from End$_{\mathbb{F}_p}(E_0)$, determine from which distribution the tuple is sampled. We remark that the ideal classes have a special form, as described in §4.1, so the sampling method is not uniform.

No torsion-point images are published during the protocol, meaning it will be immune to any attacks that make use of this extra information, for example the attack by Petit on SIDH-like constructions ⁵. Nevertheless, in CSIDH the key spaces are also limited to around $\sqrt{p}$ supersingular points, giving us a classical attack of $\tilde{O}(p^{1/4})$. In August 2020, Colò and Kohel proposed OSIDH ⁶. This combines CSIDH and SIDH, but is defined over arbitrarily large subset of oriented supersingular elliptic curves over $\mathbb{F}_{p^2}$, which covers essentially all possible corresponding $j$-invariants. As a result, there is no limit to size of key space. OSIDH, however, needs further security analysis and research into implementation before becoming a viable alternative to CSIDH or SIDH.

The commutativity of $G$ in CSIDH allows for hidden shift quantum attacks that are asymptotically sub-exponential. Implicit constants in attack complexities, the infeasibility of long sequential quantum operations and the large memory requirements are therefore taken into account to find quantum secure CSIDH parameters. The original CSIDH paper proposed parameter sets $\texttt{CSIDH-512}$, $\texttt{-1024}$ and $\texttt{-1792}$, giving NIST 1-3 level security, respectively ². Recent strides in the quantum cryptanalysis of CSIDH by Peikert ⁷ and Bonnetain and Schrottenloher ⁸ have called these parameter sets into question.

Efficiency

The choice of $E_0$ means $[\mathfrak{a}] \star E_0$ can be represented in Montgomery form $y^2 = x^3 + Ax^2 + x$ for any $[\mathfrak{a}] \in G$, so it suffices to specify the coefficient $A \in \mathbb{F}_p$. Pairing this with a space-efficient representation of $[\mathfrak{a}]$, CSIDH has small keys compared to SIDH, which is currently the NIST submission with the smallest combined key and ciphertext length. However, it is slow. Considering NIST level 1 parameters, it takes around 80ms compared to 10ms for SIDH ⁹.

To increase the speed of the protocol, Castryck and Decru considered taking prime $p \equiv 7 \mod 8$ ¹⁰. Elliptic curves are can now be represented in the form $y^2 = x^3 +Ax^2 -x$ and there are two possible endomorphism rings. Proposed NIST level 1 secure parameters $\texttt{CSURF-512}$, give a speed-up of about 5.68% compared to $\texttt{CSIDH-512}$ when sampling from a specific set up. As highlighted above, the parameter sets may beed to be reconsidered, which may decrease efficiency. Therefore, advancements in this area are highly desirable for CSIDH to compete with other post-quantum secure key-exchange protocols.

SQISign: Compact Post Quantum signatures from Quaternions and Isogenies

[Paper]

Winning the best paper award, De Feo, Kohel, Leroux, Petit and Wesolowski introduce a new signature scheme from isogeny graphs of supersingular elliptic curves. This paper builds on work by Galbraith, Petit and Silva (GPS) ¹ who proposed a signature scheme constructed from the KLPT algorithm ². We note that the KLPT algorithm solves the quaternion analog of the $l$-isogeny path problem under the Deuring correspondence. The GPS scheme was mainly theoretical and was not implemented (to the best of my knowledge).

In the SQISign paper, a new generic KLPT algorithm is presented, which produces a smaller output than the original algorithm. Using this, the authors construct a new interactive zero knowledge identification protocol, resulting in an unforgeable signature scheme. New algorithms for efficient instantiation of the protocol, parameters targeting NIST-1 level post-quantum security and a complete implementation of the signature scheme in both C and Magma are also given in the paper.

Cryptographic Group Actions and Applications

[Paper] [Talk]

In my opinion this paper tackles two issues with isogeny-based cryptography:

• For someone without a strong Maths background, who for example doesn’t know what an isogeny is, it’s quite a difficult to get into this field and develop cryptographic primitives based on isogenies.

• Isogenies are not as expressive as lattices, so it is harder (and maybe not even possible) to construct certain primitives with isogenies. However, having primitives with post-quantum instantiations based only on lattice assumptions is dangerous as an attack on the underlying hardness problems for lattices may be found in the future.

This paper by Alamati, De Feo, Montgomery and Patranabis proposes a new framework based on group actions that enables the use of isogeny-based assumptions, even for those who aren’t extremely familiar with the underlying maths. The authors achieve this by abstracting the group action and hardness assumptions in CSIDH ³ and CSI-FiSh ⁴. This new framework can be leveraged to construct several primitives not previously known from isogeny-based assumptions, such as smooth projective hashing, dual-mode PKE and a Naor-Raingold style PRF.

In addition, they introduce a new assumption over group actions, called the Linear Hidden Shift assumption. This can be used to obtain symmetric KDM-secure encryption, which in turn enables the construction of many other primitives.

B-SIDH: Supersingular Isogeny Diffie-Hellman Using Twisted Torsion

[Paper] [Talk]

In SIDH, a prime $p = 2^m3^n - 1$ is used and Alice and Bob represent each isomorphism class by a supersingular curve $E/\mathbb{F}_{p^2}$ with group order #$E(\mathbb{F}_{p^2}) = (p+1)^2 = (2^m3^n)^2$. This choice was made by Jao and De Feo to allow full $\mathbb{F}_{p^2}$-rational $2^m$-torsion and full $\mathbb{F}_{p^2}$-rational $3^n$-torsion. This means that the corresponding isogeny computations are also $\mathbb{F}_{p^2}$-rational, and so can be done efficiently.

However, Costello observes that there are in general two choices of $\mathbb{F}_{p^2}$-rational elliptic curve groups corresponding to every node in the supersingular isogeny graph: those whose group orders are $(p+1)^2$ and those whose groups orders are $(p-1)^2$. Elliptic curves from these two sets are not isomorphic over $\mathbb{F}_{p^2}$, but they are isomorphic over $\mathbb{F}_{p^4}$ and so have the same $j$-invariant.

Using this, a variant of SIDH, called B-SIDH, is constucted. An important fact shown by Costello is that we can still work over $\mathbb{F}_{p^2}$ while using both curves. The use of both curves unlocks a wealth of trade-offs. For example, B-SIDH can give significantly smaller key sizes with no known loss of security. Adj, Chi-Domínguez and Rodríguez-Henríquez present a concrete analysis of B-SIDH’s efficiency ⁵, showing B-SIDH outperforms any CSIDH instantiation. However, it is still less efficient than SIDH. Techniques developed in eSIDH ⁶ could also be used to introduce parallelisation and facilitate computations.

The search for smooth parameters that will give a reasonably efficient B-SIDH protocol is non-trivial and is a key focus of the paper, as well as a topic of subsequent research ⁷. With respect to security, as at least one of Alice or Bob must now perform walks comprised of steps in multiple $l$-isogeny graphs, the underlying hardness assumption is slightly different. However, there is no reason to believe this modification makes the problem easier as long as the number of destination nodes remains roughly the same size as in SIDH.

Calamari and Falafl: Logarithmic (Linkable) Ring Signatures from Isogenies and Lattices

[Paper] [Talk]

This paper constructs concretely efficient logarithmic ring signatures and linkable ring signatures from isogeny-based and lattice-based hardness assumptions, giving Calamari and Falafl respectively. First, Beullens, Katsumata and Pintore construct a (linkable) ring signature scheme based on a group action that satisfies certain cryptographic propoerties and then instantiate with the CSIDH group action or a MLWE-bsaed group action.

A key advantage of this scheme is that the signature scheme scales well with the ring size $N$ compared to other logarithmic (linkable) ring signatures. Indeed, the term in the signature size that depends on $\log N$ is independent of the SIDH or lattice parameters. Instead, it is due to to the signatures containing a small number of paths in Merkle trees of depth $\log N$.

For the isogeny istantiation, they consider the CSIDH-512 parameter set used in CSI-FiSh ⁴. The authors then give an estimate for the signature size: $\log N + 3.5$ KB, and a signing time of 79s for $N = 8$. As is usually the case, we get smaller signatures but longer signing time compared to the lattice-based instantiation.

Radical Isogenies

[Paper] [Talk]

This paper is mainly concerned with improving the efficiency of isogeny computations. Castryck, Decru, and Vercauteren introduce a new approach called ‘radical isogenies’ and a corresponding method to compute chains of $N$-isogenies, which is very efficient for small $N$. Indeed, compared to the state-of-the-art, their method results in an order of magnitude speed-up for $N \leq 13$. When applied to CSIDH, it gives a speed-up of about 19\% over the implementation in ⁸ for the CSURF-512 parameters ⁹.

Oblivious Pseudorandom Functions from Isogenies

[Paper] [Talk]

In this paper, Boneh, Kogan and Woo construct an oblivious PRF (OPRF) and a verifiable OPRF from isognies. The first construction uses isogenies of supersingular curves over $\mathbb{F}_{p^2}$ and adapted the Diffie-Hellman OPRF to this setting. In order to overcome the attack due to Galbraith, Petit, Shani and Ti presented at Asiacrypt 2016 ¹⁰, they develop two zero-knowledge protocols to convince each party they were sent valid messages. This construction results in an OPRF in the SIDH setting. The second construction is a Naor-Reingold-like PRF in the CSIDH setting.

SiGamal: A Supersingular Isogeny-Based PKE and Its Application to a PRF

[Paper] [Talk]

SiGamal is a PKE scheme, similar to ElGamal, which is based on CSIDH and provides IND-CPA security without using hash functions. The paper also constructs a compressed version of SiGamal called C-SiGamal. The security is based on decisional problem closely related to that of CSIDH, which arises from the assumed difficulty of computing the image of a given point under a hidden isogeny.

There is, however, a trade-off with efficiency. The computational costs of group actions in SiGamal-512 sending 256-bit plaintexts are around $2.6 \times$ that of a group action in CSIDH-512. Furthermore, SiGamal is not IND-CCA secure. Increasing efficiency and finding a PKE scheme that achieves IND-CCA security without the use of hash functions are possible directions of future research.

In the paper, Moriya, Onuki and Takagi also propose a Naor-Reingold type PRF based on SiGamal. They defined a new hardness assumption and show their proposed function is a PRF provided it holds. This new assumption guarantees the security of CSIDH that uses a prime $p$ in the setting of SiGamal. The authors also estimate the computational costs of the group actions needed to compute the PRF.

Another issue is efficieny: even if we only consider classical attacks in assessing security levels, Stolbunov’s scheme requires 229 seconds (even with precomputation) to perform a single key exchange operation at the 128-bit security level on a desktop computer.

In 2011, De Feo, Jao and Plût published a paper entitled ‘Towards Quantum-Resistant Cryptosystems from Supersingular Elliptic Curve Isogenies’, which presented isogeny-based key-exchange and encryption schemes that address both the performance and security drawbacks of Stolbunov’s system. They named their key-exchange protocol SIDH, for Supersingular Isogeny Diffie-Hellman.

Assumed knowledge:

• Isogenies for Cryptography

Throughout this we will assume that we are working over a finite field $\mathbb{F}_q$.

Background

Supersingular vs. Ordinary

There are two types of elliptic curves that we can have are ordinary or supersingular. The precise definitions are unimportant for cryptographic purposes, however it is useful to note that supersingular curves are all defined over $\mathbb{F}_{p^2}$, so for the finite field we’re working over, we can take $q = p^2$.

If we have two elliptic curves $E_1$ and $E_2$ such that there exists an isogeny $\phi$ connecting them, then we say that $E_1$ and $E_2$ are in the same isogeny class.

FACT: Ellitpic curves in the same isogeny class are either all supersingular or all ordinary.

In SIDH we will be going from one ellitpic curve, say $E$ , to another via an isogeny (or a composition of various isogenies). The fact above tells us that if we start with a supersingular curve, we will end up at another supersingular curve. This is a highly desirable property as it means we don’t have to make any restrictions on the isogenies we choose from $E$ to ensure we end up at a supersingular curve.

Non-Commutative

The main technical difficulty is that, in the supersingular case, the endomorphism ring is noncommutative, whereas Diffie-Hellman type protocols require commutativity. In the paper, they propose overcoming this obstacle by providing the outputs of the isogeny on certain points as auxiliary input to the protocols. Provided this auxiliary input does not make the problem of finding isogenies any easier, the added difficulty arising from the anticommutativity actually makes the protocol stronger.

Before analysing the security of the scheme in greater detail, we describe how to get various types of protocols using supersingular elliptic curves.

Schemes using Supersingular Elliptic Curves

In this section we present a key-exchange protocol and a public-ley cryptosystem using supersingular elliptic curves.

Setup

We first discuss the choice of prime $p$ in ⁴. Fix the finite field $\mathbb{F}_{p^2}$, where

In the original SIDH paper $(l_A, l_B) = (2,3)$, to exploit efficient isogeny computations. To provide the same security level for both Alice and Bob we set $2^{e_A} \approx 3^{e_B}$. An integer $f$ is then chosen so $p$ is prime. This choice of $p$ ensures isogeny computations can be done over $\mathbb{F}_{p^2}$.

We also fix supersingular curve $E_0$ and bases {$P_A, Q_A$} and {$P_B, Q_B$} which generate $E_0[l_A^{e_A}]$ and $E_0[l_B^{e_B}]$ respectively. Such bases can be found as

Key-Exchange Protocol

Step 1: Alice chooses random elements $m_A, n_A \in \mathbb{Z}/l_A^{e_A}\mathbb{Z}$, not both divisible by $l_A$ and computes $\phi_A: E_0 \rightarrow E_A$ with kernel $K_A := \langle [m_A]P_A + [n_A]Q_A \rangle$. Bob similarly computes $\phi_B$ with kernel $K_B$.

Alice then computes $\phi_A(P_B), \phi_A(Q_B) \in E_A$ and sends them to Bob. Bob proceeds analogously. This step was proposed by Jao and De Feo to overcome the fact that $\phi_A$ and $\phi_B$ cannot be composed due to mismatching domains and codomains.

Step 2: Alice computes $\phi$’$_A: E_B \rightarrow E_{BA}$ with kernel $\langle [m_A]\phi_B(P_A) + [n_A]\phi_B(Q_A) \rangle$. Similarly, Bob computes $\phi$’$_B: E_A \rightarrow E_{AB}$. Noting $E_{AB} = E_{BA}$, Alice and Bob use the common $j$-invariant of $E_{AB}$ as the secret shared key.

Public Key Encryption

Jao, De Feo and Plût adapted the key-exchange protocol above to give a PKE scheme, in a similar vein to constructing ElGamal Encryption from Diffie-Hellman. In the setup we also need a family of hash functions $\mathcal{H}$ = {$H_k$}$_{k \in K}$, where $K$ is a finite set and each $H_k$ is a function from $\mathbb{F}_{p^2}$ to the message space.

Key Generation: Let $m_A, n_A, E_A, \phi_A(P_B), \phi_A(Q_B)$ be as above and choose a random element $k \in K$. The public key and secret key are

Encryption: Given $\texttt{pk}$ and message $m$, choose $m_B, n_B$ as above and compute $j$-invariant $j(E_{AB})$. Set

The ciphertext is $\texttt{ct} = (E_B, \phi_B(P_A), \phi_B(Q_A), c)$.

Decryption: Given $\texttt{ct}$ and $\texttt{sk}$, compute $j(E_{AB})$ and set

The plaintext is $m$.

Security

Using the same notation, we define computational problems these schemes are based on.

Supersingular Computational Diffie-Hellman (SSCDH) Problem: Given the curves $E_A, E_B$ and the points $\phi_A(P_B), \phi_A(Q_B), \phi_B(P_A), \phi_B(Q_B)$, find the $j$-invariant of $E_0/\langle [m_A]P_A + [n_A]Q_A, [m_B]P_B + [n_B]Q_B \rangle$.

Supersingular Decision Diffie-Hellman (SSDDH) Problem: Given a tuple sampled with probability $\frac{1}{2}$ from one of the following two distributions:

• $(E_A, E_B, \phi_A(P_B), \phi_A(Q_B), \phi_B(P_A), \phi_B(Q_A), E_{AB})$, where

  \[E_{AB} \cong E_0/\langle [m_A]P_A + [n_A]Q_A, [m_B]P_B + [n_B]QB \rangle\]

• $(E_A, E_B, \phi_A(P_B), \phi_A(Q_B), \phi_B(P_A), \phi_B(Q_A), E_C)$, where

  \[E_C \cong E_0/\langle [m'\_A]P_A + [n'\_A]Q_A, [m'\_B]P_B + [n'\_B]Q_B \rangle\]

  where $m’_A, n’_A$ are chosen at random from $\mathbb{Z}/l_A^{e_A}\mathbb{Z}$ and not both divisible by $l_A$, and similarly for $m’_B, n’_B$,

determine from which distribution the tuple is sampled.

We first note that given an SSCDH solver, we can solve SSDDH. Jao, De Feo and Plût proved that given the SSDDH assumption holds, for a particular class of hash function families $\mathcal{H}$ (namely, they must be entropy-smoothing), the PKE scheme is IND-CPA. The proof is routine and an easy adaptation from the corresponding proofs given by Stolbunov for ordinary elliptic curves ¹. We therefore omit it and ask an interested reader to refer to pg. 19, ⁴.

Active Attacks on SIDH

Galbraith, Petit, Shani, and Ti gave a polynomial-time active attack against SIDH with static keys ⁵ using the additional torsion-point information revealed during the protocol. To mitigate the affects of this attack, the authors proposed applying a transformation to SIDH to generate a IND-CCA secure scheme called Supersingular Isogeny Key Encapsulation, or SIKE. Details of how this is done can be found in the SIKE proposal for NIST’s post-quantum standardization effort ⁶. Essentially, a key encapsulation mechanism (KEM) uses the public key to create a ciphertext containing a randomly chosen symmetric key, called encapsulation.

In July 2020, Round 3 finalists for NISTs post-quantum cryptography standardization effort were announced and included SIKE as an alternative candidate. Compared to other candidates, the main practical advantage of SIKE is its relatively small key sizes. However, although SIKE can be seen to be practical enough for many applications, it is still at least an order of magnitude slower than lattice- and code-based round 3 candidates.

Passive Attacks on SIDH

When constructing the isogenies of degree $l_A^{e_A}$, we take kernels of a special form. This means that there are only around $\sqrt{p}$ possible choices for the ending curve $E_A$, whereas there are around $\frac{p}{12}$ supersingular $j$-invariants over $\mathbb{F}_{p^2}$. Using this, Jao, De Feo and Plût determined the best classical and quantum attacks had complexity $\tilde{O}(p^{1/4})$ and $\tilde{O}(p^{1/6})$ respectively for a generic curve pair ⁴. However, these attacks do not use the extra torsion point information.

In 2017, Petit analysed the impact of providing extra points in the hardness of the underlying assumptions ⁷. He proposed a classical algorithm that, for certain choices of parameters, solves the following problem in polynomial-time: For a large prime $p$, smooth coprime integers $A$ and $B$, given two supersingular elliptic curves $E_0$ and $E$ over $\mathbb{F}_{p^2}$ connected by a degree-$A$ isogeny $\phi: E_0 \rightarrow E$, and given the action of $\phi$ on the $B$-torsion of $E_0$ recover $\phi$.

Petit’s attack only works for non-standard variants of SIDH satisfying $B > A^4 > p^4$. For efficiency, Jao and Feo proposed taking $A, B \approx \sqrt{p}$, so this passive polynomial-attack does not apply to SIDH/SIKE parameters.

In 2020, Kutas, Martindale, Panny, Petit, and Stange improved on this, providing polynomial-time attacks with more relaxed the conditions on $A, B$ ⁸. They also demonstrate how choosing an insecure starting curve $E_0$ can lead to polynomial-time attacks for certain $A$ and $B$. Another attack recently proposed in ANTS-XIV 2020 by Kutas, Merz, Petit, and Weitkämper consists of a hidden shift quantum attack when $A$ and $B$ are unbalanced ⁹. Currently it is not better than previous attacks but is fundamentally different and disproves the claim in the original SIDH paper that the hidden shift attack could not be adapted to an attack on SIDH. The restrictions on $A$ and $B$ mean both these results still do not affect the security of SIKE, but in anticipation of future cryptanalysis progress it is desirable to design variants of SIDH that rely on the original general isogeny problem.

• Elliptic curves (over finite fields)
• A previous blogpost on isogenies for cryptography
• Polynomials

Suppose we have an elliptic curve $E_1$ over a finite field $\mathbb{F}_{p^2}$. Given the kernel of an isogeny (a finite subgroup of the group of points on $E_1$), Vélu’s formulas give us a way to determine the codomain of the isogeny, as well as compute the isogeny. This technique is used in the Supersingular Isogeny Diffie-Hellman (SIDH) protocol proposed by Feo, Jao and Plût [2], which I will introduce in a future blog post.

Weierstrass Form

The input of Vélu’s formulas is an elliptic curve $E_1$ in general Weierstrass form and a finite subgroup of the group of points on $E_1$, let’s call it $G$.

A curve $E_1$ is said to be in general Weierstrass form over $\mathbb{F}_{p^2}$ if

where $a, b, c, d, e \in \mathbb{F}_{p^2}$ and the discriminant (a polynomial in $a, b, c, d, e$) is non-zero. This second condition ensures that the ellitpic curve is non-singular, which geometrically means the curve has no cusps or self-intersections.

When we consider the SIDH protocol, we will use elliptic curves in Montgomery form, namely

which is isomorphic to a curve in Weierstrass form over $\mathbb{F}_{p^2}$, via the isomorphism

Don’t worry about the details of the isomorphism as it won’t be necessary for the SIDH protocol.

Remembering that what we are interested in for cryptography is the isomorphism class of the elliptic curves, the main takeaway is that for the SIDH protocol we will use elliptic curves in a form that will allow us to use Vélu’s formulas.

Vélu’s Formulas

I will now explain the steps proposed by Vélu to compute the isogeny and codomain, given

and a finite set of points $G$.

For those not interested in implementing these formulas, the details are not that important. However, it is worth noting that these formulas are just rational functions of the inputs mentioned above, and the degrees of these functions are the same size as the size of $G$. Therefore, they are quite nice and easy to implement. Without these formulas it would be hard to implement any cryptography scheme based on isogenies.

Step 1

Partition the set of points $G$

1. Discard the identity point $\mathcal{O}$

2. Let $G_2$ be all the 2-torsion points and let $R$ be the rest of the points in $G$

3. Split $R$ into two equal sized sets, which we will call $R_+$ and $R_-$, such that if $P \in R_+$ then $-P \in R_-$.

4. Let $S$ be the union $R_+ \cup G_2$.

Step 2

Now given $Q = (x_Q, y_Q) \in S$ we define the following quatities

• $f_Q = 3x^2_Q + 2cx_Q + d - ay_Q$
• $g_Q = -2y_Q - ax_Q - b$

If $Q$ is a 2-torsion point (i.e. in $G_2$), then let

Otherwise, let

Then let $u_Q = (g_Q)^2$. Finally we compute

Step 3

We can now compute the target image.

Define the following values:

• $A = a$
• $B = b$
• $C = c$
• $D = d - 5v$
• $E = e - (a^2 + 4c)v - 7w$

Then the Weierstrass quation for the codomain of the isogeny is

Step 4

The image point of the point $(x, y)$ under the isogeny is given by $(\alpha, \beta)$ where

and

For the proof of the correctness of these formulas, see Washington’s treatment in [23].

Concluding Thoughts

Though the details of these formulas are not that important, it helps us bridge the gap between theory and implementation. In theory, a cryptographic scheme based on isogenies can be found to be secure and sound, but if it cannot be implemented then it is of little practical use.

Further Reading

[1] Isogenies of Elliptic Curves: A Computational Approach, by Daniel Shumow.

[2] Towards Quantum-Resistant Cryptosystems from Supersingular Elliptic Curve Isogenies, by Luca de Feo, David Jao and Jérôme Plût.

[3] Elliptic curves: Number theory and cryptography, by Lawrence Washington.

Assumed knowledge:

• Elliptic Curves (over Finite Fields)
  • What they are
  • How they form a group under addition of point
• A little bit of group theory
• Basic properties of functions like surjectivity, injectivity, bijectivity etc.

Isogenies

Let $E_1$ and $E_2$ be elliptic curves defined over a finite field $\mathbb{F}_q$. Here, $q$ is some prime power. We note that $E_1$ and $E_2$ form groups under the addition of points and as $\mathbb{F}_q$ is finite, so are these groups.

Note: Normally in maths papers,we write $E_i(K)$ to specify we are talking about $K$-valued points. I’ll drop this notation because we will only be considering the elliptic curves over a finite field.

Say we now want to consider a map between these two elliptic curves:

But wait, what do we even mean by a map from one elliptic curve to another? We might also wonder what properties should this map have for it to ‘behave well’ in both the geometric and algebraic sense?

• $\phi$ acts on points on the elliptic curve, which have an $x$ and a $y$ coordinate. So we can write $\phi = (\phi_1, \phi_2)$, which acts on a point $P = (x, y)$ on $E_1$ in the following way:

• We want this map to be rational. By this we mean that if $\phi = (\phi_1, \phi_2)$, then $\phi_1$ and $\phi_2$ are just algebraic fractions where the denominator and numerator are polynomials. For example

• We want $\phi$ to have this property, because it is a well known fact in maths that a rational map is either surjective or constant. Though this may not seem important, once we define a few more properties and start looking at isogenies, this becomes really useful.

• As $E_1$ and $E_2$ form groups, ideally we would like $\phi$ to be a group homomorphism. Intuitively this means thats $\phi$ will preserve the group structure. Mathematically, if $+_i$ is the group operation on $E_i$ (namely, the addition of points on $E_i$), and $P, Q$ are two points on $E_1$ then

If we label the identity of the group $E_i$ as $\mathcal{O}_i$ we can make the following definition.

Definition: A rational map $\phi: E_1 \longrightarrow E_2$ is called an isogeny if $\phi(\mathcal{O}_1) = \mathcal{O}_2$.

It turns out that a map being rational and sending the identity to itself automatically makes the isogeny a group homomorphism, which is one of the propoerties we wanted. Also, the isogeny is either the identity map (it is a constant map that sends the identity to itself) OR it must be surjective.

A really famous example of an isogeny when we’re working over a finite field $\mathbb{F_q}$ is the Frobenius Map. If $P = (x, y)$, this map is given by

It’s an easy check to see that this is in fact an isogeny so I encourage you to try show this to make sure you understand the definition!

Endomorphisms

Definition: If $E_1 = E_2$ then $\phi$ is called an endomorphism.

Definition: An endomorphism $\phi$ is an isomorphism if it is bijective. Remember that $\phi$ is either the identity or surjective, so we only need to check if $\phi$ is injective.

These endomorphisms are really cool because the set of endomorphisms of an elliptic curve $E$ together with the zero map (that map that sends everything to zero) actually forms a ring under the operations of pointwise addition and ‘multiplication’ given by composing the endomorphisms (i.e. $(f \times g) = f(g(x))$. Intuitively, being a ring means that the addition and multiplication behave nicely and interact well with each other. More precisely, being a ring means that:

• it is a group under the addition
• the multiplication is associative and has an identity
• multiplication is distributive with respect to addition

We denote this ring by $End(E)$.

j-Invariants

For our purposes, we let $p \equiv 3 \mod 4$ be a prime and we consider the finite field $\mathbb{F}_{p^2}$.

Note: To get some intuition as to what this field looks like we can show that $\mathbb{F}_{p^2}$ is equivalent adjoining $i$ to $\mathbb{F}_{p}$, where $i^2 + 1 = 0$, which we write as $\mathbb{F}_{p}(i)$. This means that we can view elements of $\mathbb{F}_{p^2}$ as being of the form $u + iv$ where $u, v \in \mathbb{F}_p$. Unless stated otherwise, we now assume all elliptic curves are over this finite field.

Instead of considering each individual elliptic curve, what we actually want to do is consider $E_1$ and $E_2$ to be the ‘same’ elliptic curves if and only if they are isomorphic. More precisely, we consider the equivalence classes of elliptic curves, where $E_1$ and $E_2$ are equivalent if and only if they are isomorphic. To do this we need some sort of invariant that will be the same for $E_1$ and $E_2$ if and only if they are isomorphic to allow us to label each equivalence class. So, we introduce the $j$-invariant!

Writing the elliptic curve $E$ in Weierstrass Form, namely

we have

Then, over $\mathbb{F}_{p^2}$, two elliptic curves are isomorphic if and only if they have the same $j$-invaraint, which is exactly the property we were looking for.

Properties of Isogenies

Separable vs. Inseparable

A word that is used a lot in papers on isogeny cryptography is separable. In general, an isogeny can be either separable or inseparable. The definitions aren’t really that important, but for the maths to work out and be nice, we want the isogenies to be separable.

The most important thing about separable isogenies is the fact that they are in one-to-one correspondence with finite subgroups. What does this mean? Basically, every subgroup $G$ of the points on an elliptic curve $E_1$ gives rise to a unique isogeny $\phi: E_1 \longrightarrow E_2$ whose kernel is $G$ (recall that a kernel of $\phi$ is the set of points in $E$ that get mapped to the identity $\mathcal{O}_1$), and vice versa. If this is the case, the codomain is sometimes written as $E_1/G$ rather than $E_2$.

This is made explicit by Velu’s formulas: given an elliptic curve $E_1: y^2 = x^3 +ax^2 +bx + c$, these formulas output an elliptic curve $E_2 = E_1/G$ and the explicit maps for $\phi$. In a future blog post I will go into more detail on these formulas.

Degree

Definition: The degree of a non-zero separable isogeny is the number of elements in the kernel. Equivalently, though less importantly for our purposes, it is the degree of the isogeny as a rational map (if you want a precise definition of what this means see page 21 Silverman’s ‘Arithmetic of Elliptic Curves’).

We can view isomorphisms as being special isogenies whose kernel is just ${\mathcal{O}}$, i.e. an isogeny of degree 1.

Degree interacts really nicely with composition of isogenies in the sense that

Dual Isogenies

We know that isomorphisms have an inverse and that composing them together gives us the identity map. But what about isogenies? Is there an analogue?

In general, isogenies do not have an inverse, however every isogeny $\phi$ has a unique dual isogeny, which we denote as $\hat{\phi}$. Rather than composing to give the identity, if

is an isogeny of degree $d$, then $\hat{\phi}$ is an isogeny of degree $d$ and the composition gives us

where $[d]: E_1 \longrightarrow E_2$ is the multiplication by $d$ map.

Torsion Points

Consider the multiplication-by-$d$ map. Then the group of all points $P$ on $E_1$ such that $[d]P = \mathcal{O}_1$ is denoted by $E_1[d]$ and are called the $d$-torsion points. In other words, these are the points that are in the kernel of (are sent zero by) the multiplication-by-$d$ map. In essence, $d$-torsion points are just elements of order $d$, however in most papers they are referred to as $d$-torsion points so I thought I would introduce this terminology now.

A useful fact to remember is that if $d$ is coprime to $q$ (recall this is the size of the finite field we are working over), then

and furthermore

Further Reading

[1] Supersingular Isogeny Key Exchange for Beginners, by Craig Costello (https://eprint.iacr.org/2019/1321.pdf)

[2] Rational Points on Elliptic Curves, by Joseph H. Silverman and John Tate

[3] Arithmetic of Elliptic Curves, by Joseph H. Silverman