Cycles in the Supersingular ℓ-Isogeny Graph and Corresponding Endomorphisms

Abstract

We study the problem of generating the endomorphism ring of a supersingular elliptic curve by two cycles in ℓ-isogeny graphs. We prove a necessary and sufficient condition for the two endomorphisms corresponding to two cycles to be linearly independent, expanding on the work by Kohel in his thesis. We also give a criterion under which the ring generated by two cycles is not a maximal order. We give some examples in which we compute cycles which generate the full endomorphism ring. The most difficult part of these computations is the calculation of the trace of these cycles. We show that a generalization of Schoof's algorithm can accomplish this computation efficiently. that led to a significant improvement in the running time analysis of the generalization of Schoof's algorithm, and for outlining the proofs of Proposition 2.4 and Lemma 6.9. Finally, we thank the Women in Numbers 4 conference and BIRS, for enabling us to start this project in a productive environment. K.E. and T.M. were partially supported by National Science Foundation awards DMS-1056703 and CNS-1617802. Isogeny graphs2.1. Definitions and properties. In this section, we recall several definitions and notation that are used throughout. We refer the reader to [Sil09] and [Koh96] for a detailed overview on some of the below. Let k be a field of characteristic p > 3.

Computing endomorphism rings of supersingular elliptic curves and connections to path-finding in isogeny graphs

“…Now we show that with high probability the two cycles C 0 , C 1 returned by the algorithm are linearly independent. We will use Corollary 4.12 of [3]. This corollary states that two cycles C 0 and C 1 with no self-loops generate an order inside End(E 0 ) if they (1) do not go through 0 or 1728,…”

“…In Step (2), the Gram matrix for , whose entries are the reduced traces of pairwise products of the basis elements, is computed. This uses a generalization of Schoof's algorithm (see Theorem A.6 of [3]), which runs in time polynomial in log p and log of the norm of α, β. Since α and β arise from cycles of length at most c log p , for some constant c which is independent of p, the norms of α and β are at most p c .…”

“…, q m distinct and different from p. By the local-global principle for maximal orders there is one maximal order corresponding to each collection of q i -maximal orders {O i } with O i ⊇ ⊗ ‫ޚ‬ q i . We loop through these orders in Step(3). The size of the index set in that loop and hence the number of distinct maximal orders containing is at most 2 ω(discrd( ))−1 , where ω(n) denotes the number of distinct prime factors of an integer n.Fix ε > 0.…”

Orienteering with one endomorphism

“…In particular, the limiting runtime is the call to [53], which takes time O(N 4 (log p)M(p N 2 )). See also [4,Lemma 6.9]. Lemma 2.4.…”

“…Throughout the paper, we will assume that all endomorphisms are provided with a trace and norm (which is the same as degree) that carries through computations; see Section 5.1. If the trace is not provided, then it can be computed using [54, Lemma 1], [22,Lemma 4], [4,Theorem 3.6].…”