On the quaternion -isogeny path problem

Kohel, David; Lauter, Kristin; Petit, Christophe; Tignol, Jean-Pierre

doi:10.1112/s1461157014000151

Cited by 76 publications

(135 citation statements)

References 8 publications

Supporting

Mentioning

131

Contrasting

Order By: Relevance

“…The strategy is to compute a lattice I in B p,∞ of appropriate norm that is a left ideal of End(E) and a right ideal of End(E ), and to translate it back to the geometric setting to obtain an isogeny. This approach motivated the quaternion -isogeny algorithm of Kohel-Lauter-Petit-Tignol [17,33,37], which solves the following problem: Problem 7. Let p, be distinct prime numbers.…”

Section: Problemmentioning

confidence: 99%

“…All assumptions except for the second one come from our use of (the powersmooth variant of) the quaternion isogeny algorithm in [33].…”

Section: Heuristic Assumptions Used In This Papermentioning

confidence: 99%

“…However, the subtlety is that we cannot just set η = ψ • ϕ, as then E 1 would appear on the path in the graph from E 0 to E 2 and so we would have leaked the private key. The crucial idea is to use the algorithm of Kohel-Lauter-Petit-Tignol [33] to produce a "pseudo-canonical" isogeny η : E 0 → E 2 that is independent of ϕ. The algorithm of Kohel-Lauter-Petit-Tignol is based on the theory of quaternion algebras.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Identification Protocols and Signature Schemes Based on Supersingular Isogeny Problems

2019

Self Cite

View full text Add to dashboard Cite

We present signature schemes whose security relies on computational assumptions relating to isogeny graphs of supersingular elliptic curves. We give two schemes, both of them based on interactive identification protocols. The first identification protocol is due to De Feo, Jao and Plût. The second one, and the main contribution of the paper, makes novel use of an algorithm of Kohel, Lauter, Petit and Tignol for the quaternion version of the -isogeny problem, for which we provide a more complete description and analysis, and is based on a more standard and potentially stronger computational problem. Both identification protocols lead to signatures that are existentially unforgeable under chosen message attacks in the random oracle model using the wellknown Fiat-Shamir transform, and in the quantum random oracle model using another transform due to Unruh. A version of the first signature scheme was independently published by Yoo, Azarderakhsh, Jalali, Jao and Soukharev. This is the full version of a paper published at ASIACRYPT 2017.

show abstract

Section: Problemmentioning

confidence: 99%

“…All assumptions except for the second one come from our use of (the powersmooth variant of) the quaternion isogeny algorithm in [33].…”

Section: Heuristic Assumptions Used In This Papermentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Identification Protocols and Signature Schemes Based on Supersingular Isogeny Problems

2019

Self Cite

View full text Add to dashboard Cite

show abstract

“…There are currently no subexponential classical or quantum attacks for these systems. However, under some heuristic assumptions, the quaternion analogue for the underlying hardness assumption of the hash function in [CGL09] was broken in [KLPT14], which suggests that a careful study of the isogenies and endomorphism rings of supersingular elliptic curves is necessary.…”

Section: Introductionmentioning

confidence: 99%

Cycles in the Supersingular ℓ-Isogeny Graph and Corresponding Endomorphisms

Bank

Camacho-Navarro

Eisenträger

et al. 2019

Association for Women in Mathematics Series

View full text Add to dashboard Cite

We study the problem of generating the endomorphism ring of a supersingular elliptic curve by two cycles in ℓ-isogeny graphs. We prove a necessary and sufficient condition for the two endomorphisms corresponding to two cycles to be linearly independent, expanding on the work by Kohel in his thesis. We also give a criterion under which the ring generated by two cycles is not a maximal order. We give some examples in which we compute cycles which generate the full endomorphism ring. The most difficult part of these computations is the calculation of the trace of these cycles. We show that a generalization of Schoof's algorithm can accomplish this computation efficiently. that led to a significant improvement in the running time analysis of the generalization of Schoof's algorithm, and for outlining the proofs of Proposition 2.4 and Lemma 6.9. Finally, we thank the Women in Numbers 4 conference and BIRS, for enabling us to start this project in a productive environment. K.E. and T.M. were partially supported by National Science Foundation awards DMS-1056703 and CNS-1617802. Isogeny graphs2.1. Definitions and properties. In this section, we recall several definitions and notation that are used throughout. We refer the reader to [Sil09] and [Koh96] for a detailed overview on some of the below. Let k be a field of characteristic p > 3.

show abstract

“…Given an order O in a quaternion algebra, the -isogeny path in O was recently shown to be easy [13]. Therefore, the computation of the endomorphism ring of a supersingular curve is very important for isogeny computation.…”

Section: Conclusion and Further Perspectivesmentioning

confidence: 99%

Fast heuristic algorithms for computing relations in the class group of a quadratic order, with applications to isogeny evaluation

Biasse¹,

Fieker²,

Jacobson³

2016

LMS J. Comput. Math.

View full text Add to dashboard Cite

In this paper, we present novel algorithms for finding small relations and ideal factorizations in the ideal class group of an order in an imaginary quadratic field, where both the norms of the prime ideals and the size of the coefficients involved are bounded. We show how our methods can be used to improve the computation of large-degree isogenies and endomorphism rings of elliptic curves defined over finite fields. For these problems, we obtain improved heuristic complexity results in almost all cases and significantly improved performance in practice. The speed-up is especially high in situations where the ideal class group can be computed in advance.

show abstract

On the quaternion -isogeny path problem

Cited by 76 publications

References 8 publications

Identification Protocols and Signature Schemes Based on Supersingular Isogeny Problems

Identification Protocols and Signature Schemes Based on Supersingular Isogeny Problems

Cycles in the Supersingular ℓ-Isogeny Graph and Corresponding Endomorphisms

Fast heuristic algorithms for computing relations in the class group of a quadratic order, with applications to isogeny evaluation

Contact Info

Product

Resources

About