2

I've read a few books and papers about isogeny-based cryptography and its mathematic but didn't get the idea how to find the endomorphism ring of a supersingular elliptic curve. I know how to do it for an ordinary curve but not for a supersingular one.

For example, I have a supersingular elliptic curve $E: y^2 = x^3 + x$ over $\mathbb{F}_{5^2}$. We know that $End(E) \cong \mathbb{Q}_{p, \infty}$ (maximal order of quaternion algebra ramified in $p$ and $\infty$). Can someone give the algorithm for this toy example? Is it a hard problem in general?

Any answer would be useful, especially with some literature or logical reasoning what should be done to solve this problem.

tuner007
  • 125
  • 1
    In general the problem is assumed to be hard. In fact, the $\ell$-isogeny path problem reduces to computing the endomorphism ring of a general supersingular elliptic curve: https://eprint.iacr.org/2021/919 – stillconfused Oct 04 '22 at 18:35
  • You have to make the distinction between the endormorphism ring End$(E)$ and the endomorphism algebra End$(E) \otimes_{\mathbb Z} \mathbb Q$. The latter (once we account for endomorphisms acquired over $\mathbb F_{p^2}$ and not just $\mathbb F_p$) is always going to be the division algebra $\mathbb Q_{p,\infty}$.

    The example you give in your question needs to be adjusted to give clarity on which of these two objects you are interested in.

     – Arkady Oct 05 '22 at 03:14
  • Does this answer your question: https://math.stackexchange.com/q/4370619/11323 – Kimball Oct 05 '22 at 09:43
  • Kimball, thanks, this is an important part of the answer, however, the main question is how to find the maximal order in quaternion algebra for the given supersingular elliptic curve. How did he find $\mathcal{O}_0$? – tuner007 Oct 05 '22 at 13:29
  • Arkady, I don't really get the question, such specific mathematics is unfamiliar for me, but I need it for an elliptic curves to calculate isogenies; so the question could be: how can I find a maximal order in quaternion algebra which is isomorphic to $End(E)$ for a given elliptic curve over a finite field? – tuner007 Oct 05 '22 at 14:45
  • Finally I got a partial answer: the algorithm and some ready values for finding a maximal order are shown in Pizer's paper. However, I still have no idea how to calculate it for a random small curve. Moreover, it is unclear how the curve coefficients are connected with the order. Pizer is talking about only the connection between $p$ and $\mathbb{Z}$-basis but I doubt $End(E)$ of each supersingular curve is isomorphic to the same maximal order which only depends on prime $p$. – tuner007 Oct 07 '22 at 21:04

0 Answers0