Quaternion algebras
and isogeny-based cryptography
Antonin Leroux
September 6, 2022

Contents
I

Theory and algorithms

14

1 Preliminaries
15
1.0.1 Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
1.1 Elliptic curves and isogenies . . . . . . . . . . . . . . . . . . . . . 16
1.1.1 Elliptic curves . . . . . . . . . . . . . . . . . . . . . . . . 16
1.1.2 Isogenies . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
1.1.3 Elliptic curves and isogenies over finite fields. . . . . . . . 21
1.2 Quadratic imaginary fields and quaternion algebras, orders andideals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
1.2.1 Quadratic imaginary fields . . . . . . . . . . . . . . . . . 24
1.2.2 Quaternion algebras . . . . . . . . . . . . . . . . . . . . . 25
2 The Deuring correspondence
32
2.1 An equivalence of category in three acts . . . . . . . . . . . . . . 32
2.1.1
Endomorphism algebra and endomorphism rings, where
it all begins . . . . . . . . . . . . . . . . . . . . . . . . . . 32
2.1.2 Kernel ideals, the main development . . . . . . . . . . . . 33
2.1.3 The conclusion . . . . . . . . . . . . . . . . . . . . . . . . 35
2.2 Algorithmic Deuring correspondence . . . . . . . . . . . . . . . . 36
2.2.1 Endomorphism ring computation . . . . . . . . . . . . . . 37
2.2.2 Other results and algorithms. . . . . . . . . . . . . . . . . 39
2.3 Interpreting the zoology of quaternion orders under the Deuringcorrespondence . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
2.3.1 Eichler orders . . . . . . . . . . . . . . . . . . . . . . . . . 40
2.3.2 Non-Gorenstein orders . . . . . . . . . . . . . . . . . . . . 46
2.4 Quadratic orders in the Deuring correspondence and the numberof orientable curves . . . . . . . . . . . . . . . . . . . . . . . . . . 47
2.4.1 A first result for small discriminants . . . . . . . . . . . . 49
2.4.2 The case of a maximal quadratic order. . . . . . . . . . . 50
2.4.3 The case of non-maximal orders . . . . . . . . . . . . . . 58
3

Resolution of norm equations in quaternion lattices
62
3.1 The case of special extremal orders . . . . . . . . . . . . . . . . . 63
3.1.1 Cornacchia’s algorithm . . . . . . . . . . . . . . . . . . . . 64
3.1.2
Representing integers by the norm form of the special
extremal order. . . . . . . . . . . . . . . . . . . . . . . . . 65
3.1.3 Finding solutions in the full order . . . . . . . . . . . . . 67
3.2 Ideals in the special extremal orders . . . . . . . . . . . . . . . . 69

1

3.3
3.4
3.5

3.2.1 Reducing to the prime-norm case . . . . . . . . . . . . . .
3.2.2 The linear algebra step . . . . . . . . . . . . . . . . . . .
3.2.3 Putting everything together . . . . . . . . . . . . . . . . .
Eichler orders and their ideals . . . . . . . . . . . . . . . . . . . .
Norm Equations in non-Gorenstein suborders of Eichler orders .
Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

70
72
72
74
79
81

4 Isogeny representation: algorithmic aspects
84
4.1 The kernel representation . . . . . . . . . . . . . . . . . . . . . . 85
4.1.1 A generalization of the problem . . . . . . . . . . . . . . . 88
4.1.2 Evaluation of polynomials whose roots are powers . . . . 88
4.1.3 Evaluation of the polynomial whose roots are in an elliptic
curve torsion subgroup. . . . . . . . . . . . . . . . . . . . 90
4.1.4 Application to isogeny computations . . . . . . . . . . . . 93
4.1.5 A compressed representation . . . . . . . . . . . . . . . . 95
4.2 The ideal representation . . . . . . . . . . . . . . . . . . . . . . . 96
4.2.1 Ideal to isogeny translation, the generic case . . . . . . . 97
4.2.2 Ideal to isogeny, efficient algorithms for the prime powercase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
4.2.3 Verification of the ideal representation . . . . . . . . . . . 109
4.2.4 Isogeny Evaluation from the ideal representation . . . . . 111
4.3 The suborder representation . . . . . . . . . . . . . . . . . . . . 112
4.3.1 Deriving the new representation from the ideal representation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
4.3.2 Verification of the suborder representation . . . . . . . . . 113
4.3.3 Checking traces . . . . . . . . . . . . . . . . . . . . . . . . 116
4.3.4 Evaluating with the suborder representation . . . . . . . . 117

II

Cryptographic protocols

119

5 Signatures: SQISign120
5.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
5.1.1 Identification protocols and Fiat–Shamir signatures . . . . 121
5.1.2 Isogeny-based signature schemes. . . . . . . . . . . . . . . 122
5.2 A new identification protocol and signature scheme . . . . . . . . 123
5.2.1 An identification protocol . . . . . . . . . . . . . . . . . . 123
5.2.2 The signature scheme . . . . . . . . . . . . . . . . . . . . 125
5.3 Concrete instantiation: security . . . . . . . . . . . . . . . . . . . 126
5.3.1 Computation of the response isogeny: a secure algorithm
to compute the ideal . . . . . . . . . . . . . . . . . . . . . 126
5.3.2 Defining the key space . . . . . . . . . . . . . . . . . . . . 130
5.4 Concrete instantiation: efficiency . . . . . . . . . . . . . . . . . . 131
5.4.1 Ideal to isogeny: cost estimate . . . . . . . . . . . . . . . 131
5.4.2 Parameter choices . . . . . . . . . . . . . . . . . . . . . . 133
5.4.3 SQISign: the concrete description . . . . . . . . . . . . . . 135
5.4.4 Performance . . . . . . . . . . . . . . . . . . . . . . . . . 138
5.5 Zero-Knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
5.5.1 An ad-hoc assumption . . . . . . . . . . . . . . . . . . . . 140
5.5.2 On the distribution of signatures . . . . . . . . . . . . . . 140

2

5.6

5.7

5.5.3 Hardness Assumption for Zero-Knowledge . . . . . . . . . 142
Cryptanalysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 144
5.6.1 Generic cryptanalysis . . . . . . . . . . . . . . . . . . . . 144
5.6.2 Exploiting specific properties . . . . . . . . . . . . . . . . 147
Improvement perspectives . . . . . . . . . . . . . . . . . . . . . . 150

6 Encryption: SETA
152
6.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
6.1.1 The SIDH key exchange . . . . . . . . . . . . . . . . . . . 152
6.1.2 The CSIDH key exchange . . . . . . . . . . . . . . . . . . 153
6.1.3 Torsion attacks and trapdoor curves . . . . . . . . . . . . 154
6.2 Séta trapdoor one way function and public key encryption scheme 157
6.2.1 Generalized Charles-Goren-Lauter hash function . . . . . 157
6.2.2 A trapdoor function family from the G-CGL family . . . 158
6.2.3 Inversion . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
6.2.4 Séta Public Key Encryption . . . . . . . . . . . . . . . . . 160
6.2.5 IND-CCA encryption scheme . . . . . . . . . . . . . . . . 161
6.3 Key generation method . . . . . . . . . . . . . . . . . . . . . . . 162
6.3.1 Computing the trapdoor information . . . . . . . . . . . . 162
6.3.2 Trapdoor curve generation . . . . . . . . . . . . . . . . . . 163
6.3.3 Constraints on the prime . . . . . . . . . . . . . . . . . . 164
6.4 Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
6.4.1 Main building blocks . . . . . . . . . . . . . . . . . . . . . 166
6.4.2 Prime search . . . . . . . . . . . . . . . . . . . . . . . . . 166
6.4.3 Experimental results . . . . . . . . . . . . . . . . . . . . . 167
6.5 “Uber” isogeny assumption . . . . . . . . . . . . . . . . . . . . . 167
6.5.1 The new generic problem . . . . . . . . . . . . . . . . . . 167
6.5.2 Relation with various isogeny-based constructions . . . . 168
6.5.3 Analysis of the uber isogeny assumption . . . . . . . . . . 171
6.5.4 A numerical application to the parameters of SETA . . . 172
7 Cryptographic applications of the suborder representation
174
7.1 Deducing the ideal representation from the suborder representation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
7.2 A new NIKE based on a generalization of SIDH for large prime
degrees. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
7.2.1 About efficiency . . . . . . . . . . . . . . . . . . . . . . . 183
7.3 Potential for other cryptographic applications . . . . . . . . . . . 183

3

List of algorithms
We give below a list containing most of the algorithms used in this work, together
with a quick description. When the full description is given in the manuscript,
we also include the reference of the algorithm and the page where it can befound. In all the algorithms below, O0 is the special extremal order of Bp,∞ and
N is a subset of N.
• ConnectingIdeal: takes two maximal orders O1 , O2 in Bp,∞ and computes
the connecting ideal I(O1 , O2 ).
• Cornacchia(Algorithm 1, Page 64): takes two integers q, m and finds asolution t, x to t2 + qx2 = m when it’s possible.
• RepresentIntegerN (Algorithm 2, Page 65): Finds γ of norm in N in the
maximal extremal order of Bp,∞ .
• StrongApproximationN (Algorithm 3, Page 66): takes a prime N , two values
C, D ∈ Z and finds µ of norm in N with λj(C + ωD) + N µ1 with µ1 in
the maximal extremal order of Bp,∞ .
• FullRepresentIntegerN (Algorithm 4, Page 68): same as RepresentInteger
but with a different output distribution.
• FullStrongApproximationN (Algorithm 5, Page 69): same as StrongApproximation
but with a different output distribution.
• EquivalentPrimeIdeal(Algorithm 6, Page 71): takes an ideal I of maximal
order in Bp,∞ and outputs the equivalent ideal of smallest possible primenorm.
• RandomEquivalentPrimeIdeal: same as EquivalentPrimeIdeal but outputs arandom choice among a set of ideals of small prime norm.
• IdealModConstraint: takes an ideal L of maximal order in Bp,∞ , an element γ ∈ Bp,∞ with gcd(n(γ), n(L)2 ) = n(L), and outputs (C : D) ∈P1 (Z/n(L)Z) s.t γj(C + ωD) ∈ L.
• EichlerModConstraint: takes an ideal L of maximal order in Bp,∞ , twoelements γ1 , γ2 ∈ Bp,∞ with gcd(n(γ), n(L)) = 1, and outputs (C : D) ∈P1 (Z/n(L)Z) s.t γ1 j(C + ωD)γ2 ∈ Z + L.
• KLPTN (Algorithm 7, Page 73): takes an ideal I of the special extremal
order and finds J ∼ I of norm contained in N .

4• EichlerNormN (Algorithm 8, Page 75): takes an ideal I and finds β ∈ Z + I
of norm contained in N .
• SpecialEichlerNormN (Algorithm 9, Page 76): takes a maximal order O andK, an O-ideal, and finds β ∈ O ∖ (Z + K).
• IdealEichlerNormN (Algorithm 10, Page 77): takes two ideals I, J of thespecial extremal order of Bp,∞ , and finds β ∈ (Z+I)∩J of norm containedin n(J)N .
• GenericKLPTN (Algorithm 11, Page 78): takes a maximal order O1 of Bp,∞
and an O1 -ideal I, and finds J ∼ I of norm in N .
• SuborderEichlerNormN (Algorithm 12, Page 80): takes an integer D, anideal I of the special extremal order of Bp,∞ , and computes β ∈ Z + DIof norm contained in N .
• GeneratingFamilyN (Algorithm 13, Page 81): takes an integer D and amaximal order O1 in Bp,∞ , and computes a generating family of Z + DO1
whose elements have norm in N .
• IdealSuborderEichlerNormN (Algorithm 14, Page 82): takes an integer D,
two ideals I, J of the special extremal order of Bp,∞ , and finds β ∈ (Z +DI) ∩ J of norm contained in n(J)N .
• Compression(Algorithm 17, Page 96): takes a curve E and an isogeny σ,
and computes a string s representing the isogeny σ.
• Decompression(Algorithm 18, Page 96): takes a curve E and a compressed
representation s, and computes the corresponding isogeny σ of domain E.
• IdealToKernel(Algorithm 19, Page 98): takes a curve E1 , I a cyclic ideal of
maximal order in Bp,∞ , and computes a generator of of the cyclic subgroup
E1 [I].
• KernelToIdeal(Algorithm 20, Page 98): takes a point P in E1 [D] and computes the kernel ideal corresponding to the group generated by P .
• IdealToIsogenyCoprimeT (Algorithm 21, Page 103): takes two equivalent
left ideals J, K of O0 , with J of norm dividing T 2 and K of norm ℓ• , thecorresponding isogeny φK , and computes the isogeny φJ .
• IdealToIsogenySmallFromKLPT(Algorithm 22, Page 103): takes I a left O0 ideal of norm dividing T 2 ℓ2f +∆ , an O0 -ideal in J containing I of norm
dividing T 2 , and an ideal K ∼ J of norm a power of ℓ, as well as φJ and
φK . Computes φ = φ2 ◦ θ ◦ φ1 : E1 → E2 of degree ℓ2f +∆ such that
φI = φ ◦ φJ , L ∼ I of norm dividing T 2 and φL .
• IdealToIsogenyFromKLPTℓ• (I, K, φK )(Algorithm 23, Page 104): takes I, aleft O-ideal, for a maximal order O, of norm a power of ℓ, K a left O0 -ideal
and right O-ideal of norm ℓ• , the corresponding φK , and computes φI .
• IdealToIsogenySmallFromEichlerℓf (O, I, J, φJ , P )(Algorithm 24, Page 105):
takes I a left O-ideal of norm ℓf , an (O0 , O)-ideal J of norm in ℓ• andφJ : E0 → E the corresponding isogeny, the generator P ∈ E[ℓf ] of ker φK
s.t φ̂J = φK ′ ◦ φK . Computes φI of degree ℓf .
5• IdealToIsogenyFromEichlerℓ• (I, J, φJ )(Algorithm 25, Page 107): takes I aleft O-ideal of norm ℓe with e = f v, an (O0 , O)-ideal J of norm ℓ• andφJ : E0 → E the corresponding isogeny. Computes φI of degree ℓe .
• EndomorphismEvaluationℓf (Algorithm 26, Page 108): takes two isogenies
φ1 , φ2 : E → E ′ , scalars C, D, the trace t = tr(φ̂2 ◦ φ1 ) and a point P oforder ℓf . Computes [C]P + [D]φ̂2 ◦ φ1 (P ).
• IdealVerification(Algorithm 27, Page 110): takes x ∈ N × S(p)2 and I an
ideal of Bp,∞ and outputs a bit indicating if x ∈ Lisog .
• IdealEvaluation(Algorithm 28, Page 111): takes I an O0 -ideal of Bp,∞ andP ∈ E0 (Fq ) of order coprime to D = n(I), and computes φI (P ).
• IdealToSuborder(Algorithm 29, Page 113): takes I an integral ideal of
maximal orders inside Bp,∞ of norm ℓ, and computes endomorphisms φi :∼E2 → E2 such that ι : End(E2 ) −→ OR (I) sends φ1 , . . . , φn to a generating
family θ1 , . . . , θn for Z + DOL (I).
• SuborderVerification(Algorithm 30, Page 115): takes x ∈ P × S(p)2 and π
a suborder witness, and outputs a bit indicating if x ∈ Lp−isog .
• CheckTraceM (Algorithm 31, Page 116): takes θ1 , . . . , θn , n endomorphismsof E and n elements of Bp,∞ ω1 , . . . , ωn . Outputs a bit b equal to 1 if andonly if tr(θi ) = tr(ωi ) mod M for all i ∈ [1, n].
• SuborderEvaluation(Algorithm 32, Page 118): takes π a suborder witness
for (D, E1 , E2 ) ∈ Lp−isog and an ideal J of norm coprime to ℓ, and computes φπ (E1 [J]).
• SigningKLPT2e (Algorithm 33, Page 127): takes Iτ a left O0 -ideal and rightO1 -ideal of prime norm Nτ inert in O, and I, a left O1 -ideal. Computes
J ∼ I of norm 2e .
• RandomEquivalentEichlerIdeal(Algorithm 34, Page 128): takes I a left O1 ideal, and outputs K ∼ I of norm coprime to Nτ .
• InverseTrapdoor(Algorithm 35, Page 159): takes jT ∈ JT,p , a trapdoor T
and c, outputs m ∈ [µ(D)] such that fjD,N(m) = c. ‘T• SetaQuadraticOrderGen(Algorithm 36, Page 163): takes D, N as above.
2
2<
Let S be the product of primes dividing D, finds (d, e) such that − N De−d20 is a quadratic non-residue modulo every prime dividing D and is aquadratic non-residue modulo p.
• SetaCurveGen(Algorithm 37, Page 165): takes a prime p, an integer N , aquadratic order O, a bound B, a length ε. Computes a uniformly random
curve EjT ∈ EO (p), a basis PjT , QjT of EjT [N ], and θ(PjT ), θ(QjT ) with
θ ∈ End(EjT ) such that Z[θ] ∼= O.
• pSIDHKeyGen(Algorithm 38, Page 181): takes a prime number D ̸= p,
outputs the pSIDH public key pk = E, π and the pSIDH secret key sk = I
where π is a suborder witness and I an ideal witness for (D, E0 , E) ∈Lp−isog .
6• pSIDHKeyExchange(Algorithm 39, Page 182): takes I an ideal of degree D
and a prime D′ ̸= D, p. A curve E ′ and a suborder witness π, computes
a j-invariant.

7

Introduction
Cryptography is the science of secrecy. The need to protect a message against
eavesdroppers can be traced back at least to antiquity, where we can find numerous examples of ciphers.
Despite this long history, the discipline has changed radically since the time
when messages were written with quills and sent on parchments. The revolutionof cryptography emerged in the second part of the 20th century with the development of computers. In their seminal work “New directions for cryptography”,
Diffie and Hellman [DH76] led the way into a new era for security. Based on hard
computational problems, public key cryptography enables a set of parties to secure their communication without any prior agreement of a shared secret. In
public key cryptography, number theory has found a surprisingly practical fieldof application by supplying the aforementioned hard computational problems,
the two most prominent ones by far being the integer factorization problem andthe discrete logarithm problem (in either a finite field or the group of points ofan elliptic curve).
Today we are on the brink of a new revolution in cryptography with the arrival of quantum computers. While this new generation of computers promisesinteresting applications across computing, to cryptographers they mainly represent a threat. The problem for cryptography was uncovered by Peter Shor
who showed in 1994 [Sho97] that a quantum computer could solve the integer
factorization and discrete logarithm problems in polynomial time, thus breaking
any hope of building security upon their hardness in a world where attackers
can use quantum computers.
Fortunately, these machines have their limitations and there are some problems that are believed to be hard even for a quantum computer. This is thefounding principle of post-quantum cryptography, which studies the protocols
that can be built on quantum-hard problems (in contrast, we call classical any
cryptography that is not targeting security against a quantum attacker). To
encourage the effort of the cryptographic community, the National Institute ofStandards and Technology (NIST) launched in 2016 a competition to determine
the most promising candidates. This competition is now at its third round andbig families of proposals have started to emerge.
This work will focus exclusively on one of those families: protocols based on
isogenies of elliptic curves. Isogenies are algebraic morphisms between elliptic
curves. There is currently one isogeny-based candidate and it has been classified
by NIST as one of the alternate candidates in the third round (meaning that it
is a promising scheme that needs more understanding). Cryptographers were no
stranger to isogenies due to the important part played by elliptic curves in classical cryptography. Isogeny-based cryptography is thus merely the new chapter
8

of the common story between number theory and public key cryptography.
A link between elliptic curves, isogenies, and quaternion algebras, anotherfamily of objects inherited from number theory, was discovered by the German
mathematician Max Deuring (see [Deu41] for instance). Throughout this work,
we call this link the Deuring correspondence and we will study it in Chapter 2.
Due to the rise of interest in isogenies, the fascinating mathematical results from
Deuring have started to gain the attention of cryptographers. In this thesis, we
strive to take this adventure further by studying in detail the objects of the
Deuring correspondence and their applications to cryptography.
The hard problem that is the cornerstone of isogeny-based cryptography
is the following: given two isogenous elliptic curves, find an isogeny between
them. The hardness of this problem depends on a number of parameters but
it is generally believed to have at least sub-exponential complexity even for
quantum computers.
The first appearances of isogenies in cryptography date back to the beginning of the 21st century with Teske’s trapdoor system [Tes06] and Galbraith,
Hess, and Smart’s use of isogenies in attacks on protocols based on elliptic curves[GHS02]. The first cryptographic key exchange based on isogenies was independently proposed by Couveignes [Cou06] and Rostovtsev and Stolbunov [RS06],
and is called CRS. The security of this protocol is based on the isogeny problem
in the setting of ordinary curves. While the isogeny problem is hard for ordinary curves, it is harder for supersingular curves (sub-exponential vs. exponential quantum complexity) and it is with supersingular curves that isogeny-based
cryptography really started to become relevant. The first proposal based on isogenies of supersingular curve is the CGL hash function from Charles, Goren andLauter [CLG09]. Then came the SIDH (Supersingular Isogeny Diffie–Hellman)
two-parties key exchange from De Feo and Jao in 2011 [JD11]. This protocol
recreates the usual Diffie–Hellman mechanism by decomposing an isogeny ofcomposite degree in two different ways (one for each participant). With very
compact public keys and reasonable efficiency, SIDH is the first real practicalapplication of isogeny-based cryptography and SIKE, the only isogeny-based
candidate at the NIST competition, is a simple variant of SIDH.
A few years after that, Castryck, Lange, Martindale, Panny and Renes revisited the CRS key exchange in the context of supersingular curves. Theiridea is to restrict to the set of supersingular curves defined over Fp in order to
get a structure similar to CRS, while using the nice properties of supersingularcurves (in particular the control we have on the group of points defined overFp ) to get a much more efficient scheme than CRS. While less computationallyefficient than SIDH, CSIDH has smaller keys for the same security level and,contrary to SIDH, their validity can be easily verified, making CSIDH the firstpost-quantum Non Interactive Key Exchange (NIKE), i.e., a key exchange withstatic public keys. More generally, CRS and CSIDH are two instantiations of acryptographic group action (see for instance [AFMP20]), an abstract frameworkfrom which protocols can be built in a black-box manner.
Recently, the increased interest in post-quantum cryptography has pushed
isogeny-based cryptography in new directions. During the last five years, a lotof progress has been made, both in the theoretical and algorithmic study of
isogenies and in the conception of protocols based on isogenies. Among those,
we are interested in and have contributed to the works making use of the Deuring9

correspondence.
The first step of this journey was taken by Kohel, Lauter, Petit and Tignol in2014 with their paper [KLPT14] where they studied the quaternion path problem, the analogue of the isogeny problem under the Deuring correspondence.
They showed that this problem could be solved in heuristic polynomial time bysolving some norm equations in ideals of the quaternion algebra ramified at p
and ∞. Their efficient algorithm, called KLPT, led to a deeper understanding of
the different problems in isogeny-based cryptography, for instance a proof thatthe problem of computing the endomorphism ring of a supersingular curve isequivalent to the supersingular isogeny problem [EHL+ 18, Wes22].
The protocols presented in this work continue this line of work by exploring
cryptographic applications of the Deuring correspondence. Our results were obtained by understanding how to use the endomorphism rings of supersingularcurves to make the Deuring correspondence effective. Concretely, this means
being able to translate objects such as elliptic curves, isogenies and endomorphisms to their counterparts in the world of quaternions: orders and ideals.
Once on the quaternion side, we can apply KLPT and its variants to solve thetask at hand, before going back to elliptic curves with the inverse translation.
This generic mechanism was used constructively in the GPS signature scheme
by Galbraith, Petit, and Silva [GPS17]. This signature is derived with the Fiat–
Shamir transform from the repetition of an identification scheme whose main
step is to compute an isogeny between two curves from the knowledge of theirendomorphism ring.
One of our most important contributions is to improve upon the GPS construction, both in theory and practice, by building the SQISign signature scheme
presented in Chapter 5. In that regard, our contributions can be divided in two
parts.
The first one is to generalize the KLPT algorithm to Eichler orders andtheir ideals in order to obtain more generic isogenies through the Deuring correspondence. Using that, we can construct an identification scheme whose main
operation remains the computation of an isogeny using endomorphism rings,
but with a much larger challenge space than the one of GPS. Thus, we have torepeat this sub-protocol only once to reach a good security level and we derivewith Fiat–Shamir a signature protocol that is a lot more compact than GPS.
Our second contribution is to make the translation between isogenies andquaternion ideals a lot more efficient using various tricks and the choice of a very
specific prime p. In particular, we improve the method outlined in [EHL+ 18].
Contrary to what is proposed in GPS, which is to perform the translation with aone-shot algorithm, the idea introduced in [EHL+ 18] is to decompose the target
isogeny in smaller bits and treat each of these parts with the one-shot algorithm
from [GPS17] in an efficient manner.
This idea introduces a new problem: evaluating endomorphisms of an arbitrary elliptic curve of known endomorphism ring. We propose two different
ways of solving this issue, either by using another isogeny, of degree coprime tothe one we try to translate, or by computing a well-chosen endomorphism (alsoof degree coprime to the isogeny to be translated). The latter appears fasterthan the former because finding endomorphisms is slightly easier than finding
isogenies.
The two contributions we outlined above are respectively part of two broader
axes of research on the algorithmic Deuring correspondence we will explore
10throughout this thesis. The first one is treated in Chapter 3 and is related tonorm equations in lattices of the quaternion algebra ramified at p and ∞. Kohel et al. looked at maximal orders and their ideals for the KLPT algorithm[KLPT14] and we have continued their work by exploring the rich zoology ofquaternion orders. In particular, we have looked at orders whose Gorenstein
closures are Eichler orders. We were able to show that the sub-algorithms introduced in [KLPT14] could be used to perform all the required computations.
We obtained these extensions of KLPT by exploring how the Deuring correspondence can be extended to Eichler orders of level N by considering curves
augmented with cyclic subgroups of order N .
Our second important direction targets what we call representations of isogenies, that is ways of computing and manipulating isogenies, and it is the focus
of Chapter 4. Overall, we use three distinct isogeny representations: the kernel
representation that is the standard way of computing isogenies from the Vélu
formulæ [Vél71], the ideal representation derived from the Deuring correspondence and the suborder representation, a new representation made of a suborderof the endomorphism ring. We have contributed to the algorithmic computationof these three representations in one way or another. For the kernel representation, we have introduced a new algorithm to compute the Vélu formulæ byapplying a baby-step giant-step type of optimization to the computation of thekernel polynomial by using the biquadratic relations on x-coordinates of elliptic
curve points. This idea gives a quadratic speed-up on the classical approach.
Our improvements to the ideal representation computation come from ourefforts to improve the ideal to isogeny translation algorithm used in GPS andSQISign. The ideal representation is generally much more efficient than the one
based on the Vélu formulæ as the complexities of the algorithms involved arepolynomial in the degree (contrary to the Velu formulæ that are exponential in
the worst case), an idea first introduced by Bröker, Charles and Lauter [BCL08].
While not providing any asymptotic gains, our algorithms give ways of handlingthe ideal isogeny representation much more efficiently in practice.
Following this idea, we have introduced another isogeny representation called
the suborder representation. This new representation makes use of the fact thatthe existence of an isogeny φ : E → E ′ of degree D implies an embedding of
the order Z + D End(E) inside End(E ′ ). We can find nice generating endomorphisms of this suborder using our extended norm equation algorithms, thus
providing a way to manipulate this representation and perform some interesting
computations. We believe that the ideal representation of the isogeny φ is hard
to recover from the suborder representation when D is prime, and we formulate
this idea as a new computational assumption. Under this assumption, the ideal
and suborder representations are not equivalent and we can use this gap to build
new cryptography.
As a consequence of these various algorithmic results, we propose the first
isogeny-based protocols that are explicitly using isogenies of large prime degree.
The SQISign signature scheme introduced in Chapter 5 uses large prime degree
isogenies as private keys and we introduce in Chapter 7 a new key exchange
called pSIDH based on the suborder representation and whose security relies
on our new assumption. This key exchange is basically a variant of SIDH withlarge prime degrees (instead of smooth ones) and the public keys are madeof the suborder representation of the secret key isogenies. Isogenies of large
prime degree are interesting for two main reasons: the quadratic speed-up of the11meet-in-the-middle attack in the smooth-degree case cannot be applied to prime
degrees, and the complexity of the computation becomes exponential when theendomorphism ring is unknown which makes for a good trapdoor mechanism.
In 2017, before we had introduced the suborder representation, Christophe
Petit [Pet17] showed how to recover efficiently the kernel representation of theisogeny from the suborder representation when D is smooth. He showed how
to exploit this mechanism to produce what has become known as torsion point
attacks against the SIDH scheme. These attacks provide speed-ups against
various degenerate variants of SIDH but not against the initial protocol. In fact,
only a partial suborder representation, in the form of the embedding of a specificquadratic order, is required to apply Petit’s attack. When the endomorphismring of the domain curve contains this special quadratic order, we get a socalled “backdoor curve”. The embedding of this quadratic order constitutes a
trapdoor allowing the owner of this knowledge to compute a partial suborderrepresentation and thus recover the isogeny (only when D is smooth). The only
additional information required to apply this mechanism is the action of theisogeny to be recovered on some torsion points.
Another of our contributions is to use this idea to define a trapdoor oneway function. We build a public key encryption scheme called Séta from thisprimitive, it is presented in Chapter 6. The key generation requires finding one
supersingular curve with the special quadratic order embedded in its endomorphism ring. To solve that task, we use again the Deuring correspondence. First,
we find the solutions over the quaternions, before translating it into the isogeny
setting.
To study the security of the Séta encryption scheme we introduced a new
family of computational problems called the “Uber Isogeny Problems”. This
family is parameterized by quadratic orders and, depending on the type oforder used, we have showed a connection of the Uber Isogeny Problem withproblems involved in SIDH, CSIDH, Séta and even the generic isogeny problem.
The complexity of this problem basically depends on the number of orientable
curves, i.e., the number of supersingular curves that admit the embedding ofa given quadratic order inside their endomorphism ring. By considering thequaternion orders generated by two such distinct embeddings, and generalizing
some ideas due to Kaneko [Kan89], we have managed to prove the first genericand effective lower bound on the number of orientable supersingular curves.
This gives the first lower-bound on the complexity of the brute-force attack
against the generic Uber Isogeny Problem.

Outline of the thesis
This thesis is divided in two main parts. In Part I, we study the Deuringcorrespondence from the theoretic and algorithmic standpoint, while in Part II,
we introduce some protocols built upon the results of the first part.
Part Iis made of four chapters:

Chapter 1 introduces all the necessary preliminaries on elliptic curves, isogenies and quaternions. We list all the important results on these objects forthe rest of this thesis.

12Chapter 2 is dedicated to the Deuring correspondence. We provide a rather
complete overview of all the aspects of this correspondence, and focus on thesubsidiary results that will prove useful later on.
Chapter 3 presents a family of algorithms to solve norm equations insidelattices of a quaternion algebra. These algorithms will be the basis of all thepowerful applications that we will build on top of the Deuring correspondence.
Chapter 4 presents various efficient ways to compute, evaluate and manipulate isogenies. The first one is the kernel representation and is closely related
to the basic definition of isogenies. The second one, the ideal representation, isnaturally derived from the results of the Deuring correspondence. We call thethird one the suborder representation, and it is one of our contributions. It isalso based on the Deuring correspondence, but in a less obvious manner.
Part II is made of three chapters:
Chapter 5 presents SQISign, a new signature scheme based on a proof ofknowledge of an endomorphism ring and on the algorithms for the ideal representation.
Chapter 6 presents Séta, a new public key encryption scheme based on a
trapdoor one-way function. The key generation uses the tools of the ideal
representation, while the encryption/decryption mechanism is based on more
traditional objects of isogeny-based cryptography. In the end of this chapter,
we introduce a new isogeny assumption that is tied to various problems arisingin isogeny-based cryptography, in the first attempt to provide a unified visionon the various families of schemes constituting isogeny-based cryptography.
Chapter 7 introduces some applications of the suborder representation introduced in Chapter 4. In particular, we present pSIDH, a new non-interactive
key exchange based on the problem of computing the ideal representation of an
isogeny from its suborder representation.

13

Part I

Theory and algorithms

14

Chapter 1

Preliminaries
In this chapter, we introduce all the necessary mathematical background forthe rest of this work. We try to cover all the relevant material in a brief but
rather complete overview. Our account will only graze the surface of the deep
mathematical subjects upon which we stand, but it should be enough for our
purpose. More often than not, we will favor concrete examples and definitions
to abstract and generic ones. The introduction of the mathematical backgroundfor this work is divided in three main parts. The first and second will be treatedin Section 1.1 and Section 1.2. The last and most important part will be treatedon its own in Chapter 2. We start with Section 1.0.1 to introduce some usefulnotations.

1.0.1

Notations

Below, we describe a list of generic notations and notions that we will use
throughout this work.
• We write O(poly(x)) for a quantity asymptotically upper bounded by apolynomial in x.
• For a field k, we write k, an algebraic closure of k.
• For a field k, we write Pn (k) for the projective space of dimension n. It
is made of the equivalence classes in k n+1 \ {0}n+1 for the equivalence
relation ∼k defined as (x1 : . . . : xn+1 ) ∼k (y1 : . . . : yn+1 ) when xi = λyi
for all i ∈ [1, n + 1] for some λ ∈ k ∗ .
• The set of prime integers is written P and the set of prime divisors of an
integer n is written Pn .
• A B-smooth integer n has all its prime factors smaller than B. The
smallest possible B is called the smoothness bound of n. When B ≪ n,
we will sometimes informally say that n is “smooth”. We usually meanthat the smoothness bound B of n is in O(poly(log(n))) in that case.
• A B-powersmooth number is a number n such that all the prime power
divisors of n are smaller than B. As for smooth number, a number ispowersmooth when B ≪ n.
15• A near-prime integer n is a prime multiplied by a smooth number.
• A negligible function f : Z>0 → R>0 is a function whose growth isbounded by O(x−n ) for all n > 0. In the analysis of a probabilistic
algorithm, we say that an event happens with overwhelming probability if
its probability of failure is a negligible function of the length of the input.
• We will write CRTN1 ,··· ,Nn (x1 , · · · , xn ) for the Chinese Remainder algorithm, that takes xiQ∈ Z/Ni Z for 1 ≤ i ≤ n with all Ni pairwise coprime,nand returns z ∈ Z/( i=1 Ni )Z with z = xi mod Ni for all i ∈ [1, n].
• We write vℓ (n) for the ℓ-adic valuation of an integer n.
• For any prime ℓ ∈ P, Qℓ is the field of ℓ-adic numbers and Zℓ is the ringof ℓ-adic integers.
The local-global principle. We present below a concept that will follow us
throughout this work. What we will call henceforth the local-global principle
is the idea that some objects can be understood by looking at what happens
locally, i.e from the ℓ-adic point of view at every prime ℓ. This was the approach
favored by Deuring in [Deu41] to prove all the results upon which most of ourcontent is built, and we include it in this work in the hope that it will help
provide some insights on the mathematical concepts involved. Our accountof the local-global interpretation is mostly inspired by the 13th chapter in thebook Elliptic Functions of Serge Lang [Lan87] (Lang claims to follow closely thework of Deuring in this chapter) and some content spread throughout the book
Quaternion Algebras by John Voight [Voi21], which are both excellent references
to get a better understanding on the objects treated in this work.

1.1

Elliptic curves and isogenies

In this section, we introduce the main characters of our story: isogenies. However, as in any good story, we need to set the landscape before the hero’s entrance. In Section 1.1.1, we introduce another family of main characters: elliptic
curves, and postpone the formal presentation of isogenies to Section 1.1.2. A
good and accessible reference for the content of this section is the book “TheArithmetic of Elliptic Curves” by J. Silverman [Sil86].

1.1.1

Elliptic curves

Elliptic curves have been studied from various mathematical perspectives overthe long course of their mathematical story, but we are going to stick to themost basic and concrete definitions in this work. We give below, without all thenecessary background, a generic and abstract definition of elliptic curves. We
will explain what an elliptic curve concretely is right after that.
Definition 1.1.1. An elliptic curve over a field k is a smooth projective curveof genus 1 with a distinguished base point defined over k.
For simplicity, we will focus henceforth on fields of characteristic ̸= 2, 3.
What is hiding behind Definition 1.1.1 is that elliptic curves are varieties of16the projective plane, i.e homogeneous polynomials in three variables, that we
usually call the equation of the curve. The points of an elliptic curve E over k,denoted by E(k), are simply the solutions to this equation in k. As we are going
to see, the equations defining elliptic curves have a very specific “shape”. We
use the terminology elliptic curve model to talk about a family of polynomials
defining elliptic curves.
Elliptic curve models. The most classical family are Weierstrass curves.
The Weierstrass model is often considered the canonical way of representing
elliptic curves because every elliptic curve has one.
Definition 1.1.2. A short Weierstrass curve E over k is defined by the equation
E : Y 2 Z = X 3 + aXZ 2 + bZ 3

(1.1.1)

with a, b ∈ k such that ∆ = −16(4a3 + 27b2 ) ̸= 0. The point (0 : 1 : 0) is thepoint at infinity of E and is denoted by 0E .
Even if the Weierstrass model is often used for theoretical results, it is not
the most efficient model for concrete algorithms, in the sense that the operations
are more expensive. In cryptography, the Montgomery or Edwards models are
typical choices for fast implementation. Not every elliptic curve has a rational
Montgomery or an Edward model, and this is why their main interest is forpractical use. We present below Montgomery curves that became popular after
P. Montgomery introduced them in [Mon87] to speed-up Lenstra’s ECM integer
factorization method. Most of the implementations of algorithms introduced inthis thesis are done in the Montgomery model. A good review on Montgomery
curves and the related efficient algorithms can be found at [CS18].
Definition 1.1.3. A Montgomery curve E over k is defined by the equation
E : BY 2 Z = X(X 2 + AXZ + Z 2 )(1.1.2)

with A, B ∈ k such that B ̸= 0 and A2 ̸= 4. The point (0 : 1 : 0) is the point at
infinity of E.
For both models, each point of P ∈ E(k) can be represented by its projective
coordinates (XP : YP : ZP ) ∈ P2 (k). Under the mapping x = X/Z and y =Y /Z, the Weierstrass and Montgomery equations can be simplified to what wecall the affine model of E:
E : y 2 = x3 + ax + b

E : By 2 = x(x2 + Ax + 1)

(1.1.3)(xP , yP ) are the (x, y)-coordinates of the point P . This simplification is welldefined for all the point of E(k), except for 0E that cannot be represented in(x, y)-coordinates. In that case, 0E is considered as an abstract point of E. We
define implicitly the coordinate projection functions x, y for any elliptic curve
E, and will sometimes write x(P ), y(P ).
The group law. If elliptic curves have garnered so much interest from mathematicians and, more recently, from cryptographers, it is partly because theirequation hides a deeper mathematical structure. Indeed, for any field k, it can
17be shown that E(k) is an abelian group of neutral element 0E under a composition law that we write ⊕ and that can be defined by rational maps on the
projective coordinates. We will give concrete examples later in this document(see for instance Section 4.1.3 where we introduce the biquadratic relations between x(P ), x(Q) and x(P ⊕ Q), x(P ⊖ Q)).
Definition 1.1.4. For any ℓ ∈ Z, we write [ℓ] : E(k) → E(k) for the scalarmultiplication-by-ℓ morphism. The kernel of ℓ over k is called the ℓ-torsion
subgroup and is written E[ℓ].
There exists a family of polynomials called the division polynomials andoften denoted by ΨE,ℓ that can be used to define the rational maps for the [ℓ]map. ΨE,ℓ is basically the polynomial whose roots are the x-coordinates of thepoints in E[ℓ] (the exact definition is slightly more complicated, but it is notimportant for us). They can be computed using a simple recurrence relation if
needed.
The structure of E[ℓ] is easy to determine in most cases. By the chineseremainder theorem, it suffices to consider the structure for prime-power ℓ toinfer the result for any ℓ ∈ Z.
Proposition 1.1.5. Let ℓ be the power of a prime.
(
if char(k) = 0 or gcd(ℓ, char(k)) = 1,
∼ Z/ℓZ × Z/ℓZ
E[ℓ] =
Z/ℓZ or {0E } otherwise.

(1.1.4)

When char(k) = p, the two structures Z/pZ and {0E } are possible for E[p].
The former case is called ordinary and the latter supersingular. This distinction has important consequences, and we will see equivalent definitions later in
Section 1.1.2.
From the structure on the ℓ-torsion given by Proposition 1.1.5, we can deduce
various things. For instance, we can count the number of cyclic subgroups oforder ℓ, something that will prove useful.
Proposition 1.1.6. For a prime ℓ ̸= char(k), there are ℓ + 1 cyclic subgroupsof order ℓ. Given a basis P, Q of E[ℓ], these subgroups are in bijection with
P1 (Z/ℓZ) under the map(i, j) 7→ ⟨[i]P + [j]Q⟩(1.1.5)The Tate module. This paragraph is the first occurrence of the local-global
principle that was teased in Section 1.0.1. Let ℓ be a prime number. The idea
is to construct, for the groups E[ℓn ], the analogue of what the ℓ-adic integers
Zℓ are for the groups Z/ℓn Z under the inverse limit lim.
←n

Definition 1.1.7. The (ℓ-adic) Tate module of a curve E is
Tℓ (E) = lim E[ℓn ]←n(1.1.6)

w.r.t the natural maps [ℓ] : E[ℓn+1 ] → E[ℓn ].
More concretely Tℓ (E) is made of all the infinite sequences of points (P1 , . . .)with each Pi ∈ E[ℓi ] and [ℓ]Pi+1 = Pi . The Tate module is a useful abstraction
because it allows us to manipulate all the ℓn -torsion subgroups at once. The
natural corollary of Proposition 1.1.5 is Proposition 1.1.8.
18

Proposition 1.1.8. Let ℓ be the power of a prime.
(
Zℓ × Zℓif char(k) = 0 or gcd(ℓ, char(k)) = 1,∼
Tℓ (E) =Zℓ or {0E } otherwise.

(1.1.7)

Isomorphism class and the j-invariant. One might wonder if all elliptic
curves over k are different, or if some of them are equivalent in some sense. Twocurves E, E ′ are said to be isomorphic over a field k if there exists, between them,a rational isomorphism whose coefficients are defined over k. This creates anequivalence relation on the set of elliptic curves over k. Throughout this work,
we will often consider isomorphism classes of elliptic curves over k and more
often than not when saying “an elliptic curve” we will mean “an isomorphismclass of elliptic curves”.
The j-invariant gives a canonical representative for classes of isomorphic
curves. For Weierstrass and Montgomery curves, this quantity is equal respectively toj(E) = 1728

4a3
4a3 + 27b2

andj(E) =

256(A2 − 3)3
A2 − 4(1.1.8)Proposition 1.1.9. Two curves E, E ′ defined over k are isomorphic over k if
and only if j(E) = j(E ′ ).
Remark 1.1.10. Isogenies, that we introduce next in Section 1.1.2, will provide
another equivalence relation on elliptic curves of which the isomorphic relation
is a specialization, as isomorphisms are in fact isogenies of degree 1.

1.1.2

Isogenies

With isogenies of elliptic curves, we go beyond the consideration of the set of
elliptic curves defined over k as a collection of individual objects.
Definition 1.1.11. An isogeny between two elliptic curves E, E ′ is a nonconstant morphism of projective varieties mapping 0E to 0E ′ .
Similarly to isomorphisms, we say that an isogeny is defined over k if theisogeny can be defined as a rational map whose coefficients are in k. Two curves
E, E ′ are said to be isogenous if there exists an isogeny φ : E → E ′ .
For us, the most important feature of an isogeny is going to be its degree.
We give below the formal definition of the degree, but we will stick to cases
where it can be computed quite simply.
Definition 1.1.12. An isogeny φ : E → E ′ induces an embedding φ∗ : f 7→
f ◦ φ of the function field k(E ′ ) in k(E). The degree of φ is the degree ofthe extension k(E)/φ∗ (k(E ′ )). If this extension is separable (resp. inseparable,
resp. purely inseparable), φ is said to be separable (resp. inseparable, resp. purely
inseparable). In the separable case, we have deg φ = # ker φ.
In characteristic p > 0, the reality behind Definition 1.1.12 is rather simple.
Any isogeny of degree coprime to p is separable, and the only possible purely
inseparable isogenies have degree equal to a power of p. Every isogeny can beseen as the composition of a purely inseparable isogeny and a separable one. For
19

separable isogenies, when ker φ is cyclic, we say that φ is cyclic. Every separable
isogeny is the composition of a scalar multiplication and a cyclic isogeny. In
this work, we will mostly deal with cyclic, separable isogenies. The set of cyclic
separable isogenies (up to post-composition with isomorphisms) of degree D
whose domain has j-invariant equal to j is denoted by isogk (D, j). We stressthat the elements of isogk (D, j) are classes of isogenies, but we often call themsimply “isogenies”. When the field of definition is clear from the context, weomit k and simply write isog(D, j). An isogeny of degree D is sometimes calleda D-isogeny and the curves E and E ′ are said to be D-isogenous.
Kernels and duals. For separable isogenies, there is a strong link between
isogenies and their kernels. For any elliptic curve E, there is a 1-to-1 correspondence between separable isogenies φ : E → E ′ and finite subgroups of E
(defined over k) by associating the subgroup ker φ to the isogeny φ. Conversely,
we writeφ : E → E/Gfor the isogeny whose kernel is G. With Proposition 1.1.6, this correspondence
between isogenies and kernels proves that the number of ℓ-isogenies is exactlyℓ + 1 for any prime ℓ ̸= p. Throughout this work, we will often identify an
isogeny with its kernel, and we will expand upon this relation in Section 4.1.
Definition 1.1.13. For any isogeny φ : E1 → E2 of degree d, there exists a
unique isogeny φ̂ : E2 → E1 of the same degree satisfying φ ◦ φ̂ = [d]. We callφ̂, the dual of φ. When d is coprime to p, we have ker φ̂ = φ(E1 [d]).
It can be easily verified that the dual map, sending φ to φ̂, is an involution.
The existence of the dual proves that the relation of being isogenous is actuallyan equivalence relation. The curves within a same isogeny class share important
properties (see Proposition 1.1.20 for instance). The supersingular curves (seeDefinition 1.1.22) that will be our main object of interest are all in the same
isogeny class.
1.2.1 The structure of the morphisms. With isogenies, we get a collection of morphisms. Next, we see that we have several families of these morphisms
to which we can give a richer structure.
Definition 1.1.14. Let E, E ′ be two elliptic curves defined over k. The set of
isogenies defined over k between E and E ′ (completed with the trivial isogeny
P 7→ 0E ′ ) is written Homk (E, E ′ ). With the addition law φ + ψ : P 7→ φ(P ) ⊕ψ(P ), Hom(E, E ′ ) is a Z-module.
Definition 1.1.15. An endomorphism is an isogeny from a curve to itself. We
write Endk (E) = Homk (E, E) for the set of endomorphisms. Endk (E) is a ringwith the addition from Definition 1.1.14 and the composition operation ◦.
Definition 1.1.16. Automorphisms are endomorphisms of degree 1. We write
Autk (E) for the group (for the composition) of automorphisms defined over k.
Remark 1.1.17. The map m 7→ [m] yields an embedding Z ,→ Endk (E) for
any k and elliptic curve E(k). For a generic field k, the embedding of Z inside
Endk (E) is the only information that we have on Endk (E). For finite fields, thestory is more complex, as we are going to see.
20

When the field k is not specified in Hom, End, Aut, we consider the sets ofmorphisms defined over k. Together with the degree map, the sets Hom(E, E ′ )have a structure of quadratic module. The analysis of the quadratic modules
obtained in this manner can be found in David Kohel’s thesis [Koh96].
Definition 1.1.18. The endomorphism algebra AE of a curve E is End(E)⊗Q.
The study of endomorphism algebras is the first step toward a deeper understanding of the morphism modules of elliptic curves. For instance, it can beproven that two isogenous curves have the same endomorphism algebra. These
objects are at the heart of Proposition 1.1.21 below.

1.1.3

Elliptic curves and isogenies over finite fields.

For all the remainder of this thesis, we fix a prime p > 3 and take k = Fq where
q is a power of p. In that setting, E(k) is a finite group, and we can bound theorder with the Hasse bound.
√
Proposition 1.1.19. |#E(Fq ) − q − 1| ≤ 2 q.
We have also a strong relation between order and isogenies as illustrated by
Proposition 1.1.20.
Proposition 1.1.20. Two elliptic curves E and E ′ defined over Fq satisfy#E(Fq ) = #E ′ (Fq ) if and only if E and E ′ are isogenous over Fq .
The Frobenius morphisms. The pr -power Frobenius isrr

π r : (x, y) 7→ (xp , y p ),(1.1.9)r

it is a morphism of degree pr . For any elliptic curve E, we have π r : E → E prwith E p defined from the equation of E by putting the coefficients to the powerrr
p . Thus, E p = E when E is defined over Fpr . When q > pr , the r-power
Frobenius is a non-trivial isogeny of E and when E is defined over Fpr , π r isa non-trivial element of EndFpr (E). Hence, over finite fields, we almost always
get non-trivial endomorphism rings (i.e., bigger than Z). Sometimes Z[π] is thewhole structure of the endomorphism ring, and sometimes not.
Proposition 1.1.21 lists all the possible structures for End(E). The objects
of Proposition 1.1.21 will be introduced in Section 1.2.2 and we will provide
more insights on Proposition 1.1.21 in Chapter 2.
Proposition 1.1.21. For E an elliptic curve defined over k of characteristicp > 0, End(E) is either:(i) A quadratic order inside the quadratic imaginary field AE .
(ii) A maximal order inside AE , the quaternion algebra ramified at p and ∞.
Supersingular curves. In this thesis, we will focus on curves matching with(ii) in Proposition 1.1.21. We call them supersingular elliptic curves, and they
admit several equivalent definitions.

21

Definition 1.1.22. An elliptic curve E over a field of characteristic p > 0 issupersingular (and ordinary otherwise) if one (all) of the equivalent following
properties is satisfied:(i) Tp (E) = {0}.
(ii) All the πˆr are purely inseparable.
(iii) The map [p] is purely inseparable and j(E) ∈ Fp2 .
(iv) End(E) is a maximal order in a quaternion algebra.
We can specify a bit the number of points of an elliptic curve following[Wat69, Theorem 4.1].
Proposition 1.1.23. If E is a supersingular elliptic curve over Fp2 , then:• k is odd and #E(Fpk ) = pk + 1.
• k is even and #E(Fpk ) = pk + 1, #E(Fpk ) = pk ± pk/2 + 1 or #E(Fpk ) =(pk/2 ± 1)2 .
Henceforth, when we take an elliptic curve E, it can be considered supersingular unless it is explicitly said otherwise. Following Definition 1.1.22, we candefine S(p) as the set of supersingular j-invariants. The fact that S(p) ⊂ Fp2
has several important consequences. First, it proves that every supersingularclass has a compact representative (which is going to be important for the cryptographic applications). Second, it means that S(p) is a finite set. In fact, there
is an exact formula to compute its size that we write Np .
Proposition 1.1.24.

0



1
p
Np = #S(p) = ⌊ ⌋ +

12
1



2

if p = 1 mod 12,
if p = 5 mod 12,
if p = 7 mod 12,
if p = 11 mod 12,(1.1.10)When E is defined over Fp , the Frobenius is an endomorphism of E. When
E is defined purely over Fp2 , we get that the Frobenius is an isogeny π : E → E p
where j(E p ) = j(E)p . The two curves E and E p share a powerful connection.
For instance, we have that End(E) ∼= End(E p ). It follows from S(p) ⊂ Fp2 ,that exponentiation by p is an involution on S(p). Sometimes, it will be usefulfor us to consider S(p)/π rather than S(p).
One of the numerous interesting properties of supersingular elliptic curves
is that they all lie in the same isogeny class. Moreover, we can restrict to ℓe isogenies and still get the same result. This is formalized in Proposition 1.1.25.
Proposition 1.1.25. Let E1 , E2 be two supersingular elliptic curves, and letℓ ̸= p be a prime. There exists a cyclic separable ℓe -isogeny φ : E1 → E2 forsome exponent e ∈ N.
Remark 1.1.26. Proving Proposition 1.1.25 can be done by looking at the numbers represented by the quadratic module associated to Hom(E1 , E2 ) with the22degree quadratic form. This is what is done, for instance, in David Kohel’s thesis [Koh96, Chapter 7]. We have the estimate e = O(log(p)) for the exponent
in Proposition 1.1.25. This can be also interpreted in terms of diameter of thesupersingular ℓ-isogeny graph that we will introduce next.
S
We define isog(D) = j∈S(p) isog(D, j). The language of isogenous curves
that we define below will be at the heart of our study in Chapter 4 where weare going to be interested in ways to prove membership to Lisog , i.e. show that
two supersingular curves are D-isogenous.
Definition 1.1.27. The language of isogenous supersingular curves is
Lisog = {(D, E1 , E2 ) ∈ N × S(p) | ∃ φ : E1 → E2 ∈ isog(D)}.
The graph of supersingular ℓ-isogenies. The graph structure induced byℓ-isogenies on supersingular elliptic curves is a useful representation.
Definition 1.1.28. Let Gpℓ be the graph whose vertices are the supersingularj-invariants over Fp2 and whose edges are the ℓ-isogenies. We call Gpℓ the graphof supersingular ℓ-isogenies.
Since S(p) ⊂ Fp2 , Gpℓ is finite. It is also undirected because each isogeny has
a dual. Proposition 1.1.25 proves that Gpℓ is fully connected, and the number ofcyclic ℓ-isogenies proves that it is ℓ + 1-regular.
Proposition 1.1.29. Gpℓ has the Ramanujan property, i.e., the second-largest√
eigenvalue in absolute value of its adjacency matrix is smaller than 2 ℓ.
Proposition 1.1.29 was proven by Pizer in [Piz90], it is a consequence of
the Riemann hypothesis for function fields proven by Deligne. We will give
more details on that topic in Section 2.4.3. It implies that Gpℓ is an expandergraph family as p → ∞. Concretely, this means that it is fast mixing: at theend of a random walk of length O(log(#Gpℓ )), we get a vertex distributed as a
uniformly random vertex. This property is why expander graphs are known as
good candidates to build hash functions. Charles, Goren and Lauter [CLG09]
used Gpℓ to build a cryptographic hash function whose security is based on thehardness of finding a path between two vertex of Gpℓ . Their work opened theway to all the applications that we will present in Part II.
Isogeny decomposition
Qn and isogeny commutative diagrams. Any isogeny φ of degree D = i=1 di where all the di are (non-necessarily coprime)
integers can be decomposed as φ = φn ◦ · · · ◦ φ1 where each φi has degree di .
If we assume that the di are pairwise coprime, each reordering of the di willlead to a different set of isogenies. We illustrate this principle in Figure 1.1
for n = 2. There are two possibilities in that case. We will use abundantly
the type of commutative diagrams depicted in Figure 1.1 throughout this thesis
and call them isogeny diagrams. We also introduce specific notations for theisogenies involved in the two possible decomposition. Let d1 , d2 be two coprime
integers and φ a d1 d2 -isogeny. We can write φ = ψ2 ◦ φ1 = ψ1 ◦ φ2 and it canbe verified that ker ψ1 = φ2 (ker φ2 ) and conversely for ψ2 . Alternatively, thesame isogeny diagram can be defined from φ1 and φ2 . In that case, we call ψ1
the push-forward of φ1 through φ2 and use the notation ψ1 = [φ2 ]∗ φ1 . We canalso see φ1 as the pull-back of ψ1 by φ2 (which, up to isomorphism, is the sameas the push-forward through φ̂2 ) and we write it φ1 = [φ2 ]∗ ψ1 = [φ̂2 ]∗ ψ1 .
23

φ1

E1

ψ2 = [φ1 ]∗ φ2

φ

E0
φ2

E2

E3
ψ1 = [φ2 ]∗ φ1

Figure 1.1: A commutative isogeny diagram.

1.2

Quadratic imaginary fields and quaternion
algebras, orders and ideals

In this section, we study integral rings in imaginary Q-algebras and their ideals.
We are mostly interested in quaternion algebras, but we start with the simpler
case of quadratic imaginary fields, as a warm-up. They will also play their partin our story. Throughout our small introduction, we will try to highlight thesimilarities and differences between the two cases.

1.2.1

Quadratic imaginary fields

A good reference for the content of this section and the link with elliptic curves
is the book “Primes of the form x2 + ny 2 ” by D.A Cox [Cox11]. √A quadratic
imaginary field K is a quadratic extension of Q of the form K = Q( −d) whered ∈ N∗ is a square-free integer.
Definition 1.2.1. The discriminant of K is(−dwhen d = 3
disc(K) =−4d otherwise.

mod 4(1.2.1)

We sometimes write ∆ for disc(K). The discriminant of a quadratic imaginary field is called a fundamental discriminant. We write ω for the distinguishedelement in K satisfying ω 2 = −d and ⟨1, ω⟩ is a basis of K. The canonical involution sends an element α = a + ωb to its conjugate α = a − ωb. We can define
the norm and trace of elements with n(α) = αα and tr(α) = α + α. The norm
is multiplicative.
Quadratic orders and ideals. An element α is said to be integral whenn(α), tr(α) ∈ Z. The study of integral elements is one of the original motivations
behind the interest in imaginary quadratic fields, and it cannot be done withoutlooking at orders and ideals inside K.
Definition 1.2.2. A fractional ideal of K is a Z-module of rank 2 contained in
K. An order is a fractional ideal that is also a subring of K.
We denote by n(I) the norm of I, defined as the Z-module generated by thenorms of the elements of I. Given fractional ideals I and J, if J ⊆ I, then theindex [I : J] is defined to be the order of the finite quotient group I/J.
It can be verified that orders of K contain only integral elements. They
can be written as O = Z[α] for some element α that we call the generator.
24

The discriminant of O is the discriminant of the minimal polynomial of α, it
is disc(O) = tr(α)2 − 4n(α). Sometimes we also use the notation ∆(α). A
maximal order is one that is not contained in any superorder. In any quadratic
imaginary fields, there is only one maximal order, it is called the ring of integersof K, and it contains all the integral
elements of K. It can be described with the√generic formula OK = Z[(∆ + ∆)/2] and it has discriminant equal to disc(K).
Any other quadratic order in K can be decomposed as O = Z + f (O)OK wheref (O) ∈ N is the conductor of O. The conductor is also equal to the index[O : OK ], and we have disc(O) = f (O)2 disc(K).
The integral ideals of K are the ideals of the orders of K (according to theusual definition of an ideal in a ring). For integral ideals, we can define thenorm of an ideal as the gcd of the norm of its elements. Quadratic orders are
Dedekind domains, and so their ideals have a unique factorization into a productof prime ideals.
Definition 1.2.3. A prime number ℓ is inert in O when ℓO is a prime ideal.
It is split if ℓO = ll and ramified if ℓO = l2 where l is a prime ideal of norm ℓ.
Proposition 1.2.4 shows that we can determine if a prime is split, inert or
ramified with the Kronecker symbol, which agrees with the Legendre symbol
when it is defined.
Proposition 1.2.4.


−d
ℓ





1
= 0


−1

⇔ ℓ is split,⇔ ℓ is ramified,⇔ ℓ is inert.

(1.2.2)

An ideal of a quadratic order O is principal if it is generated by one elementα ∈ O (and is written Oα).
The set of O-ideals quotiented by the principal ideals is an abelian group
Cl(O) that we call the class group of O. The class number is h(O) = #Cl(O).
Under GRH, Littlewood [Lit28] proved the inequality√π∆h(O) > (+ o(1))(1.2.3)γ
12elog log(∆)
where γ is the Euler-Mascheroni constant with eγ /π ≈ 0.56693.

1.2.2

Quaternion algebras

The book “Quaternion Algebras” by John Voight [Voi21] is the definitive reference on the content of this section. The book of Marie-France Vignéras [Vig06]
also covers most of the necessary notions. Quaternion algebras are basicallytwo quadratic imaginary fields glued together in a non-commutative manner.
In particular, there is an infinity of quadratic imaginary fields embedded inside
any given quaternion algebra, and we will see that most of the notions andproperties introduced in Section 1.2.1 can be translated one way or another inthe setting of quaternions.
Definition 1.2.5. Let K be a field. A K-algebra B is a quaternion algebra if
there exists a, b ∈ K ∗ such that B is the K-vector space with basis {1, i, j, k}25satisfying the multiplication rules i2 = a, j 2 = b, k = ij = −ji. In that case,we write H(a, b) for B.
There are two possibilities for a quaternion algebra B over a field K. Either
it is isomorphic to M2 (K) or it is a division ring (sometimes called a skewfield ).
We are mainly interested in quaternion algebras over Q, where the two elementsa, b are negative integers. In that case, the quaternion algebra H(a, b) is said
to be definite. Henceforth, we restrict to that case for ease of exposition. By
the local-global principle, a quaternion algebra B over Q is uniquely identified
by its completions Bν = B ⊗ Qν where ν ranges over the places of Q (so it iseither a prime or the infinite place and Qν = R). We say that B is split at ν if
Bν ∼= M2 (Qν ) and ramified otherwise. The product of the finite ramified places
is called the discriminant of B. Given what we just explained, a complete studyof a quaternion algebra over Q cannot really be led without understanding its
completions over the local fields Zℓ . Quaternion algebras over local fields is asubject of its own, and we will only catch glances of it through the local-global
interpretation.
In this manuscript, we will focus on the quaternion algebra Bp,∞ ramified
at p ∈ P and ∞ (where the prime p will coincide with the characteristic of thefinite fields we consider for our elliptic curves and isogenies). The fact that thecompletion Bp,∞ ⊗ Qℓ is isomorphic to M2 (Qℓ ) for all the primes ℓ ̸= p will
have its importance in our local-global principle interpretation of the Deuringcorrespondence (see Chapter 2). For what follows, we fix our quaternion algebra
as Bp,∞ , even if most of what we present remains true for a generic quaternion
algebra under small modifications.
As in the quadratic case, every quaternion algebra has a canonical involutionthat sends an element α = a1 + a2 i + a3 j + a4 k to its conjugate α = a1 − a2 i −a3 j − a4 k. We can define norm and traces from the conjugation in the samemanner as in the quadratic case. Integral elements have integral norm and trace.
This norm is multiplicative, and the induced inner product(α, β) 7→11(n(α + β) − n(α) − n(β)) = tr(αβ)
22(1.2.4)is positive definite with orthogonal basis {1, i, j, k}. A consequence of that fact
is that any element α ∈ Bp,∞ satisfies ∆(α) ≤ 0 and so Q(α) is either Q or aquadratic imaginary field.
Quaternion orders and ideals. The definition of quaternion orders andideals is the analogue of the definition in the quadratic case.
Definition 1.2.6. A lattice of Bp,∞ is a Z-submodule of rank 4. An order is alattice that is also a subring of Bp,∞ .
Following the parallelism between Definition 1.2.2 and Definition 1.2.6, we
can define norms of ideals and indexes in the samep manner as in Section 1.2.1.
The discriminant of O is defined as disc(O) = | det((αi , αj ))|i,j∈{1,2,3,4} givena basis ⟨α1 , α2 , α3 , α4 ⟩ of O; disc(O) ∈ Z and is independent of a choice of basis.
An order is called maximal when it is not contained in any other strictly larger
order. In Bp,∞ , the discriminant of the maximal orders is always equal to p.
When O′ ⊂ O is a suborder of O, the index [O : O′ ] is defined as the ideal26

generated by #O′ /O. Let us write N = [O : O′ ], then the discriminant of O′
satisfies disc(O′ ) = N 2 disc(O). We have O′ = O, if and only if N = 1.
The local-global principle tells us that orders can be understood throughtheir completions at the finite places Oℓ = O ⊗ Zℓ where ℓ | disc(O). Eachcoprime ℓ can be considered independently.
The classification of quaternion orders. The similarities between thequadratic case and the quaternion case, stops at the basic definitions. We
saw in the quadratic case that the hierarchy of quadratic orders is fairly simple
to understand. The fact that we go from dimension 2 to 4 and that quaternion algebras are non-commutative explain that the story is much richer withquaternions.
A first example of this complexity is that we have an infinity of non-trivial∗
isomorphisms indexed by the elements α ∈ Bp,∞
with ια : β 7→ αβα−1 . In
fact, it can be shown that all isomorphisms are of this form (as a consequenceof the Skolem-Noether Theorem). This means that two distinct orders can be
isomorphic, and this is what motivates to introduce the notion of types.
Definition 1.2.7. The type of an order O written Typ O is the isomorphismclass of O.
In the Deuring correspondence, we will often work with types of orders
rather than orders directly. Apart from maximal orders, a class of order thatwill be of great importance to us are Eichler orders. They can be defined as
the intersection of two maximal orders (not necessarily distinct). The level ofan Eichler order is equal to disc(O)/p in our case. A maximal order is simply
an Eichler order of level 1. When the level of an Eichler order is square-free, it
is sometimes said to be hereditary. This distinction will not really matter to us,
so we will not develop upon what makes hereditary orders different. When ℓeis the biggest power of ℓ dividing the level of O, we have that Oℓ is an Eichler
order of level ℓe in M2 (Qℓ ) and we know thatOℓ ∼(1.2.5)= ℓeZZℓ ℓ ZZℓℓ
Eichler orders have been studied extensively in the literature on quaternion
algebras [Eic38, Piz80].
There is an analogue notion of conductor for quaternion orders, but it is nottied to maximal orders as in the quadratic case.
Proposition 1.2.8. [Voi21, Proposition 24.2.15] Every quaternion order O
admits the unique decomposition Z + f (O) Gor O where f (O) ∈ N and Gor O is
another quaternion order.
Definition 1.2.9. For every order O, we call conductor, or Brandt Invariant,the integer f (O) from Proposition 1.2.8. The order Gor O from the same result
is called the Gorenstein saturation of O.
For this work, it will be sufficient to define Gorenstein orders as the orders
O with f (O) = 1. There is a more generic definition using the codifferent, but
we will not use it here. As the name and definition suggest, Gor O is always a
Gorenstein order.

27

An order is Bass when all its superorders are Gorenstein. Equivalently,
Bass orders of Bp,∞ are the orders containing a maximal order of a quadratic
imaginary field (this was originally the definition of basic orders, but the two
notions were proven equivalent by Chari, Smertnig, and Voight in [CSV21]).
We have a chain of proper implication between all these notions of quaternion
ordersmaximal ⇒ Eichler ⇒ Bass ⇒ Gorenstein.
The Eichler symbol. A very useful tool to understand the structure of aquaternion order using the local-global principle is the Eichler symbol. It was
introduced by Eichler in [Eic36]. Let us write Fℓ for the residue field of Qℓ and
J for the Jacobson radical of Oℓ . Then, we define the Eichler symbol as follows:= M2 (Fℓ ),⋆ if Oℓ /J ∼  
1 if O /J ∼ F × F ,
O
= ℓ
ℓ
ℓ
=
(1.2.6)
∼

ℓ
0
if
O
/J
F
,
=
ℓ
ℓ



−1 if Oℓ /J is a quadratic extension of Fℓ .
The Eichler symbol can be seen as a generalization of the Kronecker symbol,
as becomes explicit with the reinterpretation presented as Proposition 1.2.10.
We recall that for any α, we write ∆(α) = disc(Z[α]) = tr(α)2 − 4n(α).
 Proposition 1.2.10. Oℓ = ϵ for ϵ ∈ {−1, 0, 1} if and only if ∆(α)
takesℓ
all the values 0, ε when α ranges over all the elements of O.
Definition 1.2.11.


O
ℓ





1
= 0


−1

⇔ ℓ is residually split in O,⇔ ℓ is residually ramified in O,⇔ ℓ is residually inert in O.

(1.2.7)The Eichler symbol has numerous ties with the various notions of orders
we introduced. For instance, the order Oℓ is Eichler in M2 (Qℓ ) if and only if(O/ℓ) = 1.
More on quaternion ideals. The two notions of orders and ideals can betied together by the right and left orders of an ideal.
Definition 1.2.12. Let I be a lattice in Bp,∞ . We define the left order of I tobe:
OL (I) = {α ∈ Bp,∞ | αI ⊂ I},(1.2.8)and similarly for the right order OR (I). We say that I is a left fractional
OL (I)-ideal (resp. right OR (I)) and that I is a connecting ideal for OL (I) andOR (I).
A fractional ideal is integral if it is contained in its left order, or equivalently
in its right order. Since we will deal almost exclusively with integral ideals,
we refer to them hereafter as ideals. Most of the time, in this manuscript,
we will consider ideals of maximal orders, but we will have the time to makelittle detours for ideals in other orders. When O is a Bass order, O-ideals are28

generated by two elements. In this work, we will always consider the case where
I is locally principal. In this case, we can take one of the generator to be thenorm of I and so we have I = OL (I)α + OL (I)n(I). We simplify the notation
by writing Oα + ON = O⟨α, N ⟩ for any order O and N ∈ N. Among integral
ideals, we are mainly interested in cyclic ideals that we introduce next. Thisterminology is not really standard but we use it to highlight the parallelism withisogenies.
Definition 1.2.13. Let I be an integral left O-ideal for some order O. We saythat I is cyclic if for all prime ℓ we have that I ̸⊂ ℓO.
Cyclic ideals as we define them in Definition 1.2.13 are usually called primitive (and cyclic is used for a different notion) but we use that notation tohighlight the link with isogenies. When the order O in Definition 1.2.13 is Bass,
we have that there exists an element α ∈ O with gcd(n(α), n(I)2 ) = n(I) andI = ⟨α, n(I)⟩.
Quaternion ideal multiplication. In our setting, the product of ideals I, J
is only defined when OR (I) = OL (J). In that case, IJ is the ideal generated
by the products of pairs in I × J. It follows that IJ is also an (integral) ideal
and OL (IJ) = OL (I) and OR (IJ) = OR (J). The ideal norm is multiplicativewith respect to ideal products. An ideal I is invertible if there exists anotherideal I −1 verifying II −1 = OL (I) = OR (I −1 ) and I −1 I = OR (I) = OL (I −1 ).
The conjugate of an ideal I is the set of conjugates of elements of I, which is an
ideal satisfying OL (I) = OR (I) (and conversely). When I is invertible, we also
have II = n(I)OL (I) and II = n(I)OR (I) and we can get the multiplicative
inverse of I as1
I −1 =In(I)
Note that invertibility is not a feature of every O-ideal when O is generic, but
we will see mostly examples where ideals are invertible. In fact the invertible
ideals are exactly the locally principle ideals.
Henceforth, we arbitrarily choose to focus on left O-ideals (the situation isperfectly symmetric in any case, and we can switch from left O-ideals to rightO-ideals by considering the conjugates). Even though we are mostly interested
in these one-sided ideals, the existence of two-sided O-ideals is also worth mentioning. One fact in particular is going to be useful for us: given a maximal
order O in Bp,∞ , there is a unique two-sided ideal π of norm p. Note that
this ideal is not necessarily principal. Moreover, π and its powers are the only
integral O-ideals of norm a power of p. Every ideal I of norm pr N where N is
coprime to p admits the factorization I = π r I ′ .
Ideal class set. We define an equivalence relation ∼ on left O-ideals by rightscalar multiplication. So we have that I ∼ J for two left O-ideals I and J if⋆
there exists β ∈ Bp,∞
, such that I = Jβ.
×Definition 1.2.14. For any invertible ideal J and any β ∈ Bp,∞
, we writeχJ (β) = J

29

β
.
n(J)

(1.2.9)Ideals equivalent to J are precisely the ideals χJ (β) with β ∈ J \ {0} and wewill make an explicit use of the χ map in Chapter 3. If I = Jβ, then it follows
that OR (I) and OR (J) are in the same type, and we have OR (I) = β −1 OR (J)β.
Remark 1.2.15. Note that the converse is not true. For two left O-ideals I, J, if
OR (I) ∼= OR (J), then I is not necessarily equivalent to J (due to the possible
existence of a non-principal two-sided ideal of norm p).
For a given O, we can define equivalence classes of left O-ideals, and wedenote the set of such classes by Cl(O). The property above implies that eachclass of Cl(O) corresponds to a single type of orders.
Definition 1.2.16. Two orders O1 , O2 are connected if there exists an invertible
ideal I with OR (I) = O1 and OL (I) = O2 . The genus of an order O is noted
Gen O and it is made of all the orders connected to O.
By taking the conjugate ideals, we get that Gen O′ = Gen O iff O′ ∈ Gen(O).
Interestingly enough, grouping orders by genera agrees with the classification oforders that we have introduced above. This means that locally, the orders inthe same genus are isomorphic and conversely, that orders that are isomorphic
locally are in the same genus. For instance, this means that maximal orders
are all contained in the same genus. Similarly, we get that all orders O of
discriminant pℓe where Oℓ is an Eichler order of M2 (Qℓ ) of level ℓe are in thesame genus.
Given two orders O1 , O2 in the same genus, the ideal I(O1 , O2 ) connecting O1 , O2 is well-defined up to scalar multiplication and multiplication by a
two-sided ideal. If we look at integral ideals, we can define I(O1 , O2 ) as the connecting integral ideal with the smallest norm. It is easily verified that I(O1 , O2 )is cyclic. Henceforth, we will keep this definition and call I(O1 , O2 ) the connecting ideal of O1 and O2 .
Remark 1.2.17. Note that if O2 ∼= O2′ (but they are not equal), the connecting
ideals I = I(O1 , O2 ) and J = I(O1 , O2′ ) may be equivalent but will not be
equal.
Embedding of orders. Another aspect where quaternion orders offer much
more complexity than quadratic orders is the one of embedding.
Definition 1.2.18. Given two orders O, O′ , we say that O is embedded inside O′
if there exists an injective morphism ι : O ,→ O′ . We call ι an embedding and saythat ι is optimal if there does not exist any O′′ ⊂ O′ such that ι(O) = Z + DO′′for some integer D > 1.
Remark 1.2.19. Definition 1.2.18 also works if O is a quadratic order and O′
is a quaternion order. For instance, it agrees with the definition of optimal
embedding given in [LB20]. We will talk more about embeddings of quadraticorders inside quaternion orders in Section 2.4.
In particular, we are interested in the embedding number of quaternion orders.
Definition 1.2.20. Let O be a quaternion order in Bp,∞ . The embedding
number e(O) of O is the number of distinct maximal orders in which O is
optimally embedded.
30

Eichler and Brzezinski [EB92, Brz83] studied embedding numbers of Bassorders, and their results were recently used in [EHL+ 20] to estimate the complexity of an algorithm to compute the endomorphism ring of a supersingularcurve that we will briefly present in Section 2.2.1. We will also use their results in Section 2.4 and we give a brief summary of it in the remainder of thisparagraph. We will talk about optimal embeddings of non-Gorenstein orders in
Section 2.3.2.
In the rest of this paragraph, we fix a Bass order O of discriminant D. It
turns out that e(O) can be
Qcomputed efficiently using the local-global principlewith the formula e(O) = ℓ∈P eℓ (O) where eℓ (O) is the analogue of e(O) overthe ℓ-adics: eℓ (O) is the embedding number of Oℓ inside Bp,∞ ⊗ Qℓ . An easy
preliminary observation is that, eℓ (O) = Q
1 when ℓ is coprime to D. Thus, we
can rewrite the above formula as e(O) = ℓ∈PD eℓ (O). The value of eℓ (O) is infact closely related to the Eichler symbol (O/ℓ).
Then, it was shown by Eichler in [Eic36] (see [Brz83] for an account inEnglish of this result) how the value of the Eichler symbol was linked to eℓ (O).
Proposition 1.2.21. [Voi21] Let O be a Bass order in Bp,∞ of discriminant
D and ℓ ∈ PD :
if (O/ℓ) = 1,vℓ (D) + 1
if (O/ℓ) = 0 and ℓ ̸= p,eℓ (O) = 21
if (O/ℓ) = −1 or (O/ℓ) = 0 and ℓ = p .
Remark 1.2.22. Note that ep (O) is always equal to 1. This follows from Proposition 1.2.21 and the fact that (O/p) cannot be 1.

31

Chapter 2

The DeuringcorrespondenceThis chapter is dedicated to the study of the Deuring correspondence froma theoretical point of view. Our goal is to provide a slightly informal but
complete account of this topic, from the most fundamental theorems to themore evolved and recent results that will underlie several of the contributions
introduced later in this thesis. We will cover quickly the standard material
in Section 2.1, providing only statements and intuitions, to focus on the moreadvanced developments that will be exposed in Section 2.3. We claim no novelty
in this section but precise proofs and statements for these results cannot reallybe considered standard (at least we are not aware of any other similar accountin the literature) and our goal is thus to provide hereafter a complete reference.
The content of Section 2.3 was introduced partly in [DFKL+ 20] and partly in[Ler21]. We also cover some algorithmic aspects of the Deuring correspondence
in Section 2.2. Finally, in Section 2.4, we study the role of quadratic orders in
the Deuring correspondence and prove some results on the number of curves
admitting an embedding of a given quadratic order inside its endomorphismring that were first presented in [Ler22].
For the remainder of this manuscript, we take the setting of supersingularelliptic curves over Fp2 for a fixed prime p > 3.

2.1

An equivalence of category in three acts

In this section, we conclude our mathematical preliminaries by tying together
supersingular curves and quaternion orders in the powerful result presented in
Theorem 2.1.8, and that we call the Deuring correspondence.

2.1.1

Endomorphism algebra and endomorphism rings,
where it all begins

Let E be an elliptic curve defined over K a field of prime characteristic p.
Throughout this work, unless said otherwise, we always consider the endomorphism ring over K and we write it End(E). In this section, we return to Proposition 1.1.21 by listing the possibilities for End(E) as either an order in a quadratic
32

imaginary field or a maximal order in a quaternion algebra. We will not provide
a full proof, but will outline the reasoning and try to provide some insights.
The first step is to understand the endomorphism algebra AE = End(E) ⊗ Q(Definition 1.1.18). The existence and properties of the involution given by thedual map implies that every element in AE must have a minimal polynomialof degree at most 2 given by X 2 − tr(θ)X + n(θ) for any element θ. Since thequadratic form x, y 7→ n(x + θy) = x2 + xy tr(θ) + y 2 n(θ) is positive definite, wemust have that AE is either a quadratic imaginary field or a definite quaternion
algebra.
When we are in the quaternion algebra case, we get a natural isomorphism
between the ℓ-adic endomorphism algebras End(E)ℓ = End(E) ⊗ Qℓ and theendomorphism algebra of the Tate module Qℓ ⊗ End(Tℓ (E)). From Proposition 1.1.8, we get that End(Tℓ (E)) must be equal to M2 (Zℓ ) when ℓ is coprime
to p and this proves that all ℓ coprime to p are split in AE and this suffices toconclude that we must have AE ∼= Bp,∞ . To see that End(E) is a maximal orderof Bp,∞ , we need to prove it locally, which is true by restricting the previous
isomorphism to the tensor product with Zℓ for all ℓ ̸= p. Maximality locally at
p is slightly more subtle to prove, and we will not explain it here.
Seeing that the quaternion algebra case appears if and only all the otherequivalent definition of supersingular curves (see Definition 1.1.22) are satisfied
is also quite subtle and we refer the reader to [Sil86, Chapter 5].
A Concrete example : j-invariant 1728. We give below an example of acurve E0 with a concrete isomorphism between End(E0 ) and a maximal orderin Bp,∞ . Let p = 3 mod 4, and let E0 be the curve of j-invariant 1728, definedover Fp2 by y 2 = x3 + x. The endomorphism ring of this curve is isomorphic
1+k
2
2
to the maximal order O0 = ⟨1, i, i+j
2 , 2 ⟩ with i = −1, j = −p and k =ij. Moreover, we have explicit endomorphisms π and ι such that End(E0 ) =1+ιπ⟨1, ι, ι+ππ is the Frobenius morphism (x, y) 7→ (xp , y p ) and ι is
2 , 2 ⟩, where√
the map (x, y) 7→ (−x, −1y). If we restrict to the endomorphisms defined overFp , we get the quadratic order Z[π]. We will often use the curve E0 throughout
this thesis. When p = 7 mod 12, E0 is the special extremal curve over Fp2 (seeDefinition 3.1.1 in Chapter 3).

2.1.2

Kernel ideals, the main development

Proposition 1.1.21 is the first building block of the equivalence of categories that
we call the Deuring correspondence, as it ties endomorphism rings of supersingular curves (and so supersingular j-invariants up to Galois conjugacy) withtypes of maximal orders in Bp,∞ . A deeper and richer link between supersingular isogenies and ideals of maximal orders appears when we consider the fullfamily of homomorphism modules. This is not surprising, as for any supersingular E, E ′ we can prove that Hom(E, E ′ ) is a rank 4 Z-module in a manner
analogous to the method briefly outlined in Section 2.1.1. Before getting to
the final result in Section 2.1.3, we introduce the notion of kernel ideals. These
ideals are isomorphic to our homomorphism modules as we prove in Proposition 2.1.6 and they provide an effective method to go from ideals to isogenies(and the converse) as we will see in Chapter 4. The results given in this section
will be used as an informal proof of Theorem 2.1.8. Good references on kernel

33ideals are the Chapter 3 of an article by Waterhouse [Wat69] and the Chapter
42 of John Voight’s book [Voi21]. Proofs for the result we present below canalso be found there.
Definition 2.1.1. Let k be a field and E/k an elliptic curve. For any finite
subgroup G ⊂ E, we define its kernel ideal
I(G) = {α ∈ End(E), α(G) = 0}.

(2.1.1)

When G = ker φ, for some separable isogeny φ, we write I(ker φ) = Iφ .
Proposition 2.1.2. For any supersingular elliptic curve E and finite subgroup G ⊂ E, the kernel ideal I(G) is a left End(E)-ideal of norm #G and
OR (I(G)) ∼= End(E/G). When G is cyclic, I(G) is cyclic (see Definition 1.2.13).
With Proposition 2.1.2, we see how to get left ideals of maximal orders
from separable isogenies. We will treat inseparable isogenies after we show
the dual construction of getting a separable isogeny from an ideal. Under theidentification between isogenies and kernels, we define the kernel of an ideal.
Definition 2.1.3. Let k be a field and E/k an elliptic curve. Let I be an
integral End(E)-ideal of norm coprime to p. The kernel of the ideal I is definedasE[I] = {P ∈ E : α(P ) = 0 for all α ∈ I}.
(2.1.2)We then write φI : E → E/E[I].
Naturally, the two notions that we introduced are dual of one another.
Proposition 2.1.4. For any integral left End(E)-ideal, the set of points E[I]is a finite subgroup of order n(I). Moreover, we have that I(E[I]) = I andE[I(G)] = G for any finite subgroup G.
We now have an explicit correspondence between ideals and subgroups, andby extension a correspondence between ideals and separable isogenies. We can
extend this to inseparable isogenies by identifying the unique two-sided End(E)ideal of norm p (and its powers) to the Frobenius morphism of E (and its
powers). We remind the reader that since we consider isogenies over Fp2 , theFrobenius is not always an endomorphism. This is consistent with the fact thatthe two-sided ideal of norm p is not always principal.
With that last idea, we obtain a complete correspondence between supersingular isogenies and integral ideals. There are several other notions that agree
under this correspondence as shown in Proposition 2.1.5.
Proposition 2.1.5. Let φ : E → E ′ be an isogeny. We have Iφ̂ = Iφ . If φ isan endomorphism, then I is a principal ideal.
If ψ : E ′ → E ′′ is another isogeny, then Iψ◦φ = Iφ Iψ .
The results above imply that for a maximal order O in Bp,∞ , the set Cl(O)is in bijection with S(p). One of the consequences is that equivalent ideals
correspond to isogenies with isomorphic domains and codomains. We will makegood use of that fact in the second part of this thesis.
We now give another way of looking at kernel ideals that gives a better
understanding of their structure.
34

E1

φ1

ψ2 = [φ1 ]∗ φ2

φ

E0
φ2

E2

E3
ψ1 = [φ2 ]∗ φ1

Figure 2.1: A commutative isogeny diagram.
Proposition 2.1.6. Let φ : E → E ′ be an isogeny, the kernel ideal Iφ isisomorphic to Hom(E ′ , E)φ .
The notions of pushforward and pullback isogenies as defined in Section 1.1.2
can be translated to ideals under our correspondence. To highlight the parallelism, we write [I]∗ J for the ideal I[φJ ]∗ φI and call it the pushforward of J
through I. The same holds for [I]∗ J. With this convention, we extend theterms pushforward and pullback to ideals. Next, we describe formulas to compute [I]∗ J and [I]∗ J from I and J.
We take the notations of Figure 1.1 that we recall below as Figure 2.1 withthe corresponding notations for ideals, and write I1 = Iφ1 of norm N1 , I2 = Iφ2
of norm N2 , J1 = [I2 ]∗ I1 , J2 = [I1 ]∗ I2 and K = Iφ .
Lemma 2.1.7. If N1 ∧ N2 = 1, the three ideals J1 , J2 and K are well-definedand :(i) K = I1 ∩ I2 .
(ii) J2 = I1−1 (I1 ∩ I2 ) and J1 = I2−1 (I1 ∩ I2 ).
(iii) I2 = [I1 ]∗ J2 = I1 J2 + N2 O0 and I1 = I2 J1 + N1 O0 .
Proof. When N1 ∧ N2 = 1 the situation depicted in Figure 2.1 and the pushforward and pullback isogenies are well-defined and so are the corresponding ideals.
By definition of φ we have ker φ = ker φ1 + ker φ2 , (i) follows from the definition of kernel ideals. The composition of isogenies can be rewritten in termsof ideals as K = I1 J2 = I2 J1 , this together with (i) implies (ii). The equality[I1 ]∗ J2 = I1 J2 + N2 O0 of (iii) is a classical formula to decompose an ideal ofnorm N1 N2 with coprime N1 , N2 . For instance, it is used in [GPS17, EHL+ 18].
The fact I2 = [I1 ]∗ J2 stems from I2 = [I1 ]∗ [I1 ]∗ I2 . The formula for I1 follows
similarly.

2.1.3

The conclusion

In this section, we state the formal equivalence of categories. For that, we needto fix a supersingular curve E0 and a maximal order O0 , isomorphic to theendomorphism ring of E0 .
Theorem 2.1.8. The association
E 7→ Hom(E, E0 )φ 7→ φ∗35

where φ ∈ Hom(E, E ′ ) andφ∗ : Hom(E ′ , E0 ) −→ Hom(E, E0 )
ψ 7−→ψ ◦ φ
is functorial and defines an equivalence of categories between
supersingular j-invariants over Fp2 , under isogenies
andinvertible left O0 -modules, under left O0 -modules homomorphisms.
Theorem 2.1.8 follows from the results from Section 2.1.2. A detailed proof
can be found in [Voi18, Chapter 42, Theorem 42.3.2].
Note that the functor introduced in Theorem 2.1.8 is rather a theoreticalobject that we will not use in practice. In the remainder of this work, what
we call “the Deuring correspondence” is an implicit dictionary between theobjects in the world of elliptic curves and the objects in the world of quaternion
algebras. This dictionary sends a supersingular j-invariant to the type of its
endomorphism ring in Bp,∞ and a supersingular isogeny to its kernel ideal (upto isomorphisms between left and right orders). While not exactly functorial,
this correspondence is bijective. We summarize in Table 2.1 the main featuresof this association. We include some of the results that will be presented in
Section 2.3.
Supersingular j-invariants over Fp2
j(E) (up to Galois conjugacy)(E1 , φ) with φ : E → E1
θ ∈ End(E0 )deg(φ)
φ̂
φ : E → E1 , ψ : E → E1
Supersingular j-invariants over Fp2
τ ◦ ρ : E → E1 → E2
N -isogenies (up to isomorphism)

Types of maximal orders in Bp,∞O∼
= End(E)Iφ integral left O-ideal and right O1 -ideal
Principal ideal Oθ
n(Iφ )
Iφ
Equivalent Ideals Iφ ∼ IψCl(O)Iτ ◦ρ = Iρ · IτClass set of Eichler orders of level N

Table 2.1: The Deuring correspondence, a summary.

2.2

Algorithmic Deuring correspondence

The results from Section 2.1.3 are nice in theory, but the question of practicality
remains. Existence results and theoretical properties are not enough to build
cryptography. We need concrete algorithms and complexity estimates, either
to build security assumptions or to argue that our protocols will be efficient.
Thus, the natural question is: how can we perform concretely the translation
between the two columns in Table 2.1? In this section, we will try to present an
informal answer to this question. Providing a more detailed response will be at
the heart of Chapters 3 and 4.

36

To understand a bit better the motivation, we give a quick preview of thecontent developed in Part II. Isogeny-based cryptography was born from theidea that computing an isogeny between two given isogenous elliptic curves ishard. When the curves in input are supersingular, the problem is believed
to be particularly difficult. In that case, we call it the supersingular isogeny
problem (SIP) and we add the prefix ℓ• if we restrict to isogenies in the ℓisogeny graph. Naturally, given the dictionary from Table 2.1, one wonders if
the Deuring correspondence could be used to help solving the isogeny problem
more efficiently. The first result on the topic was provided by Kohel, Lauter,
Petit and Tignol in [KLPT14] where they gave a heuristic polynomial algorithm(that we denote by KLPT) to solve the quaternion ℓ• -isogeny path problem: thetranslation of the ℓ• -SIP under the Deuring correspondence. We present theexact formulation of this problem and the algorithm KLPT in Chapter 3. KLPT
was the first building block toward a more thorough analysis of the hardnessof the problems related to the Deuring correspondence [EHL+ 18, Wes22]. The
central problem in this context appears to be the endomorphism ring problem(ERP) presented as Problem 2.2.1 below.
Problem 2.2.1. (ERP) Given a supersingular curve E, compute End(E).
Using KLPT and several other heuristic arguments, the authors of [EHL+ 18]
were able to prove that the SIP is equivalent to the ERP. Their work waslater completed by Wesolowski [Wes22], who proved the same result assuming
only the generalized Riemann hypothesis. These results justify that finding
algorithms to solve the ERP is important. In Section 2.2.1, we outline such analgorithm. In Section 2.2.2, we briefly cover other problems and algorithm tosolve them.
Remark 2.2.2. In the formulation of Problem 2.2.1, we stated the goal as “computing End(E)” without explaining what this means exactly. We remainedvague on purpose to keep the formulation compact. In the literature, there
are usually two versions of the ERP: one where we want four elements of Bp,∞
making a basis of a maximal order isomorphic to End(E) and one where we
look for concrete endomorphisms generating End(E) as morphisms from E to
E. It is not completely trivial to prove, but these two versions are equivalent(see [EHL+ 18]). In Section 2.2.1, we give an algorithm to solve the first version.
As a generic rule, throughout this work, when an algorithm has an input or an
output that is isomorphic to Λ, a lattice of Bp,∞ , we assume that it should be
put in the form of four elements of Bp,∞ forming a basis of Λ.

2.2.1

Endomorphism ring computation

The first concrete algorithm to solve the ERP is due to Kohel in his thesis[Koh96], and the literature has not evolved much since. We can also mention
the work of Cerviño [Cer04] based on ternary quadratic form (the goal of Cerviño
was slightly different since he solves the ERP for all supersingular curves over
p at once). Below, we present briefly an algorithm from [EHL+ 20] that can beseen as an actualized version of the one introduced by Kohel. The complexitye √p). In Section 2.4 we actually proveof this algorithm is conjectured to be O(
one of the conjectures made in [EHL+ 20] (with a slightly different motivationin mind).

37

Note that the ERP is easy in some rare cases, such as the curve of j-invariant
1728 when p = 3 mod 4. In general, there are a few distinguished curves forwhich we can find the endomorphism ring quite easily, but a random elementin S(p) will not be among those examples with overwhelming probability whenp grows.
Unsurprisingly, the main bottleneck in computing the endomorphism ring ofa generic supersingular curve E is actually to compute some non-trivial endomorphisms of E. The conjecture made in [EHL+ 20], which was already at theheart of the work of Kohel, is that two non-trivial endomorphisms are alreadyenough most of the time. If α1 , α2 are two endomorphisms of E, then we canlook at the order O1,2 generated by 1, α1 , α2 , α1 α2 . Unless α1 , α2 commute, thisorder has rank 4 and with good probability it will make a good part of End(E).
If this order is big enough, it will be contained only in a few maximal orders
and one can enumerate all of them until the correct one is found.
More precisely, the size of the list to enumerate through is exactly the embedding number of the order O1,2 . When O1,2 is Bass, we have with Proposition 1.2.21, an exact formula to compute the embedding number from thefactorization of disc(O1,2 ). It can be upper-bounded by the number of the divisor function τ that we introduce later (Definition 2.4.17) and it is a classicalresult by Wigert [Wig07] that τ (N ) = O(N ε ) for any ε > 0. Computing each of
the maximal orders containing O1,2 can be done by using the local-global principle. For each prime ℓ dividing disc(O1,2 ), we can find the eℓ (O1,2 ) maximal
orders containing Zℓ ⊗ O1,2 using Bruhat-Tits trees (see [AIL+ 21] for an exposition on Bruhat-Tits trees and their link with the Deuring correspondence).
Thus, under the heuristic that if α1 , α2 are well-distributed in End(E), thenthe order O1,2 will be Bass with good probability, we get that we can recoverefficiently the full endomorphism ring of E from the two endomorphisms α1 , α2 .
It remains to see how one can compute two non-trivial endomorphisms. The
idea is to look for cycles in Gpℓ for any small prime ℓ by performing some random
walks until we find a collision. In [EHL+ 20], they look for pairs j, j p that areneighbors in Gpℓ to improve the chance of finding a collision, but the principle
is always the same. Given the size and the expansion property of Gpℓ , we can√
expect to find collisions in O( p log(p)2 ).
Remark 2.2.3. The reasoning above explains that the endomorphism ring problem is basically considered equivalent to the endomorphism problem (which
consists in computing an endomorphism of a curve E). It is hard to prove thisreduction formally because we need some assumptions on the distributions of
α1 , α2 to be able to argue that the embedding number of O1,2 is small, but
it appears plausible in practice. The authors of [EHL+ 20] provided empiricalevidence to back their conjecture. With the suborder representation that we
present in Section 4.3, we will introduce the suborder endomorphism ring problem, a new problem whose hardness is based on the reverse consideration that if
the revealed endomorphisms are well-chosen and have a huge embedding number, it can be hard to recover the full endomorphism ring. We will use thisproblem to construct some new protocols in Chapter 7.

38

2.2.2Other results and algorithms.

Below, we briefly review some other algorithmic problems occurring in the context of the Deuring correspondence. We will remain mostly informal in what
follows and postpone detailed descriptions to Chapter 3 and 4. This section
can be considered as a preview and a motivation of what we will present in the
coming chapters.
In general, we will see that any problem starting from the quaternion sideof Table 2.1 will prove to be easy. For the algorithms with inputs in the elliptic
curve side, everything depends on the knowledge of the endomorphism ring. If
the endomorphism ring of the curves involved in the problem are known, thenthe problem is easy, otherwise the problem is hard (and in fact as hard as the
ERP in most cases). In particular, when End(E) is known, there are algorithms
to translate an isogeny φ : E → E ′ into the corresponding kernel ideal (and theconverse) in time polynomial in log(p). The complexity also depends on deg φ
as we will see in Section 4.2 where we present two algorithms IsogenyToIdeal
and IdealToIsogeny dedicated to that task. We will also present some efficientversion of IdealToIsogeny when the degree of φ is the power of a small prime.
We have also the inverse problem of the ERP: given a maximal order O in
Bp,∞ , find a curve E with End(E) ∼= O. This problem can actually be solvedin polynomial time by taking advantage of the few supersingular curves whose
endomorphism rings are known. We have for instance [EHL+ 18, Algorithm 12]
to perform that task. We describe briefly how this algorithm works. Let E0
be such a curve of known endomorphism ring, and let us write O0 ⊂ Bp,∞ amaximal order in the type of End(E0 ). The first ingredient to compute thecurve E is an algorithm ConnectingIdeal. We briefly explain the purpose of thisalgorithm below, but we do not give a detailed description because is just simple
linear algebra. We state in Proposition 2.2.4 a complexity result on ConnectingIdeal that we will reuse later.
ConnectingIdeal: takes takes two maximal orders O1 , O2 in Bp,∞ and outputs
I(O1 , O2 ).
Proposition 2.2.4. ConnectingIdeal terminates in O(poly(log(pC))) when thecoefficients of the bases of the two maximal orders in input are smaller than C.
With ConnectingIdeal, we can compute a connecting ideal between O0 and
O. This is equivalent to an isogeny between E0 and E under the Deuringcorrespondence. Thus, to compute the correct output, it suffices to computethe codomain of this isogeny. This can be done with IdealToIsogeny and theusual isogeny computation algorithms (we give more details on this topic in
Section 4.1 and Section 4.2). However, as the result of Chapter 4 will prove, thecomplexity of these operations depends on the norm of I(O0 , O) and so we haveno guarantee for the complexity will be polynomial (in particular, if the norm
has big prime factors, it will have exponential complexity). As we will explain
in Chapter 4, the only way to guarantee a polynomial computation is to have apowersmooth norm (with smoothness bound of polynomial size). Thus, we needan algorithm that takes an ideal I of any norm and output an equivalent ideal
J ∼ I of powersmooth norm. Luckily, this is exactly the purpose of the KLPT
algorithm from [KLPT14] that we will describe in Chapter 3. If J ∼ I(O0 , O),
the corresponding isogeny φJ has a codomain E0 /E0 [J] that is a correct output
for our algorithm. When n(J) is powersmooth with a polynomial smoothness
39

bound, we have a polynomial algorithm to compute E0 /E0 [J] and so we get apolynomial algorithm to solve the reverse ERP because KLPT is also polynomial.
We conclude this section with a small result to prove that we always have apolynomial-size representation of ideals in Bp,∞ . We will use this fact in various
occasions in the coming chapters.
Lemma 2.2.5. For any integral ideal I of a maximal order in Bp,∞ of norm D,
there exists J, isomorphic to I, that admits a basis composed of elements withcoefficients of size O(log(pD)) over the basis ⟨1, i, j, k⟩.
Proof. It was shown in [EHL+ 18] that any maximal order admits a basis whose
coefficients have size O(log(p)) in the basis ⟨1, i, j, k⟩ of Bp,∞ . Since DO ⊂ I for
any cyclic O-ideal of norm D, we see that we can choose coefficients to represent
any element of I inside the basis of O with coefficients of size O(log(D)). Thus,
there exists a representation of a basis of I in ⟨1, i, j, k⟩ whose coefficients havesize O(log(p) + log(D)).

2.3Interpreting the zoology of quaternion orders under the Deuring correspondence

In this section, we expand upon the results of Section 2.1 by understanding
how the objects introduced in the context of quaternion orders translate into
the world of elliptic curves and isogenies. We will focus on two main subjects:
Eichler orders in Section 2.3.1 and the Brandt-invariant in Section 2.3.2. We
stress again that these results are considered folklore (see for instance [Voi18,
Remark 42.3.10] for Eichler orders) but we address the lack of a clear andexplicit reference. As we will need a lot of the intermediate results in Part II,
our proof does not take the most direct way toward the result and we try to
make each step as explicit as possible. This was also recently done in full details
by Sarah Arpin [Arp22]. The most important result is about Eichler orders in
Section 2.3.1, but we will also look at non-Gorenstein orders in Section 2.3.2.

2.3.1

Eichler orders

Looking at the interpretation of Eichler orders under the Deuring correspondence is quite natural, as there is a link between Eichler orders and cyclic idealsof maximal orders. This stems from Eichler orders being the intersection of two
maximal orders. Let us take O such an order, and we write O1 , O2 for the two
maximal orders such that O = O1 ∩ O2 . We take I the cyclic ideal I(O1 , O2 ).
It can be shown that the level of O is equal to n(I). The results of this section
will culminate in Proposition 2.3.14 where we show a correspondence between
Eichler orders class sets of level N and N -isogenies. Throughout this section,
we keep the same notations for O, O1 , O2 and I.
The following proposition clarifies the link between ideals and Eichler orders
in terms of structure of O.
Proposition 2.3.1. Let O1 , O2 be two maximal orders in Bp,∞ . We have O1 ∩O2 = Z + I(O1 , O2 ). With the notations above, we get O = Z + I.

40

Proof. Since I is integral, it is contained in both O1 and O2 and we have that
Z + I ⊂ O. We conclude by observing that the index of Z + I in both O1 andO2 is n(I), the same as O.
Remark 2.3.2. With the decomposition from Proposition 2.3.1, we can partition
the elements of O according to whether their norm is coprime to n(I) or not.
Given that n(I)ZS ⊂ I, it is easily verified that this partition can be written
as O = (I ∪ I)((Zcop (n(I)) + I) where Zcop (n) is the set of integers in Z
coprime to n.
The endomorphisms of O. We strive to understand how the elements ofO fit into our framework. We have that the two maximal orders O1 ,O2 are
isomorphic to the endomorphism rings End(E1 ), End(E2 ) of two supersingularcurves E1 , E2 . Let us write ιi : Oi → End(Ei ) the isomorphism in question for
i = 1, 2. Let us take an element β ∈ O. By design β ∈ O1 and β ∈ O2 , so
we may ask what are the endomorphisms ι1 (β) and ι2 (β) and how they may
be related. Proposition 2.3.3 below shows that these two endomorphisms areimage of one another under pushforward/pullback by φI . We formulate thisresult in terms of ideals.
Proposition 2.3.3. If β ∈ O1 is of norm coprime to N , then [O1 β]∗ I = I if
and only if β ∈ O ∖ (I ∪ I). In particular, [I]∗ O1 β is a principal O2 -ideal equal
to O2 β.
Proof. When β ∈ O ∖ (I ∪ I), the norm of β is coprime to N as noted in
Remark 2.3.2. Thus, Lemma 2.1.7 applies and we have [I]∗ (O1 β) = I −1 (I ∩O1 β). We now show that I ∩ O1 β = Iβ. Indeed, since I is integral, Iβ ⊂ O1 β
and as β ∈ O ⊂ O2 = OR (I) we also have Iβ ⊂ I. For the other side, let us
take x ∈ O1 β ∩ I. We can write x = δβ for δ ∈ O1 . Writing β = λ + α withλ ∈ Z invertible modulo N and α ∈ I, we see that δ is necessarily in I. We
have proven that I ∩ O1 β = Iβ, and [I]∗ (O1 β) = I −1 (I ∩ O1 β) concludes thefirst part of the proof with I −1 I = O2 .
Now, we show that if [O1 β]∗ I = I, then β is necessarily in O. If [O1 β]∗ I = I,
we know that the kernel E1 [I] of φI is fixed by the action of β. This implies
that E1 [I] is in an eigenspace of β (since E1 [I] = ker φI is a cyclic subgroup)and there exists λ ∈ Z such that β − λ ∈ I. Hence, β ∈ O by Proposition 2.3.1.
We have shown that I ∩ O1 β = Iβ, and we can conclude the proof using theformula [I]∗ (O1 β) = I −1 (I ∩ O1 β). We obtain [I]∗ (O1 β) = O2 β, and this ideal
is principal since β ∈ O2 .
From Proposition 2.3.3, we deduce directly a complete analysis in Proposition 2.3.4 of the elements of ι1 (O), ι2 (O).
Proposition 2.3.4. For β ∈ O one of the following holds :• n(β) = 0 mod n(I) and ι1 (β) = α or ι1 (β) = α with α = ψ ◦ φI ∈End(E1 ) for ψ : E1 → E2 and ι2 (β) = ψ̂ ◦ φ̂I .
• n(β) ̸= 0 mod n(I) and ι2 (β) = [φI ]∗ ι1 (β).
Remark 2.3.5. If we reformulate Proposition 2.3.3 with the definition of pushforwards, we see that the endomorphisms ι1 (β) leaves stable E1 [I] when n(β)

41is coprime to I. In fact, this is true for every element β ∈ O, as can be easily
verified by the decomposition O = Z + I and Definition 2.1.3. Conversely, it canbe shown that any element in End(E1 ) having this property is in fact containedin ι1 (O). We can also show that E1 [I] is the only subgroup that is an eigenspaceof all the elements of ι1 (O). This justifies that we can consider ι1 (O) as theendomorphism ring of the curves E1 augmented with the cyclic subgroup E1 [I](and alternatively ι2 is End(E2 , E2 [I]). In terms of local-global interpretation,
this can be seen with Eq. (1.2.5), where we have that Oℓ is isomorphic to a ringof triangular 2 × 2 matrices over the ℓe -torsion for every ℓe dividing the levelof O. Since Oℓ gives the action of the endomorphisms in ιi (O) on the Tate
modules Ei [ℓ], this means that there is always one common eigenvector among
the ℓe -torsion.
From Proposition 2.3.3, we deduce the following result which will underlie
the algorithm GenericKLPT from Chapter 3 and also be useful for our analysis
of ideal class sets of Eichler orders; it is a reformulation using the χ map from
Definition 1.2.14. We remind that we have χI (α) = Iα/n(I).
Corollary 2.3.6. Let J1 , J2 be O1 -ideals, with J1 ∼ J2 and n(J1 ), n(J2 ), n(I)pairwise coprime. Suppose that J1 = χJ2 (β) with β ∈ J2 ∩ O. Then [I]∗ J1 ∼[I]∗ J2 and [I]∗ J1 = χ[I]∗ J2 (β).
Proof. When χJ2 (β) = J1 , we can identify J2 ·J1 with O1 β. By Proposition 2.3.3
we know that [I]∗ O1 β = O2 β and by decomposing O2 β the same way as O1 β,
we see that [I]∗ J1 = χ[I]∗ J2 (β).
In fact, we can show that the converse of Corollary 2.3.6 does not hold ingeneral. As shown in Lemma 2.3.7 below, there are cases where β ∈ O1 ∖ O canbe found such that [I]∗ O1 β is principal (this result is not used anywhere else inthis work but we found it interesting). In this context, there exists a β ′ ∈ O2
such that [I]∗ O1 β = O2 β ′ . Of course n(β) = n(β ′ ), however, it appears thatthe trace of β is not necessarily preserved in this case. This means that eventhough β is sent to an endomorphism over E, the suborder Z[β] of O1 is notsent to an isomorphic suborder Z[β ′ ] ⊂ O2 .
Lemma 2.3.7. If there exists J ̸= I of the same norm with J ∼ I, then there
exists β ∈ O1 ∖ O such that J = [O1 β]∗ I and [I]∗ O1 β is principal.
Proof. We need to show that we can always find β ∈ O1 ∖O such that [O1 β]∗ I =J (i.e. [I]∗ O1 β is principal since J ∼ I). This is the case if Jβ ⊂ I. Indeed,
any endomorphism of Jβ can be written as a composition of β with an elementof J. The kernel of the elements in J are exactly E1 [J] by definition, but sinceJβ is in I, the elements of Jβ send E1 [I] to O. The only possibility is thatβ(E1 [I]) = E1 [J]. By definition of our pushforward isogenies this is equivalent
to [O1 β]∗ I = J. Hence, Jβ ⊂ I is sufficient to prove the result.
We just need to justify that such a β can be found for any given pair ofdistinct I ∼ J. There are several ways to construct it, for instance we can do soby computing IdealModConstraint(α, J) (the algorithm defined in Section 3.2.2)
for any α such that I = ⟨α, n(I)⟩. Finally, since I ∼ J we conclude that [I]∗ O1 β
is principal.

42

Ideal class sets of Eichler orders. We have seen in Section 2.1.2 that theclass set of a maximal order is in bijection S(p). We are going to prove next that
we can derive a similar result for class sets of Eichler orders. We derive it by
explicitly showing the connection between ideals of maximal orders and ideals ofEichler orders. More than the final result Proposition 2.3.14, our goal is reallyto understand the different elements of this class set and how they relate to theclass sets of maximal orders.
To motivate this study, note that the supersingular isogeny graphs from
Definition 1.1.28 were first constructed by Pizer [Piz90] through class sets ofquaternion orders, and only later reinterpreted as isogeny graphs in [CLG09].
For simplicity, we now assume that the norm of the ideal I is a prime N .
Everything that follows,
Q remains mostly true for an arbitrary integer N whenN + 1 is replaced by N d∈Pd (1 + 1/d). Eichler [Eic38] proved a formula for theclass number h(O) = |Cl(O)|. When N is prime, we obtainh(O) =(p + 1)(N + 1)
+ εN,p12

where εN,p is a small value depending on N and p modulo 12 (analogue to
Proposition 1.1.24). This, combined with h(O1 ) = p/12 + εp , (εp depends
on the value p mod 12) suggests that there is a (N + 1)-to-1 correspondence
between Cl(O) and Cl(O1 ), which we are now going to exhibit.
Remark 2.3.8. By symmetry of the definition of O = O1 ∩ O2 , everything could
be restated replacing O1 by O2 , up to replacing some pushforward notations[·]∗ by pullbacks [·]∗ when it makes sense (or equivalently replacing I by I).
The first step in our approach is to understand how to construct ideals ofEichler orders from ideals of maximal orders. We focus our analysis on ideals ofnorm coprime to N because they are simpler to handle and the results we canstate on them remain true when looking up to equivalence because every idealclass has a representative of norm coprime to N . Let us write IN (O) for theset of left integral O-ideals of norm coprime to N for any order O. We start byshowing a connection between IN (O1 ) and IN (O).
Lemma 2.3.9. The map
Ψ : IN (O1 ) −→ IN (O)J 7−→ J ∩ O
is a well-defined bijection between the set of integral O1 -ideals and O-ideals
of norm coprime to N . Its inverse is given by : Ψ−1 : J 7→ O1 J.
Proof. Verifying that the images of Ψ (resp. Ψ−1 ) are left integral O-ideals(resp. O1 -ideals) is straightforward from the definition. Then, it suffices toshow I = O1 (I ∩ O) and J = O ∩ O1 J for any I ∈ IN (O1 ) and J ∈ IN (O).
This is straightforward after seeing that any O1 -ideal of norm coprime to N canbe written as J = O1 ⟨α, n(J)⟩ for some α ∈ O. The corresponding O-ideal is
J = J ∩ O = O⟨α, n(J)⟩ and O1 J = J. Moreover, this decomposition justifies
that the norm is preserved through Ψ.
Note that locally, since O ⊗ Zℓ and O1 ⊗ Zℓ are isomorphic for all primesℓ ̸= N , it is not surprising to see the existence of the correspondence between
43

ideals of norm coprime to N presented in Lemma 2.3.9. This bijection suggests
defining the following equivalence relation ∼O on left O1 -ideals of norm coprime
to N . We say that J ∼O K if and only if Ψ(J) ∼ Ψ(K) as O-ideals (here ∼ isthe equivalence relation introduced in Section 1.2.2 between left ideals of a sameorder). The bijection Ψ transports the structure of ∼ to ∼O , and this implies
that we have defined an equivalence relation.
Definition 2.3.10. We write ClO (O1 ) for the set of equivalence classes ofIN (O1 ) under ∼O .
From the definition, we have that ClO (O1 ) is in bijection with Cl(O) throughΨ. In the next proposition, we make the link between class sets and our previous
results on the elements of O by showing that we can obtain an explicit correspondence between ideals of norm N and ClO (O1 ) using pushforward ideals.
Proposition 2.3.11. J ∼O K if and only if there exists β ∈ O such thatK = χJ (β) and β −1 [K]∗ Iβ = [J]∗ I.
Proof. We start by noting that β −1 [K]∗ Iβ = [J]∗ I is an equality of left OR (J)ideals. Indeed, K = χJ (β) implies OR (J) = β −1 OR (K)β (equivalent ideals
have equivalent right orders).
By definition of ∼O and properties of our bijection Ψ, J ∼O K ⇔ K =χJ (β) for some β ∈ O. In this case, applying the formula of Lemma 2.1.7 for[K]∗ I yields β −1 [K]∗ Iβ = βK · (I ∩ K)β/n(β)n(K), which can be simplified
as J −1 · (I ∩ K)β/n(K) with K = χβ (J). As noted in Corollary 2.3.6, whenβ ∈ O we can write [I]∗ K = χ[I]∗ J (β). With this and the decompositionI∩J = I·[I]∗ J, we see that (I∩J) = (I∩K)β/n(K). By replacing (I∩K)β/n(K)in β −1 [K]∗ Iβ = J −1 · (I ∩ K)β/n(K), we obtain β −1 [K]∗ Iβ = J −1 (I ∩ J) =[J]∗ I.
An interesting question is how the new equivalence relation ∼O relates tothe classical one ∼. In fact, ∼O is compatible with ∼ in the sense that J ∼O K
implies J ∼ K, as is easily verified from Corollary 2.3.6. This suggests partitioning ClO (O1 ) in subsets indexed by the elements of Cl(O1 ). Understanding
this partition is the focus of Proposition 2.3.12 and will lead naturally to our
final result of Proposition 2.3.14. Hence, we write[
ClO (O1 ) =ClO (C)C∈Cl(O1 )where ClO (C) is the set of classes in ClO (O1 ) contained in C. As mentioned
above, the respective sizes of Cl(O1 ) and Cl(O) suggest that the partition above
provides a (N + 1)-to-1 correspondence between Cl(O1 ) and Cl(O). The difference between h(O) and (N + 1)h(O1 ) is entirely accountable to the classes C not
treated by Proposition 2.3.12, which we will briefly describe in Remark 2.3.13.
Proposition 2.3.12. For C ∈ Cl(O1 ), let us take L ∈ C and define OC :=OR (L). If OC× = ⟨±1⟩, then for any γ ∈ L∖N OC and quadratic order S = Z[ωs ]of discriminant ∆S inside O1 in which N is inert, the map:
Θ : P1 (Z/N Z) −→ ClO (C)(C : D) 7−→ χL ((C + ωs D)γ)is a bijection. In particular, |ClO (C)| = N + 1.
44

Proof. First, it is clear that such γ and S can be found for any class C andrepresentative L. We propose to prove the proposition by decomposing Θ intwo bijections Θ1 and Θ2 . For this, we reformulate our equivalence relation asa relation on the ideal elements. For α0 , α1 ∈ L of norm coprime to N , wedefine the relation ∼O as α0 α1 /n(L) ∈ O. It is an equivalence relation, andwe have χL (α0 ) ∼O χL (α1 ) ⇔ α0 ∼O α1 . Indeed, since χL (α0 ) ∼O χL (α1 )we know that there exists β ∈ O such that χL (α0 ) = χL (βα1 /n1 ) if we writen(α) = n(L)n1 . Then, since OR (L)× only contains ±1, we can say w.l.o.g thatα0 = βα1 /n1 which implies that α0 α1 /n(L) ∈ O. Thus, we have showed that
Θ2 : α 7−→ χL (α) is a bijection between L/ ∼O and ClO (O1 ). Then, it remains
to show that Θ1 : (C : D) 7−→ (C +ωS D)γ is a bijection between P1 (Z/N Z) andL/ ∼O . First, Θ1 is well-defined. It stems from C + ωS D ∈ O1 = OL (L). Then,
Θ1 is injective. Indeed, if not, there exist µ1 , µ2 ∈ S such that θ := µ1 γγ µ2 isin O. Let us rewrite θ = n(γ)µ1 µ2 ∈ S. Since N is inert in S, we can assume
without loss of generality that n(θ) is coprime to N . Otherwise, this would
imply that either µ1 or µ2 has a norm that is a multiple of N , which contradicts
the fact that N is inert in S. Since O = Z + I by Proposition 2.3.1, there must
be some λ such that (x − λ) + ωS y is in I and has its norm divisible by N . A
necessary condition is that we can find λ ∈ Z∗ such that the norm of θ − λ isdivisible by N . Looking at the norm of θ − λ, we see that this is possible only
if X 2 − tr(θ)X + n(θ) = 0 has a solution in Z/N Z. The discriminant of thisequation is 4∆S y 2 n(γ)2 , and it is not a square since N is inert in S. Thus,
there are no solutions to the equation, and this suffices to prove the injectivityof our map. Bijectivity follows from a counting argument. We know that
|P1 (Z/N Z)| = N + 1 and we can show that |L/ ∼O | = |ClO (C)| ≤ N + 1. This
last bound is a consequence of Proposition 2.3.11, which implies that |ClO (C)| isbounded by the number of OR (L)-ideals of norm N . There are exactly N +1 such
ideals (this is easy to see for instance by looking at the number of corresponding
N -isogenies). Thus, we have showed that Θ1 and Θ2 are bijective maps. It isclear that their composition is Θ, hence the result.
Remark 2.3.13. Proposition 2.3.12 fails when OC contains non-trivial automorphisms. Intuitively, this can be explained because the map χI of Lemma 3.2.1
is not injective (up to signs) anymore. If δ is such an automorphism, taking
β ∈ Oδ is another solution to obtain equivalence in Proposition 2.3.11. In thiscase, we see that [K]∗ I and [J]∗ I are the same ideals up to multiplication by
an automorphism. This justifies that the number ClO (C) is basically equal to
N + 1 divided by the number of automorphisms (up to sign). The number ofsuch exceptions depends on the value of p mod 12, and is at most 2.
We conclude this section by interpreting Eichler order’s class set by putting
Cl(O) in bijection with elements over the geometric world of elliptic curves.
Remark 2.3.13 suggests that we consider isogenies up to isomorphisms. For j a
supersingular j-invariant in S(p), we write Aut(j) for the automorphism groupof curves of j-invariant equal to j. With this, isog(N, j)/ Aut(j) is the set of
N -isogenies whose domain has j-invariant equal to j up to composition withthe elements of Aut(j).
S
Proposition 2.3.14. Cl(O) is in bijection with the set j∈S(p) isog(N, j)/ Aut(j).
Proof. We already mentioned (see Table 2.1) the bijection identifying a classC ∈ Cl(O1 ) with a supersingular invariant jC corresponding to the isomorphism
45

class of some elliptic curve EC . This bijection is obtained by EC = E0 /E0 [J]for any J ∈ C. Similarly, if we take a class C ∈ ClO (O1 ) ≃ Cl(O) following
Definition 2.3.10, and J ∈ C, we associate C with the isogeny φC between thepair of supersingular elliptic curves (EC , FC ) defined as EC = E0 /E0 [J] andFC = E/E [K] with K = [I]∗ J. By the properties of pushforward isogenies,
EC and FC are indeed N -isogenous, and we have φC = [φJ ]∗ φI for any J ∈ C.
By Propositions 2.3.11 and 2.3.12 and Remark 2.3.13, classes in ClO (O1 ) canbe associated with the set of OC -ideals of norm N up to left multiplication by
an automorphism of OC . It is clear that this is in bijection with the set of
N -isogenies up to isomorphisms under the Deuring correspondence.

2.3.2

Non-Gorenstein orders

Contrary to the previous section, our goal here is not to provide an exhaustive
analysis of non-Gorenstein orders, i.e., the orders of Brandt Invariant f (O) ̸= 1,or their ideals under the Deuring correspondence, but rather to highlight thelink between an order O and its Gorenstein closure Gor(O) and see what are
the consequences over the world of elliptic curves when we translate everything
under the Deuring correspondence. Our first result Lemma 2.3.15 is about
quaternion orders and ideals, and we later reinterpret it under the Deuringcorrespondence.
Lemma 2.3.15. Let D ≥ 1 be an integer coprime to p and let O0 be a quaternion order of Bp,∞ of discriminant coprime to D. The order O = Z + DO0 is
optimally embedded in a maximal order O′ if and only if there exists a cyclic
left O′ -ideal I of norm D such that O0 is optimally embedded inside OR (I).
Proof. We start by proving the forward direction when D is prime. Let us take
ι : Z + DO0 → O′ . By tensor product by Q we can extend ι to O0 and we
get the image ι(O0 ) as an order of Bp,∞ . We set I = {x ∈ O, xι(O0 ) ⊂ O′ }.
First, it is easy to verify that I is an integral left O′ -ideal since it is containedin O′ . Then, we are going to see that it has norm D. It suffices to showthat DO ⊊ I ⊊ O′ . To see that I ̸= O′ , it suffices to note that 1 ̸∈ I sinceι(O0 ) ̸⊂ O′ (since the embedding is optimal). Then, with Dι(O0 ) ⊂ O′ wehave Dxι(O0 ) = xDι(O0 ) ⊂ O′ for every x ∈ O′ , which proves that DO′ ⊂ I.
Finally, to prove that DO′ ̸= I, we take x0 ∈ ι(O0 ) and not contained in O′ .
It is clear that Dx0 ∈ I, but Dx0 ̸∈ DO′ . Finally, from the definition of I
it is clear that ι(O0 ) is contained in OR (I). If this embedding is not optimal,
there exists O0′′ ⊂ OR (I) such that ι(O0 ) = Z + ℓO0′ . We have DO0′′ ⊂ I ⊂ O′
and so we would get ι(O) = Z + ℓ(Z + DO0′′ ) which would contradict the factthat O is optimally embedded. This concludes the proof for the prime case
D. To extend the proof to the composite settings, we can apply the previous
proof to O = Z + ℓ(Z + (D/ℓ)O0 ) for any prime ℓ dividing D. At each given
iteration, we will obtain an ideal of norm ℓ (and the fact that O is optimallyembedded rules out the case where ι(O0 ) ⊂ O′ ). In the end, multiplying allthese ideals together, we obtain an ideal of norm D between O′ and a maximal
ideal containing ι(O0 ). The final ideal is cyclic, as otherwise we could divide bysome constant d′ |D and obtain that Z + (D/d′ )O0 is embedded inside O′ .
For the other direction, we write I for the O′ -ideal of norm D. We write′′
O for OR (I) and we have the embedding ι : O0 ,→ O′′ . First, it is easy to seethat Dι(O0 ) ⊂ DO′′ ⊂ I ⊂ O′ implies that Z + DO0 is embedded inside O′46

through ι. We now need to show that this embedding is optimal. Let us assume
that it is not the case. Then, there exists O0′ ⊂ O′ such that ι(O) = Z + ℓO0′ .
If gcd(ℓ, D) = 1, then, by unicity of the Gorenstein conductor, there exists O0′′such that O0′ = Z+DO0′′ . It is easily verified that we must have ι(O0 ) = Z+ℓO0′′ .
And since Z + D(Z + ℓO0′′ ) ∈ Z + I we also have O0′′ ∈ OR (I) = O′′ . Hence,
this contradicts that O0 is optimally embedded in O′ . If ℓ and D are notcoprime we must have ℓ = D and so we must have ι(O0 ) ∈ O′ . This means thatι(O0 ) ⊂ O′ ⊂ O′′ . But O′ ∩ O′′ is an Eichler order of discriminant Dp, and thiscontradicts the assumption that disc(O)0 is coprime to D. We can apply thesame argument recursively to treat the composite case.
When the order O0 is maximal, Lemma 2.3.15 gives a sufficient and necessary condition for two elliptic curves to be D-isogenous under the Deuringcorrespondence. This is Proposition 2.3.16. Note that the concrete embedding
Z + D End(E1 ) ,→ End(E2 ) is realized by the isogeny φ : E1 → E2 of degree D, whose existence is predicted by Proposition 2.3.16. We get that forθ ∈ End(E1 ), the image of d + Dθ under this embedding is given by the endomorphism d + φ ◦ θ ◦ φ̂. Proposition 2.3.16 is the main theoretical result
behind the suborder representation that we will introduce in Section 4.3. It
is also connected with the encryption scheme SETA that we present in Chapter 6. Proposition 2.3.16 is a direct reinterpretation of Lemma 2.3.15 under the
Deuring correspondence.
Proposition 2.3.16. Let D ≥ 1 be coprime to p and E1 , E2 be two supersingular curves. The order Z + D End(E1 ) is optimally embedded inside End(E2 )if and only if E1 is D-isogenous to one of E2 or E2p .
Similarly, with the results from Section 2.3.1, we can apply Lemma 2.3.15
to O0 , an Eichler order of level M coprime to D, to enhance Proposition 2.3.16
with subgroups G1 , G2 . We a curve E and subgroup of points G, we write
End(E, G) for the set of endomorphisms that leave stable G. By the results ofSection 2.3.1, End(E, G) ∼= Z + I(G).
Proposition 2.3.17. Let D > 1, M > 1 be coprime to p and also pairwise
coprime. Let E1 , E2 be two supersingular curves and G1 , G2 be subgroups oforder M inside E1 [M ], E2 [M ] respectively. The order Z + D End(E1 , G1 ) is
optimally embedded inside End(E2 , G2 ) if and only if E1 is D-isogenous to one
of E2 or E2p and the group G2 (or π(G2 )) is the image of G1 through a Disogeny.

2.4

Quadratic orders in the Deuring correspondence and the number of orientable curves

In this section, we consider embedding of quadratic orders inside endomorphism
rings of supersingular curves. For that, we will use the slightly different terminology of orientations, inspired by Colò and Kohel in [CK19]. The notion oforientation in Definition 2.4.1 below corresponds to the one of primitive orientations with a p-orientation in [CK19] and it is equivalent under the Deuringcorrespondence to optimal embeddings of quadratic orders inside maximal orders47

of Bp,∞ (see Definition 1.2.18). The same notion is referred to as normalized
optimal embeddings in [Bel08].
For the rest of this section, we fix a quadratic imaginary field K and aquadratic order O in K.
Definition 2.4.1. For any elliptic curve E, a K-orientation is a ring homomorphism ι : K ,→ End E ⊗ Q. A K-orientation induces an O-orientation ifι(O) = End E ∩ ι(K). In that case, the pair (E, ι) is called a O-oriented curveand E is an O-orientable curve.
In what follows, we consider the elements of S(p)/π rather than S(p) because
the Frobenius π creates two orientations (one in E and one in E (p) ) from each
optimal embedding of O in a quaternion maximal order of Bp,∞ . Note that
this is not the convention taken in [Onu21, Wes21] where orientations are notconsidered up to Galois conjugacy.
Definition 2.4.2. SO (p) is the set of O-oriented curves (E, ι) up to isomorphisms and Galois conjugacy.
The following proposition follows from the results proven by Onuki [Onu21,
Proposition 3.2, Proposition 3.3, Theorem 3.4] and gives a way to compute#SO (p).
Proposition 2.4.3. The set SO (p) is not empty if and only if p does not split
in K and does not divide the conductor of O. When this condition is satisfied,and p is not ramified in K, we have #SO (p) = h(O).
When p is ramified in K, the situation is a bit more complicated but it canbe shown [ACL+ 22] that1
#SO (p) ∈ { h(O), h(O)}.
2
When SO (p) is not empty, the class group Cl(O) acts on O-orientations
through an operation that we write a ⋆ (E, ι) = (Ea , ιa ). Onuki proved that thisgroup action is free and transitive. This action is computed using isogenies. In
fact, the definition of kernel of an ideal we gave as Definition 2.1.3, makes sense
if we apply it to a quadratic ideal a in a quadratic order O embedded inside
End(E). We can define E[a] for any E, ι ∈ SO (p) and write φE
a for the isogenyof kernel E[a]. We have
Ea = E/E[a]andιa (x) =1 E
φ ◦ ι(x) ◦ φ̂Ea.
n(a) a(2.4.1)

Definition 2.4.4. The set of O-orientable curves EO (p) is the set of curves
E ∈ S(p)/π for which there exists an O-orientation ι with (E, ι) ∈ SO (p).
Contrary to #SO (p), we do not have a nice generic formula for #EO (p).
The hardness of the O-UIP, a generic isogeny problem that we will introduce
in Chapter 6, mainly depends on the value of #EO (p). This motivates that
we focus, in the rest of this section, on computing a generic lower bound of#EO (p). Aiming at the cryptographic applications, we look for an effective
bound in the cases where the discriminant of O is polynomial in p and bothhave cryptographic size.
48

Related work. The number of orientable supersingular curves is related to
the number of optimal embeddings of quadratic orders inside maximal orders of
the quaternion algebra ramified at p and ∞ and is also linked with the numberof representations of integers by ternary quadratic forms. Both quantities havebeen studied in the literature but not with the same goal. As far as we know,
prior to our work, an effective bound is only known for a restricted range of
discriminants and is due to Kaneko [Kan89]. In [Voi21, Chapter 30], several
formulas are given involving sums of these numbers (such as the Eichler classnumber formula) from which it seems hard to derive a bound. There are also
asymptotic results on number of representations by ternary quadratic forms(see for instance [IK21, Chapter 20]) but they rather target the case where thediscriminant grows to infinity while p is fixed. Our work also shares some similarities with the line of work started by Gross and Zagier [ZG85] on singularmoduli and later enriched by Dorman, and Lauter and Viray [Dor87, LV15].
Their results cannot be directly applied to our case because they target simultaneous embeddings of quadratic orders of distinct discriminants while we aregoing to focus on simultaneous embeddings of quadratic orders with the same
discriminant. Nonetheless, some of the techniques developed in these works
have inspired part of our analysis.
For the remainder of this section, we fix a quadratic order O of negative
discriminant −d. We assume that the Legendre symbol (−d/p) ̸= 1 and the
conductor f (O) is coprime to p, so we know by Proposition 2.4.3 that #EO (p) >0. We start with Section 2.4.1, where we introduce useful results from theliterature and show a first lower bound when d ≤ p. In Section 2.4.2, we prove
our main lower bound in the case where f (O) = 1. We extend this result to thegeneric case using the expansion property of the isogeny graphs in Section 2.4.3.

2.4.1

A first result for small discriminants

The main result of this Section is Proposition 2.4.6 that was first proven by
Kaneko in [Kan89]. This proposition allows us to derive interesting results on
EO (p) with Corollaries 2.4.8 and 2.4.9 (Corollary 2.4.8 being the only effective
lower bound on #EO (p) prior to this work). Proposition 2.4.6 is obtained bystudying the quaternion order generated by two integral elements in Bp,∞ . The
study of these objects already appeared in Section 2.2.1 and will prove of prime
importance for the results in Section 2.4.2 as well.
The quaternion order generated by two non-commuting elements.
Let us take α1 , α2 , two integral elements in Bp,∞ . We want to look at theorder O1,2 = ⟨1, α1 , α2 , α1 α2 ⟩. When α1 and α2 are not commuting, O1,2 is aquaternion order, i.e has rank 4 as a Z-module. In Proposition 2.4.5, we givethe classical formula to compute disc(O1,2 ). Proposition 2.4.6 is a consequenceof this formula and was proven in [Kan89].
Proposition 2.4.5. [Koh96, Chapter 7] Let Oi be quadratic orders equal toZ[αi ] for i = 1, 2 such that α1 , α2 are not commuting. Let Di = disc(Oi ), ti =tr(αi ) for i ∈ {1, 2} and s = tr(α1 α2 ), then disc(O1,2 ) = (D1 D2 −(t1 t2 −2s)2 )/4.
Proposition 2.4.6. [Kan89, Theorem 2’] Let Oi be quadratic orders equal toZ[αi ] for i = 1, 2 such that α1 , α2 are not commuting. If O1 , O2 have respective

49

discriminant −fi2 d (where d is a fundamental discriminant) and are contained
inside the same quaternion maximal order O ⊂ Bp,∞ , we have that p ≤ fi fj d.
Proof. We can write Oi = Z[αi ] for two integral elements α1 , α2 . We canconsider the quaternion order O1,2 generated by these two elements because
α1 , α2 do not commute. When Di = −fi2 d, we can rewrite the formula from
Proposition 2.4.5 as (D1 D2 − (t1 t2 − 2s)2 )/4 = (f1 f2 d − t1 t2 + 2s)(f1 f2 d +t1 t2 − 2s)/4. Without loss of generality we can assume that t1 t2 − 2s > 0(as we can replace α1 by −α1 if needed). The discriminant of a quaternion
order is always divisible by p. Since p is prime, we have that p divides either(f1 f2 d−t1 t2 +2s)/2 or (f1 f2 d+t1 t2 −2s)/2. The two numbers (f1 f2 d−t1 t2 +2s)
and (f1 f2 d + t1 t2 + 2s) have same parity and are divisible by 4 which meansthat (f1 f2 d − t1 t2 + 2s)/2 and (f1 f2 d + t1 t2 − 2s)/2 are both integers. Since
0 < t1 t2 − 2s < f1 f2 d, because disc(O)1,2 > 0, both factors are smaller than
f1 f2 d and so we have that p is always smaller than f1 f2 d.
Remark 2.4.7. During the proof for Proposition 2.4.6 we showed that t1 t2 −2s ≡±f1 f2 d mod p. This fact will be useful for what follows in Section 2.4.2.
Proposition 2.4.6 allows us to show interesting properties, including a lower
bound on the size of EO (p) (Corollary 2.4.8) and a bound on the minimal distance between two O-oriented curves (Corollary 2.4.9).
Corollary 2.4.8. When |disc(O)| < p, #EO (p) = #SO (p).
Proof. If we assume that #EO (p) < #SO (p), then there must be a curve Ewith two distinct O-orientations ι1 , ι2 . Under the Deuring correspondence, this
implies that there are two distinct quadratic orders O1 , O2 isomorphic to O
contained inside the maximal order O ∼= End E. By Proposition 2.4.6 with
f1 = f2 = 1, p must be smaller than d which contradicts our assumption.
Corollary 2.4.9. Let ℓ be a prime different from p. If ℓ is inert in O of
discriminant d, then the shortest chain of ℓ-isogenies between two curves ofEO (p) has degree larger than p/d.
Proof. (sketch) Let us denote the two curves by E1 , E2 , and by O1 , O2 theirrespective endomorphism rings. Let us take φ : E1 → E2 the smallest chain ofℓ-isogenies connecting them. Let us write θi ∈ Oi such that O ∼= Z[θi ]. Sinceℓ is inert in O, it can be shown that α1 = θ1 and α2 = φ̂ ◦ θ2 ◦ φ are twoelements in O1 that are not commuting (otherwise, at least one of the isogenies
composing φ would be commuting with θ, which is impossible since ℓ ̸= p andis inert in K). Since disc(Z[α1 ]) = −d and disc(Z[α2 ]) = − deg φ2 d, we obtain
the desired bound by applying Proposition 2.4.6.

2.4.2

The case of a maximal quadratic order.

In this section, we focus on the case where O = OK for a quadratic imaginary
field K of discriminant −d. Our main result is Proposition 2.4.19.
To improve the reader’s understanding, we divide the proof of Proposition 2.4.19 into several lemmas and propositions. Next, we give a brief outline
and some insights into the generic principle. Our starting point is the observation (already used to prove Corollary 2.4.8) that if #EO (p) < #SO (p), then50

there are some curves admitting several O-orientations. Similarly to Proposition 2.4.6, our result is obtained through the analysis of the quaternion orders
obtained by combining together the different pairs of orientations. More concretely, we bound the number of these quaternion orders in two very different
ways. The first one is a lower bound depending on #EO (p) and #SO (p) (Proposition 2.4.13) while the second one is an upper-bound (Proposition 2.4.18) thatinvolves an explicit quantity that can be computed from d and p. The combination of these two bounds yields Proposition 2.4.19.
Here are some notations that we will use throughout this section. For any
given E ∈ EO (p), we write NE ≥ 1 for the number of distinct O-orientationsof E. We write ι1 , . . . , ιNE for these NE orientations, they induce the existence of endomorphisms α1 , . . . , αNE ∈ End E such that (ιi (O))1≤i≤NE =(Z[αi ])1≤i≤NE . Since O is the maximal order of K, we can assume that αi is√√−1either ι−1i√( −q) or ιi ((1 + −q)/2) where q is the squarefree integer such that2
K = Q( −q). Let I̸= (NE ) be the set of pairs of distinct unordered elements
2
inside {1, . . . , NE }. We define an equivalence relation ∼E on I̸=(NE ) as(i, j) ∼E (l, m) iff ⟨1, αi , αj , αi αj ⟩ = ⟨1, αl , αm , αl αm ⟩.
Definition 2.4.10. The set of equivalence classes under ∼E is denoted by KE .
We write KE = #KE .
Intuitively, KE is the set of distinct quaternion orders obtained by combining
two embeddings of O inside End E. By definition, we have #SO (p) =P
E∈EO (p) NE . The quantity we propose to study isX

KO (p) =KE(2.4.2)

E∈EO (p)The link between #EO (p) and KO (p). The number KE is obviously related
to NE for every curve E ∈ EO (p). Intuitively, we would like to say that every
pair αi , αj generates a different quaternion order Oi,j with 1 ≤ i < j ≤ NE
(thus proving that KE = NE (NE − 1)/2). However, even if this seems to be
the case with good probability, it is not true in full generality. The correctstatement is given in Proposition 2.4.11. Fortunately, Proposition 2.4.11 stillallows us to derive Corollary 2.4.12 that lower-bounds KE by CNE (NE − 1) forsome constant factor C, which is enough for our purpose.
Proposition 2.4.11. Let Z[α1 ], Z[α2 ], Z[α3 ] be three quadratic order of discriminant −d (with d > 10) contained inside a maximal quaternion order O.
If d ̸≡ 3 mod 4 or d ̸≡ 0, 1 mod p, then α3 ̸∈ O1,2 = ⟨1, α1 , α2 , α1 α2 ⟩. Whend ≡ 0 mod p, either α3 ̸∈ O1,2 or the trace of α1 α2 is equal to 4n(α1 ) and α3is one of ±(tr(α1 )/2 + α1 − α2 ). When d ≡ 3 mod 4 and d ≡ 1 mod p, either
α3 ̸∈ O1,2 or the trace of α1 α2 is (d − 1)/2 and α3 is one of ((d − 1)/4 + α2 −α1 α2 ), ((d − 1)/4 + α1 − α1 α2 ), ((9 − d)/4 − α2 + α1 α2 ), ((9 − d)/4 − α1 + α1 α2 ).
Proof. Since all orders are isomorphic, we can assume that all αi have the same
trace and norm. Let us write t = tr(αi ), n = n(αi ) for any i = 1, 2, 3. The
proof is based on the following claim: any α3 ∈ O1,2 corresponds to a solutionx, y, z ∈ Z[1/2] with x − y, y − z ∈ Z to the quadratic equation:q = q(x2 + y 2 ) + sxy + z 2 (q 2 − s2 /4)
51(2.4.3)

for some integers s, q that we will define below. We exclude the trivial solutions(1, 0, 0) and (0, 1, 0).
As a consequence, our proof can be divided in two parts: first, we prove thecorrespondence between the solutions to Eq. (2.4.3) and the α3 ∈ O1,2 , then wefind the solutions of Eq. (2.4.3) to identify all the possible α3 .
Proof of the claim. If we assume that α3 ∈ O1,2 , then there exists v, x, y, z ∈Z such that α3 = v + xα1 + yα2 + zα1 α2 . The trace of α3 implies the equationt = 2v + t(x + y) + z tr(α1 α2 ). Thus, we rewrite α3 = t/2 + x(α1 − t/2) + y(α2 −t/2) + z(α1 α2 − tr(α1 α2 )/2).
There are two different cases, depending on the value of d mod 4. If d ≡ 0
mod 4 then d = 4q for some square-free q ≡ 1 mod 4 and so we can assume
w.l.o.g. that t = 0 and αi = ωi with ωi2 = −q. Else d = q for some square-freeq ≡ 3 mod 4 and we can take t = 1, αi = (1 + ωi )/2 with ωi2 = −q.
In both cases, let us write s = tr(ω1 ω2 ). If d ≡ 0 mod 4, then we obtain thenorm equation q = n(α3 ) = q(x2 + y 2 ) + sxy + z 2 (q 2 − s2 /4). When d ≡ q ≡ 3
mod 4, we have α3 = (1+ω3 )/2 = 1/2+xω1 /2+yω2 /2+(z/4)(1+ω1 +ω2 +ω1 ω2 −(1 + s/2)). Then, we obtain ω3 = (x + z/2)ω1 + (y + z/2)ω2 + z/2(ω1 ω2 − s/2).
Writing x2 = x + z/2, y2 = y + z/2, z2 = z/2 and taking the norm, we obtain
the equation q = n(ω3 ) = q(x22 + y22 ) + sx2 y2 + z22 (q 2 − s2 /4).
In conclusion, we need to find the solutions x, y, z in Z[1/2] and x − y ∈Z, y − z ∈ Z to the quadratic equation q = q(x2 + y 2 ) + sxy + z 2 (q 2 − s2 /4)
different from the trivial solutions (1, 0, 0) and (0, 1, 0). The end of the proof isdedicated to the enumeration of all possible solutions.
Finding the solutions of Eq. (2.4.3). Throughout this search, we will use
heavily the fact that |s| < 2q (which comes from disc(Z)[ω1 ω2 ] = s2 − 4q 2 < 0).
W.l.o.g. we can assume that s ≥ 0. We can directly remove the case x = y = 0
as it is clearly impossible to find a z such that q = z 2 (q 2 − s2 /4).
Our first step is to find the possible values of z. Let us rewrite our equation
as q = q(x2 +y 2 )+sxy+z 2 (q−s/2)(q+s/2). With the bound (q−s/2)(q+s/2) ≥q/2 we get that we must have z ∈ {0, ±1/2, ±1}. This implies that s ≡ 0 mod 2(otherwise q(x2 +y 2 )+sxy +z 2 (q −s/2)(q +s/2) would not be an integer). With
that additional information, we can actually show that q 2 − s2 /4 ≥ q. Thus, infact we must have z ∈ {0, ±1/2}. We also have q ≥ q(x2 + y 2 ) + sxy.
Now that we have greatly reduced the number of possible z, we can look at
the values x, y. We distinguish two cases, depending on the sign of x, y.
Let us assume that xy ≥ 0. Then, we have q ≥ q(x2 + y 2 ) + sxy. Thus,
we must have x2 + y 2 ≤ 1. Since we exclude (x, y) ∈ {(0, 0), (0, 1), (1, 0)},the only possibility respecting all our constraints is (x, y, z) = (1/2, 1/2, ±1/2).
Thus, we obtain q = q/2 + s/4 + q 2 /4 − s2 /16 which leads to the equationq 2 −2q+s(1−s/4) = 0. The discriminant of the polynomial X 2 −2X +s(1−s/4)
is equal to 4 − 4s + s2 = (s − 2)2 . The two possible solutions are s/2 and(4 − s)/2. The first one is impossible by the bound s < 2q. Since s ≥ 0 we
obtain (4 − s)/2 < 2 and this is incompatible with the bound d > 10.
We have seen that we have no solutions to Eq. (2.4.3) when xy ≥ 0. Let
us now consider the case xy < 0. W.l.o.g. we can assume that x > 0 andy < 0. Then, we have q ≤ q(x2 + y 2 ) − s|xy|, but the bound s < 2q leads to theinequality q(x2 + y 2 ) − s|xy| > q(x2 + y 2 ) − 2q|xy| = q(x + y)2 . If we want toavoid a contradiction between these two bounds, then we must have |x + y| < 1.
Since x − y ∈ Z, the only possibility is x = −y.

52

When x = −y, we can rewrite Eq. (2.4.3) as
q = (q − s/2)(2x2 + z 2 (q + s/2)).

(2.4.4)

Let us study this new equation. Since we have only a few possibilities for z,
we can simply see what happens with Eq. (2.4.4) for each value of z. Since theequation is in z 2 there are two cases: z = 0 and z = ±1/2.
If z = 0, we get q = x2 (2q − s) where x ∈ Z and so the only solution isx = 1 and s = q since q is square-free. However, looking at the discriminantof ⟨1, ω1 , ω2 , ω1 ω2 ⟩ with Proposition 2.4.5, we get that p must divide q as it
divides the discriminant of any maximal order in Bp,∞ . In that case, we havethe solution (x, y, z) = ±(1, −1, 0).
If z = ±1/2, the requirement x − z ∈ Z implies that we can write x = x′ /2
with x′ ≡ 1 mod 2. Putting all this in Eq. (2.4.4), we get q = (q − s/2)x′2 /2 +1/4(q − s/2)(q + s/2) (we recall that s′ := s/2 is in Z). It is clear that we musthave q ± s′ ≡ 0 mod 2 so let us write q ± s′ = 2q± . Our equation becomes
q = q− + q+ = q− x′2 + q+ q− which implies that q+ ≡ 0 mod q− . Thus, wemust have q+ = kq− for some k ∈ Z and Eq. (2.4.4) becomes q = (k + 1)q− =q− (x′2 + kq− ) which can only be satisfied if x′ = 1 and q− = 1. In that case,the only possible solution (up to signs) is (x, y, z) = (1/2, −1/2, ±1/2) whens = 2q − 4.
In summary, we have showed that our equations have the non-trivial solutions ±(1, −1, 0) when d ≡ 0 mod p and s = q or ±(1/2, −1/2, ±1/2) whend ≡ 3 mod 4 and s = 2q − 4 and none otherwise. We conclude the proof bycomputing what are the corresponding values of α3 , so we compute the concretevalues v, x, y, z ∈ Z such that α3 = v +xα1 +yα2 +zα1 α2 (note that these values
x, y, z are not directly the solutions to Eq. (2.4.3) when d = 3 mod 4, see theproof of our claim at the beginning of the proof).
For the first solution, selecting the value v to verify the trace equation we
get that α3 = ± tr(α1 ) + α1 − α2 . It is easily verified that tr(α1 α2 ) = 4n(α1 α2 )when s = q. Otherwise, α3 = v + xα1 + yα2 + zα1 α2 can only have a solution
when d ≡ q ≡ 3 mod 4 and tr(α1 α2 ) = 1/2 + 1/4(tr(ω1 ω2 )) = (d − 1)/2. Bycomputing the discriminant of Z⟨1, α1 , α2 , α1 α2 ⟩ with Proposition 2.4.5 whentr(α1 ) = tr(α2 ) = 1 and tr(α1 α2 ) = (q − 1)/2, we see that ∆ = d − 1 and so p
divides d − 1. This proves that d ≡ 1 mod p is also a necessary condition forour equation to be satisfied.
The other possibilities for α3 can easily be found by taking (x + z/2, y +z/2, z/2) = ±(1/2, −1/2, ±1/2) and v be such that tr(α3 ) = 1.
E −1)Corollary 2.4.12. KE ≥ NE (N.
12

Proof. From αl ̸∈ Oi,j or αm ̸∈ Oi,j ⇒ (i, j) ̸∼E (l, m) for any i, j, m, l, we see2from Proposition 2.4.11 that the cardinality of any equivalence class in I̸=(NE )must be smaller than 6, as there at most four elements αi′ contained in Oi,j andwe must choose two among the possible i′ to get a full quaternion order. This2
bound combined with #I̸=(NE ) = N (N − 1)/2 gives the result directly.
The bound obtained in Corollary 2.4.12 is the key ingredient to the inequality
between #EO (p), #SO (p) and KO (p) in Proposition 2.4.13.
2

1 #SO (p)Proposition 2.4.13. KO (p) ≥ 12
( #EO (p) − #SO (p))

53

P
Proof. We have #SO (p) =Using Corollary 2.4.12, we get
E∈EO (p) NE .
PP
2
≥ (1/12) E∈EO (p) (NE − NE ). Then, we can use the classicalE∈EO (p) K
Pn
PEn
inequality i=1 x2i ≥ (1/n)( i=1 xi )2 to get the result.
A generic upper-bound of KO (p). If (i, j) is a representative of a classk ∈ KE , we define tk as the value of tr(αi αj ) and Ok as the quaternion orderequal to the image of ⟨1, αi , αj , αi αj ⟩ under the isomorphism between Bp,∞
and End E ⊗ Q (by definition of KE , tk and Ok are independent of a choiceof i, j). The idea is to look at the embedding number
P of the different orders
Ok for k ∈ KE and E ∈ EO (p) in order to rewrite E∈EO (p) KE . With thenotation from Section 1.2.2, we write this number e(Ok ) for a given class k andwe compute it in Proposition 2.4.15. Before proving this result, we need tounderstand a bit better the structure of the orders Ok . This is the purpose ofLemma 2.4.14.
Lemma 2.4.14. Let E be a curve in EO (p) and k ∈ KE . The order Ok is a
Bass order.
Proof. One of the several equivalent definitions of Bass orders inside Bp,∞ isthat they contain a maximal order inside a commutative subalgebra of Bp,∞
[Voi21, Section 24.5]. Since O is the maximal order of K, and the property
follows from the definition of Ok .
With the knowledge that the Ok are Bass orders, we can use Proposition 1.2.10 and Proposition 1.2.21 to compute e(Ok ).
Proposition 2.4.15. Let Dk = disc(Ok )/p. The embedding number of Ok isYYe(Ok ) =(vℓ (Dk ) + 1)
2.
ℓ∈PDk ,(d/ℓ)=1ℓ∈PDk ,(d/ℓ)=0,ℓ̸=pProof. If we show that when ℓ is a prime dividing Dk , (O/ℓ) = (d/ℓ), thenthe result follows from Proposition 1.2.21 and Lemma 2.4.14. First, note thatwhen ℓ = p, the local embedding number eℓ (O) is always equal to 1 (it is aconsequence of Propositions 1.2.10 and 1.2.21 and the fact that (d/p) ̸= 1).
Then, it suffices to prove the result for the cases where ℓ ̸= p is either split
or ramified in K. The two results (d/ℓ) = 1 ⇒ (O/ℓ) = 1 and (O/ℓ) = 0 ⇒(d/ℓ) = 0 are easily implied by Proposition 1.2.10. To conclude, it suffices toshow (O/ℓ) = 0 ⇐ (d/ℓ) = 0, as (O/ℓ) = 1 ⇒ (d/ℓ) ∈ {0, 1}. For that, we willshow that ℓ divides the discriminant of every α ∈ Ok . We recall that there exists
αi , αj with O ∼= Z[αi ] ∼= Z[αj ] and Ok = ⟨1, αi , αj , αi αj ⟩. By assumption, theproperty is satisfied for αi , αj . We recall the value of Dk = (d2 − (ε − 2tk )2 )/4p
where ε = tr(αi ) tr(αj ). From ℓ | Dk and ℓ | d, we get that ℓ must divide
2tk − ε which implies that ℓ | ∆(αi αj ). Then, using ℓ | d and ℓ|(2tk − ε), we canconclude that ℓ|∆(x + yαi + zαj + wα1 α2 ) for any x, y, z, w ∈ Z4 .
The value of disc(Ok ) is (d2 − (tr(αi ) tr(αj ) − 2tk )2 )/4 by Proposition 2.4.5.
It can be shown that tr(αi ) tr(αj ) is a constant that is either 0 or 1 depending
only on the value of d mod 4. Henceforth, we write this constant εd . Inspiredby the formulation of Proposition 2.4.15, we define the functions
D : (t, d, p) 7→(d2 − (εd − 2t)2 )
4p
54

and
e : (t, d, p) 7→YY(vℓ (D(t, d, p)) + 1)ℓ∈PD(t,d,p) ,(d/ℓ)=12.

ℓ∈PD(t,d,p) (d/ℓ)=0,ℓ̸=p

Let us define TO (p) = {tk |k ∈ KE for E ∈ EO (p)}. For each t ∈ TO (p),the values D(t, d, p) and e(t, d, p) are well-defined, when p is prime and d is afundamental discriminant coprime to p.
Proposition 2.4.16. Let O be the maximal quadratic order of discriminant−d. Then,X
1 X
e(t, d, p) ≤ KO (p) ≤e(t, d, p)
12t∈TO (p)t∈TO (p)Proof. By definition, we have that for every class k, there exists t ∈ TO (p)with t = tk and e(Ok ) = e(t, d, p). Thus, each class k corresponds to at least
one embedding of Ok inside a maximal order and so we must have KO (p) ≤Pt∈TO (p) e(t, d, p).
The lower bound of KO (p) is more delicate to obtain. For that, we willneed to quantify the maximum number of embedding that corresponds to thesame class k. Let us take an element t ∈ TO (p). By definition of TO (p), there
exists a curve E ∈ EO (p) and a class k ∈ KE with tk = t. By definition of theembedding number, there exist e(t, d, p) distinct maximal orders containing Ok .
Each of these maximal orders O′ corresponds to the isomorphism class (up to
Galois conjugacy) of supersingular curve E ′ under the Deuring Correspondence.
By definition there also exists a class k ′ ∈ KE ′ such that Ok′ ∼= Ok .
We will provide an upper bound on the number of these e(t, d, p) classes thatare equal. Up to composition with the relevant isomorphisms, we can assume
that all the orders Ok′ are actually equal (and not simply isomorphic). Let us
take O1 ̸= O2 , maximal orders with Ok ⊂ Oi for i = 1, 2 and assume that these
two embeddings of Ok lead to the same class k ′ and curve E ′ . We must haveO1 ∼= O2 ∼= End E ′ , so let us write σi : Oi → End E the isomorphisms. By definition of our equivalence relation, we must have σ1 (Ok ) = σ2 (Ok ), which meansthat Ok is stable under the isomorphism σ1−1 ◦ σ2 : O2 → O1 . This shows thatour problem reduces to counting the number of isomorphisms that leave stableOk but are not the identity. For that, it suffices to count the number of possible
images of the two elements αi , αj such that k = (i, j). Proposition 2.4.11 tells
us that there are at most two other elements of same norm and trace as αi , αj .
Thus, we have 3 × 4 = 12 possible image pair for αi , αj , and so we can conclude
that each class k corresponds to at most 12 distinct embeddings of Ok inside
distinct maximal orders. This proves the result.
With Proposition 2.4.16, we have all the necessary ingredients to prove ourgeneric upper-bound of KO (p). We introduce in Definition 2.4.17, a final notation to simplify the formulation of Proposition 2.4.18.
Q
Definition 2.4.17. The function τ : N → N is defined as τ (N ) =(vℓ (N ) +ℓ∈PN1), and it computes the number of divisors of N .
lm
Proposition 2.4.18. KO (p) ≤ d+1max
τ (N ).
4p
2
0≤N ≤d /(4p)55

Proof. It is clear from the definition of the functions τ, D, e that τ (D(d, t, p)) ≥e(d, t, p). Since 0 ≤ D(t, d, p) ≤ (d2 )/4p we get thatXe(t, d, p) ≤ #TO (p)maxτ (N ).
20≤N ≤d /(4p)t∈TO (p)Next, we prove that #TO ≤ ⌈(d + 1)/4p⌉. If t ∈ TO , we must have that
D(d, t, p) = disc(Ok )/p ∈ N for some class k. The condition on the discriminant
yields d2 − (εd − 2t)2 ≡ 0 mod 4p and d2 > (εd − 2t)2 . When t > 0, we have2|t| − εd > 0 and so get the bound (|d| + εd )/2 > |t|. There are two possible
values of t mod 4p and combining that with 0 < |t| < (|d| + εd )/2 we obtain at
most ⌊(d + 1)/(4p)⌋ possible values. Adding t = 0, we obtain the desired bound.
The proof is concluded by Proposition 2.4.16.
We obtain a generic lower bound on #EO (p) in Proposition 2.4.19. It is acombination of Proposition 2.4.13 and Proposition 2.4.18.
AB
Proposition 2.4.19. #EO (p) ≥ A+B≥ 21 min(A, B) where A = #SO (p) and2#SO (p)B = 3(4p+d+1)

pmax

0≤N ≤d2 /4p

τ (N ) .

Before proving Proposition 2.4.19, we prove a useful lemma.
Lemma 2.4.20. For every 3 values x, A, B > 0 such that x ≥ λA or x ≥AB(1 − λ)B for every 0 < λ < 1 we have that x ≥ A+B≥ 12 min(A, B).
Proof. We are going to start with the intermediary result that x ≥ λA or x ≥(1−λ)B for every 0 < λ < 1 implies that x ≥ max0<λ<1 min(λA, (1−λ)B). The
function λ 7→ min(λA, (1−λ)B) is increasing on ]0, λm ] and decreasing on [λm , 1[
for the value λm such that λm A = (1 − λm )B. Thus, we get λm = B/(A + B)
and max0<λ<1 min(λA, (1 − λ)B) = λm A = AB/(A + B).
To conclude it is easy to verify that1AB≥ min(A, B).
A+B
2

Proof. (Proposition 2.4.19) We will apply Lemma 2.4.20 with x = #EO (p) andthe values A, B as in Proposition 2.4.19. Thus, we need to prove that either#EO (p) ≥ λA or #EO (p) ≥ (1 − λ)B for any 0 < λ < 1.
Note that when #EO (p) < λ#SO (p) for some λ ≤ 1, we must have KO (p) >0 because there is at least one curve with two distinct orientations. Thus,
Proposition 2.4.13 proves that
#EO (p) ≥#SO (p)2 − #SO (p)#EO (p).
12KO (p)For any λ ∈ [0, 1], if #EO (p) < λ#SO (p), we have that
#EO (p) > (1 − λ)#SO (p)2.
12KO (p)The proof is concluded by Proposition 2.4.18 and ⌈(d + 1)/4p⌉ ≤ 1 + (d +1)/4p.
56

Remark 2.4.21. Our bound becomes less and less tight when the size of d grows
in comparison to p. Asymptotically, we have
#SO (p)2
d→∞ 3(4p + d + 1)

p

lim

max2

0≤N ≤d /4p

τ (N )=0which is very far from the expected EO (p) = Np when d → ∞. However, whenthe value of d is polynomial in p, classical analysis on the τ function detailed
below shows that our bound will never be trivial even as p grows to infinity (seeEq. (2.4.6)). This is typically the case needed for isogeny-based cryptography
as illustrated by our numerical application in Section 6.5.4 for a prime p ≈ 2400
and a discriminant d satisfying p < d < p2 .
Remark 2.4.22. Note that we can derive a family of upper bounds on the classnumber h(O) from Proposition 2.4.19. Indeed, since we have the trivial boundp/12 + 1 ≥ Np ≥ #EO (p), in the cases where A > B (which will happen when dis much bigger than p as explained in Remark 2.4.21), we obtain p/12+1 ≥ B/2.
When we replace #SO (p) by the correct value ch(O) (with c ∈ {1/2, 1}) in theformula for B we obtainh(O)2 <

(p + 12)(4p + d + 1)
max τ (N ).
2c2 p
0≤N ≤d2 /4p(2.4.5)Intuitively, the best bounds should be obtained when d ≈ p. The estimates weprovide on τ (N ) below does not allow us to conclude that this would lead to an
improvement on the state of the art upper bounds on class numbers.
Remark 2.4.23. When p divides d, it might be possible to get better bounds.
For instance, when d/p is a prime smaller than p/4, a lower bound was provenin [EHL+ 20, Theorem 3.9], using the fact that a curve in EO (p) must be d/pisogenous to its Galois conjugate E p . Another possibility, is to exploit thefact that when d ≡ 0 mod p, the element ω1 ω2 /p is integral (see the proof of
Proposition 2.4.11 for the definition of ω1 , ω2 ) and so we may be able to consider
superorders of the Ok (which might give a better bound since the discriminants
are smaller). While this idea seems promising, it does not appear trivial toobtain the analogue of Proposition 2.4.11 and this is why we left the study ofthis special case open for future work.
Upper bound on the number of divisor functions. The number of division function τ is well-studied and generic upper-bounds can be found in theliterature. Since Wigert [Wig07], we know that τ (N ) = O(N ε ) for any ε > 0.
In 1983, Nicolas and Robin showed thatlog(N )

τ (N ) ≤ 2η1 log log(N ) , for any N ≥ 3(2.4.6)

where η1 = 1.53793986 . . ..
More recently De Konick and Letendre [DKL18] proved several new upperbounds involving ω(N ) the number of distinct prime factors of N . In particularthey showed that for any composite n ≥ 2τ (N ) ≤log(N )
1 + η3
ω(N ) log(ω(N ))57

ω(N )(2.4.7)

where η3 = 1, 1999953 . . .
When ω(N ) ≥ 74 they even prove thatτ (N ) ≤1+log(N )
ω(N ) log(ω(N ))ω(N )(2.4.8)We will ued this last bound in the numerical application we propose in Section 6.5.4.

2.4.3

The case of non-maximal orders

In this section, we provide an upper-bound on #EO (p) when O is not maximal.
Most of the ideas exposed below are not fundamentally new, and have been
considered for instance by Lubotzky, Phillips and Sarnak [LPS86], but we expose
them here for completeness as simple statements matching our needs are rather
hard to extract.
For the rest of this section, let us take O = Z + f O0 where f > 1 iscoprime to p and O0 is a maximal quadratic order. The fundamental property
underlying our result in Proposition 2.4.26 is summarized in Proposition 2.4.24.
This is a consequence of [LB20, Lemma 5.4, Corollary 5.5] showed by Love
and Boneh (they talk about optimal embeddings inside maximal orders rather
than orientations of elliptic curves in their paper but the two notions are thesame under the Deuring Correspondence) and the standard characterization ofhorizontal, ascending and descending isogenies (see [CK19, Onu21] for instance).
Proposition 2.4.24. Let O be a quadratic order of conductor f and discriminant d such that EO (p) is not empty. Let ℓ ̸= p be a prime number. For every
curve E ∈ EO (p), among the ℓ + 1 curves ℓ-isogenous to E, there are ℓ − (d/ℓ)
curves contained in EZ+ℓO . If ℓ is coprime to f , the 1 + (d/ℓ) remaining curves
are in EO (p) and if not, then the final curve is contained in EO′ (p) where O′ isthe quadratic order of discriminant d/ℓ2 such that O = Z + ℓO′ .
Note that by ℓ-isogenous we mean connected by an ℓ-isogeny (that must
be cyclic since ℓ is prime). From Proposition 2.4.24, we see that we can tie
the generic case to the case of fundamental discriminant using the expansion
properties of the isogeny graphs. For simplicity, we assume henceforth thatf = ℓe for some prime ℓ and e ∈ N and O0 is any maximal quadratic order.
By Proposition 2.4.24, each coprime factor of the conductor can be treatedindependently . The exact bound in Proposition 2.4.26 depends on whether ℓis split, ramified or inert in K but the three cases can be treated in a similarmanner. As a warm-up, we start with Proposition 2.4.25, to give a lower boundon the number of curves that are f -isogenous to a curve in an arbitrary subset
E0 of the isomorphism classes of supersingular curves over Fp2 .
For any prime ℓ coprime to p, the graph of cyclic ℓ-isogenies on isomorphismclasses of supersingular curves is Ramanujan with degree of regularity equal toℓ + 1. For ℓe -isogenies, we obtain an almost-Ramanujan graph with degree of
regularity equal to λ1 (ℓe ) = ℓe (1+1/ℓ). We write A(ℓe ) for the adjacency matrixof the graph of cyclic ℓe -isogenies on supersingular curves. The matrices A(ℓr )for r ∈ N are related to the Brandt matrices B(ℓr ) for r ∈ N under the relationA(ℓr ) = B(ℓr ) − B(ℓr−2 ) and B(ℓ) = A(ℓ) and B(1) = A(1) = I. The Brandt
matrices B(m) correspond to the action of the Hecke operator Tm on the space58

of modular forms of weight 2 on
) when m and N are coprime. The graphPrΓ0 (Niassociated to the B(ℓr ) areℓ-regular.
The matrices A(ℓr ) and B(ℓr )i=0
are real symmetric positive and have Np ordered real eigenvalues. The biggest
eigenvalue is always equal to the degree of regularity k of the associatedgraphpand the corresponding eigenspace is generated by the vector (1/ Np )1≤i≤Np ofnorm 1. The expansion of the graph can be measured by the size of the second
eigenvalue.
The graph is said to be Ramanujan when this value is smaller than√
2 k − 1. A consequence of the Riemann hypothesis for function fields, provenrby Deligne (see [Kat76]√ for instance) is that the second eigenvector of B(ℓ ) issmaller than (r + 1) ℓr . When r = 1, this proves that the graph of ℓ-isogenies
is Ramanujan. For r > 1, the bound is not good enough to prove the samething. This is why the other graphs are to be almost-Ramanujan. We will use
A(ℓr ) = B(ℓr ) − B(ℓr−2 ) to deduce results on the expansion of the graph of ℓeisogenies.
Proposition 2.4.25. Let e ∈ N and ℓ ∈ P different from p and let E0 be a
non-empty subset of isomorphism classes of supersingular elliptic curves. Let
us write C0 = #E0 and write Eℓe for the set of isomorphism classes of curvesℓe -isogenous to a curve of E0 . We have the bound#Eℓe ≥

NP
2 e

2 e−2

ℓ
1 + (NP /C0 − 1) (e+1) ℓλ1+(e−1)(ℓe )2.

Proof. Assume that we have an ordering E1 , . . . , ENp of all supersingular elliptic
curves (up to isomorphism). Let us write X = (xi )1≤i≤Np ∈ RNp , the vector
such that xi = 1 if Ei ∈ E0 and 0 otherwise. If we write Y = A(ℓe )X, then #Eℓe
is equal to the number of non-zero entries of Y . A very classical bound tells us
that∥Y ∥21#Eℓe ≥.
∥Y ∥22We see easily that ∥Y ∥1 = λ1 (ℓe )C0 . To upper-bound ∥Y ∥22 , we are going to
use the Ramanujan property. Let us write f1 , . . . , fNp the orthonormal basis ofpeigenvectors of A(ℓe ). We already explained that f1 = (1/ Np )1≤i≤Np . We can′′write X = z1 fp
1 + X where X is orthogonal to f1 . The coefficient z1 is equal to⟨X, f1 ⟩ = C0 / Np . We have ∥A(ℓe )X∥22 = λ1 (ℓe )2 z12 + ∥A(ℓe )X ′ ∥2 . We havethe equality A(ℓe ) = B(ℓe )−B(ℓe−2 ). The vector X ′ lies in a space of dimension
Np − 1√where all the eigenvalues of B(ℓr ) have absolute value smaller than(r + 1) ℓr for every r ≥ 1. We have ∥A(ℓe )X ′ ∥22 ≤ ∥B(ℓe )X ′ ∥22 + ∥B(ℓe−2 )X ′ ∥22by the triangular inequality. Thus, ∥A(ℓe )X∥22 ≤ λ1 (f )2 z12 + ((e + 1)2 ℓe + (e −1)2 ℓe−2 )∥X ′ ∥22 . We can easily compute that ∥X ′ ∥22 = ∥X∥22 − z12 . Thus we
obtain ∥Y ∥22 ≤ λ1 (ℓe )2 C02 /Np + ((e + 1)2 ℓe + (e − 1)2 ℓe−2 )(C0 − C02 /Np ). Thus,
we obtain#Eℓe ≥ λ (ℓe )2 C 2
1

0

Np

#Eℓe ≥λ1 (ℓe )2 C02+ ((e + 1)2 ℓe + (e − 1)2 ℓe−2 )(C0 − C02 /Np )
NP
2 e

2 e−2

ℓ
1 + (NP /C0 − 1) (e+1) ℓλ1+(e−1)(ℓe )259.

Proposition 2.4.26. Let O = Z + ℓe O0 for some ℓ ∈ N coprime to p and amaximal quadratic order O0 . Let us write C0 = #EO0 .
If ℓ is inert in K:#EO (p) ≥

NP
2 e

2 e−2

+(e−1) ℓ
1 + (NP /C0 − 1) (e+1)(ℓℓe +ℓ
e−1 )2,else if ℓ is ramified:#EO (p) ≥NP
2 e

2 e−1 )

1 + (NP /C0 − 1) ((e+1) ℓℓ2e+e ℓ,else, ℓ is split and:#EO (p) ≥1 + (NP /C0 − 1)NP.
⌊(1+j)/2⌋ −2⌊(1+j−2)/2⌋ )2 (e−j+1)2 ℓe−j+1(2
j=0(ℓe −ℓe−1 )2Pe

Proof. The case ℓ inert is a simple combination of Proposition 2.4.24 and Proposition 2.4.25 since the set EZ+ℓO (p) is exactly the set of curves ℓ-isogenous tocurves in EO (p). When ℓ is ramified or split, the situation is slightly more complicated. In fact, in both cases, the result is obtained by rewriting the reasoning
used in the proof of Proposition 2.4.25. Indeed, we are going to show that
#EZ+ℓe O0 is equal to the number of non-zero entries of a vector Y computed as
M X where X is defined as in the proof of Proposition 2.4.25 and M is a liner
combination of the A(ℓi ) for i ∈ [0, e]. For Proposition 2.4.25 (and ℓ inert) we
can simply take M = A(ℓe ). When ℓ is not inert, we need to remove some of
the ℓe isogenies and this is why we have a more complicated expression for M .
For what remains, let us assume that the labelling of the NP -isomorphism classesof supersingular curves is such that E1 , . . . , EC0 are the C0 curves contained inE ∈ EO0 (p). Xi is the vector of NNp such that (Xi )j = 1 if j = i and 0 otherwise
PC0
and X = i=1
Xi .
When ℓ is ramified, Proposition 2.4.24 implies that there exists a permutation
σ of [1, C0 ] such that Ei and Eσ(i) are ℓ-isogenous and σ 2 is the identity. To
get the curves of EO (p), we need to exclude all the ℓe -isogenies that can be
written as ϕ ◦ φi where φi is the ℓ-isogeny between Ei and Eσ(i) . A(ℓe )Xi gives
all the curves that are ℓe -isogenous to Ei . To remove the ones that are obtained through the wrong isogenies we can subtract by A(ℓe−1 )Xσ(i) but withthat we have also subtracted the curves that are ℓe−2 -isogenous to Ei . So weneed to compensate
by adding A(ℓe−2 )Xi and iterating thisPreasoning, we endPeeup with the j=0 (−1)j A(ℓe−j )Xσj (i) . Thus, we get M = j=0 (−1)j A(ℓe−j )after summing this formula for all i ∈ [1, C0 ]. The lower bound on the numberof zeroes P
of Y = M X is given by ∥Y ∥21 /∥Y ∥22 . A simple counting gives thate2
∥Y ∥1 = ( j=0 (−1)j λ1 (ℓei ))2 = ℓ2e . To lower bound ∥Y ∥22 , we see that M has
the same eigenvector f1 (see the notations of the proof of Proposition 2.4.25)
p for
the eigenvalue ℓ2e . Thus, we can decompose X = z1 f1 + X ′ with z1 = C0 / Np .
Once again we replace each A(ℓr ) by B(ℓr ) − B(ℓr−2 ) and B(ℓ) = A(ℓ) andB(1) = A(1). Interestingly, a lot of terms cancel out in M and we end with
B(ℓe ) − B(ℓe−1 ). As in the proof of Proposition 2.4.25, we conclude with thebound on the eigenvalues of the B(ℓr ) and the triangular inequality. This is
how we get ∥M X ′ ∥22 ≤ ((e + 1)2 ℓe + e2 ℓe−1 )∥X ′ ∥22 . The proof is concluded in a60

similar way to Proposition 2.4.25.
When ℓ is split, we have by Proposition 2.4.24 that there exists two permutations σl , σr such that Ei is ℓ-isogenous to Eσl (i) and Eσr (i) and σl ◦ σr = σr ◦ σlis the identity. A similar reasoning proves that we can takeM=eX(−1)j 2⌊(1+j)/2⌋ A(ℓe−j ).

j=0Once again, we use our relation between
Pe A and B matrices to get a sum on
the B(ℓe−j ). We have ℓe (1 − 1/ℓ) = j=0 (−1)j 2⌊(1+j)/2⌋ λ1 (ℓe−j ) and the final
result follows from the same ideas as before.

61Chapter 3

Resolution of norm
equations in quaternion
lattices
In this chapter, we study the problem of finding elements of given norm insidesome families of lattices in Bp,∞ . Overall, we will cover orders whose Gorenstein
closure are Eichler orders and their ideals.
The basis for all the content of this chapter have been laid out by Kohel,
Lauter, Petit and Tignol in their seminal paper ”On the quaternion ℓ-isogeny
path problem” [KLPT14]. In particular, they introduced all the building blocks
RepresentInteger, StrongApproximation, IdealModConstraint, EquivalentPrimeIdeal
and the KLPT algorithm. Our contribution is to show how to reuse and modify
these building blocks to expand upon the range of lattices that we are able totreat. The content of this chapter is a mix between some results presented in
our publications [DFKL+ 20, DFLW22, Ler21].
The problem originally targeted by [KLPT14] is called the Quaternion N isogeny path problem.
Problem 3.0.1. Let N ⊂ N. Given a maximal order O and I, a left O-ideal.
Find J ∼ I of norm in N .
In Section 2.2, we have already mentioned the importance of the KLPT algorithm and we will provide in Chapter 4, and later in Chapter 5, new reasons
behind our interest in these algorithms. Motivated by these applications, ourgoal is to obtain practical and efficient algorithms. Most of the proofs andanalysis below are relying on plausible heuristics that have been verified experimentally. When a result bears the mention (UPHA), it means that it holds
under plausible heuristic assumptions. The Generalized Riemann Hypothesis(GRH) will often be among those assumptions but it is not the only one.
We imitate the formulation of Problem 3.0.1 and index our algorithms bya set N to indicate that it will look for solutions whose norm is contained in
N . In all our algorithms, we will always strive to minimize as much as possible
the norm of the output without impacting too much the performances. This
principle might be worth keeping in mind to understand some of the choicesthat we are going to make.
62

If c ∈ N, we define cN = {cn, n ∈ N }. For simplicity, in our algorithms,
we will also assume that the set N is such that if n ∈ N , then all d|n are also
contained in N . This will be true for the sets that we will use in practice. One
example of such set is ℓ• = {ℓe , e ∈ N}. Another is D(M ), the sets of divisor of
M . When n1 ∈ N , we write N /n1 = {n/n1 , n ∈ N and n/n1 ∈ N}.
Remark 3.0.2. In fact, the authors of [KLPT14] only considered the case whereN = ℓ• , but variants where the elements can have powersmooth norm were later
introduced by [GPS17]. As the method of resolution is quite similar for any N ,we consider the generic case.
In Sections 3.1 and 3.2, we mostly present the results from [KLPT14] leading
to the KLPT algorithm. We introduce our contributions in Sections 3.3 and 3.4.

3.1

The case of special extremal orders

One notion that will be of great importance to us in this chapter and the next isthe one of special extremal order from [KLPT14]. We will keep the notations introduced in Definition 3.1.1 throughout this chapter. We use the basis ⟨1, i, j, k⟩
for Bp,∞ where i2 = −a for some integer a > 0, j 2 = −p and k = ij = −ji.
Definition 3.1.1. Let O be a maximal order in Bp,∞ . We say that O is aδ-special extremal if the unique two-sided ideal of norm p in O is equal to
OjO for some jO ∈ O of norm p and there is a quadratic order O ⊂ O of
discriminant −δ such that the orthogonal complement of O (with respect to theinner product of Bp,∞ defined in Eq. (1.2.4)) is OjO . For each type of special
extremal orders, we consider the canonical representation as the one satisfying
jO = j and O ⊂ Q(i). The generator of O is written ω and the norm form of
O is noted fO . The special extremal order of Bp,∞ is a δ-special extremal orderwith smallest possible δ (arbitrarily chosen among all the at most 2 types ofδ-special extremal order [CPV20, Theorem 26]).
Remark 3.1.2. We will denote by O0 the special extremal order of Bp,∞ and q√
is the square-free integer such that Q( −q) ∼= Q ⊗ O. In fact, we have alreadyencountered one of those orders in the beginning of Section 2.1.3. Indeed, whenp = 7 mod 12, the smallest possible δ is 4 and we can take the canonical δspecial extremal order to be
O0 = ⟨1, i,

i+j 1+k,⟩2
2(3.1.1)and we have q = 1. We saw that this maximal order corresponded to thesupersingular curve E0 of j-invariant 1728. Examples of special extremal orders
for other primes are given in [KLPT14]. Under GRH, a result of Ankeny [Ank52]
proves that q = O(log(p)2 ). We will use this estimate for our complexity analysis
throughout this chapter. We call the special-extremal curve over Fp2 to be thecurve (up to isomorphism) whose endomorphism ring is isomorphic to the special
extremal order of Bp,∞ . Note that this isomorphism class is well-defined since
it is defined over Fp because the two-sided ideal of norm p is principal.
Lemma 3.1.3. The suborder ⟨1, ω, j, jω⟩ has index disc(O) in O0 and its norm
form is given by
f0 : (t, x, y, z) 7→ fO (t, x) + pfO (y, z).
(3.1.2)
63

The idea from [KLPT14] is that it is relatively easy to solve norm equationsin the suborder ⟨1, ω, j, jω⟩ ⊂ O0 given by the norm form f0 above. Theiralgorithm RepresentInteger to perform that task is presented later in this section,
but we need first to find solutions to the binary quadratic equations of the formfO (t, x) = m. In Section 3.1.1, we present Cornacchia’s algorithm to solve thatproblem.

3.1.1

Cornacchia’s algorithm

We present, as Algorithm 1, Cornacchia’s algorithm [Cor08] to solve quadratic
equations of the form t2 +qx2 = m in Z. When there is a solution for a given m, q,
Cornacchia will find it. The efficiency mainly depends on the hardness of a squareroot computation mod m. This operation basically comes down to factoringm. In particular, when m is prime or a near-prime, the factorization is easy tofind and so Cornacchia will be efficient. To preserve the efficiency, we assume
that Cornacchia starts by checking if m is prime or near-prime with an algorithm
TrialFactorization. When m satisfies the condition, TrialFactorization outputs thefactorization of m and the computation proceeds, otherwise, Cornacchia outputs⊥.
Algorithm 1 Cornacchia
Input: q, m ∈ N.
Output: ⊥ or t, x ∈ Z such that t2 + qx2 = m.
1: fac ← TrialFactorization(m).
2: if fac =⊥ then3:
Return ⊥.
4: end if
5: Determine if −q is a square mod m using fac.
6: if −q is not a square. then7:
Return ⊥.
8: end if
9: Compute r−2 a square root of −q mod m using fac.
10: Set r−1 = m and i = −1.
11: repeat
12:
i←i+1
13:
ri ← ri−2 mod ri−1 .
2
14: until ri2 < m < ri−1.
2
15: if m − ri ̸= 0 mod q then16:
Try again with another square root of −q mod m and if it is not possible
return ⊥.
17: end ifp
18: t ← ri , x ←(m − t2 )/q
19: if x ̸∈ Z then20:
Try again with another square root of −d mod m and if it is not possible,
return ⊥.
21: end if
22: return t, x
If q is fixed, the probability that there exists a solution for some random m is64

proportional to 1/h(OQ(√−q) ). The expected running time is O(poly(log(qm))).

3.1.2

Representing integers by the norm form of the special extremal order.

Once we have Cornacchia to solve efficiently norm equations of the form fO (t, x) =m, we can devise easily an efficient algorithm to find solutions to f0 (t, x, y, z) =M . The generic idea used both in RepresentInteger and StrongApproximation is
to sample y, z in some randomized way and try to see if we can find t, x suchthat fO (t, x) = M − pfO (y, z) with Cornacchia. The algorithm RepresentInteger
was introduced by the authors of [KLPT14] and uses this idea quite straightforwardly to find elements of a given norm.
Algorithm 2 RepresentIntegerN
Input: N ⊂ Z such that there exists M ∈ N with M > p
Output: γ = t + xω + yj + zjω with n(γ) ∈ N .
1: Set M ∗ = {}.
2: Select the smallest
M ∈ N ∖ M ∗ such that M > p.
q
M
3: Set m = ⌊ p(1+q) ⌋ and sample random integers y, z ∈ [−m, m]2 . Set
M ′ = M − pfO (y, z).
4: If Cornacchia(fO , M ′ ) = ⊥ go back to Step 3 or Step 2 if all pairs y, z havebeen tried. Otherwise, set t, x = Cornacchia(fO , M ′ ).
5: return γ = x + ωy + j(z + ωt).
We formulate a statement on the running time of RepresentInteger in Lemma
3.1.4. We remind the reader that D(M ) is the set of divisors of M .
Lemma 3.1.4. (UPHA) Let M > p be an integer and N = D(M ). The numberMof possible outputs γ to RepresentIntegerN is in Θ( p log(M)h(O) ) and the running
time is in O(poly(log(M ))).
Proof. We use the notations of Algorithm 2. Let us assume that the value M
has been selected in Step 2. There are Θ(M/p) possible pairs y, z. Let us
take a random one. Assuming a good distribution of integers of the form M −
pfO (y, z), the near-primality condition on M ′ will be satisfied with probability
roughly 1/ log(M ). Then, assuming again a good distribution, under GRH, theprobability that there is a solution to the equation fO (t, x) = M ′ is 1/h(O).
This justifies the estimate on the number of solutions and also on the running
time by the estimate on the value of d and M > p and the expected running
time of Cornacchia.
We present below a second algorithm StrongApproximation that solves norm
equations inside O0 but with an additional constraint. More precisely, this algorithm finds the strong approximation mod N in N of some µ0 ∈ OjO , i.e., anelement µ ∈ O0 with µ = λµ0 ∈ N O0 and n(µ) ∈ N (we give more explanations
on the link with the strong approximation in Remark 3.2.2). We will explain
later the motivation behind this algorithm.
Remark 3.1.5. StrongApproximation can be modified to output elements of smaller
norm following [PS18]. We choose to exclude this improvement from Algorithm 3 for clarity of exposition. The idea from [PS18] is to take a good pair65

Algorithm 3 StrongApproximationN
Input: A prime number N , two values C, D ∈ Z.
Output: µ = λµ0 + N µ1 with µ0 = j(C + ωD), µ1 ∈ O0 such that n(µ) ∈ N .
1: Select M ∈ N such that M ≥ pN 4 and M/p(C 2 + qD 2 ) is a quadratic
residue modN . Compute the square root λ of this element.
2: Select a random pair y, z such that M − pfO (λC + N y, λD + N z) = 0
mod N 2 . This can be done by solving a linear equation modN .
M −pfO (λC+N y,λD+N z)
3: Set M ′ =and determine if the equation fO (t, x) =N2
M ′ has a solution (and find its solution if so) using Cornacchia. If no solution
exists, go back to Step 2.
4: return µ = λj(C + Dω) + N (t + ωx + j(y + ωz)).

y, z instead of sampling it at random. We define good solutions as the ones
corresponding to small value of pfO (λC + N y, λD + N z). In [PS18], it is shownthat good solutions correspond to vectors that are close to some lattice. Looking at the determinant of this lattice, we can prove that there exists a solutionof approximate size pN 3 (instead of pN 4 ). This in turns lets us take a smaller
M ∈ N during Step 1. By enumerating short vectors in increasing order, we
can make StrongApproximation deterministic. Henceforth, when we write StrongApproximation, we implicitly mean the version of Algorithm 3 modified with theideas from [PS18].
Lemma 3.1.6. (UPHA) For any κ > 0, there exists η = O(log log(p) +log log(N ) + log(κ)) such that if c is bigger than log(p) + 3 log(N ) + η and
M is a random integer with c < log(M ) < c + 1, then StrongApproximationD(M )(modified as in Remark 3.1.5) will succeed with probability higher than 1 − 2−κ .
The expected running time is in O(poly(log(pN ))).
Proof. Let us assume that the integer M has been selected in Step 1. As in
the proof of Lemma 3.1.4, the probability that, for a given pair y, z, the endof the computation succeeds is in O(1/h(O) log(M )) assuming that M ′ is welldistributed. Under the heuristics in [PS18], there exists η = O(log log(p) +log log(N ) + log(κ)) such that if c is bigger than log(p) + 3 log(N ) + η and
M is such that c < log(M ) < c + 1, then there are enough pairs y, z such thatM > pf (λC+N y, λD+N z) to rerandomize M ′ enough to find one for which Cornacchia will succeed. By our estimates, we will have to try for O(h(O) log(M ))of them, and we can conclude with the complexity of Cornacchia.
Remark 3.1.7. The formulation of Lemma 3.1.6 targets the case where N =D(M ) because it is hard to state a formal result for a generic set N . Lemma 3.1.6
implies that if N is infinite, StrongApproximation will succeed with probability 1.
For any κ > 0, when N is finite but contains an element M as in Lemma 3.1.6,
the probability of success should be higher than 1 − 2−κ under the assumptionthat this element M will behave as a random element of the same size would.
For most of the algorithms that follows, we will give results with a formulation
similar to Lemma 3.1.6.
Strong Approximation step for composite numbers. Here, we explain
how to extend the StrongApproximation algorithm to the case where N is not66

Qka single prime but a product of several coprime factors i=1 Ni . In fact, it
suffices
follow the method described in Algorithm 3. What will change whenQtok
N = i=1 Ni is simply the running time due to potential failure. There areexactly two possibilities for these failures: first, the equation of Step 2 of Algorithm 3 may require to compute the inverse of non-invertible elements. A
random element in Z/N Z has a probability at least c/ log(N ) to be invertible,
so this will cause a logarithmic slowdown in the worst case. In practice, we willconsider cases where the Ni are large prime numbers of roughly the same sizes.
In these cases, the probability of being invertible will be overwhelming.
The second concern, however, is more problematic, as we can estimate its
probability of happening to be roughly in 1−2−k (we recall that k is the numberof coprime factors of N ). During Step 1 of Algorithm 3, a value M ∈ N must
be chosen to ensure that M/(p(C 2 + D2 )) is a quadratic residue mod N . The
proportion of quadratic residues mod N is 1/2k and this explains the probability
estimate we give above. The set N will influence this probability in practice. In[KLPT14], when N = ℓ• and k = 1, the authors explained a method to select a
power ℓe1 to ensure that the quadratic residuosity constraint is always satisfied.
When one of the failures above happens, we will need to rerandomize thecomputation either by selecting another y, z in Step 2 or, when applying StrongApproximation in a bigger algorithm, by changing the inputs.

3.1.3

Finding solutions in the full order

Most of the time, the fact that RepresentInteger and StrongApproximation produces solutions contained in the suborder Z[i, j] is perfectly fine. However, weare going to argue later that this can also be problematic depending on theapplication. In this section, we introduce two new variants FullRepresentInteger
and FullStrongApproximation to find solutions in the full order O0 that were
presented in our article [DFLW22]. For simplicity, we assume for this sectionthat we take p = 7 mod 12 so we have O0 defined as in Eq. (3.1.1) and we have
ω = i and q = 1. We can rewrite the norm form f0 as
f0 : (t, x, y, z) 7→ t2 + x2 + p(y 2 + z 2 )(3.1.3)Let us write g0 , the norm form of the full order O0 . Lemma 3.1.8 below shows
how we can relate integers represented by g0 to the integers represented by f0 .
Lemma 3.1.8. If M is represented by g0 , then 4M is represented by f0 with(x′ , y ′ , z ′ , t′ ) such that t′ = z ′ mod 2 and x′ = y ′ mod 2.
Proof. By definition of O0 , we have g0 : (t, x, y, z) 7→ (t + z/2)2 + (x + y/2)2 +p((y/2)2 + (z/2)2 ). If we have M = g0 (t, x, y, z), we have that 4M = (2t + z)2 +(2x + y)2 + p(y 2 + z 2 ) and conversely. Thus, an integer M is represented by f0 if
and only if 4M is represented by f0 and the solution x′ , y ′ , z ′ , t′ satisfies t′ = z ′mod 2 and x′ = y ′ mod 2.
From Lemma 3.1.8 and RepresentInteger (resp. StrongApproximation), we
derive FullRepresentInteger (resp. FullStrongApproximation). In the case of FullRepresentInteger, we include another change in the way the values py ′ , z ′ aresampled. Instead of selecting both at random in [−m, m] with p
m = ⌊ 2M/p⌋,
we start by taking y ′ at random inside [−m′ , m′ ] with m′ = ⌊ 4M/p⌋ before67

psampling z ′ inside [−m′′ , m′′ ] with m′′ = ⌊ 4M/p − z ′2 ⌋. The reason behind
this modification will be given in Section 5.6. Intuitively, the idea is to reach awider range of solutions.
Algorithm 4 FullRepresentIntegerN
Input: N ⊂ Z such that there exists M ∈ N with M > p
1+k
Output: γ = x + yi + z i+j
2 + t 2 with n(γ) dividing M .
∗1: Set M = {}.
2: Select the smallest
M ∈ N ∖ M ∗ such that M > p.
q
⌋ and sample a random integer y ′ ∈ [−m′ , m′ ].
3: Set m′ = ⌊ 4M
qp
′
′′
′′
′
′2
4: Set m′′ = ⌊ 4M
p − y ⌋ and take a random z inside [−m , m ]. Set M =4M − pf (y ′ , z ′ ).
5: If Cornacchia(fO , M ′ ) = ⊥, go back to Step 3 (or Step 2 if all pairs y ′ , z ′have been tried). Otherwise, set t′ , x′ = Cornacchia(fO , M ′ ).
mod 2 or x′ ̸= y ′ mod 2, then go back to Step 3 or Step 2 if allpairs y ′ , z ′ have been tried.
7: Set γ = (x + iy + jz + kt)/2 and repeat γ = γ/2 while γ/2 ∈ O0 andn(γ) ∈ 4N .
8: return γ.

6: If t′ ̸= z ′Just as RepresentInteger is heuristically believed to return well-distributed
solutions in Z[i, j], the variant FullRepresentInteger is believed to return welldistributed solutions in O0 , thanks to Lemma 3.1.8. A rigorous study of the
distribution of the output appears to be hard because of the Cornacchia subroutine, whose success depends on the factorization pattern of its input. This
question is further investigated in Section 5.6 in the context of the security ofthe signature scheme introduced in Chapter 5, with heuristics and experimental
evidences.
The running time of FullRepresentInteger is essentially the same as the running time of RepresentInteger, divided by the success probability of the condition
γ/2 ∈ O0 . Heuristically, this constant is 2/3: the solutions (x′ , y ′ , z ′ , t′ ) mod 2of the equation x′2 + y ′2 + p(z ′2 + t′2 ) = 0 mod 4 are (0, 0, 0, 0), (1, 1, 1, 1),(1, 0, 0, 1), (0, 1, 1, 0), (1, 0, 1, 0), and (0, 1, 0, 1). Among these 6, there are 2 that
do not lead to γ/2 ∈ O0 : the solutions (1, 0, 1, 0) and (0, 1, 0, 1). The heuristic
analysis is corroborated by the behavior of our implementation.
Remark 3.1.9. One might wonder why we do not propose to swap x′ and y ′ when
the constraint is not satisfied. Undeniably, this would be a good way to ensurethat each set of values x′ , y ′ , z ′ , t′ leads to a solution. However, this introduces
a distinguishable bias, precisely of the kind investigated in Section 5.6.
The StrongApproximation algorithm can also be modified to find solutionsin the full order O0 with Lemma 3.1.8. In Algorithm 5, we present FullStrongApproximation as a generic reduction to StrongApproximation. Thanks
to Lemma 3.1.8, properties of the distribution of the output of FullStrongApproximation directly follow from properties of the distribution of StrongApproximation. As in the case of FullRepresentInteger, we expect the running
time of FullStrongApproximation to be equal to the running time of StrongApproximation multiplied by 3/2.

68

Algorithm 5 FullStrongApproximationN
Input: A prime number N , two values C, D ∈ Z.
Output: µ ∈ O0 such that 2µ = λµ0 + N µ1 with µ0 = jC + kD, µ1 ∈ O0 , andn(µ) ∈ N .
1: Let 4N = {4n | n ∈ N }.
2: Set µ′ = StrongApproximation4N (N, C, D).
3: If µ′ ̸∈ 2O0 , go back to Step 2.
4: return µ = µ′ /2.

Lemmas 3.1.4 and 3.1.6 remain true for FullRepresentInteger and FullStrongApproximation. In all the algorithms that we introduce in the next sections, wewill use FullRepresentInteger and FullStrongApproximation. Most of the time itwill not change much compared to their simpler variant, but it will be crucial
in some cases.

3.2

Ideals in the special extremal orders

In this section, we present the main contribution of [KLPT14]: the KLPTN
algorithm. This algorithm finds a solution to the quaternion N isogeny path
problem for any O0 -ideal. We show with Lemma 3.2.1 how solving this problem
is actually equivalent to solving a norm equation inside I with the χ map from
Definition 1.2.14.
Lemma 3.2.1. For any integral ideal I, the map
χI (α) = Iαn(I)is a surjection from I ∖ {0} to the set of ideals J equivalent to I. For α ̸= β,
we have χI (α) = χI (β) if and only if α = βδ where δ ∈ OR (I)× .
Proof. (sketch) This map is well-defined, as proven in [KLPT14]. We see that it
is a surjection by identifying I ·J with a principal ideal OR (I)β. Then, it is clearthat β ∈ I and J = χI (β). Finally, one can verify that OR (I)β1 = OR (I)β2 if
and only if β1 = δβ2 where δ ∈ OR (I)× .
Following Lemma 3.2.1, we define qI : α 7→ n(α)/n(I). As a consequence ofLemma 3.2.1, KLPTN consists in finding α ∈ I with qI (α) ∈ N before returningχI (α). For what remains of this section, we focus on how to find such an elementα.
A common framework. The KLPT algorithm shares a common structurewith the other norm equation algorithms that we are going to introduce inSections 3.3 and 3.4. In the hope that it might provide some insights on thesealgorithms and help the reader understand how they work and why they were
designed in that way, we describe below an informal framework and will try topresent our algorithms through that framework.
Let us consider a generic lattice Λ ⊂ O0 . The goal is to find α ∈ Λ of norm
contained in N . The framework is parameterized by two integers N1 , N2 , whose
exact values will depend on Λ. The algorithms can be decomposed as follows:691. Find γ satisfying a set of conditions and having a norm in N1 N .
2. Find C, D ∈ Z such that γj(C + Dω) ∈ Λ.
3. Compute µ = StrongApproximationN1 N /n(γ) (N2 , C, D).
4. Output γ(j(C + Dω) + N2 µ).
The goal of the “conditions” on the element γ in the first step of our framework is to ensure that the second step will always have a solution. The formulation of this second step might seem mysterious at first glance. One may wonder
why we look for an element of this specific form. The answer to this question is tobe found in the StrongApproximation algorithm. The generic principle (explainedin the beginning of Section 3.1.2) behind the formulation of RepresentInteger andStrongApproximation is basically the best method we know to find elements ofsmall given norm in O0 . When we look at StrongApproximation specifically,
it becomes clear that we need to look for C, D such that γj(C + Dω) ∈ Λ.
The same reasoning is given with more details in [KLPT14]. We always solve
the second step in our framework using linear algebra modN2 , as we are going
to explain in Section 3.2.2. When N2 is composite, we will decompose it in
sub-operations modulo the different factors before using CRT to put everything
together. By our assumptions on the form of the set N , we have that N1 N /n(γ)
is not empty since n(γ) ∈ N1 N .
Remark 3.2.2. The authors of [KLPT14] observed that finding an element µ
could be seen as an effective realization of the strong approximation theorem(this result is basically a generalization of the chinese remainder theorem, see[Voi18, chapter 28] for more details) in the sense that the element µ generates
the lattice Λ almost everywhere (i.e, at all primes coprime to the norm of µ). Of
course, the explanations provided in [KLPT14] are targeted at the case whereΛ is an ideal as in Section 3.2, but in fact the strong approximation theorem
justifies that we can extend their approach to a larger set of lattices in Bp,∞ .

3.2.1

Reducing to the prime-norm case

One thing that we did not mention before, but that will have its importance inpractice, is that we will not apply the framework described above on the latticeΛ directly but rather on an “equivalent” lattice. The goal of this initial step isto reduce the values N1 , N2 (whose size will directly impact the size of the final
output, as we can see with Lemma 3.1.6 for instance).
When Λ is an O0 ideal, this means that we want to replace I with anequivalent ideal L of small prime norm. The fact that the norm is prime is not
absolutely necessary, but it makes everything simpler at a minimal cost. To
achieve that, we will present two algorithms EquivalentPrimeIdeal and RandomEquivalentPrimeIdeal. The first one will find the equivalent ideal of smallest
possible prime norm, while the other one will select a random one among a setof potential good candidates, this is useful to rerandomize the computations incase something fails.
With Lemma 3.2.1 we see that we need to find an element β with qI (β) equal
to N where N is prime and as small as possible. The idea is to use a Minkowski
reduced basis β1 , β2 , β3 , β4 of I. A Minkowski reduced basis is constituted of70the elements βi attaining the successive minima of qI and when O is a maximal
order, they verify
p2 ≤ 16qI (β1 )qI (β2 )qI (β3 )qI (β4 ) ≤ 4p2 .

(3.2.1)P4
It can be shown that qI ( i=1 ci βi ) is small when the ci are small. Since we are
dealing with lattices of dimension 4, a Minkowski reduced basis can always be
efficiently computed.
Note that EquivalentPrimeIdeal takes an integral ideal in input, but there is
no assumption on its left order O, it need not be a special extremal order oreven a maximal order.
Algorithm 6 EquivalentPrimeIdealb (I)Input: I a left O-ideal.
Output: J ∼ I of smallest possible prime norm N .
1: Compute a Minkowski-reduced basis β1 , β2 , β3 , β4 of I.
2: Use it to find the element β of the smallest prime norm qI .
3: return J = χL (β).
The randomized
P4 version RandomEquivalentPrimeIdeal simply computes β asa combination i=1 ci βi where the coefficients are random in [−b, b] for somesmall bound b.
The authors of [GPS17] showed that EquivalentPrimeIdeal has the same output distribution when given equivalent ideals in input. Thus, we sometimes
abuse notations by giving a class C ∈ Cl(O) as input to EquivalentPrimeIdeal.
It is important for us to understand the size of the norm N of the outputs of EquivalentPrimeIdeal. When O is a maximal order, we can see that we√should have N ≈ p with Eq. (3.2.1). This yields Lemma 3.2.3, and this result holds under heuristic assumptions on the distribution of primes represented
by some quadratic forms (see [KLPT14] for more details). We stress that thisapproximation is quite tight in practice when O is a random maximal order,
as illustrated in the experimental results of [KLPT14]. However, for some rare
specific cases, the estimate will be off by a big margin, we come back on thiscase in Section 3.5.
Lemma 3.2.3. (UPHA) for any κ > 0, there exists η0 = O(log log(p) + log(κ))
such that for a random class C ∈ Cl(O0 ), the norm N of EquivalentPrimeIdeal(C)verifies log(p)/2 − η0 < log(N ) < log(p)/2 + η0 with probability higher than
1 − 2−κ .
Remark 3.2.4. By taking κ = log(p), we get that there exists a minimal value
η0 for which Lemma 3.2.3 holds with overwhelming probability and p uniquelydetermines this value. Henceforth, we fix such a value η0 . We will use it in
Chapter 5.
Lemma 3.2.5. EquivalentPrimeIdeal and RandomEquivalentPrimeIdeal terminates in expected O(poly(log(pn(I)C))) where C is a bound on the coefficientsof a basis for O.

71

3.2.2The linear algebra step

We explain here how to perform the second step of the framework we outlined
above. For now, let us assume that we replaced I with the equivalent L ofnorm N and that we have a suitable element γ. In Section 3.2.3, we will give anecessary condition on γ with Lemma 3.2.6 and explain how to find this element
γ. Our goal is to find C, D ∈ Z such that γj(C + ωD) ∈ L. Since N O ⊂ L,
it is natural for us to work modN to find these coefficients L. Since L is a
Z-module, we can scale by an invertible scalar λ without changing anything. In
the end, we see that we actually look for a solution (C : D) ∈ P1 (Z/N Z).
To find a representative (C : D) with the correct property we use more
concretely the fact that O0 /N O0 ∼= M2 (Z/N Z) (which can be seen for instancefrom the fact that O0 ⊗ ZN ∼= M2 (ZN )) and so the solution we look for will bein the kernel of the matrix generated by γj, γjω and a basis of L modN O0 .
We note IdealModConstraint the algorithm taking in input L, γ and outputting the correct (C : D) ∈ P1 (Z/N Z). We do not give a detailed descriptionof this algorithm, as it is fairly simple to derive from our explanations above.

3.2.3

Putting everything together

We now have all the building blocks for the full KLPT algorithm from [KLPT14].
With Lemma 3.2.6, we understand what “conditions” we require on the elementγ.
Lemma 3.2.6. [KLPT14] Let L be a random O0 ideal of norm N and γ ∈ O0 .
When gcd(n(γ), N 2 ) = N , there exist C, D ∈ Z such that γj(C + Dω) ∈ L withprobability at least 1 − 4(N − 1)/(N + 1).
Proof. (sketch) The proof is quite similar to what we have seen in Proposition 2.3.12. The map (C : D) 7→ O0 γj(C + ωD)/O0 N gives an action of(jO/N jO)∗ up to scalar multiplication (which is in bijection with P1 (Z/N Z))
on the ideals of the form J/N O0 where J is a cyclic ideal of norm N in O0 . Thisaction has either one orbit and so this proves the result, or it has two orbits:
one of size 2, one of size N − 1. The former happens when N is inert in O andthe latter if N splits. The probability that O0 γ/N O0 and L : N0 are in thesame orbit is 1 − 4(N − 1)/(N + 1).
In practice, we can expect values of N to be polynomial in p. In that case,
we can consider the probability given in Lemma 3.2.6 to be overwhelming. In
full generality, we can add the constraint that N is inert in O to increase theprobability of success to 1. The condition on γ from Lemma 3.2.6 is quite easy
to satisfy with the RepresentInteger algorithm.
We are now ready to give the detailed description of the KLPT algorithm
from [KLPT14]. Following Section 3.2.1, the first step is to replace I by anequivalent ideal L of prime norm N . Then, we apply our framework with N1 =N2 = N and Lemma 3.2.6 with the content of Section 3.2.2 to get Algorithm 7.
Proposition 3.2.7. (UPHA) For any κ > 0, there exist η1 , η2 = O(log log(p) +log(κ)) such that if c1 > 1/2 log(p) + η1 and c2 > 5/2 log(p) + η2 and Mi is arandom integer with ci < log(Mi ) < ci + 1 for i = 1, 2 then KLPTD(M1 M2 ) will
succeed with probability higher than 1 − 2−κ on an ideal whose class is uniformly
distributed in Cl(O0 ). The expected running time is in O(poly(log(pn(I)))).
72

Algorithm 7 KLPTN (I)
Input: I a left O0 -ideal.
Output: J ∼ I of norm in N .
1: Compute L = EquivalentPrimeIdeal(I) with N = n(L) and δ ∈ I such thatL = χI (δ).
2: Compute γ = FullRepresentIntegerN N .
3: Compute (C0 : D0 ) = IdealModConstraint(L, γ).
4: Compute µ = FullStrongApproximationN N /n(γ) (N, C0 , D0 )) and set β = γµ.
If the computation fails, go back to Step 2.
5: return J = χL (β).

Proof. By Lemma 3.2.3, the integer N will be contained in log(p)/2 − η0 <log(N ) < log(p)/2+η0 for some η0 = O(log log(p)). If we take η1 = η0 , log(M ) >c1 > 1/2 log(p) + η0 implies that M1 N > p. Thus, by Lemma 3.1.4, we can finda solution γ with FullRepresentInteger. By Lemma 3.2.6, an element (C0 : D0 ) ∈P1 (Z/N Z) can be found with IdealModConstraint. Then, by Lemma 3.1.6, we
can take η2 to be the η from Lemma 3.1.6, so that FullStrongApproximation will
succeed with probability bigger 1 − 2−κ .
By Lemma 2.2.5, I has a basis whose coefficients have size O(log(n(I))).
Hence, the expected running time follows from Proposition 2.2.4 and Lemmas 3.1.4, 3.1.6 and 3.2.5.
Remark 3.2.8. A result of [GPS17] proves that the outputs of EquivalentPrimeIdeal and KLPT only depend on the equivalence class of the input (in fact, this is
only true with a minor tweak to the original algorithm of [KLPT14]). Hence, wewill sometimes abuse notations and use both algorithms as if they took inputs
in Cl(O0 ). Moreover, we will assume henceforth that KLPT is deterministic(which can always be achieved by fixing an order on the random choices).
As explained in Remark 3.1.7, Proposition 3.2.7 can be used to deduce meaningful results on KLPTN for more complicated sets N .
Extending KLPT to any maximal order. The KLPT algorithm presented
as Algorithm 7 specifically targets O0 -ideals. In fact, we gave a formulationthat works efficiently for all δ-special extremal orders when δ is not too big.
However, this represents only a minority of maximal orders, as most of them
do not contain a quadratic order of small discriminant. For a generic maximal
order, we have the upper-bound p2/3 for the norm of the smallest non-trivial
endomorphism ω and this bound is tight. This might seem like a big obstacle
but the authors of [KLPT14] observed that an efficient algorithm in a special
case was sufficient as all the maximal orders are in the same genus. Let us takethe ideal I = I(O1 , O2 ), where neither O1 , O2 are special extremal. To findJ ∼ I, it suffices to find Ji ∼ Ii = I(O0 , Oi ) for i = 1, 2 and take J = J1 J2 . The
Ii exists because all maximal orders are connected, and the Ji can be computedwith KLPT. This idea provides a way to solve the quaternion N -isogeny path
problem for any maximal order with at most two executions of the KLPTN
algorithm. While this method is satisfying in itself, we are going to see laterthat it is not generic enough for one of our cryptographic application. This73

is partly what motivated the study of Eichler orders and their ideals that we
introduce in Section 3.3.
Remark 3.2.9. In his recent article [Wes22], Benjamin Wesolowski introduced
a version of KLPT for which he managed to prove termination in polynomial
time assuming only GRH. This version is a lot less efficient than the one we
presented, we do not explain it in full details here. Nonetheless, it is important
to know that (up to increasing a lot the size of the outputs) we have a provableversion of KLPT. Note that there are no provable versions of all the otheralgorithms we introduce in the remaining of this chapter. However, given thatthey are built mostly on the same building blocks as KLPT, it is quite probablethat provable versions could be derived similarly. This is not something that wehave investigated in full details, though.

3.3

Eichler orders and their ideals

In this section, we will show another way to solve Problem 3.0.1 for the O1 -idealI, where O1 is a generic maximal order, using algorithms to solve norm equations
in Eichler orders and their ideals. Our idea is in fact quite simple. Since weknow how to solve norm equations in O0 and O0 -ideals, we will consider theorder O1 ∩ O0 and the ideal I ∩ O0 . By definition, we get an Eichler order andthe ideal of an Eichler order (see Lemma 2.3.9) in this manner. Thus, we will
derive a GenericKLPT algorithm from an algorithm IdealEichlerNorm to solve
norm equations in ideals of Eichler orders.
Adaptation of the algorithmic framework to the new case. Now that
we have given an example with KLPT of an algorithm following our framework,
the formulation of all the other algorithms will appear more natural. To get ourdesired algorithm for Eichler orders and their ideals, we just need to understandthe conditions on γ. With Proposition 3.3.1, we cover the case of Eichler orders.
Proposition 3.3.1. Let Z + I be an Eichler order of level N contained in O0
and N inert in O. If α1 , α2 ∈ O0 are such that gcd(n(αi ), N ) =1, then there
exist C, D ∈ Z with α1 j(C + ωD)α2 ∈ (Z + I).
Proof. We can get the result by looking at the map Θ from Proposition 2.3.12
with L = O0 and γ = α2 . When we apply Proposition 2.3.12 to the class C0of principal ideals of O0 , we see that each of the classes of ClZ+I (C0 ) contains
an ideal of the form O0 α2 j(C + Dω) for some C, D ∈ Z. In particular, there
exist C0 , D0 such that O0 α1 ∼Z+I O0 α2 j(C0 + ωD0 ). In that case, the resultsfrom Section 2.3.1 prove that we must have α1 j(C0 + ωD0 )α2 ∈ Z + I, and thisproves the result.
Proposition 3.3.1 implies that we can design an algorithm EichlerModConstraint
very similar to IdealModConstraint that takes I, α1 , α2 in input and outputs(C : D) ∈ P1 (Z/N Z) such that α1 j(C + ωD)α2 ∈ Z + I. This algorithm consists mainly of linear algebra mod N . Henceforth, we assume that we have suchan algorithm EichlerModConstraint.
We deduce from Proposition 3.3.1 a useful corollary on EichlerModConstraint,
for two values α2 , α2′ contained in the same Eichler class, which will be usefulfor us at some point in Chapter 5.
74

Corollary 3.3.2. Let I be an O0 -ideal of norm N and α1 , α2 , α2′ ∈ O0 allwith norm coprime to N . Let L be an ideal of norm coprime to L such that
α2 , α2′ ∈ L. If χL (α2 ) ∼Z+I χL (α2′ ), then EichlerModConstraint(I, α1 , α2 ) =EichlerModConstraint(I, α1 , α2′ ).
Proof. When χL (α2 ) ∼Z+I χL (α2′ ), the results from Section 2.3.1 prove thatthe two maps Θ, Θ′ related to α2 , α2′ in Proposition 2.3.12 are the same, and so
the proof of Proposition 3.3.1 allow us to conclude.
Norm equations in O1 ∩ O0 . In this paragraph, we assume for simplicity
that the ideal I = I(O0 , O1 ) has prime norm N inert in O. Unlike the O0 -ideal
case and what is explained in Section 3.2.1, it seems hard to replace I withanother equivalent ideal in our case. We will explain in Section 3.5 that most of
the algorithms involved in EichlerNorm can still be made to work when N is notprime. The main obstacle is in fact FullStrongApproximation and we discussed in
Section 3.1.2 what are the effects of a composite modulus. If N is not inert in O,
the algorithm will still work with overwhelming probability 1−4(N −1)/(N +1)
as in Lemma 3.2.6.
Under our assumption on N , we have that I satisfies the constraint of Proposition 3.3.1. We have Z + I = O0 ∩ O1 and when we apply Proposition 3.3.1 toour framework with N1 = 1 and N2 = N , we get algorithm EichlerNorm.
Algorithm 8 EichlerNormN (I)
Input: I a cyclic O0 -ideal of norm N inert in O.
Output: β ∈ Z + I of norm in N .
1: Compute (C : D) = EichlerModConstraint(I, 1, 1).
2: Compute µ = FullStrongApproximationN (N, C, D).
3: return µ.
Proposition 3.3.3. (UPHA) For any κ > 0, there exists η = O(log log(p) +log log(N ) + log(κ)) such that if c is bigger than log(p) + 3 log(N ) + η and
M is a random integer with c < log(M ) < c + 1, then EichlerNormD(M ) will
succeed with probability higher than 1 − 2−κ . The expected running time is inO(poly(log(pN ))).
Proof. Our result follows from Lemma 3.1.6 and Proposition 3.3.1.
Solving norm equations in a generic maximal order. With EichlerNorm,
we have an algorithm to solve norm equations in Eichler orders of the form Z+I
where I is an O0 -ideal of norm N . We can deduce an algorithm SpecialEichlerNorm to solve norm equations efficiently in any maximal order O. The idea is tofind O1 ∼= O such that I(O0 , O1 ) satisfies the constraints on the input of EichlerNorm, so we can solve in O0 ∩ O1 and then transport the output in O using theisomorphism between O and O1 . Motivated by our application of SpecialEichlerNorm to more complicated algorithms in Chapter 4, we require that the output
β of SpecialEichlerNormN satisfies the following additional constraint: given the
additional input K, a left O-ideal of norm ℓ coprime to all the elements of N ,we need that β ̸∈ Z + K (see Step 2 in Algorithm 8). A justification for thisconstraint will be provided in Section 4.2.2.

75

Algorithm 9 SpecialEichlerNormN (O, K)
Input: O a maximal order and K a left O-ideal of norm ℓ.
Output: β ∈ O ∖ (Z + K) of norm in N coprime to ℓ.
1: Compute I = I(O0 , O).
2: Set L = RandomEquivalentPrimeIdeal(I), N = n(L) and compute α s.t.
L = Iα.
3: Compute K ′ = α−1 Kα
4: Compute (C : D) = EichlerModConstraint(L, 1, 1).
5: Enumerate all possible solutions of µ = FullStrongApproximationN (N, C, D)
until µ ̸∈ Z + K ′ . If it fails, go back to Step 2.
6: return β = αµα−1 .
Proposition 3.3.4. (UPHA) Let ℓ be a small prime. SpecialEichlerNorm iscorrect. For any κ > 0, there exists η = O(log log(p) + log(κ) + log(ℓ)) suchthat if c > 5/2 log(p) + η and M is a random integer coprime to ℓ and c <log(M ) < c+ 1, then SpecialEichlerNormD(M ) will succeed with probability higher
than 1−2−κ on a uniformly random maximal order O and random cyclic O-idealof norm ℓ. The expected running time is in O(poly(log(p))).
√
Proof. Under the estimate of Lemma 3.2.3, we can expect N to be around p.
Thus, the size estimate follows from the same reasons as in Proposition 3.3.3.
For the running time and probability of success, we need to look at the constraintµ ̸∈ Z+K ′ . Now, we introduce the following heuristic assumption: the output µ
of FullStrongApproximation satisfies µ ̸∈ Z + K ′ with probability approximately[O0 : Z + K ′ ]−1 = 1/ℓ (which is the probability one would get by drawing µuniformly in a large enough ball of O0 ). Even though the precise distributionof µ appears difficult to analyze, this heuristic is plausible since the algorithm
FullStrongApproximation seems to constrain possible values of µ only locally at
N and M , both coprime to ℓ. Thus, when we combine the probability of successof FullStrongApproximation from Lemma 3.1.6, we get the result.
Correctness follows from the fact that µ ∈ Z + L = O0 ∩ OR (L), where
L = Iα, we can show that O = αOR (L)α−1 . Since µ ̸∈ Z + K ′ , then αµα−1 ̸∈Z + αKα−1 = Z + K.
Remark 3.3.5. Note that the new heuristic introduced in the proof of Proposition 3.3.3 would not have held if we had used StrongApproximation insteadof FullStrongApproximation. Indeed, as we have explained, the solutions ofStrongApproximation lie in Z⟨1, i, j, k⟩ which is contained in the Eichler order (Z + O0 ⟨1 + i, 2⟩). Thus, in the execution of SpecialEichlerNorm, whenK ∩ L = O0 ⟨1 + i, 2⟩ ∩ L, the condition µ ̸∈ Z + K can never be satisfied. This
is why it is important to use our new variant FullStrongApproximation to ensurethat the elements µ are not contained in any specific suborder of O0 .
Norm equations in ideals of Eichler orders. In this paragraph, we show
how to solve norm equations in lattices of the form (Z + I) ∩ J where I, J are
O0 cyclic ideals of coprime norm with the algorithm IdealEichlerNorm. The factthat the norms are coprime is in fact essential, as will become clear in the proofof Proposition 3.3.6. Intuitively, this is because we need to deal with the twoconstraints (the solution needs to be in Z + I and in J) independently. When76

the norms are coprime, the local-global principle tells us that this is possible.
As for EichlerNorm, we assume that I has norm NI , a prime number inert in O.
We need not make the same assumption for J as we can use EquivalentPrimeIdeal
to replace J by an equivalent ideal L of prime norm N (we also require thatgcd(N, NI ) = 1). With our framework, the combination of Proposition 3.3.1
and Lemma 3.2.6 into Proposition 3.3.6 will underlie the formulation of IdealEichlerNorm. We will see that we get IdealEichlerNorm by combining KLPT with
EichlerNorm. Intuitively, it is quite natural under the bijection of Lemma 2.3.9
that identifies the Z + I-ideals of norm N with the O0 -ideals of norm N .
Proposition 3.3.6. Let I, J be two O0 ideals of norm NI , NJ with gcd(NI , NJ ) =1. Let L = χJ (δ) and N := n(L) coprime to NI , and let γ ∈ O0 be such thatgcd(n(γ), NI N 2 ) = N . There exist C, D ∈ Z with γj(C + ωD)δ ∈ (Z + I) ∩ J.
Proof. By Lemma 3.2.6, there exist C0 , D0 ∈ Z such that γj(C0 +ωD0 ) ∈ L and
it is easy to see that any C, D = C0 , D0 mod N work as well since N O0 ⊂ L.
By Proposition 3.3.1, there exist C1 , D1 ∈ Z with γj(C1 +ωD1 )δ ∈ Z+I becausen(δ) = N NJ which is coprime to NI . Similarly, any C, D = C1 , D1 mod N1
will preserve this property. So if we take elements C, D ∈ Z satisfying the twoconstraints mod N, N1 , we get that γj(C + ωD) ∈ L and so γj(C + ωD)δ ∈ J
by definition of the χ map. We also have γj(C + ωD)δ ∈ Z + I, and this proves
the result.
Concretely, the elements C, D in Proposition 3.3.6 will be found using IdealModConstraint, EichlerModConstraint and CRT to combine the results mod N
and mod NI . In our framework, we take γ as in Proposition 3.3.6 and N1 = N
and N2 = N NI .
Algorithm 10 IdealEichlerNormN (I, J)
Input: I, J be two O0 ideals of norm NI , NJ with gcd(NI , NJ ) = 1.
Output: β ∈ (Z + I) ∩ J and n(β) ∈ n(J)N .
1: Compute L = EquivalentPrimeIdeal(J), L = χJ (δ) for δ ∈ J. Set N = n(L).
2: Compute γ = FullRepresentIntegerN N .
3: Compute (C0 : D0 ) = IdealModConstraint(L, γ).
4: Compute (C1 : D1 ) = EichlerModConstraint(I, γ, δ).
5: Compute C = CRTN,NI (C0 , C1 ) and D = CRTN,NI (D0 , D1 ).
6: Compute µ = StrongApproximationN N /n(γ) (N NI , C, D).
7: returnγµδ.

Proposition 3.3.7. (UPHA) For any κ > 0, there exist η1 , η2 = O(log log(p) +log(κ)) such that if c1 > 1/2 log(p) + η1 and c2 > 5/2 log(p) + 3 log(NI ) + η2
and Mi is a random integer with ci < log(Mi ) < ci + 1 for i = 1, 2, thenEichlerNormD(M1 M2 ) will succeed with probability higher than 1−2−κ when J is ina random class of Cl(O0 ). The expected running time is in O(poly(log(pNI NJ ))).
Proof. We obtain the result by combining Proposition 3.3.6 with Lemmas 3.1.4
and 3.1.6 and the estimates from Lemma 3.2.3 for the size of N .

77

A Generic KLPT algorithm. We arrive at the main goal of this section:a new generic version of KLPT for all maximal orders. Our algorithm GenericKLPTN takes in input a maximal order O, an O-ideal I, and finds J ∼ I withn(J) ∈ N . The idea is to combine IdealEichlerNorm with SpecialEichlerNorm tofind β ∈ J. More precisely, we will find K of prime norm connecting O0 andO1 ∼= O. Then, we will apply IdealEichlerNorm to find β ∈ (Z + K) ∩ [K]∗ I
of norm in N . By the results of Section 2.3.1, we get that β ∈ I, and so the
output is simply χI (β). The reasoning that we just outlined is not exactly formal
because I is not an O1 -ideal, but it works if we use the isomorphic copy of I in
O1 . The relevant isomorphism is β 7→ αβα−1 where α is s.t. K = I(O0 , O1 )α.
Algorithm 11 GenericKLPTN (O1 , I)
Input: O1 a maximal order and I a left O1 -ideal.
Output: J ∼ I of norm in N .
1: Compute I0 = I(O0 , O1 ).
2: Set K = RandomEquivalentPrimeIdeal(I0 ), compute α s.t. K = I0 α.
3: Compute I ′ = α−1 Iα and L = [K]∗ I ′ .
4: Compute µ = IdealEichlerNormN (K, L).
5: Compute β = αµα−1 .
6: return χI (β).

Proposition 3.3.8. (UPHA) For any κ > 0, there exist η1 , η2 = O(log log(p) +log(κ)) such that if c1 > 1/2 log(p)+η1 and c2 > 4 log(p)+η2 and Mi is a random
integer with ci < log(Mi ) < ci + 1 for i = 1, 2, then EichlerNormD(M1 M2 ) will
succeed with probability higher than 1 − 2−κ when O1 is a random maximal
order and I is in a random class of Cl(O). The expected running time is inO(poly(log(pn(I)C))) where C is a bound on the coefficients of a basis for O1 .
Proof. The size estimates and expected running time are a consequence of Lemmas 3.2.3 and 3.2.5 and Proposition 3.3.7. For correctness, since µ ∈ (Z+K)∩L,
β ∈ Z + I0 = O0 ∩ O1 and β ∈ [K]∗ L = I and so the output is correct.
As for KLPT (see Remark 3.2.8), we assume that GenericKLPT is deterministic. In Chapter 5, we will introduce SigningKLPT, a variant of GenericKLPT
adapted to the signature scheme SQISign. In particular, the distribution of
output is crucial for the security of the protocol, and we will explain there
why the generic method from Kohel et al. in [KLPT14] is not sufficient for thisapplication.
Remark 3.3.9. Proposition 3.3.8 shows that our new method succeeds in finding an ideal of norm smaller than the solution proposed in [KLPT14] that weoutlined in the end of Section 3.2.3. Indeed, as mentioned above, their output
is a concatenation of two solutions obtained from KLPT, thus their output isof norm roughly equal to p6 . Finding a smaller solution was not the primary
motivation, but it is nice nonetheless.
Norm equation in all Eichler orders and ideals. We advertised analgorithm to solve norm equations in Eichler orders, but so far we have only
treated the case of orders of the form O0 ∩ O1 . Let us take a generic Eichler
order O = O1 ∩ O2 = Z + I(O1 , O2 ). It can be shown that O ∩ O0 = (Z +78

I(O0 , O1 )I(O1 , O2 )). The algorithm EichlerNorm can be modified to work on an
input ideal whose norm is not a prime inert in O. The efficiency will be reduced(depending mainly on the number of factors of the ideal in input) and there
may be some failures with constant probability but since we can rerandomize
by replacing I(O0 , O1 ) by equivalent ideals as in Step 2 of SpecialEichlerNorm
or GenericKLPT, we can increase the probability of success to be overwhelming(if there are big enough elements in N ). Since we have no concrete applicationsof this algorithm, we do not describe it in full details.

3.4

Norm Equations in non-Gorenstein suborders of Eichler orders

In this section, we treat the case of non-Gorenstein orders whose Gorenstein
closure is an Eichler order. Concretely, this means lattices of the form Z + DI
and (Z + DI) ∩ J where I, J are cyclic integral ideals of maximal orders andgcd(n(I), n(J), D) = 1. Our motivation is the resolution of norm equations
inside Z + DO for any maximal order O ⊂ Bp,∞ . As in Section 3.3, we will
restrict the resolution to the suborder (Z + DO) ∩ O0 . Since O ∩ O0 = Z + I
where I = I(O0 , O), we end up solving inside Z + DI = (Z + DO) ∩ (Z + I).
We introduce SuborderEichlerNorm to do that. We apply SuborderEichlerNorm
to get GeneratingFamily, an algorithm that computes a generating family of
Z + DO (see Definition 3.4.3). Finally, we show that SuborderEichlerNorm canbe extended to treat ideals of the form (Z + DI) ∩ J, and we introduce IdealSuborderEichlerNorm. Both these algorithms will prove useful for the content of
Chapter 4 where we will use these algorithms in our new isogeny representation.
Norm equations inside Z + DI. Next, we explain our method for the case
Λ = Z + DI. As before, we assume that I has a prime norm N inert in O.
This time, we need γ to satisfy more conditions than a simple constraint on its
norm. We will introduce the necessary condition in Proposition 3.4.1. It proves
to be slightly inconvenient, and will impact the size of the final solution, but wemanaged to find a way to keep some control on the norm of γ while ensuringthat the linear algebra step always has a solution.
Proposition 3.4.1. Let I be an integral left O0 -ideal of prime norm N and let
D be a distinct prime number. If γ ∈ O0 can be written as j(C2 + ωD2 ) + Dµ2
with µ2 ∈ O0 and n(γ) is coprime to N , then there exist C1 , D1 ∈ Z such thatγj(C1 + ωD1 ) ∈ Z + DI.
Proof. If n(γ) is coprime to N , we know from Proposition 3.3.1 that there exist
C0 , D0 such that γj(C0 + ωD0 ) ∈ Z + I. Then, if we set C2′ = −D2′ C2 (D2 )−1
mod D for any D2′ , it is easy to verify that γj(C2′ + ωD2′ ) ∈ Z + DO0 . Hence, if
C1 , D1 satisfy C1 , D1 = C0 , D0 mod N , C1 , D1 = C2′ , D2′ mod D and gcd(N, D) =1, we have that γj(C1 + ωD1 ) ∈ Z + DO0 ∩ (Z + I) = Z + DI.
With Proposition 3.4.1, we see that we must take N1 = 1 and N2 = N D andthat we must also apply a strong approximation modD to compute a γ whose
norm is in N . When we apply these ideas to the framework described above,
we obtain SuborderEichlerNorm.

79

Algorithm 12 SuborderEichlerNormN (D, I)
Input: I a left O0 -ideal of norm prime N coprime to D.
Output: β ∈ Z + DI of norm contained in N .
1: Select a random class (C2 : D2 ) ∈ P1 (Z/DZ).
2: Compute γ = FullStrongApproximationN (D, C2 , D2 )). If the computation
fails, go back to Step 1.
3: Compute (C0 : D0 ) = EichlerModConstraint(I, γ, 1).
4: Sample a random D2′ in Z/DZ, compute C2′ = −D2′ C2 (D2 )−1 mod D.
5: Compute C1 = CRTN,D (C0 , C2′ ), D1 = CRTN,D (D0 , D2′ ).
6: Compute µ = FullStrongApproximationN /n(γ) (N D, C1 , D1 )). If it fails, goback to step 1.
7: return β = γµ.

Proposition 3.4.2. For any κ > 0, there exists η1 , η2 = O(log log(pN D) +log(κ)) such that if c1 > log(p) + 3 log(D) + η1 and c2 > log(p) + 3 log(DN ) + η2
and Mi is a random integer with ci < log(Mi ) < ci + 1 for i = 1, 2, thenSuborderEichlerNormD(M1 M2 ) will succeed with probability higher than 1 − 2−κ
when I is in a random class of Cl(O0 ). The expected running time is inO(poly(log(pDN ))).
Proof. The result follows from Proposition 3.4.1 and Lemma 3.1.6. We canverify that j(C2 + D2 ω)j(C2′ + ωD2′ ) ∈ Z + DO0 . Since β − j(C2 + D2 ω)j(C2′ +ωD2′ ) ∈ DO0 this proves that β ∈ Z + DO0 .
A generating family of Z+DO. In this paragraph, we show how to computea generating family of the order Z + DO1 where O1 is a maximal order of Bp,∞ .
This algorithm will be useful in Chapter 4.
Definition 3.4.3. A generating family θ1 , · · · , θn for an order O is a set ofelements in O suchQ
that any element ρ ∈ O can be written as a linear combination of 1 and j∈I θj for all I ⊂ {1, · · · , n}. In that case, we write
O = Order(θ1 , . . . , θn ).
We present below GeneratingFamilyN that takes in input a maximal order
O1 and a prime D, outputs a generating family of Z + DO1 with elements
having norm in N . The idea behind this algorithm is quite straightforward:
apply SuborderEichlerNorm on I, for various ideals I connecting O0 and orders
isomorphic to O1 . This gives a way to sample elements in Z + DO1 , and it
suffices to iterate this method until we obtain a generating family from this set.
Experimental results show that after taking a few elements in that manner (forinstance, no more than ten for parameters of cryptographic sizes, i.e, of a few
hundred bits), we can extract a generating family of size three. We formulate
this more precisely as Conjecture 1.
Conjecture 1. Let O1 be a maximal order in Bp,∞ . Let I1 , I2 , I3 be random∗
O0 -ideals of prime norms with αi OR (Ii )αi−1 = O for some αi ∈ Bp,∞
. If
θ1 , θ2 , θ3 are random outputs of SuborderEichlerNorm(D, Ii ) for i = 1, 2, 3, thenZ + DO1 = Order(α1 θ1 α1−1 , α2 θ2 α2−1 , α3 θ3 α3−1 ) with probability 1/c where c =O(poly(log(pD))).

80

Algorithm 13 GeneratingFamilyN (O1 , D)
Input: A maximal order O1 and a prime D.
Output: A generating family θ1 , . . . , θ3 for Z + DO1 where each θj has normin N .
1: Set L = {} and I0 = ConnectingIdeal(O0 , O1 ).
2: while There do not exist θ1 , θ2 , θ3 ∈ L s.t Z + DO1 = Order(θ1 , θ2 , θ3 ) do
3:
I = RandomEquivalentPrimeIdeal(I0 ) and I = I0 α.
4:Compute θ = SuborderEichlerNormN (D, I).
5:
L = L ∪ {αθα−1 }.
6: end while
7: return θ1 , θ2 , θ3 .

Proposition 3.4.4. (UPHA) Assuming Conjecture 1, for any κ > 0, there exist
η1 , η2 = O(log log(pD) + log(κ)) such that if c1 > log(p) + 3 log(D) + η1 andc2 > 5/2 log(p) + 3 log(D) + η2 and Mi is a random integer with ci < log(Mi ) <ci + 1 for i = 1, 2, then GeneratingFamilyD(M1 M2 ) will succeed with probability
higher than 1 − 2−κ when O1 is a random maximal order in Bp,∞ . The expectedrunning time is in O(poly(log(pDC))) where all the coefficients of a basis forO1 are smaller than C.
Proof. The result follows from Lemmas 3.2.3 and 3.2.5, Propositions 2.2.4 and 3.4.2
and Conjecture 1.

Norm equations inside (Z+DI)∩J. For simplicity in this paragraph, we assume that both I and J have inert prime norm NI , NJ and gcd(NI , NJ , D) = 1.
We obtain Proposition 3.4.5 as a combination of Lemma 3.2.6 and Proposition 3.4.1. IdealSuborderEichlerNorm follows from our framework if we takeN1 = NJ , N2 = NI NJ D. This yields Algorithm 14.
Proposition 3.4.5. Let I, J be two cyclic integral left O0 -ideals of prime norm
NI , NJ inert in J, and let D be a distinct prime number. If γ ∈ O0 can be
written as j(C2 + ωD2 ) + Dµ2 with µ2 ∈ O0 and gcd(n(γ), NI NJ2 ) = NJ , thenthere exist C1 , D1 ∈ Z such that γj(C1 + ωD1 ) ∈ (Z + DI) ∩ J.
Proposition 3.4.6. (UPHA) For any κ > 0, there exist η1 , η2 = O(log log(pNI NJ D)+
log(κ)) such that if c1 > log(p) + 3 log(D) − log(NJ ) + η1 and c2 > log(p) +3 log(DNI NJ ) + η2 and Mi is a random integer with ci < log(Mi ) < ci + 1 for
i = 1, 2, then SuborderEichlerNormD(M1 M2 ) will succeed with probability higher
than 1 − 2−κ when I is in a random class of Cl(O0 ). The expected running timeis in O(poly(log(pDNI NJ ))).
Proof. The result follows from Proposition 3.4.5 and Lemma 3.1.6.

3.5

Failures

Most of the size estimates we have presented on the various algorithms introduced in the sections above are based on the heuristic that, for a given class81

Algorithm 14 IdealSuborderEichlerNormN (D, I, J)
Input: An integer D, two left O0 -ideals I, J of inert prime norm NI , NJ andgcd(NI , NJ , D) = 1.
Output: β ∈ Z + DI ∩ J of norm NJ N .
1: Select a random class (C2 : D2 ) ∈ P1 (Z/DZ).
2: Compute γ = FullStrongApproximationN NJ (D, C2 , D2 )). If the computation
fails go back to Step 1.
3: Compute (C0 : D0 ) = EichlerModConstraint(I, γ, 1).
4: Compute (C3 : D3 ) = IdealModConstraint(J, γ).
5: Sample a random D2′ in Z/DZ, compute C2′ = −D2′ C2 (D2 )−1 mod D.
6: Compute C1 = CRTNI ,D,NJ (C0 , C2′ , C3 ), D1 = CRTNI ,D,NJ (D0 , D2′ , D3 ).
7: Compute µ = FullStrongApproximationNJ N /n(γ) (NI DNJ , C1 , D1 )). If it
fails, go back to step 1.
8: return β = γµ.

of ideals, the norm N of the output of EquivalentPrimeIdeal satisfies the boundin Lemma 3.2.3. This will be true with overwhelming probability for a randomclass, but there are some identifiable counter examples. In fact, by looking at
Eq. (3.2.1), it is easy to see that the bad situation will happen when the shortest
element α ∈ I is such that qI (α) is not prime and is significantly smaller than√p. Even if the bad ideal classes are rare, we will sometimes encounter them,and this is why we cannot simply dismiss them as too unlikely to happen. In
any case, it is always better to be able to handle all the extreme situations. The
simplest way to deal with this problem is to increase the size of the elements of
N . Indeed, as it is clear from Eq. (3.2.1), the size of N is at most p. Thus, if
N contains big enough elements, our algorithms will always be able to succeed.
However, in a number of our applications, this solution will not be acceptable
as the size of the elements in N will be tightly constrained. There is a way tohandle the problem without increasing the size of the output in most of thecases. In all our algorithm, the size constraint actually comes from the FullStrongApproximation algorithm. As we explained already, we want the input
N of FullStrongApproximation to be prime to improve efficiency. However, we
also explained that it could be run with an input N that is not prime. Thus,√
when there exists an equivalent ideal of norm M ≪ p, we can run FullStrongApproximation with this non-prime M . With good probability, the computation
will still succeed in a relatively efficient time (because M will not have too manyfactors) and obtain a solution whose size will be smaller than usual. Theremay be some very bad cases, where M has a lot of factors and so FullStrongApproximation will be very inefficient, but those situations will just not happen
in practice.
The only case, where this fix will not be enough is in SpecialEichlerNorm
because of the additional constraint that β ̸∈ Z + K. Indeed, if L is the ideal
equivalent to I(O0 , O) of the smallest possible norm and it happens that L ⊂ K,
then the constraint will never be satisfied because the output µ of FullStrongApproximation will satisfies µ ∈ Z + L ⊂ Z + K by design of the algorithm. Ifn(L) is coprime to ℓ, this will not happen, but it can occur when ℓ|n(J). In
summary, SpecialEichlerNormN cannot terminate on input O, K with an output
of size roughly p5/4 when O is connected to O0 with an ideal of very small

82

norm included in K. Without any further context, it is hard to see how we
can overcome the problem, and so we wait for a concrete application of SpecialEichlerNorm to explain how we hope to deal with this obstacle.

83Chapter 4

Isogeny representation:
algorithmic aspects
In this chapter, we explore ways to represent, manipulate and compute isogenies.
A good part of this chapter is made of new contributions, constituted of a mixof results from our articles [BDFLS20, DFKL+ 20, DFLW22, Ler21].
We begin with the definition of our main topic of interest: isogeny representations. We recall that Lisog is the language of isogenous curves (see Definition 1.1.27). Informally, an isogeny representation is a string sφ associated to
an isogeny φ : E1 → E2 of degree D. This string can be used as input to twoalgorithms: one that can verify that the element D, E1 , E2 is in Lisog and onethat can compute φ(P ) for some point P ∈ E1 .
We call the former a verification algorithm and the latter an evaluation
algorithm. We can regroup isogeny representations in families of representations
by looking at the associated verification and evaluation algorithms. Thus, toa family XX of representations we associate two algorithms XXVerification andXXEvaluation.
Since an isogeny of degree D1 D2 can always be decomposed as a D1 -isogeny
and a D2 -isogeny, we focus naturally on the case where D = ℓ and ℓ is a prime.
In a few occurrences, we will also target the case D = ℓe for efficiency reasons.
In what follows, we will introduce several families of representations andtheir verification and evaluations algorithms. This is motivated by isogeny-based
cryptography. As we will see in Part II, a number of algorithms introduced inthis chapter are going to be useful.
If we go back to Definition 1.1.11, isogenies are rational maps between elliptic
curves. As such, the most natural representation of an isogeny φ are the rational
functions f1 , f2 ∈ K(x, y), such that φ : (x, y) 7→ (f1 (x, y), f2 (x, y)). However,
we will see that this representation is far from being the most convenient. It canbe shown that the degree of the polynomials involved in the expression of f1 , f2
scales linearly with the degree ℓ of the isogeny. Very quickly, this representationof isogenies will be too big to handle efficiently. Nonetheless, we consider therational maps f1 , f2 as the canonical representation for φ and will refer to thesewhen simply saying “an isogeny”.
Let us make here a brief summary of the other family isogeny representations
that we will consider and of their respective interests. First, we have the kernel

84representation that we will treat in Section 4.1. Based on the Vélu formulæ, thisis the representation that is most often used in practice and it is definitely themost efficient to treat isogenies of smooth degree. However, in the generic case,the computational complexity is exponential in the degree. The ideal representation will be the focus of Section 4.2. This representation is based on the resultsof the Deuring correspondence and it is the most adapted to handle isogenies ofarbitrary degree since we have some heuristic polynomial-time algorithms in the
degree to perform all the necessary computations. Finally, we will introduce inSection 4.3, the suborder representation. This representation is also based on
the Deuring correspondence but in a different way. Like the ideal representation,
we have some heuristic polynomial-time algorithms to handle most of the taskeven though they are less efficient for the suborder representation. The interestof this third representation lies in the fact that we believe it is not equivalent
to the ideal representation and the gap between these two representations canbe used to build cryptography. This will be the focus of Chapter 7.
Through this chapter, unless specified otherwise, the isogenies we consider
are cyclic separable isogenies.

4.1

The kernel representation

For the result of this section, ℓ ̸= p is a prime number and q = pk for somek ≥ 1.
In this section, we state all time complexities in terms of algebraic operations
over Fq . In fact, most of our algorithm are algebraic algorithms in the senseof [BCS97], and can further be lifted to algorithms defined over Z[1/2] and insome cases over Z. In other words, the algorithms are agnostic to the choice ofp and q in Fq , except for sometimes requiring q to be odd; and the algorithms
can also be applied to more general rings, as long as all necessary divisions canbe carried out.
We have already explicited in Section 1.1 the strong link between an isogeny
and its kernel through the correspondence between cyclic ℓ-isogenies and cyclic
subgroups of order ℓ. The domain E and a generator P of ker φ is what we call akernel representation for φ. In this section, we will look at what operations canbe done using the kernel representation and how to perform them efficiently.
Let E be an elliptic curve over the finite field Fq , and let P be a point inE(Fq ) of order ℓ. The point P generates the cyclic subgroup G ⊆ E(Fq ). And
we write E ′ for the curve E/G and φ : E → E ′ for the isogeny whose kernel is⟨P ⟩. This isogeny is defined over Fq .
Vélu introduced formulæ for φ and E ′ (see [Vél71] and [Koh96, §2.4]): forE defined by y 2 = x3 + a2 x2 + a4 x + a6 and ℓ ≥ 3, we haveΦG (x) Y ΩG (x),φ : (x, y) 7−→
ΨG (x)2 ΨG (y)3where
ΨG (X) =Q(ℓ−1)/2
s=1
3

X − x([s]P ) ,ΦG (X) = 4(X + a2 X 2 + a4 X + a6 )(Ψ′G (X)2 − Ψ′′G (X)ΨG (X))
Pℓ−1
− 2(3X 2 + 2a2 X + a4 )Ψ′G (X)Ψ(X) + (ℓX − s=1 x([s]P ))ΨG (X)2 ,ΩG (X) = Φ′G (X)ΨG (X) − 2ΦG (X)Ψ′G (X) .
85

Definition 4.1.1. The polynomial ΨG in the Vélu formula is the kernel polynomial of φ.
With the Vélu formulæ, we see that we can very naturally design an algorithm KernelToIsogeny that takes a generator P of G and computes the isogeny
φ from ΨG , ΦG and ΩG (we will explain later that, for our applications, computing the kernel polynomial is enough). We are not going to give a detailed
description of this algorithm because it is quite straightforward from the Vélu
formulæ. We can easily verify that the degree of the polynomials ΨG , ΦG andΩG is in O(ℓ). Thus, when using efficient algorithms to compute a polynomialeand its derivatives from its roots, we get that KernelToIsogeny takes O(ℓ)
operations over Fq . From the output of KernelToIsogeny, φ can be evaluated ineO(ℓ).
To compute the defining equation of E ′ , we can evaluate φ(Q) for a few
Q outside G, possibly after extending Fq , and then interpolate a curve equation
through the resulting points. Alternatively, Vélu gives further formulas for theedefining equation. In any case, this computation can be done in O(ℓ)-operations
over Fq . In conclusion, there is an algorithm KernelVerificationℓ that takes in
input a triple ℓ, E, E ′ (where E, E ′ are defined over Fq ) and a non-trivial pointe
P ∈ E[ℓ]/Fq and outputs 1 if and only (ℓ, E, E ′ ) ∈ Lisog in O(ℓ)-operations
over
Fq . The Vélu formluæ also give directly an algorithm to evaluate the isogeny
φ on any point of E. This proves that the kernel representation is a family ofisogeny representation.
Conversely, given the isogeny φ, we can compute a generator of ker φ. We
call this algorithm IsogenyToKernel and similarly to KernelToIsogeny we do notinclude a detailed description. The idea is quite simple: compute a basis ⟨P1 , P2 ⟩of E[ℓ] and compute φ(P1 ), φ(P2 ). Then compute the discrete logarithm ofφ(P2 ) in the subgroup generated by φ(P1 ) (or the converse if it failed) to find alinear combination of P1 , P2 of order ℓ that is sent to 0E ′ by φ. The complexityeof IsogenyToKernel is O(ℓ)
operations over Fq .
Up to this point, everything that we said on the kernel representation ispretty standard in the literature. The main contribution of this section is toimprove upon the linear complexity of the algorithm we just√ outlined. Wee ℓ) that we willachieve a quadratic speed-up with algorithms of complexity O(
describe below. Before getting to that, we give some additional information on
the kernel representation.
Efficient isogeny computation. Let us go back to the case of an isogeny
φ of abstract degree D for a time. Neither the algorithms KernelToIsogeny,
IsogenyToKernel we described above nor the improvements that we will present
later have a polynomial complexity in D when D is prime. We are going to
introduce in Sections 4.2 and 4.3 two isogeny representations that let us manipulate efficiently isogenies of arbitrary degree when the endomorphism ringof E is known, but we are not aware of any generic algorithm when we have no
information on End(E). Note that contrary to the two aforementioned isogeny
representations, the kernel representation does not require having any information on End(E). One might wonder if there is a case where we can hope tohave efficient algorithms for the kernel representation. Fortunately, the answer
to that question is yes. Indeed, we have mentioned several times already that
any isogeny of composite degree D1 D2 could be seen as a D1 -isogeny composed86with a D2 -isogeny. This implies that if D is a B-smooth integer, we can get ale log(D)) over the field of definition for the D-torsion
gorithms of complexity O(Bby treating independently each isogeny of prime degree involved in the decomposition of the isogeny φ. This approach gives a polynomial algorithm when
the smoothness bound B = O(poly(log(D))). Since we only have an exponential
algorithm to treat prime degrees, we cannot hope to do better than that.
Remark 4.1.2. We made the choice of counting the number of operations over Fq
to simplify our analysis in the next sections. However, to get a more practicalestimate, we would also need to consider the degree of the extension Fq /Fp .
Indeed, the cost (in operations over Fp ) of operations over Fq is polynomial in[Fq : Fp ]. Even when D is smooth, we can see from Proposition 1.1.23 that wecannot exclude that Fq /Fp has large degree. For a generic p, the only way toensure that [Fq : Fp ] = O(poly(log(D))) is if D is powersmooth and each prime
power factor of D is smaller than B ′ = O(poly(log(D))). For some specificchoices of p and degree D, we can get that [Fq : Fp ] is small enough to get
efficient algorithms when D is smooth but not powersmooth. These restrictions
on the degrees that can be handled efficiently from the kernel representation
will have a big impact on the choices of parameter for the protocols in isogenybased cryptography. Most of the time, we need to use very specific values ofp and D. However, with the efficient isogeny representations from Sections 4.2
and 4.3, we will be able to use big prime degrees in some cases. In fact, theprotocols that we present in Part II are the first examples of schemes in isogenybased cryptography that are making use explicitly of big prime degrees insteadof smooth ones.
Compact kernel representation. We have discussed efficiency at length,
but compactness is another issue. Fortunately, the prospects are slightly better in that department for the kernel representation. Indeed, we show with
Lemma 4.1.3 that the kernel representation can always be compacted in a stringof polynomial size even if the kernel points are defined over a big extension of
Fp . Of course, Lemma 4.1.3 says nothing about the efficiency of the algorithm
required to compute that compressed representation. The compression technique underlying Lemma 4.1.3 is quite standard in isogeny-based cryptography[ZSP+ 18, NR19, AJK+ 16, CJL+ 17, PDJ20]. In Section 4.1.5, we will see a concrete and efficient algorithm to compress an isogeny of degree 2e based on thisprinciple.
Lemma 4.1.3. A cyclic isogeny of degree D can be represented as a string ofsize O(log(pD)).
Proof. We will be making use of the kernel representation to compress the cyclic
isogeny φ of degree D. First, one needs the starting curve E, which can be
described in O(log(p)) using the j-invariant. Let P, Q be a basis of E[D]. A
generator of the kernel of φ, can always be expressed as a linear combination ofP, Q whose coefficients x, y are smaller than D. In the end, it suffices to publish
j(E), x, y to obtain a representation of φ of size O(log(pN )). If the basis P, Q
can be computed canonically from j(E), anyone will be able to find ker φ fromE, x, yIn the rest of this section, we show how to get faster algorithms, in particular
to evaluate the kernel representation. The results that we present are the main87contributions of our joint publication [BDFLS20] with Bernstein, De Feo andSmith. In our cryptographic applications, the full computation of the isogeny
involved is often not necessary. First, we often work in x-only coordinates for
efficiency and size reasons, which means that focusing on the kernel polynomial
ΨG will be enough. Second, most of the time, we simply need to be able
to evaluate our isogeny on a few well-chosen points. For this reason, we will
focus mainly on evaluating the kernel polynomial as efficiently as possible. Our
main result on that matter is introduced in Section 4.1.3, and the two sections
Sections 4.1.1 and 4.1.2 can be seen as preliminaries to review related works. In
Section 4.1.4, we will explain concretely how to use this result for our purpose.

4.1.1

A generalization of the problem

Our algorithmic problem falls naturally into a more general framework: theefficient evaluation of polynomials and rational functions over Fq whose roots
are values of a function from a cyclic group to Fq .
Fix a cyclic group G (which we will write additively), a generator P of G,
and a function f : G → Fq . For each finite subset S of Z, we define a polynomialYhS (X) =(X − f ([s]P )) ,s∈S

where [s]P denotes the s-th scalar multiple of P . The kernel polynomial ΨG (x)above is an example of this, with f = x and S = {1, . . . , (ℓ − 1)/2}. Anotherexample is the cyclotomic polynomial Φn , where f embeds Z/nZ in the roots ofunity of Fq , and Φn (X) = hS (X) where S = {i | 0 ≤ i < n, gcd(i, n) = 1}. Moregenerally, if f maps i 7→ ζ i for some ζ, then hS (X) is a polynomial whose roots
are various powers of ζ; similarly, if f maps i 7→ iβ for some β, then hS (X) isa polynomial whose roots are various integer multiples ofQβ.
Given f and S, then, we want to compute hS (α) = s∈S (α − f ([s]P )) for
any α in Fq . One can always directly compute hS (α) in O(#S) Fq -operations;this is the standard way to compute ΨG (α). But if S has enough additive
structure, and if f is sufficiently compatible
with the group structure on G,√e #S) Fq -operations. Pollard [Pol74] andthen we can compute hS (α) in O(
Strassen [Str76] were the first to introduce this kind of ideas for deterministic
factorization. Those ideas were later reused in various contexts: we can mention
the recent generalization of Bostan [Bos20] for q-holonomic sequences.
Our main theoretical result on this subject is Theorem 4.1.9, which shows
how to achieve this quasi-square-root complexity for a large class of S when fis the x-coordinate function on an elliptic curve. We apply this to the special
case of efficient ℓ-isogeny computation in Section 4.1.4.
We focus on asymptotic exponents,
in particular improving ℓ-isogeny evalua√ee ℓ). However, this analysis hides polylogarithmiction from cost O(ℓ)
to cost O(
factors that can dominate the asymptotic improvement for small ℓ. At the endof Section 4.1.4, we discuss briefly concrete efficiency and compare with theconventional method.

4.1.2

Evaluation of polynomials whose roots are powers

In this section, we introduce the standard algorithm by Pollard to evaluate
efficiently a polynomial whose roots (with multiplicity) form a geometric pro88

gression.
Fix ζ ∈ (Z/nZ)∗ , we will consider this as an Q
implicit parameter of ouralgorithm below. Define G = Z and define hS (X) = s∈S (X −ζ s ) ∈ (Z/nZ)[X]for S = {1, 2, 3, . . . , ℓ}. Given α ∈ Z/nZ, one can straightforwardly evaluatehS (α) for this S using O(ℓ) algebraic operations√ in Z/nZ and we will show howeto accomplish the same result using only O( ℓ) operations.
√
Outline of the algorithm. Compute b = ⌊ ℓ⌋, and define I = {1, 2, 3, . . . , b}
and J = {0, b, 2b, . . . , (b − 1)b}. A multipoint evaluation can be used on theQbpolynomial hI (X) = i=1 (X − ζ i ) to compute hI (α/ζ j ) for all j ∈ J. Multiply
Qbζ jb by hI (α/ζ j ) to obtain i=1 (α − ζ i+j ) for each j, and then multiply acrossQb2Qℓj ∈ J to obtain s=1 (α−ζ s ). Finally, multiply by s=b2 +1 (α−ζ s ) to obtain theQb2sdesired hS (α). One can also view the productofs=1 (α − ζ ) as the resultant
QQjtwo degree-b polynomials. Specifically, j hI (α/ζ ) is the resultant of j (X −Q
Qα/ζ j ) and hI ; and j ζ jb hI (α/ζ j ) is the resultant of j (ζ j X − α) and hI .
Generic resultant algorithms can also be used to evaluate hS (α).
Structures in Q
S and f . We highlight two structures exploited in the aboveℓcomputation of s=1 (α−ζ s ). First, the set S = {1, 2, . . . , ℓ} has enough additive
structure to allow most of it to be decomposed as I +J, where I and J are muchsmaller sets. Second, the map s 7→ ζ s is a group homomorphism, allowing each
ζ i+j to be computed as the product of ζ i and ζ j .
We now formalize the statement regarding additive structure, focusing on
the Fq case that we will need later in the paper. First, some terminology: wesay that sets of integers I and J have no common differences if i1 − i2 ̸= j1 − j2
for all i1 ̸= i2 in I and all j1 ̸= j2 in J. If I and J have no common differences,then the map I × J → I + J sending (i, j) to i + j is a bijection.
Lemma 4.1.4.
Let q be a prime power. Let ζ be an element of F∗q . DefineQ
hS (X) = s∈S (X − ζ s ) ∈ Fq [X] for each finite subset S of Z. Let I and J be
finite subsets of Z with no common differences. Then
hI+J (X) = ResZ (hI (Z), HJ (X, Z))
where ResZ (·, ·) is the bivariate resultant, andY
HJ (X, Z) :=(X − ζ j Z).
j∈J

Q Q
Q
Proof. ResZ (hI (Z), HJ (X, Z)) = i∈I j∈J (X−ζ i ζ j ) = (i,j)∈I×J (X−ζ i+j ) =hI+J (X) since the map I × J → I + J sending (i, j) to i + j is bijective.
We now give a detailed description of the algorithm outlined above as Algorithm 15.
Proposition 4.1.5. Let q be a prime power. Let ζ be an element of F∗q . Let
I, J be finite subsets of Z with no common differences. Let K be Q
a finite subset
of Z disjoint from I + J. Given α in Fq , Algorithm 15 outputs s∈S (α − ζ s )eusing O(max(#I,#J, #K)) Fq -operations, where S = (I + J) ∪ K.

89

Algorithm 15 Computing hS (α) =Qs∈S (α − ζs)a prime power q; ζ ∈ F∗q ; finite subsets I, J, K ⊆ Z such that I and Js

Input:
have no common differences and (I + J) ∩ K = {}; ζ for each s ∈ I ∪ J ∪ K
α in Fq
Q
Output:QhS (α) where hS (X) = s∈S (X − ζ s ) and S = (I + J) ∪ K
hI ← Qi∈I (Z − ζ i ) ∈ Fq [Z]HJ ← j∈J (α − ζ j Z) ∈ Fq [Z]hI+J ←QResZ (hI , HJ ) ∈ Fq
hK ← k∈K (α − ζ k ) ∈ Fq
return hI+J · hK
Proof. Since S \ K = I + J, we have hS (α) = hI+J (α) · hK (α), and Lemma 4.1.4
eshows that hI+J (α) = ResZ (hI (Z), HJ (α, Z)). Line 1 computes hI (Z) in O(#I)
e
Fq -operations; Line 2 computes HJ (α, Z) in O(#J) Fq -operations; Line 3 comeputes hI+J (α) in O(max(#I,#J)) Fq -operations; and Line 4 computes hK (α)
eein O(#K) Fq -operations. The total is O(max(#I,#J, #K)) Fq -operations.

4.1.3

Evaluation of the polynomial whose roots are in an
elliptic curve torsion subgroup.

The technique in §4.1.2 for evaluating polynomials whose roots are powers iswell known. Our main theoretical contribution is to adapt this to polynomials
whose roots are functions of more interesting groups: in particular, functionsof elliptic-curve torsion points. The most important such function is the xcoordinate. The main complication here is that, unlike in §4.1.2, the function x
is not a homomorphism.
The elliptic setting. Let E/Fq be an elliptic curve, let P ∈ E(Fq ), anddefine G = ⟨P ⟩. Let S be a finite subset of Z. We want to evaluate(
Y0
if Q = 0 ,hS (X) =(X − f ([s]P )) ,where
f : Q 7−→x(Q)ifQ ̸= 0 ,s∈Sat some α in Fq . Here x : E → E/⟨±1⟩ ∼= P1 is the usual map to the x-line.
Adapting Algorithm 15 to this setting is not a simple matter of replacing themultiplicative group with an elliptic curve. Indeed, Algorithm 15 explicitly uses
the homomorphic nature of f : s 7→ ζ s to represent the roots ζ s as ζ i ζ j wheres = i + j. This presents an obstacle when moving to elliptic curves: x([i + j]P )is not a rational function of x([i]P ) and x([j]P ), so we cannot apply the same
trick of decomposing most of S as I + J before taking a resultant of polynomials
encoding f (I) and f (J). The isogenies context is different: we need a productof functions of x([i + j]P ).
Fortunately, even if the x-map is not homomorphic, there is an algebraic
relation between x(P ), x(Q), x(P + Q), and x(P − Q), which we will review
below. The introduction of the difference x(P − Q) as well as the sum x(P +Q) requires us to replace the decomposition of most of S as I + J with adecomposition involving I + J and I − J, which we will formalize in the next
paragraph.
90

Biquadratic relations on x-coordinates. Lemma 4.1.6 recalls the generalrelationship between x(P ), x(Q), x(P + Q), and x(P − Q). Example 1 gives
explicit formulæ for the case that is most useful in isogeny-based cryptography.
Lemma 4.1.6. Let q be a prime power. Let E/Fq be an elliptic curve. Thereexist biquadratic polynomials F0 , F1 , and F2 in Fq [X1 , X2 ] such that(X − x(P + Q))(X − x(P − Q)) = X 2 +F1 (x(P ), x(Q))
F2 (x(P ), x(Q))
X+
F0 (x(P ), x(Q))
F0 (x(P ), x(Q))

for all P and Q in E such that 0 ∈/ {P, Q, P + Q, P − Q}.
Proof. The existence of F0 , F1 , and F2 is classical (see e.g. [Cas91, p. 132] for
the Fi for Weierstrass models); indeed, the existence of such biquadratic systems
is a general phenomenon for theta functions of level 2 on abelian varieties (seee.g. [Mum66, §3]).
Example 1 (Biquadratics for Montgomery models). If E is defined by an affine
equation By 2 = x(x2 + Ax + 1), then the polynomials of Lemma 4.1.6 are
F0 (X1 , X2 ) = (X1 − X2 )2 ,F1 (X1 , X2 ) = −2((X1 X2 + 1)(X1 + X2 ) + 2AX1 X2 ) ,F2 (X1 , X2 ) = (X1 X2 − 1)2 .
The symmetric triquadratic polynomial (X0 X1 − 1)2 + (X0 X2 − 1)2 + (X1 X2 −1)2 − 2X0 X1 X2 (X0 + X1 + X2 + 2A) − 2 is X02 F0 (X1 , X2 ) + X0 F1 (X1 , X2 ) +F2 (X1 , X2 ).
Montgomery curves By 2 = x(x2 + Ax + 1), and the remarkably simple
formula (X1 X2 − 1)2 /(X1 − X2 )2 for the product x(P + Q)x(P − Q) on thesecurves, were introduced by Montgomery in [Mon87, Section 10.3.1].
An extended index system. In §4.1.2, we represented most of S as I + J;
requiring I and J to have no common differences ensured this representation
had no redundancy. Now we will represent most elements of S as elementsof (I + J) ∪ (I − J), so we need a stronger restriction on I and J to avoid
redundancy.
Definition 4.1.7. Let I and J be finite sets of integers.
1. We say that (I, J) is an index system if the maps I × J → Z defined by(i, j) 7→ i + j and (i, j) 7→ i − j are both injective and have disjoint images.
2. If S is a finite subset of Z, then we say that an index system (I, J) is anindex system for S if I + J and I − J are both contained in S.
If (I, J) is an index system, then the sets I +J and I −J are both in bijection
with I × J. We write I ± J for the union of I + J and I − J.
Example 2. Let m be an odd positive integer, and consider the set
S = {1, 3, 5, . . . , m}in arithmetic progression. Let
I := {2b(2i + 1) | 0 ≤ i < b′ }andJ := {2j + 1 | 0 ≤ j < b}√′where b = ⌊ m + 1/2⌋; b = ⌊(m + 1)/4b⌋ if b > 0; and b′ = 0 if b = 0. Then
(I, J) is an index system for S, and S \(I ±J) = K where K = {4bb′ +1, . . . , m−2, m}. If b > 0 then #I = b′ ≤ b + 2, #J = b, and #K ≤ 2b − 1.
91

The elliptic resultant. We are now ready to adapt the results of §4.1.2 tothe setting of the kernel polynomial. Our main tool is Lemma 4.1.8, which
expresses hI±J as a resultant of smaller polynomials.
Lemma 4.1.8. Let q be a prime power. Let E/Fq be an elliptic curve. Let P
be an element of E(Fq ). Let n be the order of P . Let (I, J) be an index systemsuch that I, J, I + J, and I − J do not contain any elements of nZ. Then
hI±J (X) =1· ResZ (hI (Z), EJ (X, Z))
∆I,J

where
EJ (X, Z) :=Y
F0 (Z, x([j]P ))X 2 + F1 (Z, x([j]P ))X + F2 (Z, x([j]P ))j∈Jand ∆I,J := ResZ (hI (Z), DJ (Z)) where DJ (Z) :=Q

j∈J F0 (Z, x([j]P )).

Proof. Since (I, J) is an index system, I +J and I −J are disjoint, and therefore
we have hI±J (X) = hI+J (X) · hI−J (X). Expanding and regrouping terms, we
get
YhI±J (X) =(X − x([i + j]P )) (X − x([i − j]P ))(i,j)∈I×J=

YY
i∈I j∈J

F1 (x([i]P ), x([j]P ))F2 (x([i]P ), x([j]P ))X +X+
F0 (x([i]P ), x([j]P ))F0 (x([i]P ), x([j]P ))2

by Lemma 4.1.6. Factoring out the denominator, we findQ
Qi∈I EJ (X, x([i]P ))i∈I EJ (X, x([i]P ))Q
Q
hI±J (X) == Q;
F(x([i]P),x([j]P))i∈Ij∈J 0i∈I DJ (x([i]P ))Q
Q
and finally i∈I EJ (X, x([i]P )) = ResZ (hI (Z), EJ (X, Z)) and i∈I DJ (x([i]P )) =ResZ (hI (Z), DJ (Z)) = ∆I,J , which yields the result.
We introduce as Algorithm 16, our efficient method to evaluate the polynomial hS on a point α. Theorem 4.1.9 proves its correctness and run time.
Theorem 4.1.9. Let q be a prime power. Let E/Fq be an elliptic curve. Let P
be an element of E(Fq ). Let n be the order of P . Let (I, J) be an index system
for a finite set S ⊂ Z. Assume that I, J, and S contain no elements of nZ.
Given α in Fq , Algorithm 16 computesYhS (α) =α − x([s]P )s∈Sein O(max(#I,#J, #K)) Fq -operations, where K = S \ (I ± J).
√e #S), then Algorithm 16 comIn particular, if #I, #J, and #K are in O(√e #S) Fq -operations. The O
e is uniform in q. Instead of taking
putes hS (α) in O(
P and various x([s]P ) as parameters, Algorithm 16 can take P as an input, atthe cost of computing the relevant multiples of P .
92

Algorithm 16 Computing hS (α) =

Q

s∈S


α − x([s]P ) for P ∈ E(Fq )Input: a prime power q; an elliptic curve E/Fq ; P ∈ E(Fq ); a finite subset
S ⊂ Z; an index system (I, J) for S such that S ∩nZ = I ∩nZ = J ∩nZ = {},where n is the order of P ; x([s]PQ ) for each s ∈ I ∪ J ∪ K α in Fq
Output: Q
hS (α) where hS (X) = s∈S (X − x([s]P ))1: hI ←
Qi∈I (Z − x([i]P )) ∈ Fq [Z]2: DJ ←
j∈J F0 (Z, x([j]P )) ∈ Fq [Z]3: ∆I,J ← ResZ (hI , DJ ) ∈ Fq
Q
2
4: EJ ←
j∈J F0 (Z, x([j]P ))α + F1 (Z, x([j]P ))α + F2 (Z, x([j]P )) ∈ Fq [Z]5: R ← ResZ (hI , EJ ) ∈ Fq
6: hK ←

Q

7: returnk∈S\(I±J) (α − x([k]P )) ∈ Fq

hK · R/∆I,J .

Proof. The proof follows that of Proposition 4.1.5. Since S \ K = I ± J, we havehS (α) = hI±J (α) · hK (α). Using the notation of Lemma 4.1.8: Line 1 computeseehI (Z) in O(#I)
Fq -operations; Line 2 computes DJ (Z) in O(#J)
Fq -operations;eLine 3 computes ∆I,J in O(max(#I, #J)) Fq -operations; Line 4 computeseEJ (α, Z) in O(#J)
Fq -operations; Line 5 computes ResZ (hI (Z), EJ (α, Z)),ewhich is the same as ∆I,J hI±J (α) by Lemma 4.1.8, in O(max(#I,#J)) Fq e
operations; Line 6 computes hK (α) in O(#K)
Fq -operations; returns hS (α) =ehK (α)·hI±J (α). The total number of Fq -operations is in O(max(#I,#J, #K)).

4.1.4

Application to isogeny computations

Coming back to our problem of evaluating kernel polynomials for isogenies ofprime degree ℓ, we have:YΨG (X) = hS (X) =(X − x([s]P ))where
S = {1, 3, . . . , ℓ − 2}s∈S(the set S may be replaced by any set of representatives of ((Z/ℓZ)\{0})/⟨±1⟩).
Following Example
2, let I = {2b(2i + 1) | 0 ≤ i < b′ } and J = {1, 3, . . . , 2b − 1}√with b = ⌊ ℓ − 1/2⌋ and (for b > 0) b′ = ⌊(ℓ − 1)/4b⌋; then (I, J) is an index
system for S, and Algorithm 16 computes hS (α) = ΨG (α) for any α in Fq in√e ℓ) Fq -operations.
O(
Below, we give more explanations as to why evaluating ΨG on a few selected
points is sufficient for our purpose, which can be divided in two main tasks: evaluating isogenies and computing the codomain. We focus on the x-coordinatesin the Montgomery setting as it is the most standard for concrete instantiation.
Evaluating isogenies. Let E/Fq : y 2 = x(x2 + Ax + 1) be an elliptic curve inMontgomery form, and let P be a point of prime order ℓ ̸= 2 in E(Fq ). Costelloand Hisil give explicit formulæ in [CH17] for a quotient isogeny φ : E → E ′with kernel G = ⟨P ⟩ such that E ′ /Fq : y 2 = x(x2 + A′ x + 1) is a Montgomery
curve:
φ : (X, Y ) 7−→ (φx (X), c0 Y φ′x (X))
93

where c0 =Q

0<s<ℓ/2 x([s]P ) andφx (X) = X

Y x([s]P )X − 1.
X − x([s]P )(4.1.1)0<s<ℓSee [Ren18] for generalizations and a different proof, and see the earlier paper [MS16] for analogous Edwards-coordinate formulas.
Our main goal is to evaluate φ on the level of x-coordinates: that is, tocompute φx (α) given α = x(Q) for Q in E(Fq ).
When the y-coordinate of φ(Q) is also required, one needs to compute φ′x (α)
together with φx (α). This can be done with simple adaptations of the techniquepresented above in Algorithm 16 (see [BDFLS20] for more details).
To compute φx (α), we rewrite Eq. (4.1.1) as
φx (X) =X ℓ · hS (1/X)2
hS (X)2

where

S = {1, 3, . . . , ℓ − 2} .

Computing φx (α) thus reduces to two applications of Algorithm 4.1.9, using(for example) the index system (I, J) for S in Example 2. The constant ∆I,J
appears with the same multiplicity in the numerator and denominator, so weneed not compute it. All divisions in the computation are by nonzero field
elements except in the following cases, which can be handled separately: if
Q = 0 then φ(Q) = 0; if Q ̸= 0 but hS (α) = 0 for α = x(Q) then φ(Q) = 0; if
Q = (0, 0) then φ(Q) = (0, 0).
Computing codomain curves Our other main task is to determine thecoefficient A′ in the defining equation of E ′ .
One approach is as follows. We can now efficiently compute φ(Q) for any Q
in E(Fq ). Changing the base ring from Fq to R = Fq [α]/(α2 + Aα + 1) (losing asmall constant factor in the cost of evaluation) gives us φ(Q) for any Q in E(R).
In particular, Q = (α, 0) is a point in E[2](R), and computing φ(Q) = (α′ , 0)reveals A′ = −(α′ + 1/α′ ). An alternative—at the expense of taking a squareroot, which is no longer a q-independent algebraic computation—is to find apoint (α, 0) in E(Fq2 ) with α ̸= 0. Sometimes α is in Fq , and then extending to
Fq2 is unnecessary.
′
Another approach is to use explicit
from [CH17]
Q formulas for A . The formulas
P′2
2
give A = c0 (A − 3σ) where c0 = 0<s<ℓ x([s]P ) and σ = 0<s<ℓ (x([s]P ) −1/x([s]P )). As pointed out in [MR18] in the context of CSIDH, one can insteadtransform to twisted Edwards form and use the formulas from [MS16], obtaining
A′ = 2(1 + d)/(1 − d) where

d=

A−2
A+2

ℓ  Ys∈Sx([s]P ) − 1x([s]P ) + 1

8


=

A−2
A+2

ℓ 

hS (1)hS (−1)8.

√e ℓ) operations: every task we need can be
We can thus compute A′ using O(
performed by some evaluations of hS and some (asymptotically negligible) operations.

94

Concrete efficiency. Asymptotic improvements rarely translate in a concrete
improvement for all size of inputs. Thus, the question is: at what point the newalgorithm outperforms the old one? Our new method is no exception. We havemade various implementations in different languages to try and determine when
our improved method to evaluate the Vélu formulæ becomes better than theconventional one in the case of the small primes used in the CSIDH scheme[CLM+ 18], where we have Fq = Fp for a 512-bits prime p. While the precise
cutoff depends on various things, we can estimate that the new method is worth
using for primes degrees bigger than roughly 100 over a prime characteristic ofcryptographic sizes. We will see in Part II that this is well within the range ofdegrees required by some of our protocols. More analysis and benchmarks can befound in [BDFLS20]. In the implementations that we present for the protocols
of Part II, we used our new algorithm to deal with the isogeny computations
for degrees over 100.

4.1.5

A compressed representation

In this section, we give an example of the compression/decompression mechanism underlying Lemma 4.1.3 in the case of a degree contained in 2• . We
will use these algorithms for the protocols in Part II. We will provide anotherexample with the G-CGL hash function introduced in Section 6.2.1
Discrete logarithm algorithms. In Compression, Decompression and laterin the algorithms of Sections 4.2 and 4.3, we will need to solve some discrete
logarithms. We write DLPD for the algorithm taking Q, P ∈ E[D] with Q ∈ ⟨P ⟩and that outputs the scalar a such that Q = [a]P . We will also use the bidimensional version BiDLPD that takes Q, P1 , P2 ∈ E[D] with P1 , P2 a basis of
E[D] and outputs a, b such that Q = [a]P1 + [b]P2 . We write xDLP and xBiDLP,√
the variant that takes the x-coordinates instead. The complexity is in O( D)
operations over the field of definition of E[D]. The worst case is when D isprime. The complexity of the composite case reduces to the complexity of eachcoprime component with the classical Pohlig-Hellman method.
We put ourselves in the setting where the 2f -torsion is defined over Fp2 ande is equal to vf . In that case, if σ is the isogeny to be compressed, we can decompose σ = σv ◦ · · · σ1 . We highlight that the strategy inspiring Algorithms 17
and 18 is quite classical and this is why we introduce Compression, Decompression without a formal proof of correctness. We present a slightly faster version
than what is usual by using a less compact representation. The idea is to add
a few bits of information for every σj . We choose arbitrarily to take 4 for thenumber of these bits, but we stress that this choice can be adjusted. For thesake of explanation, let us assume that each σj has degree exactly 2f . We use
a canonical way to sample pseudo-random points on any supersingular curve
E. This means that anyone knowing a curve E can agree on an ordered list of
points P1E , P2E , P3E , · · · on E(Fp2 ). This is classical for key compression, and werefer to the sources mentioned in the beginning of the section for more details.
We keep this notation for Algorithms 17 and 18.
We can easily derive variants Compressionℓ• , Decompressionℓ• for isogenies ofany prime power degree (up to considering fields extensions of Fp2 if necessary).
By concatenating the output of these variants of Compression and Decompression, we get an algorithm that works for any arbitrary degree. If the degree95

Algorithm 17 Compression2• (E, σ)Input: A curve E and an isogeny σ = σv ◦ · · · σ1 of degree 2f v of domain E.
Output: A bit string of size (f + 4)(v − 1) + f representing σ.
1: Compute a canonical basis of the torsion E[2f ] and encode in S1 an integerof f bits using DLP2f , the kernel of σ1 . This also determines Q1 a point
orthogonal to the kernel. Q2 ← σ1 (Q1 )2: for j ∈ [2, v] do
3:
Write Ej for the codomain of σj−1 , k ← 1.
4:
Deterministically generate a sequence R1 , R2 , · · · ∈ Ej [2f ] until we reacha k for which Rk is orthogonal to Qj . If k < 24 − 1, set sj to be the binary
representation of k. Else, set sj = 1111.
5:
Use DLP2f to compute the f -bit integer Sj such that ker σj = ⟨Rj +[Sj ]Qj ⟩.
6:
Qj+1 ← σj (Qj ).
7: end for
8: return S = S1 ||s2 ||S2 || · ||sv ||Sv .
Algorithm 18 Decompression2• (E, S)
Input: The curve E, a bit string S of size (f + 4)(v − 1) + f representing σ.
Output: An isogeny σ = σv ◦ · · · σ1 of degree 2f g .
1: Parse S as S1 ||s2 ||S2 || · ||sv ||Sv where each Sj has f bits and sj has 4 bits.
2: Compute canonically a basis of the torsion E[2f ] and find R1 using S1 .
Define σ1 as the isogeny of kernel R1 and determine Q1 a point orthogonal
to the kernel.
3: Q2 ← σ1 (Q1 ).
4: for j ∈ [2, v] do
5:Write Ej for the codomain of σj−1 , k ← 1.
6:
If sj ̸= 1111, parse sj as an integer k and recover Rj . Else, k ← 16 andcompute R15 , R16 , . . . until Rj is orthogonal to Qj .
7:
Parse Sj as an integer and compute σj = KernelToIsogenyRj +[Sj ]Qj .
8:
Qj+1 ← σj (Qj ).
9: end for
10: return σ = σv ◦ · · · ◦ σ1 .

is smooth or powersmooth (with smoothness bound in O(poly(log(p)))), thenthere is always a choice of exponent f such that the field of definition of theℓf -torsion is small for every supersingular, and so we get an algorithm of complexity O(poly(log(p))).

4.2

The ideal representation

In this section, we introduce the ideal representation, an isogeny representation
naturally derived from the Deuring correspondence. This representation appears to be much more suited to handle a generic isogeny than the canonicalrepresentation or the kernel representation.
The important algorithmic building blocks to handle the ideal representation
were introduced in [KLPT14, GPS17, EHL+ 18]. Our main contribution in this96

section are the practical algorithms to perform the translation from the ideal
representation that we present in Section 4.2.2.
Remark 4.2.1. In this section and the next, we will build upon the heuristic
algorithms from Chapter 3. As a result, all our results are only holding under heuristic assumptions. As mentioned in Chapter 3, Wesolowski [Wes22]
introduced a version of the KLPT algorithm and managed to prove its expected
polynomial termination assuming only the GRH. The tools developed for KLPT
could be reused to derive provable versions of most of the other algorithms
from Chapter 3. Using these variants instead, it should be possible to prove
most of the results of this section and the next under the generalized Riemannhypothesis only.
Let us fix an element x = (D, E1 , E2 ) ∈ Lisog and assume that φ is a corresponding isogeny of degree D. We define the ideal representation for the isogeny
φ as the associated kernel ideal Iφ (see Definition 2.1.1). With Lemma 2.2.5,
we have shown that the ideal representation can be as compact as the kernel
representation as we can represent any ideal of degree D with a basis whose
coefficients over the canonical basis of Bp,∞ have size O(log(pD)).
In Section 4.2.1, we see how to perform the generic translation from theideal representation to the canonical representation and the converse. In Section 4.2.2, we present fast algorithms targeting the special case of ideal to isogenytranslation when the degree is in ℓ• for some small prime ℓ. In Section 4.2.3,
we explain how to perform the verification of an ideal representation. Finally,in Section 4.2.4, we explain how to use the ideal representation to evaluate
any isogeny in polynomial time over the field of definition of the point to beevaluated.

4.2.1

Ideal to isogeny translation, the generic caseWe introduce two generic algorithms to make the translation for an isogeny/idealof degree/norm ℓ. As for the kernel representation, the algorithms we present
work over Fq the field of definition of the ℓ-torsion. Galbraith, Petit and Silva
in [GPS17] introduced the first explicit formulation of these algorithms. They
are quite naturally derived from Definition 2.1.1 and Definition 2.1.3 of kernel
ideals and kernel of an ideal. In fact, these algorithms work by computing thekernel of φ first, so we give a detailed description of the two sub-algorithms
IdealToKernel and KernelToIdeal from which we can derive IdealToIsogeny and
IsogenyToIdeal by composition with KernelToIsogeny and IsogenyToKernel. We
target an arbitrary degree D.
In both IdealToKernel and KernelToIdeal, we assume that an explicit basis
θ1 , θ2 , θ3 , θ4 is known for End(E1 ) where each θi can be evaluated on any point
P of E(Fq ) in O(log(pℓ)) operations over Fq . We also assume that we have a
way to compute a concrete isomorphism between End(E1 ) and any isomorphic
maximal order. We will come back to these assumptions a bit later.
Lemma 4.2.2. The√algorithms KernelToIdealD and IdealToKernelD are correct
and terminate in O( D) operations over the field of definition of E1 [D].
Proof. By our assumption on the endomorphism ring of E1 , the bottleneck
operationin both algorithms is the discrete logarithm computations, which have√O( D) complexity.
97

Algorithm 19 IdealToKernelD
Input: A curve E1 , a cyclic ideal of maximal orders I ⊂ Bp,∞ .
Output: A generator PI of E1 [I]
1: Compute D = n(I) and O1 = OL (I).
2: Compute an explicit isomorphism ι : End(E1 ) → O1 .
3: Compute a generator α ∈ I such that I = O1 ⟨α, D⟩.
4: Compute a basis P, Q of E1 [D].
5: Compute R, S = ι−1 (α)(P, Q).
6: if The order of R < D then
7:
Swap P with Q and R with S.
8: end if
9: Compute a = DLPD (R, S).
10: return P − [a]Q.
Algorithm 20 KernelToIdealD
Input: A point P of order D in E1 [D].
Output: The ideal I(⟨P ⟩).
1: Compute ι : End(E1 ) ,→ Bp,∞ and set O1 = ι(End(E1 ).
2: Compute a basis θ1 , θ2 , θ3 , θ4 of End(E1 ) where each θi has its norm coprime
to D.
3: Find i, j such that θi (P ), θj (P ) is a basis of E1 [D].
4: Take k ̸= i, j and compute a, b = BiDLPD (θk (P ), θi (P ), θj (P )).
5: Compute α = ι(θk − aθi − bθj ).
6: return O1 ⟨α, D⟩.

For the correctness of IdealToKernelD , since α is a generator of I, we havethat ι−1 (E1 [D]) is a cyclic subgroup of order D of E1 . Since P, Q is a basis of
E1 [D], at least one of them is a generator of this cyclic subgroup, and so weensure that there is a solution to the DLP. By definition of the kernel of an
ideal, we get that P − [a]Q is a generator of this group.
For the correctness of KernelToIdealD , we have that End(E1 ) ⊗ Zℓ is theendomorphism ring of the Tate module Tℓ (E1 ) and is isomorphic to M2 (Zℓ ) for
any prime ℓ ̸= p. So we get that the action of End(E1 ) on E1 [D] ∼= Z/DZ2
is the same as M2 (Z/DZ). Thus, we must have two endomorphisms θi , θj in
the basis of End(E1 ) sending P to points of order D that are not in the same
subgroup of order D, which implies that they form a basis of E1 [D]. This is
why the bi-dimensional DLP will be correct and find two coefficients a, b suchthat θk (P ) = aθi (P ) + bθj (P ). This proves that α = ι(θk − aθi − bθj ) will
be in I(⟨P ⟩) from Definition 2.1.1. To see that α must generate this ideal, it
suffices to argue that ⟨P ⟩ = ker(α) ∩ E1 [D]. Since we have already exhibitedthat ⟨P ⟩ ⊂ ker(α), if there is another point Q ∈ ker(α) ∩ E1 [D], we must havethat there exists d|D such that E1 [d] ⊂ ker(α) and this is not possible for a
combination of a basis of End(E1 ) whose coefficients are not all zero in Z/dZ
(otherwise the basis could not generate any matrix in M2 (Z/dZ)). This provesthat the output is correct.
Remark 4.2.3. Seeing Lemma 4.2.2, one might think that contrary to what weannounced, the ideal representation is not better than the kernel representation98

since the complexity remains exponential in D. In fact, the inefficiency of KernelToIdeal and IdealToKernel stems directly from the fact that we want to translate
to or from the kernel representation. In Section 4.2.3, we will show that we cando a lot better because we avoid entirely to compute the kernel of φ.

4.2.2

Ideal to isogeny, efficient algorithms for the prime
power caseThis section is dedicated to devise an efficient method to perform the ideal
to isogeny translation when the degree is ℓe . We are going to present two
different algorithms to perform that task. The first one, IdealToIsogenyFromKLPT, was first introduced in essence by Eisentraeger et al. in [EHL+ 18] as anefficient generalization of the IdealToIsogeny algorithm from Section 4.2.1. The
version we present is enhanced with several tricks to improve the efficiency andwas presented in our article [DFKL+ 20]. The second one, IdealToIsogenyFromEichler, works slightly differently. It was a contribution of our paper [DFLW22]
and was introduced as an improvement of IdealToIsogenyFromKLPT. The two
approaches have their interest and this is why we present them both, but thesecond one appears to be faster in practice, which we will justify informally inthis section, and later experimentally in Chapter 5, where we provide a detailed
cost analysis between the two methods and concrete efficiency in the context ofthe signature scheme presented there.
The IdealToIsogeny algorithm from Section 4.2.1 is not efficient when the
degree is ℓe for some large exponent e because the ℓe -torsion might be definedon an extension of Fp2 of very large degree. To avoid the expensive operations
over huge field extensions, we will divide the computation into steps of size ℓfwhere f is the biggest exponent such that the ℓf -torsion is defined over Fp2 (weassume f > 0) so we only need to perform operations in Fp2 .
In Part II, we are going to take ℓ = 2 but we state our algorithms in fullgenerality. Nonetheless, it might be worth remembering that we target valuesof ℓ ≪ p for which a O(poly(ℓ)) complexity is considered acceptable. Let I be
the ideal of norm ℓe that we want to translate. The corresponding isogeny φIadmits the decomposition φg ◦ . . . φ1 under the filtration I = I1 I2 · · · Ig , where
each Ii of norm ℓf corresponds to φi under the Deuring correspondence.
Given what we have said so far, the task might seem easy at first glance. If
we iterate several times IdealToIsogeny√ to translate each of the Ii , then with theeℓ) complexity algorithm, it seems that weℓf -torsion defined over Fp2 and a O(fhave everything we need already. And this is true except for a small caveat: for
IdealToKernel, we made the seemingly reasonable assumption that we have a way
to evaluate efficiently the endomorphisms of the domain. In reality, evaluating
endomorphism of a random supersingular curve is not something easy, and thetwo methods we present below are heavily dependent on the way we choose to
do this task.
On representing and evaluating endomorphism rings. In Chapter 2,
we introduced the Deuring correspondence and we gave as a concrete example
the curve E0 of j-invariant 1728, which is supersingular and has endomorphism
1+kring isomorphic to the maximal order O0 = ⟨1, i, i+j
2 , 2 ⟩ in Bp,∞ when p = 3
mod 4. We also gave concrete formulas for the endomorphisms ι, π ∈ End(E0 )99corresponding to i, j under the isomorphism ρ0 : O0 → End(E0 ). From there,
we can derive explicitly the image of any endomorphism under ρ0 by decomposing it first on the basis of O0 before using the addition formulas, the scalarmultiplications and ι, π.
There is only a slight issue in what we described briefly: how do we translate
the division by two through our isomorphism? Scalar multiplication is a welldefined operation over any elliptic curve, but there is no division operation. If
we say that the division by two is the inverse of the multiplication by two, we caneasily evaluate it on any point of order N coprime to 2 by replacing the divisionby 2 with the scalar multiplication by the inverse of 2 mod N . Treating thepoints of even order is more complicated. Since [2] has a kernel of size 4, there
are always four preimage under [2] of any point of even order, and they can befound by computing the roots of the second division polynomial. Fortunately,
we don’t need to lift the ambiguity to evaluate endomorphisms. If we want toevaluate the endomorphism α/2 on the point P when we know how to evaluate
the endomorphism α on any point, it suffices to have any point Q such thatP = [2]Q. Then (α/2)(P ) = α(Q). Since the second division polynomial has
small degree, finding the roots can be done easily and the point Q will be definedon a quadratic extension in the worst case.
This finishes explaining how we can evaluate any endomorphism of End(E0 )quite efficiently. We can find an analog of the curve E0 for any prime p. Interestingly enough, as we can conjecture from our example, all the instances ofsuch supersingular curves have an endomorphism ring that is isomorphic to oneof the special extremal orders from Chapter 3. So let us assume for the rest of
this paragraph that we take the curve E0 to be the special extremal curve in Fp2 .
The difficulty we encountered with the division by 2 forebodes the complications
we will encounter for a generic supersingular curve E1 where we don’t have niceendomorphisms with simple expressions. A solution was outlined in [EHL+ 18]
using an isogeny φ : E0 → E1 of degree N . Let us write Iφ , the corresponding
ideal and O1 = OR (I) ∼= End(E1 ). The idea is to use the fact that N O1 ⊂ O0 .
This containment corresponds to the embedding of θ0 = φ̂ ◦ θ ◦ φ in End(E0 )for any θ ∈ End(E1 ) (we have already used this embedding in Section 2.3.2).
Using the reverse embedding of N O0 ,→ O1 , we get [N 2 ]θ = φ ◦ θ0 ◦ φ̂ and soθ=φ ◦ θ0 ◦ φ̂.
N2

(4.2.1)Thus, the idea is to evaluate θ by first evaluating θ0 with the explicit isomorphism ρ0 , translate this to E1 using φ and φ̂ and then apply the division by
N 2.
The method we just outlined will successfully allow us to evaluate any endomorphism in any supersingular curve (when we know its endomorphism ring).
However, if we want something that is efficient, there is still some work to do.
The main operations are translation from Iφ to φ, evaluations of φ and φ̂, andthe division by N 2 . This implies two things: the degree N needs to enable
fast N -isogenies evaluations and translation, and we need efficient division by
N . These two constraints imply that we need to be very careful in the choiceof N . More precisely, for efficient isogeny evaluation and translation, the best
choice is to have N smooth as we explained in Section 4.1. For the division,
it is important that N is either small (so that we can easily compute a preimage under the scalar multiplication by N ) or that it is coprime to the order of100the point we need to evaluate. Apart from special cases, we cannot hope for asmall N and so we will always target the second possibility. Without further
assumptions, when O1 is a random maximal order, we cannot say anything on
the norm of I(O0 , O1 ). This is where the algorithms from Chapter 3 come intoplay. Using KLPT, we can find a J ∼ I with some control over its norm. Thismeans that we will be able to compute O1′ ∼= End(E1 ) where n(I(O0 , O1′ ) willallow for efficient evaluation of the endomorphisms on any points of E1 (under
the constraint we stated above). This is exactly the idea that we apply to get
IdealToIsogenyFromKLPT. The IdealToIsogenyFromEichler algorithm will follow
from slightly different ideas that we explain a bit later.
The discussion above motivates the introduction of a smooth integer T coprime to ℓ such that T -isogeny computations are efficient over the supersingularcurves in Fp2 and T > p3 so that KLPTD(T ) will succeed with overwhelming
probability (we recall that KLPTD(T ) will look for ideals whose norm divides
T ). If we want a generic T that will work for all prime p, we can always takeit to be powersmooth. For specific values of p, it might be possible to get abetter choice by carefully looking at the divisors of #E(Fq ) for q that are small
powers of p (in practice we will take q = p2 ). This is what we will do in theconcrete instantiations in Part II. The difficulty in finding a good T comes fromthe bound in Proposition 3.2.7 where we require T > p. We will come backlater in Part II on the problem of finding good p and T .
Putting everything we have said so far together, we see that IdealToIsogenyFromKLPT will be made of consecutive executions of two main building blocks:
IdealToIsogenyCoprime to translate and evaluate T -isogenies and IdealToIsogenySmallFromKLPT to translate ℓf isogenies using the endomorphism ring representation given by the output of IdealToIsogenyCoprime. Below, we discuss several
tricks that will make our final algorithms more efficient.
Computing half of the isogeny from the image curve. One of the main
limitations of the algorithm outlined above is the fact that we restrict ourselvesto degrees that are defined on small Fp2 extensions, which is a strong constraint
on the size of these degrees. There is a way to double the size of the degrees
we can handle without changing the torsion requirement. Let us assume herethat we want to perform the translation of an isogeny φ : E1 → E2 of norm
D2 . Instead of applying IdealToIsogeny on E1 that would require to use the D2 torsion, we can use the fact that φ := φ2 ◦ φ1 , each of degree D, to apply IdealToIsogeny once on E1 and once on E2 to compute φ1 and φ̂2 respectively using
only the D-torsion. We apply this idea in IdealToIsogenyCoprime to translate an
ideal of norm dividing T 2 (instead of T previously) to the corresponding isogeny.
3This means we now only need T ∼ p 2 instead of T ∼ p3 and this will greatly
help for a choice of concrete parameters in our applications. We will also use it
in IdealToIsogenySmallFromKLPT to make steps of size ℓ2f instead of ℓf .
Meet-in-the-middle. If we push further the idea from the previous paragraph, we can do a little better. Let us now assume that we want to translate
an isogeny of degree D2 e. We can decompose it as φ = φ2 ◦ η ◦ φ1 where φi havedegree D and η have degree e. We can compute φ1 , φ̂2 from the D-torsion as
before. Let us write E3 , E4 the codomains of these curves so that η : E3 → E4 .
If η is small enough and smooth enough, it is conceivable that we can simply

101

E2
ψ1′
ρ2
ψ2

E4

E6
η

smooth (coprime to ℓ) isogenies

θ
E3
ψ1

E5
E0

φ2

φK

ℓ• -isogenies
meet-in-the-middle isogenies

φ1
E1

φJ
Figure 4.1: Graphical representation of the ideal to isogeny translation of IdealToIsogenySmallFromKLPT√
compute η in O( e) by performing a meet-in-the-middle of degree e between
E3 , E4 (i.e., perform brute force through all the isogenies of degree e1 startingfrom E3 and e2 starting from E4 with e1 e2 = e until we find a collision). We
will apply this idea by taking e = ℓ∆ in IdealToIsogenySmallFromKLPT to makesteps of size ℓ2f +∆ instead of ℓ2f . In our applications, the size of ∆ will not
be negligible before the size of f , which is why this trick is useful. We do not
apply it in IdealToIsogenyCoprime because, as T is much bigger than ℓ∆ , it will
not change much.
Our two ideas put together are illustrated in Figure 4.1. The notations from
Figure 4.1 are consistent with the ones in IdealToIsogenyCoprime and IdealToIsogenySmallFromKLPT;
Ideal to isogeny from KLPT. We are now ready to give a detailed description of our main algorithm IdealToIsogenyFromKLPT in Algorithm 23. As we
explained, our method is inspired by the algorithms from [EHL+ 18] and this is
why we give only sketches of proofs for the next propositions.
IdealToIsogenyFromKLPT translates an O-ideal of norm ℓe in the corresponding isogeny for any maximal order O. It requires K a left O0 -ideal and rightO-ideal of degree in ℓ• along with the corresponding isogeny φK : E0 → E
where O ∼= End(E). The value ℓ is an implicit parameter, as are the exponents
f and ∆ (for the meet-in-the-middle) and the integer T .
As explained, IdealToIsogenyFromKLPT uses the following subroutines:• IdealToIsogenyCoprime(J, K, φK ): described in Algorithm 21, it takes J, K
two left O0 -ideals of norm n(K) ∈ ℓ• and n(J) dividing T 2 along with theisogeny φK : E0 → E and outputs φJ .
• IdealToIsogenySmallFromKLPT(I, J, K, φJ , φK ): described in Algorithm 22,
it takes I a left O0 -ideal of norm dividing T 2 ℓ2f +∆ , J containing I of norm
dividing T 2 and K ∼ J of norm ℓ• along with φJ , φK and outputs φ ofdegree ℓ2f +∆ such that φI = φ ◦ φJ .

102

Algorithm 21 IdealToIsogenyCoprimeT (J, K, φK )Input: Two equivalent left ideals J, K of O0 , with J of norm dividing T 2 andK of norm ℓ• , and the corresponding isogeny φK : E0 → E.
Output: φJ .
1: H1 ← J + T O0 .
2: Let α ∈ K such that J = χK (α).
3: H2 ← ⟨α, (n(J)/n(H1 ))⟩.
4: φHi ← IdealToIsogenyn(Hi ) (Hi ) : E0 → Ei .
5: Let ψ : E → E/φK (ker φH2 ) = E1 .
6: return ψ̂ ◦ φH1 .

Proposition 4.2.4. The algorithm√ IdealToIsogenyCoprime is correct and terminates in O(poly(log(pn(K)T )) B), where B is the maximum of ℓ and thesmoothness bound of T .
Proof. (sketch) The coefficients of a basis of O0 are in O(poly(p)). Thus, the coefficients of a basis of J, K are in O(poly(pT n(K))), and so every operation over
Bp,∞ can be carried out in O(poly(log(pTn(K)))). The T -isogeny translation√and computations takes O(log(t) B)-operations over Fp2 by Lemma 4.2.2 andthe results from Section 4.1. IdealToIsogeny can be applied because we performthe translation for O0 -ideals and the curve E0 is one of the special cases where
we have a concrete isomorphism√ between End(E0 ) and O0 . The evaluation
through φK can be done in O( B log(n(K)) and since ℓ and T are coprime, ψis well-defined as the push-forward through φK of φH2 .

Algorithm 22 IdealToIsogenySmallFromKLPT(I, J, K, φJ , φK )Input: I a left O0 -ideal of norm dividing T 2 ℓ2f +∆ , an O0 -ideal in J containing
I of norm dividing T 2 , and an ideal K ∼ J of norm a power of ℓ, as well as
φJ and φK .
Output: φ = φ2 ◦ θ ◦ φ1 : E1 → E2 of degree ℓ2f +∆ such that φI = φ ◦ φJ ,L ∼ I of norm dividing T 2 and φL .
0: Write φJ , φK : E0 → E1 .
1: Let I1 = I + ℓf O0 .
2: Let φ′1 = IdealToIsogenyℓf (I1 ).
3: Let φ1 = [φJ ]∗ φ′1 : E1 → E3 .
4: Let L = KLPTD(T 2 ) (I).
5: Let α ∈ K such that J = χK (α).
6: Let β ∈ I such that L = χI (β).
7: Let γ = βα/n(J). We have γ ∈ K, γ̄ ∈ L, and n(γ) = T 2 ℓ2f +∆ n(K).
8: Let H1 = ⟨γ, n(K)ℓf T ⟩. We have φH1 = ψ1 ◦ φ1 ◦ φK : E0 → E5 , where ψ1
has degree T .
9: Let H2 = ⟨γ, ℓf T ⟩. We have φH2 = ρ2 ◦ ψ2 : E0 → E6 , where ψ2 has degree
T and φ2 has degree ℓf .
10: Find η : E5 → E6 of degree ℓ∆ with meet-in-the-middle.
11: Let φ2 ◦ θ = [ψ̂1 ]∗ ρ̂2 ◦ η : E3 → E2 and ψ1′ = [φ̂2 ◦ η]∗ ψ̂1 .
12: return φ = φ2 θ ◦ φ1 , L and ψ1′ ◦ ψ2 .

103

Proposition 4.2.5. (UPHA) For any κ > 0, there exists η = O(log log(p) +log(κ)) such that if T is a B-smooth integer with log(T ) > 3/2 log(p) + η and√ℓ < B < p+η, then IdealToIsogenySmallFromKLPT will succeed with probability
bigger than 1 − 2−κ when I is√in a random ideal class. The expected running
time is O(poly(log(pT n(K)f )) B ∆ )Proof. (sketch) For the same reason as in Proposition 4.2.4 the ideals have coefficients of size in O(poly(pT n(K))) and so all the operations over Bp,∞√can be performed in O(poly(log(pT n(K)))). The meet-in-the-middle takes O( B ∆ ) operations
take√√ over small field extensions of log(p). The T -isogeny computations
O( B log(T )) and ℓf -isogenies translation and computations take O( B log(T )f )by Lemma 4.2.2. The proof of the expected running time is completed by Proposition 3.2.7.
We refer to Figure 4.1 to verify the correctness of the various isogeny computations that we do. If T > p3/2 + η and is B-smooth with B < p1/2 + η(where the value η depends on η1 , η2 in Proposition 3.2.7) we will be able towrite T 2 as T1 T2 where T1 , T2 respects the constraint of Proposition 3.2.7 andthe probability of success follows from Proposition 3.2.7.
Algorithm 23 IdealToIsogenyFromKLPTℓ• (I, K, φK )Input: A left O-ideal I of norm a power of ℓ, K a left O0 -ideal and right O-idealof norm ℓ• , the corresponding φK .
Output: φI .
1: Write I = Iv ⊂ · · · ⊂ I1 ⊂ I0 = O where n(Ii )/n(Ii−1 ) ≤ ℓ2f +∆ .
2: J ← KLPTT 2 (K).
3: φJ ← IdealToIsogenyCoprime(J, K, φK ).
4: for i = 1, . . . , v do
5:φi , J, φJ ← IdealToIsogenySmallFromKLPT(J · Ii , J, K, φJ , φK ).
6:
K ← K · Ii .
7:
φK ← φi ◦ φK .
8: end for
9: return φn ◦ · · · ◦ φ1 .

Proposition 4.2.6. (UPHA) For any κ > 0, there exists η = O(log log(pn(I))+
log(κ)) such that if T is a B-smooth integer with log(T ) > 3/2 log(p) + η and√ℓ < B < p + η, then IdealToIsogenyFromKLPT will succeed with probability
bigger than 1 − 2−κ when I is in a√random ideal class. The expected running
time is O(poly(log(pT n(K)n(I)f )) B ∆ )Proof. (sketch) The result follows from Proposition 4.2.4 and Proposition 4.2.5.

2.2.1 Ideal to isogeny from Eichler orders. Next, we introduce IdealToIsogenyFromEichler, an improved variant of IdealToIsogenyFromKLPT. The
main change is in the sub-routine IdealToIsogenySmallFromKLPT that we replace
by IdealToIsogenySmallFromEichler. The idea behind this second version is thefollowing: the algorithm IdealToKernel from Section 4.2.1 only needs to evaluate
one endomorphism of E1 , but we use a method that gives a way to evaluate any
104

endomorphism of E1 . Intuitively, this means that our algorithm is not optimal
because we compute something more powerful than what we need. In IdealToIsogenySmallFromEichler, we thus strive to be more efficient by computing
exactly one endomorphism θ of E1 and nothing else. Note that this θ is not
the endomorphism used in IdealToKernel. For IdealToIsogenySmallFromEichler,
we will need that P, θ(P ) is a basis of E1 [ℓf ] for some P of order ℓf given in
input. We consider that this generator is an input of IdealToIsogenyFromEichler,
together with the isogeny whose kernel is ⟨P ⟩ and the corresponding ideal. The
exact constraint for θ is given in Lemma 4.2.7. With this, it will become clearthat we can compute θ with SpecialEichlerNorm and this is the main reason
why IdealToIsogenyFromEichler ends up being better than IdealToIsogenyFromKLPT because the size of the outputs of SpecialEichlerNorm is smaller thanfor KLPT. According to Proposition 3.3.3, we can find an isogeny of degree≈ p5/2 (against p3 for KLPT). Using the trick to divide an isogeny of degree
T 2 in two isogenies of degree T , we will end up with T -isogeny computations
where T ≈ p5/4 (against p3/2 before). Concretely, this means that we will
decompose the endomorphism θ of norm dividing T 2 in two isogenies φ1 , φ2 ofdegree n1 , n2 dividing T such that θ = φ2 ◦ φ̂1 . The resulting sub-algorithm
IdealToIsogenySmallFromEichler also ends up being slightly less convoluted than
IdealToIsogenySmallFromKLPT, allowing for a more concise exposition, which is
why we do not need the analog of IdealToIsogenyCoprime.
Algorithm 24 IdealToIsogenySmallFromEichlerℓf (O, I, J, φJ , P )Input: I a left O-ideal of norm ℓf , an (O0 , O)-ideal J of norm in ℓ• and φJ :E0 → E the corresponding isogeny, the generator P ∈ E[ℓf ] of ker φK s.tφ̂J = φK ′ ◦ φK .
Output: φI of degree ℓf
1: Set K = J + Oℓf .
2: Compute θ = SpecialEichlerNormT (O, K + Oℓ) of norm dividing T 2 .
3: Select α ∈ I s.t. I = O⟨α, ℓf ⟩.
4: Compute C, D s.t. α · (C + Dθ) ∈ K and gcd(C, D, ℓ) = 1 using linear
algebra.
5: Take any n1 |T and n2 |T s.t. n1 n2 = n(θ). Compute H1 = O⟨θ, n1 ⟩ andH2 = O⟨θ, n2 ⟩.
6: Compute Li = [J]∗ Hi , and φi = [φJ ]∗ IdealToIsogenyni (Li ) for i ∈ {1, 2}.
7: Compute Q = φ̂2 ◦ φ1 (P ).
8: Compute φI of kernel ⟨[C]P + [D]Q⟩.
9: return φI .
Before stating that Algorithm 24 is correct and terminates, we need a preliminary lemma. For any O-ideal K of degree ℓf we write Kr = K + ℓr O for
1 ≤ r ≤ f.
Lemma 4.2.7. Let E be a supersingular curve and O ∼= End(E) be a maximal
order. Let K and I be two O-ideals of norm ℓf , let θ ∈ O ∖ (Z + K) have norm
coprime to ℓ. Let E[K] = ⟨P ⟩, then E[I] = ⟨[C]P +[D]θ(P )⟩ iff gcd(C, D, ℓ) = 1
and α ◦ (C + Dθ) ∈ K for any α s.t I = O⟨α, ℓf ⟩.
Proof. Let us take Q = [C]P + [D]θ(P ) and assume that E[I] = ⟨Q⟩. Since
Q has order ℓf , it is clear that gcd(C, D, ℓ) = 1. Let us take α ∈ I such105

that I = O⟨α, ℓf ⟩. This condition is equivalent to ker α ∩ E[ℓf ] = E[I]. We
want to show that α ◦ (C + Dθ) ∈ K, i.e., that α ◦ (C + Dθ)(P ) = 0 whichis straightforward since E[I] = ⟨[C]P + [D]θ(P )⟩. Conversely, let us assume
that gcd(C, D, ℓ) = 1 and α ◦ (C + Dθ) ∈ K for any α s.t. I = O⟨α, ℓf ⟩.
Taking such an α, we get that α ◦ (C + Dθ)(P ) = 0 which must imply that[C]P + [D]θ(P ) = λQ for some λ ∈ Z and Q such that E[I] = ⟨Q⟩. If weshow that gcd(λ, ℓf ) = 1 then we will have shown our result as P and θ(P )have order ℓf . Let us assume this is not the case. We have gcd(λ, ℓf ) = ℓe0 fore0 > 0. Then the point P0 = [ℓf −e0 ] of order ℓe0 satisfies [D]θ(P0 ) = [−C]P0 .
Since gcd(C, D, ℓ) = 1, we must have gcd(D, ℓ) = 1 and so θ(P0 ) = [µ]P0 whereµ = −C/D mod ℓe0 . This proves that we have θ ∈ Z + Ke0 ⊂ Z + K1 , which
contradicts our initial assumption. Hence, gcd(λ, ℓf ) = 1 and we have proventhe result.
Proposition 4.2.8. (UPHA) IdealToIsogenySmallFromEichler is correct. For
any κ > 0, there exists η = O(log log(p) + log(κ)) such that if T is a B-smooth
integer (with ℓ < B) with log(T ) > 5/4 log(p) + η, then IdealToIsogenySmallFromEichler will succeed with probability bigger than 1 − 2−κ when O√is random
maximal order. The expected running time is O(poly(log(pT n(J)f )) B).
Proof. Correctness follows from Lemma 4.2.7. When we assimilate the endomorphisms α and [C] + [D]θ in End(E) with their image through the isomorphism
between End(E) and O, we get that the composition α ◦ (C + Dθ) becomes themultiplication of the quaternion elements α · (C + Dθ). Thus, by Lemma 4.2.7,
the values C, D computed at Step 4 are such that ker φI = ⟨[C] + [D]θ(P )⟩. By
definition of H1 , H2 , we have that θ = φ̂2 ◦ φ1 and this concludes the proof thatthe output isogeny is indeed the one corresponding to I through the Deuring
Correspondence.
Apart from the execution of SpecialEichlerNorm, the only step that needs
justification is Step 4. First, it is not clear that such a solution must always
exist. In fact, the existence of such C, D follows from θ ̸∈ Z + (K + ℓO). Thiscondition implies that P, θ(P ) form a basis of E[ℓf ], for otherwise we would
have [ℓf −1 ]P = [ℓf −1 ]θ(P ) and so θ ∈ Z + (K + ℓO), since E[K] = ⟨P ⟩. Whenit exists, a solution C, D can easily be found using linear algebra, similarly to
IdealModConstraint.
The condition on the size of T is compatible with the constraints in Proposition 3.3.3, and so the final result follows from Proposition 3.3.3.
Now we are ready for our full algorithm, which is basically made of sequential
executions of IdealToIsogenySmallFromEichlerℓf . For simplicity, we assume in
Algorithm 25 that the ideal input to IdealToIsogenyFromEichlerℓ• has norm ℓe ,where e = f g for some g ∈ N. We can derive easily the general case from there.
Proposition 4.2.9. (UPHA) IdealToIsogenyFromEichler is correct. For any
κ > 0, there exists η = O(log log(pn(I)) + log(κ)) such that if T is a B-smooth
integer (with ℓ < B) with log(T ) > 5/4 log(p) + η, then IdealToIsogenyFromEichler will succeed with probability bigger than 1 − 2−κ when I is in√a random
ideal class. The expected running time is O(poly(log(pT n(I)n(J)f )) B).
Proof. It is easily verified that the Oi , Ii , Ji , φJ ◦ φI , Pi are correct inputs to
IdealToIsogenySmallFromEichler. If I is well-distributed, we can assume that the106

Algorithm 25 IdealToIsogenyFromEichlerℓ• (I, J, φJ )Input: I a left O-ideal of norm ℓe with e = f v, an (O0 , O)-ideal J of norm ℓ•and φJ : E0 → E the corresponding isogeny
Output: φI of degree ℓe .
−1
1: Set Ji = J, Ii = I + ℓf O, Ii′ = Ii I, Oi = O.
f
2: Set φi of degree ℓ as the isogeny such that φ̂J = φ′ ◦ φi
3: Set φI = [1]E and Ei = E.
4: for i ∈ [1, v] do
5:Compute Pi ∈ Ei [ℓf ] s.t. ker φi = ⟨P ⟩.
6:
Compute φIi = IdealToIsogenyFromEichlerℓf (Oi , Ii , Ji , φJ ◦ φI , Pi ).
7:
Set φi = φ̂Ii , φI = φIi ◦ φI and Ei is the codomain of φIi .
8:Set Ji = Ji · Ii , Oi = OL (Ii′ ), Ii = Ii′ + ℓf Oi and Ii′ = Ii−1 Ii′ .
9: end for
10: return φI .

Ii are in well-distributed ideal classes. Thus, the result follows from Proposition 4.2.8
Remark 4.2.10. Throughout this section, we have given tight bounds on thesize of T . For concrete implementation, it will be important to take T as small
as we can. However, in the remainder of this chapter, we will use IdealToIsogenyFromEichler in various algorithms for which we do not care about concrete
efficiency, but we want the algorithm to succeed with overwhelming probability
in polynomial time. For instance, it is easy to see from Proposition 4.2.9 that we
can take ℓf = O(log(p)) and T to be B-smooth with B = O(log(p)) such that
IdealToIsogenyFromEichler will succeed with overwhelming probability. This iswhat we will implicitly do for the rest of this chapter.
Below, we explain more precisely how to perform Step 7 of IdealToIsogenySmallFromEichler. We left the technical details out of the description in Algorithm 24 for clarity, but they are important for an efficient implementation. For
now, we have avoided the issues of potential failures of SpecialEichlerNorm thatwere mentioned in Section 3.5 by assuming that the ideal I is in a random class.
We will discuss a bit later how to perform the computation in the event of abad distribution.
Endomorphism evaluation. For Step 7 of IdealToIsogenyFromEichlerℓf , it isrequired to evaluate the endomorphisms θ = φ̂2 ◦ φ1 after the computation of
the two isogenies φ1 , φ2 . One might assume that it suffices to push P throughφ1 and then do the same through φ̂2 . This apparently simple algorithm is
not so easy to implement concretely. The first problem lies with signs. Mostof the efficient isogeny algorithm are using x-only (or X, Z) arithmetic, which
implies that we can only evaluate isogenies up to signs. This is problematicas the ultimate goal is to compute [C]P + [D]θ(P ). Solving this issue requires
evaluating several other points through φ1 , φ2 , and there does not seem to beanother easy way to remove the ambiguity. The second issue is with the dual
computation in itself. For an isogeny φ of degree T and kernel ⟨P ⟩, computingφ̂(R) for some point R would first require to compute φ(Q), where Q is of order107

T and orthogonal to P to get ker φ̂, before using this kernel to compute φ̂(R)and this is expensive (see Section 5.4.1 for a more detailed cost analysis).
Targeting the application to IdealToIsogenySmallFromEichler, we present in
Algorithm 26, a method that requires only two T -isogeny computations and5 evaluations together with a few discrete logarithms to evaluate an endomorphism of the form C + Dθ where θ = φ̂2 ◦ φ1 on a point of power-smooth order(this performs both Step 7 and Step 8 of Algorithm 24 at once). Our method isentirely based on x-only arithmetic and requires a basis P, Q of the ℓf -torsion.
The main principle is to express φ1 (P ) as a linear combination of φ2 (P ), φ2 (Q)and see that φ̂2 ◦ φ1 (P ) is a multiple of the linear combination of P, Q withthe same coefficients. When dealing with x-only arithmetic, we need also tocompute φ2 (P + Q) to perform the discrete log computations. Finally, to lift
the ambiguity (the linear combination that we obtain is only up to sign) we
use the trace of θ = φ̂2 ◦ φ1 (which can be computed by expressing θ in thebasis ⟨1, i, j, k⟩). In the basis P, Q, the action of θ can be seen as a matrix of
M2 (Z/ℓf Z). This matrix is essentially the one we obtain with the coefficient of
the two discrete logarithms, and so it suffices to check the value of the trace tolift any sign ambiguity.
We recall that we have the function xBiDLPℓf (x(R), x(P ), x(Q), x(P + Q))
that computes the scalars a, b such√that x(R) = x([a]P + [b]Q) for points P, Q
of order ℓf . It has complexity O(f ℓ).
Algorithm 26 EndomorphismEvaluationℓf (φ1 , φ2 , C, D, t, P )Input: Two isogenies φ1 , φ2 : E → E ′ , scalars C, D, the trace t = tr(φ̂2 ◦ φ1 )and a point P of order ℓf
Output: [C]P + [D]φ̂2 ◦ φ1 (P )1: Compute Q such that P, Q is a basis of E[ℓf ] and compute P + Q.
2: Compute x(φ1 (P )), x(φ1 (Q)), x(φ2 (P )), x(φ2 (Q)), x(φ2 (P + Q)).
3: Compute x1 , x2 = xBiDLPℓf (x(φ1 (P )), x(φ2 (P )), x(φ2 (Q)), x(φ2 (P + Q))
and x3 , x4 = xBiDLPℓf (x(φ1 (Q)), x(φ2 (P )), x(φ2 (Q)), x(φ2 (P + Q))).
4: Change the signs of (x1 , x2 ), (x3 , x4 ) until (x1 + x4 ) deg φ2 = t mod ℓf .
5: Set a = C + x1 D and b = x2 D.
6: Compute R = [a]P + [b]Q.
7: return R.
Remark 4.2.11. If we want to compute a compressed representation of the output of IdealToIsogenyFromEichler using Compression, we could be more efficientby performing the successive steps of Compression at each execution of IdealToIsogenySmallFromEichler. Typically, the deterministic basis generation of Compression could be done at the same time as Step 1 of EndomorphismEvaluationin the choice of Q and so the value a, b would be used to derive the final representation. This is what we do for the implementation results presented in
Chapter 5.
Handling failures. In Section 3.5, we explained that there are some inputs
O, K for which the computation of SpecialEichlerNormD(T ) (O, K) will fail if
T ≈ p5/4 . If one of the Oi is one of those bad orders, the execution of IdealToIsogenySmallFromEichler at the i-th iteration in IdealToIsogenyFromEichler will
fail. Since we cannot afford to increase the size of T , we need another way
108to handle the failures. Short of finding a new (and better) method, there arebasically two options: use an adapted version of IdealToIsogenySmallFromKLPT
to perform the translation, or use a special extremal order other than O0 with
SpecialEichlerNorm.
At first glance, going back to IdealToIsogenySmallFromKLPT might seem likean odd thing to do as we explained that the requirement for the size of T weregreater than in IdealToIsogenySmallFromEichler. However, the failure cases forSpecialEichlerNorm are actually good cases for the method using KLPT because
there is an ideal of norm M ≪ p1/2 connecting O0 and O. As we explained in
Section 3.5, this is only a bad thing for SpecialEichlerNorm because we have anadditional constraint with the ideal K but KLPT does not suffer from the same
limitation and should succeed to find an element of norm T 2 if T ≈ pM . Hence,
when M < p1/4 , we can hope to make it work with T ≈ p5/4 . However, there
is an obvious range of degrees p1/4 ≪ M ≪ p1/2 where this solution will notwork. This is why, in practice, we will use the second method described below.
Using another extremal order. The bad property resulting in failures directly depends on the special extremal order O0 (which is unique by Definition 3.1.1). By looking at the δ-special extremal orders for values of δ slightly
above the minimal one, we can gather a collection extremal orders in which
we can run SpecialEichlerNorm with a negligible efficiency loss (we saw that thecomplexity was linear in h(O), where we recall that O is the small quadraticorder of discriminant d contained in the extremal order). Thus, it suffices toenumerate through our small set of extremal orders until we find one that does
not have the bad property. To prove that this idea works, we need to make surethat a maximal order O will not have the bad property with all the extremal
orders. Unfortunately, we do not have a definitive proof of this fact and are
reduced to make it a heuristic assumption. Boneh and Love [LB20] showedthat maximal quaternion orders admitting embeddings of small quadratic orders are far from one another. While this conveys the right idea, their bound in[LB20, Proposition 4.5] is too loose to help us. In practice, switching to anothermaximal order seems to work well.
Isogeny to ideal. In this section, we presented several methods to perform
efficiently the ideal to isogeny translation. We chose this task because it will be
the crucial part in several of our cryptographic applications. However, the algorithms that we have presented can be adapted to perform the reverse translationof computing the ideal corresponding to a chain of ℓf -isogenies. The method
is roughly the same (up to replacing IdealToIsogeny with IsogenyToIdeal). However, note that the tricks we introduced for IdealToIsogenySmallFromKLPT totranslate an ideal of norm ℓ2f +∆ instead of an ideal of norm ℓf appear hardto translate to the setting of IsogenyToIdeal. We do not give a full descriptionof “isogeny-to-ideal” variants of IdealToIsogenyFromKLPT and IdealToIsogenyFromEichler as we do not need it and it does not appear to require any new
interesting ideas.

4.2.3

Verification of the ideal representation

In this section, we come back to one of our initial motivation, which is to provethat a triple D, E1 , E2 is in Lisog . The main result is Proposition 4.2.13 that109

proves that we have a polynomial time verification algorithm.
Note that when the prover is unbounded, it is clear that he can compute thecompact representation of an ideal I whose corresponding isogeny is connecting
E1 and E2 . Indeed, since there is a finite number of maximal orders and ideals
of a given norm inside Bp,∞ , the prover can simply enumerate through all ofthem until finding a fitting one.
We now present IdealVerification, a verification algorithm that takes a triple
x = (D, E1 , E2 ) and an ideal I and decides if x ∈ Lisog . The idea is to use
the following procedure on ideals connecting a special order O0 with OL (I)and OR (I): use KLPT to get an equivalent ideal of smooth norm and computethe corresponding isogeny with IdealToIsogenyFromEichlerℓ• (note that we could
have used IdealToIsogenyFromKLPT as well). This algorithm requires some parameter f, T that we select as explained in Remark 4.2.10 to ensure terminationin polynomial time with overwhelming probability.
Algorithm 27 IdealVerification(x, I)
Input: x ∈ N × S(p)2 and I an ideal of Bp,∞ .
Output: A bit indicating if x ∈ Lisog .
1: Parse x as D, E1 , E2 and take ℓ a small prime.
2: Compute n(I) and OL (I), OR (I).
3: if n(I) ̸= D or I ̸⊂ OL (I) then4:
Return 0.
5: end if
6: Take O0 , the special extremal order of Bp,∞ and E0 the curve in S(p) with
End(E0 ) ∼= O0 ;
7: Compute I1 = ConnectingIdeal(O0 , OL (I)), I2 = I1 · I.
8: for i ∈ [1, 2] do
9:Compute Ji=
KLPTℓ• (Ii ) and φi
:
E0
→
Ei′ =
IdealToIsogenyFromEichlerℓ• (Ji , O0 , [1]).
10: end for
11: if j(E1′ ), j(E2′ ) ̸∈ {(j(E1 ), j(E2 )), (j(E1 )p , j(E2 )p )} then12:
Return 0.
13: end if
14: return 1.

Lemma 4.2.12. Let ℓ be any integer in N coprime to p. If φ : E1 → E2 hasdegree ℓ, then IdealVerification((D, E1 , E2 ), Iφ ) = 1.
Conversely, for (D, E1 , E2 ) ∈ N × S(p)2 , if there exists an ideal I such that
IdealVerification((D, E1 , E2 ), I) = 1 then (D, E1 , E2 ) ∈ Lisog .
Proof. Let us take φ : E1 → E2 of degree ℓ. By definition of Iφ , we haven(Iφ ) = D and Iφ ⊂ OL (I) so the first check passes. Then, the codomain of thetwo φIi have endomorphism ring isomorphic to OR (Ii ) so they might be either
both Ei or both Eip (since I2 = I1 I, it cannot be E1 , E2p or E1p , E2 ). In bothcases, the final output is 1.
If there exists an ideal I such that IdealVerification((D, E1 , E2 ), I) = 1, thenn(I) = D and I is integral (this is from the first verification). Since I = I1 ·I2 /n(I1 ) ∼ J1 ·J2 is an integral ideal of degree ℓ, there exists an isogeny of degreeℓ between E1′ , E2′ . Since the final output is 1, the two curves E1′ , E2′ are equal110to either E1 , E2 or E1p , E2p . Since φ : E1p → E2p of degree ℓ imply the existenceof φp : E1 → E2 of degree ℓ, in both cases we have that (D, E1 , E2 ) ∈ Lisog .
Proposition 4.2.13. (UPHA) IdealVerification succeeds with overwhelming probability and terminates in expected O(poly(log(pD))).
Proof. We consider that ℓ = O(1). The basis elements of left and right ordersof an ideal of norm ℓ can be written in O(log(pD)) bits by Lemma 2.2.5. Then,the results follows from Propositions 2.2.4, 3.2.7 and 4.2.9 with a choice of T
(as in Remark 4.2.10 with smoothness bound in O(poly(log(pD))) and f =O(poly(log(pD))). With this constraint, we can expand the size of T as we needto get a success probability that is overwhelming according to Proposition 4.2.9.

4.2.4

Isogeny Evaluation from the ideal representation

In this section, we show how to evaluate the isogeny φI on any point of ordercoprime to n(I). For simplicity, we assume that I is an O0 -ideal, where O0
is the special extremal order of Bp,∞ . We make this assumption, so we canevaluate efficiently the endomorphism of E0 . A generic algorithm of complexity
O(poly(log(pD)) can be derived using the tools we have developed, but the
special case suffices to illustrate our point. An algorithm very similar to IdealEvaluation can be found in [FKM21]. The main idea is to apply KLPT and
IdealToIsogenyFromEichler to find an equivalent isogeny of prime power degreeand making use of it to perform the computation. As for IdealVerification, we
will pick parameters T, f to ensure success with overwhelming probability.
Algorithm 28 IdealEvaluation(I, P )Input: I an O0 -ideal of Bp,∞ and P ∈ E0 (Fq ) of order coprime to D = n(I).
Output: φI (P ).
1: Take a small prime number ℓ.
2: Compute J = KLPTℓ• (I) and set K = I · J. We write α ∈ End(E) for theendomorphism φK .
3: Compute α(P ).
4: Compute φJ = IdealToIsogenyFromEichlerℓ• (J, O0 , [1]) and compute Q =φJ (α(P )).
5: Compute µ = n(J)−1 mod n(I).
6: return [µ]Q.

Proposition 4.2.14. (UPHA) IdealEvaluation is correct, succeeds with overwhelming probability, and terminates in probabilistic O(poly(log(pD))) operations over Fq .
Proof. We have φK = φ̂J ◦ φI , and so µφJ (α(P )) = φI (P ). The divisionby µ makes sense modn(I) since the order of P is coprime to n(I). The correctness of IdealEvaluation follows from the correctness of the sub-algorithms
KLPT, IdealToIsogenyFromEichler. Step 3 can be executed because of our assumption on E0 . If we assume that ℓ = O(1), termination is a consequenceof Propositions 2.2.4, 3.2.7 and 4.2.9 and that the computation of φJ (P ) can111be done in O(poly(log(p))) operations over the field of definition of P sincedeg φ = O(poly(p)) and have smoothness bound in O(poly(log(p))). With the
choice of T as explained in Remark 4.2.10, the algorithm succeeds with overwhelming probability.

4.3

The suborder representation

In this section, we introduce a new isogeny representation that we call thesuborder representation. This new representation is the subject of our paper[Ler21]. As for the ideal representations, the suborder representation relies
heavily on the tools provided by the Deuring correspondence. The motivation
behind this new construction is to be found in the cryptographic applications.
In Chapter 7, we will argue that the suborder representation is not equivalent
to the ideal representation under the hardness of a new problem and we will
give examples of protocol that we can build upon this assumption.
We focus on the case where the degree D is prime because it is simpler. We
will explain later in Chapter 7 why it appears to be the most promising for ourapplications. We will explain only informally how to deal with the composite
order in the end of Section 4.3.2.
From now on, unless stated otherwise, D is prime. The suborder representation has also a small limitation: we can only verify that either E1 , E2 are
D-isogenous or E1 , E2p are D-isogenous when End(E1 ) ≁ End(E2 ). Thus, we=consider the alternate language Lp−isog defined as follows:{(D, E1 , E2 ) ∈ P×S(p)2 |E1 ̸= E2 , E2p and (D, E1 , E2 ) ∈ Lisog or (D, E1 , E2p ) ∈ Lisog }A brief overview. The main mathematical result underlying our new representation is Proposition 2.3.16. When D is prime, this result states that thequaternion sub-order Z + D End(E1 ) is embedded inside End(E2 ), if and only ifeither End(E2 ) ∼= End(E1 ) or (D, E1 , E2 ) ∈ Lisog . Thus, our new representation
will be constituted of a maximal order O1 ∼= End(E1 ) and a concrete embedding of Z + DO inside End(E2 ), and this is what we concretely call a suborderrepresentation. We highlight that O1 is simply given as an order inside Bp,∞
(through a basis of 4 quaternion elements), whereas the embedding of Z + DO1
is made of isogenies of smooth degree from E2 to E2 . The suborder representation can be verified by computing the traces of the endomorphisms revealed inthis manner.

4.3.1

Deriving the new representation from the ideal representation

The goal of this section is to introduce an algorithm IdealToSuborder that takes
a maximal order O1 and a O1 -ideal I of norm ℓ and outputs a representationof the embedding Z + DO1 ,→ End(E2 ). By a representation, we actually mean
the embeddings of a generating family for Z + DO1 (see Definition 3.4.3).
Definition 4.3.1. Let φ : E1 → E2 be an isogeny of degree D. A suborderrepresentation πφ for φ is made of an order O1 ∼= End(E1 ) and of compressed
representations s1 , . . . , sn of n endomorphisms of E2 corresponding to a generating family of Z + DO1 .
112

Our algorithm IdealToSuborder (Algorithm 29) is built upon the GeneratingFamily algorithm from Chapter 3 that will be used to generate the endomorphism of the suborder representation. We recall that GeneratingFamilyN on
input O1 , D computes a generating family for Z + DO1 (see Definition 3.4.3)
whose elements have their norm in N .
IdealToSuborder can be divided in two main parts: GeneratingFamily to obtain quaternion elements θ1 , . . . , θn and an IdealToIsogenyFromEichler step toconvert the ideals OR (I)θi to isogenies φi : E2 → E2 . For all the algorithms ofthis section, we are going to fix a small constant prime ℓ.
Algorithm 29 IdealToSuborder(I)Input: I an integral ideal of maximal orders inside Bp,∞ of norm ℓ.
∼
Output: Endomorphisms φi : E2 → E2 such that ι : End(E2 ) −→ OR (I) sends
φ1 , . . . , φn to a generating family θ1 , . . . , θn for Z + DOL (I).
1: Compute D = n(I) and O = OL (I), O ′ = OR (I) and select a small primeℓ.
2: Compute J = ConnectingIdeal(O0 , O ′ )3: Compute K = KLPTℓ• (J).
4: Compute φK = IdealToIsogenyFromEichlerℓ• (K, O0 , [1]).
5: Compute θ1 , . . . , θn = GeneratingFamilyℓ• (O, D).
6: for i ∈ [1, n] do
7:Compute φi : E2 → E2,i = IdealToIsogenyFromEichlerℓ• (O′ θi , K, φK ).
8:Compute si = Compressionn(θi ) (E2 , φi ).
9: end for
10: return O, (si )1≤i≤n .

Proposition 4.3.2. (UPHA) IdealToSuborder is correct, succeeds with overwhelming probability and terminates in O(poly(log(pD))) and the output has
size O(poly(log(pD))).
Proof. Correctness follows from the correctness of IdealToIsogenyFromEichler
and GeneratingFamily. Similarly to ideals and Lemma 2.2.5, the left and rightorders O, O′ admits a representation of size O(poly(log(pD))). Terminationand the overwhelming success probability follows from Propositions 3.2.7, 3.4.4
and 4.2.9 (with n = O(1) and the parameters T, f as in Remark 4.2.10).

4.3.2

Verification of the suborder representation

This section focuses on the verification of the representations computed with
IdealToSuborder. From Proposition 2.3.16, we know that it suffices to convince
the verifier that Z + D End(E1 ) is embedded inside End(E2 ) and End(E1 ) ≁=End(E2 ). The second part is easy to verify, it suffices to compute the j-invariants
and verify that neither j(E1 ) = j(E2 ) nor j(E1 ) = j(E2 )p . We achieve the firstpart of the verification with the endomorphisms φ1 , . . . φn . With, Lemma 4.3.3,
we show that it suffices to check some traces and norms of endomorphisms
computed from the (φi )1≤i≤n . We remind the reader that the Order() notation
was introduced in Definition 3.4.3.

113

Lemma 4.3.3. Two orders O1 = Order(θ1 , . . . , θn ) and O2 = Order(ω1 , . . . , ωn )of rank Q
4 in a quaternion
Q algebra are isomorphic if n(θi ) = n(ωi ) for all i ∈ [1, n]
and tr( j∈I θj ) = tr( j∈I ωj ) for all I ⊂ [1, n].
Proof. In our setting, two quaternion orders are isomorphic if their norm forms
are the same. Thus, we are going to give a bijection α : O1 → O2 and verify that′′it preserves norm and traces. We label θ0′ , θ1′ , . . . , θm(resp. ω0′ , ω1′ , . . . , ωm
) withnm = 2 −1 the set of multi-products obtained from θ1 , . . . , θn (resp. ω1 , . . . , ωn ),the multi-product θ0 (resp. ω0 ) corresponding to the empty set is simply 1. By
the definition of a generating family, any element α ∈ O1 (resp. O2 ) can be′′
written as a linear combinationof θ0′ , P. . . , θm(resp. ω0′ , . . . , ωm). We are going toPmm′′prove that the map α : i=0 xi θi 7→ i=1 xi ωi is an isomorphism of quaternion
orders. It is easy to verify that this map is bijective. It remains to check thatit preserves the trace and the norm when n(θi′ ) = n(ωi′ ) and tr(θi′ ) = tr(ωi′ ) for
all i ∈ [0, m].
The trace being linear, it is clear that tr(α(θ)) = tr(θ) for all θ ∈ O1 . For
Pm
Pm
Pany θ = i=0 xi θi′ , we have n(θ) = 0≤i<j≤m xi xj tr(θi′ θ̂j′ )+ 21 i=0 x2i tr(θi′ θ̂i′ ).
Thus, we need to prove that we have equality of traces for all θi′ θ̂j′ and ωi′ ω̂j′ .
Since tr(ab) = tr(ba) = tr(âb̂) and tr(a)for all a, b ∈ Bp,∞ ,Q tr(b) = tr(ab)+tr(âb)
Q
it suffices to verify the equality tr( j∈I θj ) = tr( j∈I ωj ) to get the desired
result. This also proves that we have equality of norms between θ and α(θ).
As Lemma 4.3.3 indicates, we need to compute some traces for the verification. This will be done by an algorithm CheckTraceM (whose description we
postpone until Section 4.3.3). The goal of this algorithm is to verify the validityof the traces modulo the parameter M (see Proposition 4.3.7).
Below, we give a bound above which equality will hold over Z if it holds
modM .
p
Lemma 4.3.4. Given any θ ∈ End(E1 ), if tr(θ) = t mod M for M > 4 n(θ)
and |t| ≤ M/2, then tr(θ) = t.
Proof. Over Bp,∞ , the norm form is n : (x, y, z, w) 7→ x2 + qy 2 + pz 2 + qpw2
where q > 0, p > 0. Since tr : (x, y, z,pw) 7→ 2x, we can easily verify thattr(θ)2 < 4n(θ). This gives a bound of 2 n(θ) on the absolute value of tr(θ).
The result follows.
Proposition 4.3.5. Ifq
M > max 2 n(θj )n ,
1≤j≤n

2

then for x ∈ P × S(p) , there exists a suborder representation π such that
SuborderVerificationM (x, π) = 1
if and only if x ∈ Lp−isog .
Proof. Assume that there exists a representation π passing the verification fora given x = (D, E1 , E2 ). The check in Step 2 proves that O is a maximal
order of Bp,∞ . The second verification in Step 8 proves that End(E1 ) ∼= O.
Finally, the verification in Step 13 proves that the φi are endomorphisms of
E2 . Then, if CheckTraceM (φ1 , . . . , φn , θ1 , . . . , θn , E2 ) = 1, the correctness of114

Algorithm 30 SuborderVerificationM (x, π)
Input: x ∈ P × S(p)2 and π a suborder representation.
Output: A bit indicating if x ∈ Lp−isog .
1: Parse x as D, E1 , E2 and π = O, (si )1≤i≤n .
2: if If disc(O) ̸= p then3:
Return 0.
4: end if
5: Compute θ1 , . . . , θn = GeneratingFamilyℓ• (O, D).
6: Compute J = ConnectingIdeal(O0 , O) and L = KLPTℓ• (J).
7: Compute ψ : E0 → E1′ = IdealToIsogenyFromEichlerℓ• (L).
8: if j(E1 ) ̸= j(E1′ ) or j(E1 ) ̸= j(E1′ )p then9:
Return 0.
10: end if
11: for i ∈ [1, n] do
12:Compute φi : E2 → Fi = Decompressionn(θi ) (E2 , si )13:
if j(Fi ) ̸= j(E2 ) then14:
Return 0.
15:
end if
16: end for
17: return CheckTraceM (φ1 , . . . , φn , θ1 , . . . , θn , E2 ).

GeneratingFamily and CheckTrace, Lemmas 4.3.3 and 4.3.4 imply that Z + DO
is embedded inside End(E2 ) and Proposition 2.3.16 proves that x ∈ Lp−isog .
Now let us take (D, E1 , E2 ) ∈ Lp−isog . By definition, there exists an ideal Iof norm ℓ and OL (I) ∼= End(E1 ), OR (I) ∼= End(E2 ). We are going to show that
if π = IdealToSuborder(I), then we have SuborderVerificationM (x, π) = 1. First,
since OL (I) is a maximal order, the verification of Step 2 passes successfully.
This is also the case for the verification of Step 8 since OL (I) ∼= End(E1 ). Then,by the correctness of IdealToSuborder showed in Proposition 4.3.2, we have thatsi can be parsed as isogenies φi : E2 → E2 that correspond to the OR (I)θithrough the Deuring Correspondence (since GeneratingFamily is deterministic).
Thus, it is clear that CheckTrace will output 1, and this concludes the proof.
With Proposition 3.4.4 and Proposition 4.3.5, we see that we can take M =#E(Fpk ) for some k ∈ N big enough to get that the verification algorithm
SuborderVerificationM is correct.
Proposition 4.3.6. (UPHA) Let k, M be as defined above. SuborderVerificationM
terminates in probabilistic O(poly(log(pD))) with overwhelming probability.
Proof. We have k = O(poly(log(pD))) by Proposition 4.3.5, and this implies
M = O(poly(pD)) by Proposition 1.1.23. When N = ℓ• , Proposition 3.4.4
implies that the execution of GeneratingFamilyℓ• will succeed with overwhelming
probability. Then, the expected running time follows from Propositions 2.2.4,
3.4.4 and 4.3.7.
Verification in the composite case. Now, we explain briefly how to extend the SuborderVerification to perform the verification when the degree D is
composite. With Proposition 2.3.16, we know that we need to check that the115embedding of Z + D End(E1 ) inside End(E2 )is primitive. When D is prime, theembedding is either primitive or E1 and E2 are isomorphic, which is why it suffices to check that the latter is not true. When D is composite, the verificationthat the embedding is primitive is more complicated. For that, we need to checkthat ι(Z + D End(E)) ̸= Z + N O for some order O ⊂ End(E2 ) and N |D. SinceO∼= Z + (D/N ) End(E), it suffices to find one endomorphism β = d + φ ◦ α ◦ φ̂and prove that d′ + (β − d)/N is not an endomorphism of E2 to prove thatι(Z + D End(E)) ̸= Z + N O for any N of O. If the norm of d′ + (β − d)/Nis powersmooth and coprime to N , GN = ker(d′ + (β − d)/N ) and E2 /GN
can be computed efficiently. Thus, the additional verification mechanism works
as follows: for every prime N dividing D, use GeneratingFamily to computea generating family θ1 , . . . , θn of norm coprime to N of Z + (D/N ) End(E),express each θi as d′ + (βi − d)/N where βi ∈ Z + D End(E) and compute
GN,i = ker d′ +(ι(βi )−d)/N . If there exists one N such that j(E2 /Gi,N ) = j(E2 )for all 1 ≤ i ≤ n, the verification fails.

4.3.3

Checking traces

In this section, we present an algorithm CheckTraceM to perform the verificationof the suborder representation.
Computing the trace of an endomorphism is a well-studied problem, as it is
the primary tool of the point counting algorithms such as SEA [Sch95]. For ourapplication the task is even simpler as we merely have to verify the correctnessof the alleged trace value and not compute it. With the formula tr(θ) = θ + θ̂,
it suffices to evaluate θ and θ̂ on a basis of the M -torsion, and then verify the
relation. In particular, we do not need M to be smooth since we just want tocheck equality.
Algorithm 31 CheckTraceM (E, φ1 , . . . , φn , θ1 , . . . , θn )Input: θ1 , . . . , θn , n endomorphisms of E and n elements of Bp,∞ ω1 , . . . , ωn .
Output: A bit b equal to 1 if and only if tr(θi ) = tr(ωi ) mod M for all i ∈[1, n].
1: Compute P, Q a basis of E[M ] over the appropriate field extension. Set
b = 1.
2: for All I ⊂ [1, n] do
QQ
3:Set θI = j∈I θj and φI = j∈I φj .
4:
Verify φI (R) + φ̂I (R) = [tr(θI )]R for R ∈ {P, Q}. If not, set b = 0.
5: end for
6: return b.

Proposition 4.3.7. When M = #E(Fpk ), n = O(1) and deg φi = O(poly(pD))
and have smoothness bound in O(poly(log(pD))) for all 1 ≤ i ≤ n, CheckTraceM
terminates in O(poly(k log(pD))
Proof. By definition of M , the points P, Q are defined over Fpk and so operations
over the M -torsion have O(poly(k log(p)) complexity. By the assumption on the
degree of the φi , computing all the φI (P, Q) can be done in O(poly(log(p)))
since n = O(1), and this concludes the proof.

1164.3.4

Evaluating with the suborder representation

In this section, we show that we can evaluate the isogeny φπ from the suborderrepresentation π (in Section 4.2.4, we described Algorithm 28 to do that same
operation from an ideal representation). The algorithm SuborderEvaluation that
we introduce below is going to be one of the major building blocks behind
one of the construction in Part II. In fact, we achieve something slightly lesspowerful than IdealEvaluation, as SuborderEvaluation computes images of cyclic
subgroups rather than points. SuborderEvaluation can be extended to performthe same operation as IdealEvaluation but we do not need it here. For the sakeof our application, we also choose to give the input as an ideal J rather than asubgroup. The output will then be φ(E[J]).
The SuborderEvaluation algorithm uses the sub-algorithm IdealSuborderEichlerNorm that we introduced in Section 3.4.
The principle of SuborderEvaluation is different from the one of IdealEvaluation.
Since the suborder representation do not give the full endomorphism ring of E2 ,we cannot apply KLPT to find another path of nice degree (which is the key stepin IdealEvaluation). Instead, we propose to use the fact that the embedding of
Z + D End(E1 ) inside End(E2 ) is obtained by push-forward through φπ . Moreprecisely, this means that ker ι(β) = φπ (ker β) for any β ∈ Z + D End(E1 ).
Thus, to find φπ (E1 [J]), we want to find an endomorphism β ∈ Z + D End(E1 )such that ker β ∩ E1 [n(J)] = E1 [J]. By definition of E1 [J], and such a β is
exactly found by IdealSuborderEichlerNorm. After that, it suffices to computeker ι(β) ∩ E2 [n(J)] and we are done. The integer k is taken as in Proposition 4.3.6.
Proposition 4.3.8. (UPHA) SuborderEvaluation is correct when the output
isp not ⊥, and terminates with overwhelming probability in O(poly(log(pD)) +n(J)) operations over the n(J) torsion.
Proof. First, we will prove correctness. The verification at the beginning provesthat if the output is not ⊥, π is a valid suborder representation.
When L = ConnectingIdeal(O0 , O) and I = RandomEquivalentPrimeIdeal(L)with I = Lα, then if β ∈ (Z + DI) ∩ α−1 Jα, then αβα−1 ∈ (Z + DL) ∩ J ⊂(Z + DO) ∩ J. This explains that we can decompose αβα−1 on the generating
family θ1 , . .P
. , θn . Since π gives
Q a correct embedding of Z + DO inside End(E1 )and so σ = I⊂{1,...,n} ci,I j∈I φj is an endomorphism of E2 whose degree isa multiple of n(J). To conclude the proof of correctness, it suffices to show thatker σ ∩ E2 [n(J)] = φπ (E1 [J]). If αβα−1 = [d] + [D]γ for some γ End(E1 ), we
have that σ = [d] + φπ ◦ γ ◦ φ̂π . Now let us take P0 ∈ E1 [J]. Since αβα−1 ∈ J,
we have ([d] + [D]γ)P0 = 0 and σ(φπ (P0 )) = [d]φπ (P0 ) + φπ (γ ◦ φ̂π ◦ φπ (P0 )) =φπ (([d] + [D]γ)P0 = 0. This proves that φπ (E[j]) ⊂ ker σ ∩ E2 [n(J)]. And we
obtain equality since the two subgroups have the same order. Thus, we haveshowed that our protocol is correct.
Then, the complexity follows from Propositions 2.2.4, 3.4.4, 3.4.6 and 4.3.6
and the fact that n(I) = O(poly(p)).

117

Algorithm 32 SuborderEvaluation(E1 , E2 π, D, J)
Input: two curves E1 , E2 , a prime D, π a suborder representation for(D, E1 , E2 ) ∈ Lp−isog and an ideal J of norm coprime to ℓ.
Output: ⊥ or φπ (E1 [J]).
1: Parse π as O, s1 , · · · , sn .
2: Compute θ1 , . . . , θn = GeneratingFamilyℓ• (O, D).
3: Compute φi = Decompressionn(θi ) (E2 , si ).
4: if OL (I) ≁ O then=5:
Return ⊥.
6: end if
7: if SuborderVerification#E1 (F k ) ((D, E1 , E2 ), π) = 0. thenp
8:
Return ⊥.
9: end if
10: Compute
L=
ConnectingIdeal(O0 , O)
andI=
RandomEquivalentPrimeIdeal(L) with I = Lα.
11: Compute β = IdealSuborderEichlerNormℓ• (D, I, α−1 Jα).
P
Q
12: Express αβα−1 =I⊂{1,...,n} ci,I ( j∈I θj ).
13: Compute P, Q, a basis of E2 [n(J)].
P
Q
14: Compute R, S =I⊂{1,...,n} ci,I ( j∈I φj )(P, Q).
15: if S = 0 then16:
return ⟨Q⟩.
17: end if
18: Compute a = DLPn(J) (R, S).
19: return ⟨P − [a]Q⟩.

118

Part II

Cryptographic protocols

119Chapter 5

Signatures: SQISign
In this chapter, we introduce SQISign (short for Supersingular Quaternion and
Isogeny Signature), a new signature scheme explicitly based on the algorithmsof the Deuring correspondence from Chapter 3 and Chapter 4. This chapter
mixes the content of our articles [DFKL+ 20], which introduced the SQISign
protocol, and [DFLW22], which presented various improvements and results on
cryptanalysis.
The principle behind our construction was first introduced by Galbraith, Petit and Silva [GPS17] in the so-called GPS signature protocol. The common idea
is the following: use the knowledge of a curve’s endomorphism ring to find pathsin the isogeny graphs. This approach uses the norm-equation algorithms from
Chapter 3 and the ideal-to-isogeny algorithms from Chapter 4. More precisely,
the GPS protocol uses the KLPT algorithm (see Algorithm 7 in Section 3.2.3)
to perform the computation in Bp,∞ before translating it into an isogeny. The
authors of GPS introduced the algorithms IdealToIsogeny and IsogenyToIdeal togo back and forth between the different isogeny representations (we presented
those algorithms in Section 4.2.1). For SQISign, we will use GenericKLPT (Algorithm 11 in Section 3.3) for the computation over the quaternions and theefficient algorithms IdealToIsogenyFromKLPT or IdealToIsogenyFromEichler (seeSection 4.2.2) to translate the output from GenericKLPT into an isogeny. Our
new protocol can thus be seen as an improved version of GPS: with these newalgorithmic tools, we get a scheme that is much more compact and efficient.
In Section 5.1 we introduce some useful preliminaries on signatures, andbriefly present the state of isogeny-based signatures prior to the publicationof [DFKL+ 20]. The rest of this chapter is dedicated to SQISign, its detailed
description, and its security analysis.

5.1

Preliminaries

We start with a few security definitions for identification protocols and the Fiat–
Shamir transform in Section 5.1.1. In Section 5.1.2, we give more backgroundon GPS and isogeny-based signature schemes.

1205.1.1

Identification protocols and Fiat–Shamir signatures

We briefly recall here the standard security definitions for sigma-protocols (see[Dam10, Kat10, Ven15] for precise references).
A sigma protocol is a 3-round public-coin interactive protocol between a
prover and a verifier. For R, a relation on a set Y × X, we define the language
L = {y ∈ Y, ∃x ∈ X, R(x, y) = 1}. The verifier receives y ∈ L and the proverholds a witness x for this y and wants to prove it to the verifier without revealing
x. A transcript is a triple (a, b, c) where a is the commitment, b the challenge
and c is the response. Intuitively, the role of the commitment is to bind theprover to some information at the beginning of the interaction with the verifier.
Publishing that commitment before seeing anything from the verifier will force
him to behave correctly. Then, comes the challenge from the verifier. Thisis a random string that the prover should not be able to anticipate without
negligible probability. The response is then computed by the prover from his
secret key, the commitment and the challenge. In the end, the verifier outputs
a bit, indicating whether it accepts the transcript. When the verifier outputs 1,
we saiy that the transcript is accepting.
Definition 5.1.1. A sigma-protocol is complete if the verifier outputs 1 withprobability 1 when there exists a witness. A sigma-protocol is special sound if
there exists a polynomial time algorithm, called an extractor, that can recover
the witness x from two accepting transcripts (a, b, c) and (a, b′ , c′ ) sharing thesame commitment. A sigma-protocol is (computationally) honest verifier zeroknowledge if there exists a polynomial time algorithm, called a simulator,thaton input y ∈ L, but without access to the witness x, generates accepting transcripts that are (computationally) indistinguishable from transcripts of the real
protocol.
It is a classical result (see for instance [Ven15]) that canonical identification schemes secure against impersonation under passive attacks can be constructed from complete, special sound and honest verifier zero-knowledge sigmaprotocols. A signature scheme unforgeable under chosen message attacks canbe derived from such an identification scheme using the Fiat–Shamir transform[FS86]. The main goal of this transform is to remove the interaction from theinteractive protocol. This can be done by replacing the verifier’s challenge by
the value H(M ∥ a) where H is a hash function, a is the commitment and M is
the message. The idea is to prevent the prover from computing his commitment
with the knowledge of the challenge. This way of constructing signatures fromsigma-protocols is standard, and we refer the reader to [AABN02] for the proofof the following result:
Theorem 5.1.2. Let ID be a non-trivial canonical identification scheme thatis secure against impersonation under passive attacks. Let S be the signature
derived from ID using the Fiat–Shamir transform. Then S is unforgeable underchosen-message attacks in the random oracle model.
Extending the result above to the quantum random oracle model is anactive area of research. Unruh proposed a post-quantum adaptation of theFiat–Shamir transform in [Unr15], but the cost of applying Unruh’s transformation is rather high. More recently, several results have appeared proving the security of the unmodified Fiat–Shamir transform under mild assump121

tions [LZ19, DFMS19], but we leave it as an open question to prove similar
results for SQISign.

5.1.2

Isogeny-based signature schemes.

We present below an overview of isogeny-based signatures prior to the publication of [DFKL+ 20]. All known isogeny-based signature schemes are derived
from an interactive identification protocol by applying the Fiat-Shamir transform. The soundness security property is mainly based on the hardness ofguessing the challenge and this is why the challenge space is the crucial parameter. In all of the schemes that we present below, the challenge space of theunderlying sigma protocol has size 2, so we need to repeat it λ times to obtaina global challenge space of size 2λ . The resulting signature is a concatenationof the output of these executions which is not very compact. We start with aquick overview of the solutions based on the kernel representation of isogenies.
Signature from the kernel representation. The first practical isogeny
signature scheme is based on the SIDH key exchange from De Feo and Jao[JD11] (presented in Section 6.1.1). It was derived by Yoo et al. in [YAJ+ 17]
from the identification protocol presented in [DFJP14]. While it benefits from
SIDH’s efficiency, it is not very compact due to the soundness issue we mentioned
above.
Then, SeaSign was introduced by De Feo and Galbraith [DFG19] in thegroup action setting of the CSIDH protocol. The original idea is due to Stolbunov [Sto10] and was only later reinterpreted in the context of CSIDH by De
Feo and Galbraith. Using the additional structure of the group action, SeaSign
offers some tradeoff between the size of the keys and the size of the signatures,but it is even less efficient than the signature derived from SIDH. Moreover, thequantum security of all schemes constructed from CSIDH remains unclear (see[BS20, Pei20]). Beullens, Kleinjung and Vercauteren introduced a modificationof Seasign called Csi-FiSh [BKV19]. They show that Seasign can be considerably improved once the structure of the class group involved in CSIDH has
been computed. In [BKV19], they broke the record of the largest class group
computation and applied it to their scheme, thus obtaining an isogeny-based signature scheme with quite decent performances (in terms of size and efficiency).
However, the class group computation has sub-exponential complexity, so theparameters of Csi-FiSh cannot be scaled to larger values. This is a major issue
because of the security concerns we mentioned above. These three schemes,
together with the GPS protocol that we introduce in the next paragraph, form
a complete overview of isogeny-based signatures before the introduction of our
SQISign construction.
The GPS signature. The protocol presented by Galbraith, Petit and Silva
differs from the other solutions because it is the only one based on the Deuring correspondence and the ideal representation. Despite these differences, theconcrete scheme has the same generic structure, since it is derived from an
identification protocol with challenge space of size two.
Let E0 be the special extremal curve in S(p) and O0 the special maximal
order in Bp,∞ (Definition 3.1.1). A GPS public key is a curve EA ∈ S(p), and the122Figure 5.1: The GPS identification scheme.
b ∈ {0, 1}
σ1 (KLPT)

E0
τ
EA

σ0

commitment isogeny (prover)•challenge bit (verifier)response isogeny (prover)E1

secret key isogeny

secret key is the endomorphism ring of EA (equivalently an isogeny τ between
E0 and EA ). The GPS identification protocol is made from a sigma protocol
to prove the knowledge of End(EA ). The commitment is a curve E1 computedfrom E as the codomain of some isogeny σ0 : E0 → E1 . The challenge is a bitb ∈ {0, 1}. The response is σb where σ1 is computed in the following manner:with σ0 and End(EA ) find a maximal order O1 isomorphic to End(E1 ), apply
KLPT on I(O0 , O1 ) to find an equivalent ideal of powersmooth norm and apply
IdealToIsogeny to compute σ1 : E0 → E1 . The situation is depicted in Figure 5.1
As we explained, the resulting GPS signature suffers from a small challenge
space. Additionally, IdealToIsogeny is a rather more theoretical than practicalalgorithm, particularly when required to translate ideals with large norm (whichis the case for the output of KLPT as we saw in Proposition 3.2.7). Because of
those issues, GPS produces large signatures and was never implemented. Our
protocol SQISign address both shortcomings. With the new algorithm GenericKLPT introduced in Chapter 3, we solve the soundness issue by expanding
the challenge space to have exponential size. The efficient algorithms IdealToIsogenyFromKLPT and IdealToIsogenyFromEichler, introduced in Section 4.2.2,
target the practical efficiency.

5.2

A new identification protocol and signatureschemeIn this section, we give an overview of our new protocol, SQISign. A more precise
and concrete description, together with implementation results, will be given in
Section 5.3 and Section 5.4. A completely explicit description of SQISign canbe found in Section 5.4.3. Following the standard framework introduced in
Section 5.1, our signature protocol is obtained from an interactive identification
protocol by the Fiat–Shamir transform [FS86]. In Section 5.2.1, we present theunderlying identification scheme and some results regarding soundness. Zeroknowledge requires more care, and we will treat it later in Section 5.5. In
Section 5.2.2, we introduce the outline of our signature.

5.2.1

An identification protocol

Our new identification scheme is made of a sigma protocol to prove the knowledge of the endomorphism ring of a curve E (or equivalently an isogeny between
E and a curve E0 of known endomorphism ring, see Section 2.2). In the description below, we outline the generic principle of the protocol without giving too
many details. In particular, we only sketch the response computation. Making

123this operation safe and efficient will occupy a good part of this chapter.
Let λ be a security parameter. The setup is as follows.
setup : λ 7→ param Pick a prime number p and let E0 be the special extremal
supersingular curve over Fp2 . Select an odd, smooth, λ-bit number Dc ,and let D = 2e where e is above the diameter of Gp2 .
keygen : param 7→ (pk = EA , sk = τ ) Pick a random isogeny τ : E0 → EA of
degree Nτ , leading to a random elliptic curve EA . The public key is EA ,and the secret key is the isogeny τ .
To prove knowledge of the secret τ , the prover engages in the following
Σ-protocol with the verifier. We summarize this scheme in Figure 5.2.
Commitment The prover generates a random (secret) isogeny walk ψ : E0 →E1 , and sends E1 to the verifier.
Challenge The verifier sends the description of a cyclic isogeny φ : E1 → E2of degree Dc to the prover.
Response From the isogeny φ ◦ ψ ◦ τ̂ : EA → E2 , the prover constructs a newisogeny σ : EA → E2 of degree D such that φ̂ ◦ σ is cyclic, and sends σ tothe verifier.
Verification The verifier accepts if σ is an isogeny of degree D from EA to E2
and φ̂ ◦ σ is cyclic. They reject otherwise.
ψE0challenge isogeny (verifier)

φ

τ
EA

commitment isogeny (prover)E1

σresponse isogeny (prover)secret key isogeny

E2

Figure 5.2: A picture of the identification protocol
Completeness follows from the correctness of the response computation,
which allows the honest prover to construct σ : EA → E2 such that φ̂ ◦ σis cyclic. Special soundness is analyzed below. We will see in Lemma 5.2.1 that
it is related to the following relation:(EA , α) ∈ R ⇐⇒ α is a cyclic smooth degree endomorphism of EA .

(5.2.1)

Lemma 5.2.1. The sigma protocol introduced above is special sound.
Proof. It suffices to show that given two accepting conversations (E1 , φ, σ) and(E1 , φ′ , σ ′ ) where φ ̸= φ′ , the composition σ̂ ′ ◦ φ′ ◦ φ̂ ◦ σ is a non-scalar endomorphism of EA of smooth degree. By construction, σ̂ ′ ◦φ′ ◦ φ̂◦σ is an endomorphism
of EA of degree (DDc )2 . This shows that the degree is smooth. It remains toprove that it is not a scalar. Suppose by contradiction that σ̂ ′ ◦φ′ ◦ φ̂◦σ = [DDc ].
The compositions φ̂ ◦ σ and φ̂′ ◦ σ ′ are two cyclic isogenies from EA to E1 of thesame degree. Therefore, σ̂ ′ ◦φ′ is the dual of φ̂◦σ. We deduce that φ̂◦σ = φ̂′ ◦σ ′ ,a contradiction.
124

With the Fiat-Shamir transform, we can derive a secure signature schemefrom an identification protocol that is complete, special-sound and honest verifier zero-knowledge when the special soundness is based on a relation R thatis hard, i.e., for which it is hard to compute a witness from an element of thelanguage L.
The relation R introduced in Eq. (5.2.1) is hard under the hardness of the
Smooth Endomorphism Problem — a problem heuristically equivalent to theclassic Endomorphism Ring Problem (see Remark 2.2.3).
Problem 5.2.2 (Smooth Endomorphism Problem (SEP)). Given a curve E ∈S(p), find a (non-trivial) cyclic endomorphism of E of smooth degree.
Response computation and the zero-knowledge property. The sketch
given in Section 5.2.1 is incomplete, as it does not specify a method to computethe response isogeny σ. Imitating the approach from [GPS17], our proposed solution is to use the algorithmic tools obtained from the Deuring correspondence.
The response computation is divided into two main steps. First, we computethe response as an ideal using a variant of GenericKLPT (see Algorithm 11 in
Section 3.3). This is the purpose of the SigningKLPT algorithm that we will
introduce as Algorithm 33 in Section 5.3.1 (the difference between these twoalgorithms is motivated purely by security considerations). Then, the response
isogeny can be computed as the translation of the output of SigningKLPT withthe efficient ideal-to-isogeny algorithms introduced in Section 4.2.2. In particular, IdealToIsogenyFromKLPT was introduced in our paper [DFKL+ 20] toperform this operation efficiently. The more efficient IdealToIsogenyFromEichler
was introduced in [DFLW22] as an improvement of IdealToIsogenyFromKLPT.
The zero-knowledge property of our identification scheme crucially depends
on the approach employed to perform the computation of the response. We
justify this briefly by exhibiting bad ways of doing it. The obvious method
would be to reveal the isogeny σ = φ ◦ ψ ◦ τ̂ . This is, of course, a valid answer,
but it directly reveals the secret τ . We might also be tempted to apply themethod from [KLPT14] (described at the end of Section 3.2.3) instead of ouradaptation of GenericKLPT. However, by design, the isogeny corresponding toan ideal obtained in this manner goes through the special extremal curve E0 ,and so reveals the secret. This issue is in fact what motivated us to introduce
GenericKLPT in [DFKL+ 20]. Arguing that our algorithm SigningKLPT does
not lead to a similar leakage will be at the heart of the analysis we provide in
Section 5.5 and Section 5.6. We will prove zero-knowledge in Section 5.5, undera new conjecturally hard computational problem introduced as Problem 5.5.6.

5.2.2

The signature scheme

The new signature scheme is simply a Fiat–Shamir transformation of the identification protocol introduced in Section 5.2.1. The main part of this transformation is to compute the challenge as some hash of the message and thecommitment. In our case, this operation is not entirely trivial because the challenge is an isogeny of degree Dc . We propose composing the DecompressionDc
algorithm introduced in Section 4.1.5 with a standard hash function. For any
degree Dc , the set of cyclic isogenies of degree Dc corresponds with {0, 1}µ(Dc )125

for some µ(Dc ) under our compression method. Let H : {0, 1}∗ → {0, 1}µ(Dc )be a cryptographically secure hash function.
sign : (SK, m) 7→ Σ Pick a random (secret) isogeny ψ : E0 → E1 . Let s =H(j(E1 ), m), and build the isogeny DecompressionDc (E1 , s) = φ : E1 →E2 . From the knowledge of OA , and of the isogeny φ ◦ ψ : E0 → E2 ,construct an isogeny σ : EA → E2 of degree D such that φ̂ ◦ σ is cyclic.
The signature is the pair (E1 , σ).
verify : (pk, m, Σ) 7→ true or false Parse Σ as (E1 , σ). From s = H(j(E1 ), m),recover the isogeny DecompressionDc (E1 , s) = φ : E1 → E2 . Check that σ
is an isogeny from EA to E2 and that φ̂ ◦ σ is cyclic.
Theorem 5.2.3. The signature described above is secure against chosen-message
attacks in the random oracle model assuming the hardness of Problems 5.2.2
and 5.5.6.
Proof. This follows from Theorem 5.1.2 applied to the identification scheme described in Section 5.2.1. The associated sigma-protocol is complete as explained
briefly in Section 5.2.1, special sound due to Lemma 5.2.1, and honest verifierzero-knowledge by combining Lemma 5.5.1 with Proposition 5.5.10.

5.3

Concrete instantiation: security

In this section and the next, we fill the gaps left open in Section 5.2 and explainin detail how to instantiate our new signature scheme. Below, we are interested
in security issues. Most of this section is spent on the SigningKLPT algorithm
which computes the ideal corresponding to the response isogeny, but we will
also talk about key generation.

5.3.1

Computation of the response isogeny: a secure algorithm to compute the ideal

In this section, we describe the SigningKLPT procedure (Algorithm 33) used inour signature scheme. This algorithm is a variant of GenericKLPT (presented in
Section 3.3). We are going to apply SigningKLPT in the setting 2• to find an
ideal with norm a power of 2. There are two main differences between SigningKLPT and GenericKLPT, and both stem from security considerations. First,
we would like to have output of constant degree (so it does not depend on thesecret). We will write SigningKLPT2e to indicate that 2e is the targeted norm of
the ideal. Second, we need some randomization to ensure a good distribution.
To that end, we introduce RandomEquivalentEichlerIdeal (Algorithm 34), usedin Step 1 of SigningKLPT. We will motivate these changes later in this section.
First, we give a detailed description of SigningKLPT. As usual, O0 is the
special extremal order of Bp,∞ . SigningKLPT takes two cyclic ideals as input:Iτ of norm Nτ and right order O1 , corresponding to the secret isogeny τ , andI a cyclic O1 -ideal. The output J ∼ I of norm 2e corresponds to the desired
response isogeny σ in our protocol. Let us write Oτ = O0 ∩ O1 = Z + Iτ . The
order Oτ is an Eichler order of level Nτ .
Let us explain briefly how we intend to deal with the fixed norm constraint.
As we will see in Section 5.5, it is important for security to deal with this issue
126

in the right manner. A good part of SigningKLPT (from Step 3 to Step 9) isvery similar to IdealEichlerNorm. The goal of these steps is to find an elementof norm 2e in the ideal Oτ ∩ L for some ideal L of norm N such that Oτ ∩ I
is equivalent to Oτ ∩ L as ideals of Eichler orders. The norm of the output of
IdealEichlerNorm has two main factors: γ, the output of FullRepresentInteger in
Step 3, has norm N 2e0 and µ, the output of FullStrongApproximation in Step 8,
has norm 2e1 . We therefore have a natural decomposition e = e0 + e1 . Since γ
must be computed before µ, the value of e0 uniquely determines the value of e1 .
We will sample e0 at random from a set e0 (N ) whose exact definition is given in
Proposition 5.3.5 and mainly follows from Lemma 3.1.4 to ensure terminationof FullRepresentInteger. The estimates from Lemma 3.1.6 let us determine whatsize we can take for e in order to ensure termination with a given probability.
Algorithm 33 SigningKLPT2e (Iτ , I)
Input: Iτ a left O0 -ideal and right O1 -ideal of prime norm Nτ inert in O, andI, a left O1 -ideal.
Output: J ∼ I of norm 2e .
1: Compute K = RandomEquivalentEichlerIdeal(I, Nτ )2: Compute K ′ = [Iτ ]∗ K and set L = EquivalentPrimeIdeal(K ′ ), L = χK ′ (δ)
for δ ∈ K ′ with N = n(L). Sample e0 ∈ e0 (N ).
3: Compute γ = FullRepresentIntegerN D(2e0 ) .
4: Compute (C0 : D0 ) = IdealModConstraint(L, γ).
5: Compute (C1 : D1 ) = EichlerModConstraint(Iτ , γ, δ).
6: Compute C = CRTNτ ,N (C0 , C1 ) and D = CRTNτ ,N (D0 , D1 ).
7: e0 ← v2 (n(γ)) and e1 ← e − e0 .
8: Compute µ = FullStrongApproximation{2e1 } (N Nτ , C, D). If it fails, go backto Step 3.
9: Set β = γµ.
10: return J = [Iτ ]∗ χL (β).
The randomization procedure. Step 1 of SigningKLPT is to perform arandomization step which we will use in the security argument for our signature.
This additional step has two interesting consequences for us. First, the outputof Algorithm 33 only depends on the equivalence class of the input I. Second,
it randomizes the execution.
RandomEquivalentEichlerIdeal takse a cyclic O1 -ideal I as input, and returns
an equivalent random ideal, meaning (in this context) that if we write C for theclass of I in Cl(O1 ), then we want an output ideal equivalent to I and lying
in a uniformly random class of ClOτ (C) (see Definition 2.3.10). This condition
might seem a little arbitrary at first; however, Proposition 5.3.3 will show that
this is exactly the kind of randomness we need.
To reach our goal, we use the classical technique of finding some well-chosenβ ∈ I and outputting χI (β). The method to choose β is inspired by the resultsof Section 2.3.1. The idea is to use the bijection from Proposition 2.3.12 inorder to sample a class uniformly. Note that Proposition 2.3.12 does not holdfor some special maximal orders O, but we may assume that this is not thecase here (there are at most two such types of maximal orders among O(p)possibilities).

127

Algorithm 34 RandomEquivalentEichlerIdeal(I, Nτ )Input: I a left O1 -ideal.
Output: K ∼ I of norm coprime to Nτ .
1: Sample a random element ωS in O1 until Nτ is inert in Z[ωS ].
2: Sample γ a random element in I such that n(γ)/n(I) is coprime to Nτ .
3: Select a random class (C : D) ∈ P1 (Z/Nτ Z).
4: Set β = (C + ωS D)γ.
5: return K = χI (β)
We now show that Algorithm 34 terminates and that its output distribution
is correct.
Lemma 5.3.1. Algorithm 34 terminates in expected O(poly(log(pNτ n(I)))) andoutputs an ideal equivalent to I and uniformly distributed among the Nτ + 1
possible classes of ClOτ (C) where C is the class of I in Cl(O1 ).
Proof. Since Oτ = O1 ∩ O0 has level N , we can represent a basis of Oτ withcoefficients of size in O(poly(log(pNτ ))). We can find a quadratic suborder
Z[ωS ] ⊂ O in which Nτ is inert in O(1) attempts. Then, it is clear that taking
a random element in I will verify that n(γ)/n(I) is coprime to Nτ with overwhelming probability. The elements in I can be represented with coefficients ofsize O(poly(log(pNτ n(I)))) and then we have C, D smaller than Nτ . Thus, theexpected running time in O(poly(log(pn(I)Nτ ))) follows from the complexity ofthe operations over Bp,∞ .
The algorithm concretely instantiates the map Θ from Proposition 2.3.12.
This map is bijective, and if we choose (C : D) uniformly at random from
P1 (Z/Nτ Z) then the output is uniformly distributed.
Consequently, the output of RandomEquivalentEichlerIdeal only depends onthe class (inside Cl(O)) of the ideal in input. The call to RandomEquivalentEichlerIdeal in Step 1 of SigningKLPT thus implies the following lemma that will
prove useful in Section 5.5.
Lemma 5.3.2. For any Iτ , the output distributions of SigningKLPT(I, Iτ ) and
SigningKLPT(J, Iτ ) are the same for any I ∼ J. Put otherwise, for fixed Iτ , theoutput distribution of Algorithm 33 only depends on the equivalence class of the
input ideal I.
Next, we describe how the distribution of L (as defined in Step 2 of Algorithm 33) is determined by the output distribution of RandomEquivalentEichlerIdeal. This is what motivates the current formulation of Algorithm 34.
Proposition 5.3.3. The set GI = {L, L = EquivalentPrimeIdeal([Iτ ]∗ K) for K ∼I} has size at most Nτ + 1 and for every L ∈ GI there exists an output K =RandomEquivalentEichlerIdeal(I) such that L = EquivalentPrimeIdeal([Iτ ]∗ K).
When #GI = Nτ + 1, the ideal L is uniformly distributed inside this set.
Proof. As we mentioned before, there are exactly Nτ + 1 classes for K ∼ I
in ClOτ (O). By Corollary 2.3.61 , the class of K in ClOτ (O) uniquely determines the class of [Iτ ]∗ K in Cl(O0 ). As noted in Remark 3.2.8, the output
1 Corollary 2.3.6 uses pushforwards rather than pullbacks, but we obtain the desired result
by replacing I with I.

128

of EquivalentPrimeIdeal is well-defined and deterministic on Cl(O0 ). The result
follows from this remark with Lemma 5.3.1.
Remark 5.3.4. In full generality, we cannot prove more than the Nτ + 1 upperbound of Proposition 5.3.3. However, in most cases, this number is exactly equal
to Nτ + 1. To estimate the difference, we need to count the number of times
when [Iτ ]∗ K1 ∼ [Iτ ]∗ K2 for K1 and K2 lying in different classes of ClOτ (O).
Rewriting this in our commutative diagram (recall that the norms of K1 and K2
are coprime to Nτ ) we have [Iτ ]∗ K1 ∼ [Iτ ]∗ K2 if and only if [K1 ]∗ Iτ ∼ [K2 ]∗ Iτ .
Thus, each of the Nτ + 1 classes of ClOτ (O) that we consider is mapped to one
left OR (I)-ideal of norm Nτ through K 7→ [K]∗ Iτ . Hence, we want to estimate
the number of pairs of distinct equivalent ideals of norm Nτ . In general, if
Nτ + 1 is small compared to p, then a maximal order has a very low probabilityof having two distinct equivalent ideals of same norm Nτ , which means thatwith high probability there are exactly Nτ + 1 classes. In any case, the numberof possible equivalence classes is in Θ(Nτ ).
Termination and complexity.
KLPT.

We can now state the complexity of Signing-

Proposition 5.3.5. (UPHA) For any κ > 0, there exist η1 , η2 , and ε =O(log log(p) + log(κ)) such that if ε > 1, e0 (N ) = [log(p) − log(N ) + η1 , log(p) −log(N ) + η1 + ε] and e > 3 log(p) + 3 log(Nτ ) + η2 + ε, then SigningKLPT2ewill succeed with probability higher than 1 − 2−κ when I is in a random class ofCl(O1 ). The expected running time is in O(poly(log(pNτ n(I)))).
Proof. In a manner similar to GenericKLPT, this result follows from Proposition 3.3.6 and Lemmas 3.1.4, 3.1.6 and 5.3.1, together with estimates from
Lemma 3.2.3 for the size of N .
Remark 5.3.6. The role of ε in Proposition 5.3.5 might appear mysterious, but
it will prove useful later in Section 5.6 with Proposition 5.6.8. The condition
ε > 1 is there to ensure that e0 (N ) contains at least one integral element. For
our purposes, any ε > 1 + 2η0 (where η0 is the term from Lemma 3.2.3 and Remark 3.2.4) will work. This last constraint is also justified by Proposition 5.6.8.
Remark 5.3.7. If we take κ = log(p), we get that SigningKLPT2e succeedswith overwhelming probability. Thus, there exist two minimal values η1 , η2 =O(log log(p)) such that Proposition 5.3.5 holds. Henceforth, we assume that, fora given p, these two values η1 , η2 are fixed and used to determine the exponent
e. We also assume that a value ε > 1+2η0 is fixed as explained in Remark 5.3.6,
we get that the set e0 (N ) is fully determined by the value of p.
Remark 5.3.8. In our practical instantiation, executions of KLPT, SigningKLPTand all the algorithms from Chapter 3 are quite negligible compared to otheroperations (in particular the computations involved in the manipulation of thekernel representation of isogenies). This is why we have not spent much timetrying to optimize these algorithms.
The security of the scheme resulting from SigningKLPT will be analyzed in
Section 5.5 and Section 5.6. In particular, we will motivate the choices andmodifications underlying the formulation of SigningKLPT.

129

5.3.2

Defining the key space

We refer to the description from Section 5.2.2 for the notation in this section.
For statistical security, the degree Nτ of the secret isogeny τ should be
sufficiently large to ensure a near-uniform distribution of the public key EA
over the set of supersingular curves. However, there is another constraint on
Nτ : the ideal Iτ corresponding to τ is used in SigningKLPT, so we want Nτ to
be a prime inert in O (see the description of SigningKLPT). Proposition 5.3.5
proves that the size of Nτ has an impact on the size of the output, and so on
the global efficiency of our signature scheme. Thus, efficiency demands that wetake Nτ as small as possible.
In this section, we discuss a key sampling method which trades off statisticalsecurity for efficiency. We will use this alternative key space in our implementation. In this analysis, we focus exclusively on key-recovery attacks that use
only the key only.
A natural method to generate the key would be as follows: fix a boundBτ , then sample a prime degree Nτ inert in O randomly in [2, Bτ ] and finally sample a random isogeny of degree Nτ from E0 . With the estimatesof Lemma 3.2.3, we see that an overwhelming proportion of the supersingular√graph can be reached with this method if Bτ is at least p. When EA is nearly
uniformly distributed, the best known classical attack to recover the key is due
e 1/2 ) (it has the same complexity
to Delfs and Galbraith [DG16] and has cost O(pas the algorithm outlined in Section 2.2.1, but does not rely on any assumptions). It consists in performing a random walk from EA until a curve E ′ overFp is reached, then doing a search in the Fp -graph for an isogeny connecting
E ′ to E0 . The quantum version of this algorithm achieves a quadratic speedup using Grover’s algorithm, and thus has cost O(p1/4 ) [BJS14]. Hence, for aclassical security level λ, and quantum security level µ = λ/2, it is enough tochoose log(p) = 2λ = 4µ. In particular, we estimate that log(p) = 256, 384 and512 reach the NIST’s security levels 1, 3 and 5 respectively.
A simple way to improve the efficiency of our protocol is to decrease thebound Bτ . This is reminiscent of the SIDH protocol [JD11], in which only asmall fraction of the supersingular graph is used, and whose security is consequently not amenable to a generic isogeny problem. However, unlike in the
SIDH case, slightly reducing the key space does not improve the cost of known
attacks. Indeed, in our protocols Nτ is a large prime, thus meet-in-the-middle
strategies à la [ACVCD+ 19] would be ineffective.
When Bτ is small enough, exhaustive search becomes the best strategy:
compute all isogenies of degree smaller than Bτ , and compare their codomain
curve with EA . All of the isogenies can be computed in polynomial time inlog(p), even if Nτ is not smooth, because we can translate the ideal into asmooth-degree one with KLPT. Since there are Θ̃(Bτ ) possible degrees Nτ andΘ(Nτ ) cyclic isogenies for each of these degrees, the classical complexity of this
attack is in Θ̃(Bτ2 ), and Grover’s algorithm yields again a quadratic speed-up
at best. To defeat this attack, we only need log(Bτ ) > 14 log(p) which is better
than the log(Nτ ) > 21 log(p) bound that we have in general.
This improvement produces a shorter and more efficient signature for thesame level of security, as it reduces the output size of Algorithm 33 from 92 logℓ (p)to 15
4 logℓ (p) (see Proposition 5.3.5). We use it in the implementations presented
in Section 5.4.4.

130

5.4

Concrete instantiation: efficiency

In this section, we discuss efficiency considerations for a concrete instantiationof SQISign. Together with the results from Section 5.3, we obtain a complete
and detailed description of SQISign that we provide in Section 5.4.3. This leads
to an implementation in C whose performances we report in Section 5.4.4. In
what follows, we target the NIST level 1 of security and 128-bits of classicalsecurity. Following the discussion in Section 5.3.2, this means that we will takea prime p with log(p) ≈ 256.
The main issue that remains to be dealt with is the ideal to isogeny translation to derive the response from the output of SigningKLPT. Fortunately, we
already have all the necessary tools. Indeed, the IdealToIsogenyFromKLPT and
IdealToIsogenyFromEichler algorithms introduced in Section 4.2.2 were designed
specifically to perform that task efficiently. Despite the amount of effort we
spent on making these algorithms efficient, we will see in Section 5.4.4 that thisis, by far, the bottleneck of the computation. In comparison, the other steps
such as SigningKLPT are completely negligible. This is why we have spent little
time discussing the concrete efficiency of this algorithm.
We already explained in Section 4.2.2 that IdealToIsogenyFromEichler should
be considered an improvement of IdealToIsogenyFromKLPT, and we justify thisbelow with a detailed cost analysis in Section 5.4.1. This will be confirmed in
Section 5.4.4 by our implementation of the two methods. In Section 5.4.2, we
explain how to find good parameters to instantiate our translation algorithms.

5.4.1

Ideal to isogeny: cost estimate

We will observe in Section 5.4.4 that algebraic operations over Fp2 make up mostof the cost of SQISign: up to ≈ 90% in our experiments. These mainly comefrom isogeny computations, and T -isogenies in particular. It is thus reasonable
to ignore, in the analysis below, the computations over the quaternions and thelinear algebra required by the algorithms from Chapter 3. Ideally we would
count the number of Fp2 -operations performed for each choice of parameters,
however this is difficult given the complexity of the algorithms. Instead, we will
use a much coarser metric based on four indicators.
We are only going to compare IdealToIsogenyFromKLPTℓ• and IdealToIsogenyFromEichlerℓ• for a small prime ℓ (in practice, ℓ = 2). A full description ofthese algorithms was given in Section 4.2.2 but we give a brief reminder below.
Both algorithms decompose an ideal of norm ℓe into ideals of smaller norm.
The former decomposes into ideals of norm ℓ2f +∆ for some constant ∆, which
are then translated to isogenies by IdealToIsogenySmallFromKLPT. The latterdecomposes into ideals of norm ℓf , which are translated by IdealToIsogenySmallFromEichler.
The translations are achieved using T -isogenies where T is a smooth integer
coprime to ℓ. Even if we use the same notation for this parameter, the two
methods do not have the same requirements: we need T > p3/2 for IdealToIsogenyFromKLPT, and T > p5/4 for IdealToIsogenyFromEichler. The fact that
this constraint is relaxed for IdealToIsogenyFromEichler explains why this version
will end up being more efficient. Both sub-algorithms consist mostly of isogeny
computations of degree T and ℓf . For each of them, we will count:(Tc ) How many isogenies of degree T are computed ;131

(Te ) At how many points the isogenies of degree T are evaluated ;(ℓc ) How many isogenies of degree 2f are computed/evaluated;(∆c ) How many meet-in-the-middle searches for isogenies of degree ℓ∆ are performed (this is exclusive to IdealToIsogenySmallFromKLPT).
The costs of Tc and Te depend on the factorization of T . Instead of using
the full factorization, we will base our estimate on a bound B such that allprime factors of T are < B. Using the method introduced in Section 4.1, √thecosts of computing and evaluating an isogeny of prime degree n growwithn√(ignoring logarithmic factors), we will thus multiply Tc and Te by B. Sinceℓ is small, the cost of computing and evaluating an isogeny of degree ℓf grows
with f log(f ) (ignoring the dependency in ℓ), we shall thus multiplyℓc by this√∆factor. Finally, the √meet-in-the-middle requires computing all ℓ isogenies, so
we multiply ∆c by ℓ∆ .
Given an ideal of norm ℓe , IdealToIsogenyFromKLPT calls IdealToIsogenySmallFromKLPT ≈ e/(2f +∆) times, while IdealToIsogenyFromEichler calls IdealToIsogenySmallFromEichler ≈ e/f times. For this reason, we divide all countsby 2f + ∆ and f , respectively.
Summarizing, for the method based on KLPT we will use the following 4valued estimator:√√√(Tc B , Te B , ℓc f log(f ) , ℓ∆ ∆c )/(2f + ∆),(5.4.1)
where the division is applied component-wise. For the method based on SpecialEichlerNorm, given that it does not use a meet-in-the-middle search, we will
instead use√√(5.4.2)(Tc B/f , Te B/f , ℓc log(f )).
We give below the estimation count for each of the operations. We will computethe exact value of the estimators for concrete examples of prime characteristic p
in Section 5.4.2.
First Method. Some steps in IdealToIsogenySmallFromKLPT are rather vague,
so we refer to the code at https://github.com/SQISign/sqisign to see how
it is done in practice.
The operation count for IdealToIsogenySmallFromKLPT is as follows: Step 3
is 2 Te (push ker φ1 through φJ ) and 1 ℓc (compute φ1 ), Step 8 is 1 Tc (computeψ1 ), Step 9 is 1 Te , 1 Tc (compute ψ2 and ker ρ2 ) and 1 ℓc (compute φ2 ), Step 10
is 1 ∆c , Step 11 is 2 Te (compute ker ψ̂1 ), 2 ℓc (push ker ψ̂1 through ρ2 ◦ η), 1
Tc and 1 Te (compute ψ1′ and ker φ̂2 ), 1 ℓc (compute φ2 ) and 1 ∆c (compute θ).
The total is 3 Tc , 6 Te , 2 ∆c and 5 ℓc .
Second Method. Step 7 of IdealToIsogenySmallFromEichler requires solving
a DLP instance in the ℓf -torsion, and we overestimate the complexity by sayingthat this is equivalent to 1 ℓc operation (asymptotically it is the same cost, but
the DLP is faster in practice). We obtain the following count: Step 6 is 2 Tc ,Step 7 is 5 Te and 1 ℓc (see Algorithm 26), and Step 8 is 1 ℓc . Overall, we get
2 Tc , 5 Te and 2 ℓc .

132

5.4.2

Parameter choices

The choice ℓ = 2 yields the fastest verification possible so this is the value
we take for our concrete instantiation of SQISign. For the fastest and simplest
instantiation of our algorithms we want E[T 2f ] to be defined over Fp2 so we need
T 2f |p2 − 1. Since we have the constraint T > p for both IdealToIsogenyFromEichler and IdealToIsogenyFromKLPT, we cannot hope to choose a good T andexponent f before finding the prime p. Thus, we will have to search throughmany primes until we find one with the good properties. In this section, we
describe how to speed up this search and give examples with log(p) ≈ 256.
These examples are the ones we used in our implementation to get the resultspresented in Section 5.4.4.
Remark 5.4.1. In each case, we target the smallest possible size for T and evaluate the quality of each prime by the smoothness of T . Efficiency clearly depends
on the size of f . A bigger f means fewer executions of IdealToIsogenySmallFromKLPT and IdealToIsogenySmallFromEichler but a larger smoothness bound for
T . Given the difficulty to estimate the exact complexity of the computation, we
decided to target a fixed value of f . Based on some rough estimates, we chosef ≈ 32 for IdealToIsogenyFromKLPT and f ≈ 64 for IdealToIsogenyFromEichler;more work would be required to determine a finer choice.
Remark 5.4.2. For security, only the size of p is important (to ensure hardnessof the ERP). In isogeny-based cryptography, primes are always chosen in very
specific forms for better efficiency: for instance, SIDH takes p = c2eA 3eB ± 1(see Section 6.1.1).
Search methods. Finding primes p such that p2 − 1 has a smooth factor
considerably larger than p is a difficult task because we need to control bothp − 1 and p + 1 simultaneously. This problem was recently considered in thecontext of the SIDH-like key exchange B-SIDH [Cos19], where the focus is on
finding p such that p2 − 1 is fully smooth. Here, we have a slightly different
problem, as we only need p2 − 1 to contain a large enough smooth factor; inaddition, we want it to be divisible by a large power of 2. We have explored two
main approaches to find such p.
We call the first approach the XGCD method. It is rather simple, but it
appears to be well-suited to our task as this is the one that gave the better
primes. The idea is to construct primes p such thatp ± 1 = 2a · α · A,p ∓ 1 = 2 · β · B,
where
• a + log2 (αβ) ≈ f , where f is our target for the power of 2-torsion,• α, β are odd B1 -smooth for some bound B1 , and• there is a B2 -smooth γ|AB such that log2 (αβγ) > t for some threshold t.
We construct these by choosing a, α and β before using the Chinese remainder
theorem to reconstruct p, and then testing the primality of p and the smoothnessof AB.
133

We use two tricks to increase the probability of success. First, to increase
the probability that p is prime, we always include some small factors in α or β,
namely 3, 5, 7 and 11. Second, and most importantly, to increase the probability
that AB contains a large smooth factor we observe that we have freedom in the
choice of log2 (A) and log2 (B), as long as log2 (AB) has the right size, andthat the probability of having a large smooth factor γ|AB is not maximized bylog2 (A) ≈ log2 (B) unless γ = AB.
The second approach is to look for primes of the form p = 2f xn ± 1 where
n is a fixed exponent and x will cover numbers of size (log(p) − f )/n. This idea
was introduced in [Cos19] to find B-SIDH friendly primes, but it can be adapted
to our setting quite easily. The problem here is that the search space ends up
being quite reduced as soon as n grows.
Remark 5.4.3. An earlier version of [Cos19] explored the possibility of using
Størmer’s theorem [Stö03] for this search, but this theorem does not exactly
match our needs; further, a recent update to [Cos19] reports that Størmer’s
theorem does not seem to produce good results for meaningful sizes. The methods of the recent work [CMN21] really target the case of B-SIDH and is not well
suited to produce primes such that p2 − 1 contains a large power of 2, or of any
other small prime.
Concrete searches. The requirement on T in IdealToIsogenyFromKLPT comesfrom the KLPT algorithm. Given Proposition 3.2.7, we decided to look for T
with t = log(T ) > 390 (in practice, this choice appears to be large enoughfor KLPT to succeed with overwhelming probability). We applied the XGCD
method, with the following parameters: a = 32, B1 = 210 and B2 = 214 . Using
the probability estimates of [BS07], we found that the smoothness probability
is maximized by taking log2 (B) = 87, and thus log2 (β) Q= 168, log2 (α) = 56 andlog2 (A) = 168. We fixed α = 521 · 7 · 11, and β = 3b · i δi where the numberof B1 -smooth integers in β is chosen to guarantee a large enough search space.
We implemented this strategy in C using the GMP library. A search effort
of about 6 CPU-years produced several useful primes. The most interesting one,called p6983 , hasp6983 + 1 = 233 · 521 · 72 · 11 · 31 · 83 · 107 · 137 · 751 · 827 · 3691 · 4019 · 6983
· 517434778561 · 26602537156291 ,53

p6983 − 1 = 2 · 3· 43 · 103 · 109 · 199 · 227 · 419 · 491 · 569 · 631 · 677 · 857 · 859· 883 · 1019 · 2713 · 4283 .

We used this prime in our implementation. (At the time when we published[DFKL+ 20], we were not aware of the second method from [Cos19] and so we
did not try it.)For IdealToIsogenyFromEichler, we follow Proposition 3.3.4 and look for t >330 (this value appears to be large enough in practice to ensure success withoverwhelming probability). We used the method of [Cos19] to look for primes
p = 261 x4 − 1, sieving the whole interval x ∈ [247 , 249 [ in approximately 360
CPU-days. We found 398 integers such that p2 − 1 has a 211 -smooth odd factor
of more than 330 bits, of which 15 were prime (see Table 5.1); none of them hasa large enough 210 -smooth factor.

134143189100303149
424067696488337
512391149388477
548396183941255

369428710635531
431716591494287
512583833108361
550470785518701

391443251922757
491224940548057
514414280000642
562456538440551

411099446409699
491531434028942
515727186701509

Table 5.1: The list of integers x ∈ [247 , 249 [ such that 261 x4 − 1 is prime andx4 (215 x − 1)(215 x + 1)(230 x2 + 1) contains a 211 -factor > 2330 .
Using the XGCD method, we found that we could obtain primes with f ≈ 64
and B = 212 at a reasonable cost. The best candidate we found, which we namep3923 , has 254 bits andp + 1 = 265 · 52 · 7 · 11 · 19 · 292 · 372 · 47 · 197 · 263 · 281 · 461 · 521· 3923 · 62731 · 96362257 · 3924006112952623 ,
p−1=2·3

65· 13 · 17 · 43 · 79 · 157 · 239 · 271 · 283 · 307 · 563 · 599· 607 · 619 · 743 · 827 · 941 · 2357 · 10069 .

Despite the slightly larger smoothness bound, we found that p3923 performs
better in practice than primes of the form 261 x4 − 1, probably owing to thelarge power of 3, which contributes favorably to T -isogeny computations.
Looking at the estimator values for p3923 in Table 5.2, we see that applying IdealToIsogenyFromEichler to this prime yields a significant gain during T isogeny computations and meet-in-the-middle at the cost of a modest loss during
2f -isogeny computations. Since the former tends to affect performance much
more than the latter, in practice, we expect IdealToIsogenyFromEichler to compare favorably to IdealToIsogenyFromKLPT. We also considered using p6983 with
IdealToIsogenyFromEichler as a way to compare the two methods on the sameprime. The estimators in Table 5.2 tends to prove that even for p6983 , which
was selected for IdealToIsogenyFromKLPT, the better performances are obtainedwith IdealToIsogenyFromEichler. This will be confirmed by experiments.
In fact, we will see in Section 5.4.4 that in practice, the gain of IdealToIsogenyFromEichler is even larger than predicted by our estimator. Finding
more accurate estimators to guide the prime search in SQISign is an interesting
problem for future research.
algorithm
p log(p) f B Tc Te ℓc ∆c
IdealToIsogenyFromKLPT p6983 256 33 213 3 6 5 2
IdealToIsogenyFromEichler p6983 256 33 211 2 5 2 –IdealToIsogenyFromEichler p3923 254 65 212 2 5 2 –estimator(3.4, 6.8, 10.4, 3.2)
(2.7, 6.9, 10.1)(2.0, 4.9, 12.0)

Table 5.2: Operation estimates for several variants of ideal-to-isogeny translation. B is the smoothness bound of T .

5.4.3

SQISign: the concrete description

We now give a detailed description of all the steps composing the identification
scheme for SQISign. We target λ = 128 bits of classical security.

135Given the discussion in Section 5.4.1 and Section 5.4.2, we transform ideals
to isogenies using IdealToIsogenyFromEichler. We use the prime p3923 defined in
Section 5.4.2. Tecall that T ≈ p5/4 . We have 2f = 265 available torsion.
Experiments suggest that taking D = 21000 for the degree of the response
isogeny suffices to ensure the success of SigningKLPT with overwhelming probability. This choice is not necessarily the tightest possible, but it is close enough.
We will use the challenge and commitment isogenies to compute the endomorphism ring of the curve E2 , so we need to be able to translate them into
their corresponding ideals efficiently. Let us write Dc for the challenge degree
and T ′ for the commitment degree. We will see that we can have T ′ Dc |T 2f .
For faster verification, we want the challenge isogeny computation to be as fast
as possible, and this is why we use all the smallest factors in Dc .
Building τ (keygen). As explained in Section 5.3.2, we select the degree Nτ
of the secret isogeny τ to be a prime smaller than 2λ/2 = 264 and inert in O,
chosen uniformly at random among such numbers. Since Nτ is a large prime, we
never compute the isogeny τ concretely, as this would be too inefficient. Instead,
we use the corresponding ideal Iτ . This is enough to apply SigningKLPT but
it does not give us the public key EA . For this, we compute another isogeny
τ ′ : E0 → EA of degree in 2• . We can obtain Iτ ′ using KLPT and compute τ ′with IdealToIsogenyFromEichler. We present an alternative and more efficient
key generation procedure at the end of this section.
We do the keygen as follows:
1. Select a prime Nτ ≤ Bτ inert in O uniformly at random.
2. Select a left O0 -ideal Iτ of norm Nτ uniformly at random among the Nτ +1
possibilities.
3. Compute Jτ = KLPT2• (Iτ )4. Compute τ ′ = IdealToIsogenyFromEichler(Jτ , O0 , [1]E0 ) and set pk = EA ,the codomain of τ ′ .
Building ψ (commitment). There are several options for building the commitment (and, incidentally, the challenge); we present the most efficient option
here. We note that, for security reasons, ψ must be as hard to recover as thesecret. This suggests taking a smooth isogeny of degree about p (here we do
not gain anything by using the same idea as in Section 5.3.2). Given the factorization 2f T = Dc · T ′ , we choose ψ as a random isogeny of degree T ′ from
E0 . The exact value for Dc is given in the next paragraph. With this choice ofT ′ , computing the isogeny ψ and converting it to the ideal Iψ is efficient withIsogenyToIdeal.
Building φ (challenge). The previous choice of commitment generation was
motivated by the fact that we want an efficient way to translate the challenge
into its corresponding ideal. For λ-bit soundness security we need a challenge
space of size 2λ , so the challenge isogeny needs to be of degree 2128 in ourcase. With p3923 , we get Dc = 265 340 . The remaining factors in T are usedin T ′ . Let φ : E1 → E2 be a random cyclic isogeny of degree Dc . Since theT ′ Dc -torsion is accessible over Fp2 , and we have ψ : E0 → E1 of degree coprime136

to Dc , computing the corresponding ideal will be efficient for the prover using
IsogenyToIdeal.
Building σ (response).

The response is computed as follows:
1. Compute Iφ = [Iψ ]∗ IsogenyToIdealDc ([ψ]∗ φ) .
2. Set I = Iτ · Iψ · Iφ and compute J = SigningKLPT21000 (I, Iτ ).
3. Compute σ = IdealToIsogenyFromEichler(J, Jτ , τ ′ ).
4. Compute S = Compression21000 (EA , σ).

Verification. Upon receiving the string S the verifier needs to check that σ,
the 21000 isogeny represented by S, is a cyclic isogeny between EA and E2 ,and that the composition φ̂ ◦ σ is a cyclic isogeny. The verifier can recover
the isogeny σ as Decompression21000 (EA , S). Then, the codomain of σ can becomputed easily using the ideas from Section 4.1. To verify that φ̂ ◦ σ is cyclic,
it suffices to compute the action of φ̂ ◦ σ on EA [2f ]. There are points of order
2f in this image if and only if φ ◦ σ is cyclic.
Remark 5.4.4. Here we have made the choice of responding with isogenies ofdegree in 2• to get the fastest verification possible, but this is not a necessity.
In fact, there is a tradeoff in signature efficiency versus verification efficiency.
Signing time could be greatly improved by allowing some T -torsion inside theresponse isogeny. However, in this case, the verifier would be required to compute isogenies of degree dividing T , which is a lot less efficient than 2-isogenies
with the current parameters. For instance, if Nτ ≈ p1/4 , looking for a response
isogeny of degree in T 2• would allow us to decrease the 2-adic valuation of thedegree of σ by a factor of 5/3, at the cost of performing one T -isogeny computation. As each iteration of IdealToIsogenySmallFromEichler requires to compute
several T -isogenies, we estimate that signing time could be decreased by approximately the same factor of 5/3. This would come at the cost of requiring
the verifier to compute one T -isogeny. Further work might clarify the efficiencyof our signature scheme if we were to push this idea to its full extent and lookfor σ with a degree dividing some power of T .
SQISign with p6983 . We can also devise a version of SQISign working with
p6983 and IdealToIsogenyFromKLPT. Everything is roughly the same, up to thenecessary changes of values for T and f . When IdealToIsogenyFromKLPT isused, we take the meet-in-the-middle exponent to be ∆ = 14 (this choice wasbased on empirical evidence, and is not necessarily the optimal choice).
An alternative key generation method. We now present an alternative
key generation procedure. It is more efficient than the one presented above,
but the distribution of the resulting secret keys is more difficult to analyze. We
state it here for completeness. The idea is quite simple: instead of generatingIτ first and then computing Jτ using KLPT, we generate an endomorphism γ
of norm Nτ ℓ• and then derive Iτ and Jτ from γ. The endomorphism γ canbe generated using FullRepresentInteger. Since this algorithm allows one to findendomorphisms that are much smaller than in KLPT, we can obtain τ ′ of smaller137

norm. Let us write eτ for the ℓ-valuation of the degree of τ ′ . With KLPT wehave eτ ≈ 2 log(p) + 2 log(Nτ ). Using this new method, the lower bound on eτ
becomes the diameter of the graph (so that every secret isogeny of degree Nτ
can be generated that way). This allows one to take eτ ≈ log(p). When eτ issmaller, key generation becomes more efficient as the translation from Jτ to τ ′becomes faster. This idea leads to the key generation described below.
1. Select a prime Nτ ≤ Bτ inert in R uniformly at random.
2. Compute γ ∈ O0 a random solution of γ = FullRepresentIntegerD(Nτ ℓeτ )and set Iτ = ⟨γ, Nτ ⟩, Jτ = ⟨γ̄, ℓeτ ⟩.
3. Compute τ ′ = IdealToIsogenyFromEichler(Jτ , O0 , [1]E0 ) and set pk = EA ,the codomain of τ ′ .

5.4.4

Performance

We discuss below the performance features of SQISign.
Signature size and comparison with existing schemes. For λ bits ofclassical security, we take p ≈ 22λ . The public key is the j-invariant of thecurve EA , and it has size 2 log2 (p) = 4λ. The secret can be seen as a pairNτ , Iτ . The integer Nτ is a log(p)/4-bit prime, and we can represent Iτ as anumber in [1, Nτ + 1], so another log(p)/4-bit integer. In total, the secret key
has size λ. The signature comprises E1 and σ, where σ is produced by theCompression algorithm from Section 4.1.5. As argued there, we can either use afull compression of exactly e bits, or allow for a few additional bits to accelerate
the verification time. With the second method, the size is e + 4(⌈e/f ⌉ − 1). We
recall that, with keys as in 5.3.2, e = 15/4 log(p) + O(log(λ)). Representing thecommitment curve E1 requires 2 log2 (p) = 4λ additional bits. We summarize
these values in Table 5.3 when λ = 128. For our concrete instantiation we havelog2 (p) = 254, f = 65 and e = 1000.
Secret Key (bytes) Public Key (bytes) Signature (bytes)
16
64
204
Table 5.3: Size of SQISign keys and signature for the NIST-1 level of security
and 128 bits of classical security.
These sizes make SQISign the most compact post-quantum digital signature targeting NIST-1 level of security, in terms of combined public key andsignature size. With respect to round 3 candidates, it is more than 5 times
more compact than Falcon [FHK+ 19] in terms of combined size, and only trails
GeMSS [CFMR+ 19] in terms of signature size. SQISign signatures are morecompact than RSA, and only about three times larger than ECDSA, for a comparable level of classical security.
Implementation. We implemented SQISign in C using the libpari libraryof PARI/GP 2.11.4 [The20]. We ran experiments on a 3.40GHz Intel Core i76700 (Skylake) CPU with Turbo Boost disabled. The code was compiled using
clang-6.0 -O3 -Os -march=native -mtune=native -Wall -Wextra-std=gnu99
138

-pedantic. We used the fast algorithms presented in Section 4.1.4 for isogeny
computations of degree greater than ≈ 100.
We made two different implementations. The first, using the IdealToIsogenyFromKLPT algorithm with p6983 , was introduced with the original submission of SQISign [DFKL+ 20]. It is available at https://github.com/SQISign/
sqisign.
The second implementation was introduced in [DFLW22] and is available
at https://github.com/SQISign/sqisign2. It is based on the IdealToIsogenyFromEichler algorithms, supports both primes p3923 and p6983 and contains various additional optimizations. In particular, the first implementation did not use
the correct compression/decompression method, which explains why we observea speed-up in the verification time as well. The speed-up in verification between
p3923 and p6983 with the second implementation can be explained because we
can put more 2f -torsion in the challenge degree Dc .
The results are in Table 5.4. With our improvements, and moving from theold implementation with p6983 to the new one with p3923 , we observe a morethan two-fold speed-up in all operations.
FromKLPT/p6983
FromEich/p6983
FromEich/p3923
Keygen Sign Verify Keygen Sign Verify Keygen Sign Verify
1st quartile 1,918 7,722 135 2,569 6,673
82
717 3,645
64
Mcycles median
1,950 7,828 142 3,081 6,718
86
741 3,685
65
3rd quartile 2,008 7,959 148 3,973 6,797
88
780 3,743
68
1st quartile
562 2,26639
754 1,95824
210 1,070
19
ms
median572 2,29742
904 1,971
25
218 1,081
19
3rd quartile589 2,335
44 1,166 1,994
26
229 1,098
20
Table 5.4: Performance of SQISign in millions of cycles and in milliseconds.
Statistics over 100 runs for key generation and signature, and over 250 runs forverification.
We stress that we did not attempt to produce a constant-time implementation. This appears to be an intensive task due to the complexity of the algorithms involved. In https://github.com/SQISign/sqisign-magma, we provide an additional implementation in Magma [BCP97] (it implements the samealgorithms as the first version of our C implementation). It performs poorly
compared to our C code, but we hope it may serve as a useful reference.
Remark 5.4.5. One might wonder why key generation is so slow and has ahuge variance with the algorithm IdealToIsogenyFromEichler and p6983 . This isbecause we encounter one of the bad cases described in Section 3.5: for the
first execution of IdealToIsogenySmallFromEichler, we get a maximal order thatis connected with O0 with an ideal of norm 233 . We apply the countermeasuredescribed at the end of Section 4.2.2, but the computation is much slower.

5.5

Zero-Knowledge

We now discuss the Zero-Knowledge property of our identification scheme.

1395.5.1

An ad-hoc assumption

We prove that our identification scheme is computationally zero-knowledge assuming that the distribution of the response isogeny σ can be simulated. This
result is not dependent on the concrete instantiation. In the following subsections, we will focus on the instantiation of SQISign with the SigningKLPTalgorithm, and argue that in this case, the distribution DEA is indistinguishable
from the uniform distribution of cyclic D-isogenies, assuming the hardness ofProblem 5.5.6.
Let DEA be the distribution of isogenies σ in SQISign for a given public key
EA .
Lemma 5.5.1. If we assume that for any SQISign public key EA , there exists a probabilistic polynomial algorithm S taking EA as input whose output
distribution is (computationally) indistinguishable from DEA , then the SQISignidentification protocol is (computationally) Honest-Verifier Zero-Knowledge.
Proof. (Sketch.) We maintain the notation of Section 5.2. We construct a simulator as follows. The simulator generates the isogeny S(EA ) = σ : EA → E2 , auniformly random isogeny φ̂ : E2 → E1 of degree Dc , and outputs (E1 , φ, E2 , σ).
We now argue that transcripts constructed by the simulator are computationallyindistinguishable from real transcripts. First, observe that in the real transcript
all curves are nearly uniformly distributed, as long as Dc and the degree of ψ
are chosen large enough. This is due to the Ramanujan property of the supersingular isogeny graphs. With our assumption on S, the distribution of E2 is(computationally) indistinguishable from the real one. The “challenge” ϕ is arandom isogeny of degree Dc , so it is identically distributed in both the real andsimulated transcripts; and thus so is the curve E1 .
It remains to prove that the “response” isogeny σ and its real counterpart
cannot be efficiently distinguished. This stems directly from our assumption on
S and the definition of DEA .

5.5.2

On the distribution of signatures

The goal of this section is to understand the distribution of the isogenies σobtained from J = SigningKLPT2e (I, Iτ ). With Lemma 5.5.2, we will see thatany such σ is the push-forward through the secret isogeny τ of some otherisogeny ι. From the proof of Lemma 5.5.2, it appears that ι lies in a specific
set of isogenies: the set PNτ from Definition 5.5.4. This fact is obvious from
Lemma 5.5.2 and the definition of PNτ (which closely follows SigningKLPT).
What is less trivial is that any element of PNτ is a possible output of ouralgorithm, and that this set can be entirely computed from the knowledge of Nτ .
We will prove this in Proposition 5.5.5, and use it to state Problem 5.5.6 as our
security assumption.
Figure 5.3 represents the isogenies involved in the proof of Lemma 5.5.2.
The isogenies and curves that are public are highlighted in bold.
Lemma 5.5.2. Let L ⊂ O and β ∈ L be as in Steps 2 and 9, respectively, ofSigningKLPT. The isogeny σ corresponding to the output J of SigningKLPT2e
is equal to σ = [τ ]∗ ι, where ι is an isogeny of degree 2e verifying β = ι̂ ◦ φL .

140

γN

µ

γℓ

φL

E0

N -isogenies

γℓ L

EL

E3

τ

ℓ-isogeniesµLNτ -isogenies

ιpublic isogenies[ι]∗ τ

EA

E0

public curves

γℓ τ
E4

E2
µτ

σ = [τ ]∗ ι
Figure 5.3: Analysis of the output of SigningKLPT under the Deuring correspondence
Proof. The endomorphism γ can be decomposed as γN ◦ γℓ and then β = γµ =γN ◦ γℓ ◦ µ. Since β ∈ L, it can be rewritten as γℓ L ◦ µL ◦ φL if we compose
the other way, where γℓ L ◦ µL = [φL ]∗ γℓ ◦ µ. Thus, we see that ι is defined
to be the dual of γℓ L ◦ µL . Finally, σ is the image under τ of ι. We have thedecomposition σ = [τ ]∗ ι = µτ ◦ γℓ τ . Note that, equivalently, σ can also be seenas the image under τ ◦ γN of the dual of γℓ ◦ ν.
To show that ι lies in a public set PNτ , we need to understand the exact link
between τ and ι. It is clear that L is strongly related to ι as β = ι̂ ◦ φL . Hence,the codomain of ι is determined by the class of L in Cl(O0 ). This underlies thedefinition of PNτ as the union of subsets UL,Nτ indexed by all possible L (seeDefinition 5.5.4).
Remark 5.5.3. In Proposition 5.3.3, we saw that L lies among at most Nτ + 1
possible values for a given input I. Each such L is uniquely determined by theclass of K (with respect to ∼Oτ ) computed in Step 1 of Algorithm 33. In thissense, it would be more natural to divide outputs according to the classes of
ClOτ (O). However, from this point of view, it is less clear that the set PNτ isindependent of τ . As argued in Remark 5.3.4, this number is exactly Nτ + 1
with an overwhelming probability. To simplify the remaining statements, wewill suppose that we are in this likely case.
Suppose we have chosen a class for L among the Nτ +1 candidates. We want
to determine how the rest of the computation follows from this initial choice.
We take a random e0 ∈ e0 (N ).
During Step 3, we compute γ. It is clear that N = n(L) and the value e0
uniquely determines the distribution of outputs for FullRepresentIntegerN D(ℓe0 )(see Algorithm 2). Then, the projective pair (C0 : D0 ) only depends on L and141

γ. We have proved in Corollary 3.3.2 that the projective pair (C1 : D1 ) did
not depend on the actual value of δ, so it is also uniquely determined by the
choice of class for K (and thus of L) and γ. The rest of the computation isdeterministic from there (up to failures that imply picking another γ).
We are now ready to characterize the set of possible outputs of SigningKLPT.
For a given L of norm N , we consider UL,Nτ as the set of all isogenies ιcomputed as in Lemma 5.5.2 from elements β = γµ ∈ L where e0 is a random element in e0 (N ), γ is a random output of FullRepresentIntegerN D(ℓe0 ) andµ = (C + ωD)j where p(C 2 + D2 )ℓe1 (N,Nτ ) is a quadratic residue modN Nτ
and where C = CRTN,Nτ (C0 , C1 ), D = CRTN,Nτ (D0 , D1 ) where (C0 : D0 ) =IdealModConstraint(L, γ) and (C1 : D1 ) is a random element of P1 (Z/Nτ Z).
For an equivalence class C in Cl(O0 ) we write UC,Nτ for UL,Nτ where L =EquivalentPrimeIdeal(C).
S
Definition 5.5.4. PNτ = C∈Cl(O0 ) UC,NτWith the next proposition we show that our definition of PNτ is the right
one as it accounts for all the output of Algorithm 33.
Proposition 5.5.5. The set PNτ from Definition 5.5.4 can be computed fromthe sole knowledge of Nτ . The set {J, J = [Iτ ]∗ Iι , ι ∈ PNτ } is exactly the set of
outputs SigningKLPT2e (I, Iτ ) as I runs over the non-trivial classes in Cl(O).
Proof. The first point follows directly from Definition 5.5.4. From the definition,
it is clear that each UC,Nτ can be computed from L = EquivalentPrimeIdeal(C)and Nτ . With Lemma 5.5.2 and comparing the definition of the UL,Nτ withthe steps of Algorithm 33 we see that its outputs are all contained in {J, J =[Iτ ]∗ Iι , ι ∈ PNτ }. To conclude the proof, we need to show that for any element J of this set, there exists an ideal I and an execution of Algorithm 33
such that SigningKLPT2e (I, Iτ ) = J. We write β = γµ corresponding toι ∈ UL,Nτ for L ∼ Iι . For such a J, any I ∼ J can work as input as aconsequence of Lemma 5.3.2. From Proposition 5.3.3, we know there exists
K and a random input leading to K = RandomEquivalentEichlerIdeal(I) with[Iτ ]∗ K ∼Oτ χL (β) during the execution of Step 1. We can obtain γ as theoutput of FullRepresentIntegerN M(ℓe0 ) by definition of γ. Because of Corollary 3.3.2, we see that the elements C and D obtained in the execution of
Algorithm 33 are in the same classes as the elements C ′ , D′ used in the computation of µ = FullStrongApproximation(N Nτ , C ′ , D′ ) in the definition of PNτ .
Hence, we obtain the same element β ∈ L, and we have just described an execution of Algorithm 33 that led to the output J precisely.

5.5.3

Hardness Assumption for Zero-Knowledge

In this section, we present the hardness assumption on which the zero-knowledge
property relies. We would like to show that the output of SigningKLPT cannot
be linked to any isogeny from E0 to EA , and more specifically τ . The formulation of Problem 5.5.6 is suggested by the results introduced in Lemma 5.5.2 andProposition 5.5.5 where we showed that the signature isogeny σ is the image
under τ of an isogeny ι lying in some public set of isogenies PNτ (see Definition 5.5.4).
Recall that isog(D, j(E)) is the set of cyclic isogenies of degree D whose
domain is a curve inside the isomorphism class of E. When P is a subset of142isog(D, j(E)) and τ : E → E ′ is an isogeny with gcd(deg τ, D) = 1, we write[τ ]∗ P for the subset {[τ ]∗ ϕ | ϕ ∈ P} of isog(D, j(E ′ )). Finally, we let K denotea probability distribution on the set of cyclic isogenies whose domain is E0 ,representing the distribution of SQISign private keys. With these notations, wedefine the following computational problem:
Problem 5.5.6. Let p be a prime, and D a smooth integer. Let τ : E0 → EA bea random isogeny drawn from K, and let Nτ be its degree. Let PNτ ⊂ isog(D, j0 )as in Definition 5.5.4, and let O be an oracle sampling random elements in[τ ]∗ PNτ . Let σ : EA → ⋆ be of degree D where either
1. σ is uniformly random in isog(D, j(EA ));2. σ is uniformly random in [τ ]∗ PNτ .
The problem is: given p, D, K, EA , σ, to distinguish between the two cases witha polynomial number of queries to O.
We will assume that Problem 5.5.6 cannot be solved with non-negligible advantage by any polynomial time adversary. In Section 5.6 we briefly discuss
several potential attack strategies; however, given current knowledge, no strategy seems better than direct key recovery, computing τ from the knowledge of
EA only.
Remark 5.5.7. To ensure the hardness of Problem 5.5.6, the size of the family
PNτ used in Proposition 5.5.5 must be exponential in the security parameter.
With PNτ from Definition 5.5.4, we have that |PNτ | = Θ̃(pNτ ) (UPHA). Indeed,following the analysis of Section 5.5.2, there are Θ(Nτ ) elements resulting froma given pair (L, γ) (the maximal number of possibilities is Nτ + 1, and there isa constant probability that each element meets the quadratic residuosity condition). There are #Cl(O0 ) = Θ(p) possible L and x = O(log(p)) = Θ̃(1) possible
γ (following the choice for e0 (N ) made in Remark 5.3.6 and Remark 5.3.7).
Remark 5.5.8. Here we formulated the security assumption of SQISign instantiated on top of SigningKLPT. Variants of Algorithm 33 would entail different
families PNτ in the definition of Problem 5.5.6. We argue in Section 5.6 that any
secure instantiation requires |PNτ | to be exponential in the security parameter
for any Nτ but that this condition is not sufficient.
Proposition 5.5.10 shows the security reduction to Problem 5.5.6. The proof
relies on several heuristic assumptions. First, we need the heuristics behind
Proposition 5.3.5 to prove that, for the chosen degree D = 2e , SigningKLPT2eterminates in polynomial time.
Proposition 5.5.5 is not enough to prove Proposition 5.5.10: we need some
information on the distribution of the outputs of Algorithm 33 over PNτ . We
will prove in Lemma 5.5.9 that when the input is uniformly distributed over
Cl(O), the output distribution of SigningKLPT is statistically close to the uniform distribution on the set of possible outputs. This result is obtained with
one new assumption:
Assumption 1. The distribution of classes obtained by taking the classes of
the ideals Iι corresponding to ι ∈ PNτ is statistically close to the uniform
distribution on ClOτ (O0 ).

143Lemma 5.5.9. (UPHA) The outputs of Algorithm 33, given uniformly distributed inputs, are distributed in a manner statistically indistinguishable fromthe uniform distribution on {J, J = [Iτ ]∗ Iι , ι ∈ PNτ }.
Proof. First, with Proposition 5.3.5, we showed UPHA that we can find an
output of the correct degree. By Proposition 5.5.5, it lies in {J, J = [Iτ ]∗ Iι , ι ∈PNτ }. From Lemma 5.3.1, we see that K lies in a uniformly random classof ClOτ (O) and so is K ′ in ClOτ (O0 ). Once this class is fixed, the output is
uniquely determined by the choice of γ. During Step 3, a random γ is selected.
Repeating until the quadratic condition of Step 6 is met, we find a uniformly
random solution among the elements in PNτ contained in that equivalence class.
By Assumption 1, this is statistically indistinguishable from a uniformly random
element of {J, J = [Iτ ]∗ Iι , ι ∈ PNτ }.
Under Lemma 5.5.1, the next proposition shows that Zero-Knowledge security reduces to Problem 5.5.6.
Proposition 5.5.10. (UPHA) When SQISign is instantiated with SigningKLPTD , distinguishing between DEA and the uniform distribution on isog(D, j(EA )reduces to Problem 5.5.6.
Proof. We will show that we can construct a distinguisher for Problem 5.5.6 froma distinguisher between DEA and the uniform distribution on isog(D, j(EA )).
When SigningKLPT is used to compute σ, the distribution DEA is statisticallyindistinguishable from the distribution of isogenies corresponding, through the
Deuring correspondence, to the output of SigningKLPTD upon input (Iτ , I),
where I lies in a uniformly random class of Cl(O) and Iτ is computed from thesecret key as an ideal corresponding to an isogeny between E0 and EA . Recall
that the distribution of E2 is nearly uniform, so the distribution of the class of I
in the real execution is statistically close to the uniform distribution.
Clearly, the two distinguishers have compatible inputs. To prove the reduction, we have to show that the input distributions are statistically indistinguishable. Recall that for both problems there are two possible cases: either theisogeny is uniformly random of degree D or it has a special form. In the firstcase, the two problems clearly share the same input distribution. The secondcase is covered by Lemma 5.5.9.

5.6

Cryptanalysis

In this section we study the hardness of Problem 5.5.6, the assumption behind
SQISign’s security introduced in Section 5.5. This problem is parameterized bya family of isogenies PNτ . In Section 5.6.1, we start by looking at Problem 5.5.6
without any specific instantiation of PNτ (we will only make assumptions on
their size). Then, in Section 5.6.2, we study the case where a specific property
verified by the family PNτ might prove useful to break Problem 5.5.6, before
trying to argue that our concrete family PNτ from Definition 5.5.4 does notverify such a problematic property.

5.6.1

Cryptanalysis for generic families of PNτ

We introduce below several variants of Problem 5.5.6 (Problems 5.6.1, 5.6.3
and 5.6.4), which we obtain by modifying the size of PNτ and the range of144

possible values Nτ . We show that the first two problems can be solved efficiently,
but argue that existing cryptanalysis techniques fall short for the last one.
A first important remark is that since PNτ can be computed without theknowledge of τ , we do not have to worry about σ having problematic properties
such as revealing a path from EA to a special curve E (hence revealing critical information). This could happen, of course, but it cannot be more thanan unlucky coincidence: the density of special curves is low in the set of all
supersingular curves, so this event will only happen with negligible probability. Thus, to produce an effective distinguisher, an adversary has to exploit the
information that σ is the image under τ of an element of the public set PNτ .
In Problem 5.6.1, we assume that the value of Nτ is fixed and publicly known,
and we impose the constraint that the size of PNτ is polynomial in the security
parameter λ.
Problem 5.6.1. Let p be a prime and D be a smooth number, let Bτ be apositive integer and let Nτ be a prime smaller than Bτ coprime to D. Let EA
be a supersingular curve for which there exists τ : E0 → EA of degree Nτ . Let
PNτ ⊂ isog(D, j0 ) be a subset of size polynomial in λ and O an oracle sampling
random elements in [τ ]∗ PNτ . Let σ : EA → ⋆ be of degree D, where either
1. σ is a uniformly random isogeny of degree D starting from EA .
2. σ is a uniformly random element of [τ ]∗ PNτ .
The problem is: to distinguish between these two cases with a polynomial numberof calls to O.
This problem can be easily solved due to the small size of PNτ . Indeed, thenumber of isogenies in [τ ]∗ PNτ being polynomially bounded implies that we canenumerate them all with a polynomial number of calls. Once the list is made,distinguishing is easy.
Even though the problem is already broken, let us also study the prospectsof key recovery; this will prove useful for the rest of this section. In fact, thesetting of Problem 5.6.1 might allow efficient key recovery. The precise analysis
is somewhat tedious, so we do not prove formally that this attack succeeds inpolynomial time; rather, we sketch a brief outline and argue why it appears to
be troublesome. If σ is the image of ι ∈ PNτ under τ , then its kernel is theimage of the kernel of ι. In [Pet17], an attack on SIDH is devised using similar
information (the action of the secret isogeny on some torsion group). Namely,
if Nτ is smaller than a certain bound (depending on D), then this could allow
an adversary to recover τ . The actual parameters in our scheme are of the sizethat are troublesome for such an attack, where the degree of σ is much greaterthan Nτ . With the estimates from Proposition 5.3.5, we see that D ∼ Nτ9 in
the generic case and this is enough for the attack of [Pet17] (that was recently
improved in [KMP+ 20]).
Remark 5.6.2. The torsion point attack that we mention above is at the heartof the encryption scheme Séta introduced in Chapter 6.
Also note that the fact that Nτ is public allows one to improve the bruteforce key recovery attack. Indeed, in this case there are only O(Nτ ) possible
secret isogenies. Therefore, as mentioned in Section 5.3.2, the brute-force attack
can be performed in Θ(Bτ ).
145

In Problem 5.6.3 we look at a modified version of Problem 5.6.1 where weremove the assumption that Nτ is public.
Problem 5.6.3. Let p be a prime, D a smooth number and Bτ a positive
integer. Let EA be a supersingular curve for which there exists τ : E0 → EA
of prime degree Nτ with Nτ ≤ Bτ . Let PNτ ⊂ IsoD,j0 be a family of subsets
indexed by Nτ of size polynomial in λ, and Oτ an oracle sampling random
elements in [τ ]∗ PNτ . Let σ : EA → ⋆ be of degree D, where either
1. σ is a uniformly random isogeny of degree D starting from EA .
2. σ is a uniformly random element of [τ ]∗ PNτ .
The problem is: to distinguish between the two cases with a polynomial numberof calls to Oτ .
For the same reasons as for Problem 5.6.1, we can easily produce a distinguisher for Problem 5.6.3. Indeed, even if the exact Nτ is unknown, there is still
only one valid value and so [τ ]∗ PNτ has polynomial size. Just as before, we canget it entirely by querying the oracle (we do not even have to know which Nτ
was used for this), so the problem is easy. A brute-force attack to recover the
key will now cost Θ(Bτ2 ), as we are back in the case described in Section 5.3.2.
The torsion attack of [Pet17] can no longer be applied, as it requires theknowledge of the exact value of Nτ . However, we may still try to perform
it on all possible Nτ until one works. This yields an attack in Θ(Bτ ). For
Problem 5.6.4 we go back to the case where Nτ is public, but this time PNτ has
exponential size with respect to the security parameter.
Problem 5.6.4. Let p be a prime and D be a smooth number, let Bτ be apositive integer and let Nτ be a prime smaller than Bτ coprime to D. Let EA
be a supersingular curve for which there exists τ : E0 → EA of degree Nτ (notprovided as input). Let PNτ ⊂ IsoD,j0 be a family of subsets indexed by Nτ andlet Oτ be an oracle sampling random elements in [τ ]∗ PNτ . Let σ : EA → ⋆ beof degree D, where either
1. σ is a uniformly random isogeny of degree D starting from EA .
2. σ is a uniformly random element of [τ ]∗ PNτ .
The problem is: to distinguish between the two cases with a polynomial numberof calls to Oτ .
In this case, as with Problem 5.6.1, the brute-force key recovery attack isin Θ(Bτ ). It is not clear that we can exploit the information provided by σ tohelp with key recovery. In particular, the potential key recovery attack against
Problem 5.6.1 appears difficult to apply in this setting: the set PNτ is too large
to efficiently identify a possible preimage for ker σ. We are reduced to trying all
possible values for ker[τ ]∗ σ, which takes too long. In full generality, the calls tothe oracles appear to be difficult to exploit. Indeed, enumerating all possibilities
is out of the question, and it seems difficult to exploit anything else.
From the analysis above, it appears that having a secret Nτ is important toprevent efficient attacks for key recovery, while having PNτ of large size is theimportant feature for guaranteeing the hardness of the distinguishing problem.
As argued in Remark 5.5.7, our family PNτ from Definition 5.5.4 is large enough.
146

5.6.2

Exploiting the specific properties of PNτ

In this section, we focus concretely on the family PNτ defined in Definition 5.5.4
and used for the security of our signature scheme. In particular, we will study
one way to build a distinguisher against Problem 5.5.6 assuming a hypotheticalspecial property of the family PNτ . We will show that there exists a family ofisogenies, very closely related to our PNτ , that suffers from this weakness. Then,we will argue why the family from Definition 5.5.4 does not suffer from the sameproblem, and we will present experimental evidence to confirm our reasoning. In
fact, the problematic family for which there is an easy distinguisher was the oneused in the original SQISign paper [DFKL+ 20]. We later realized that there wasa problem and a fix was proposed in [DFLW22]. In SigningKLPT, we presented
the secure version and not the original variant from [DFKL+ 20].
A generic distinguisher using the first part of the walk. Let us assume that there exists an integer D1 dividing D and polynomial in the security
parameter such that for Nτ there is a cyclic isogeny of degree D1 from E0
which is not in IτD1 = {ι1 of degree D1 , ∃ι2 , ι2 ◦ ι1 ∈ PNτ }. Then the set{σ1 of degree D1 , ∃σ2 , σ2 ◦ σ1 ∈ [τ ]∗ PNτ } similarly misses some isogenies ofdegree D1 from EA . When D1 is small (polynomial), we can enumerate all D1
isogenies in polynomial time and use that to build a polynomial-time distinguisher.
Short of exploiting similar properties that allow one to construct a distinguishing criterion based on the study of a small, specific part of σ, Problem 5.5.6
seems computationally hard. For instance, if the family PNτ satisfied the criterion above but only for D1 exponential in the security parameter, it is unclearthat a distinguisher could be built from this knowledge.
A distinguisher against a modified version of the protocol. If we consider a modified version of SigningKLPT where FullRepresentInteger is replaced
by RepresentInteger in Step 3, then the resulting family PNτ suffers from the badproperty we described above. In that setting, our distinguisher for Problem 5.5.6
is a consequence of the limitations pointed out in Section 3.1.3, because we takeD to be a power of 2. Lemma 5.6.5 and the resulting Proposition 5.6.6 link theobservations of Section 3.1.3 to a property of the set [τ ]∗ PNτ .
Lemma 5.6.5. Let L be an O0 -ideal of norm N and let γ be an element in
O0 of norm N ℓe for some prime N . Take µ ∈ O0 such that β = γµ ∈ L. Ifγ ∈ ⟨1, i, j, k⟩, then χL (β) ⊂ O0 ⟨1 + i, 2⟩.
Proof. We have γ ∈ ⟨1, i, j, k⟩ ⊂ O0 ⟨1 + i, 2⟩. Now, χL (β) = O0 ⟨µγ, 2e ⟩, hence,µγ ∈ O0 γ ⊆ O0 ⟨1 + i, 2⟩ = O0 ⟨1 + i, 2⟩, which proves the lemma.
Proposition 5.6.6. Let D = 2e and τ, Nτ be as in Problem 5.5.6, and let the set
PNτ be defined by a modified version of SigningKLPT where FullRepresentInteger
has been replaced by RepresentInteger. There exists an isogeny ι0 ∈ isog(2, j(E0 ))such that every ι ∈ PNτ can be decomposed as ι = ι1 ◦ ι0 , where ι1 is an isogenyof degree 2e−1 .
Proof. Let J be the ideal corresponding to σ ∈ [τ ]∗ PNτ . By the definition of
PNτ , ι corresponds to the ideal χL (γµ). It is easily verified that L, γ, µ satisfy

147the requirements of Lemma 5.6.5 and that γ ∈ ⟨1, i, j, k⟩ since it is a possible
output of RepresentIntegerO0 . Thus, we can apply Lemma 5.6.5 and we get that
χL (β) ⊂ O0 ⟨1 + i, 2⟩. This proves the result by taking ι0 to be the isogeny
corresponding to the ideal O0 ⟨1 + i, 2⟩.
Proposition 5.6.6 implies that, when defined as in Definition 5.5.4, the family
PNτ satisfies the special property introduced above. Indeed, we obtain thatIτ1 = {ι1 of degree 2 s.t ∃ι2 , ι2 ◦ ι1 ∈ PNτ } has size 1 (instead of 3), and so a
trivial distinguisher can be built against Problem 5.5.6 simply by looking at the
distribution of the first step of σ.
A fix against the attack. To block the distinguisher, the solution is to use
FullRepresentInteger and not RepresentInteger, which is what we do in SigningKLPT. FullRepresentInteger was designed specifically to produce solutions γthat were not necessarily contained in ⟨1, i, j, k⟩. If γ = (x′ + y ′ i + z ′ j + t′ k)/2
then it is easy to see that γ ̸∈ ⟨1, i, j, k⟩ as soon as (x′ , y ′ , z ′ , t′ ) ̸= (0, 0, 0, 0)
mod 2. Our analysis at the end of Section 3.1.3 showed that there were 4
possible configurations for (x′ , y ′ , z ′ , t′ ) mod 2, and each can be obtained whenthe value of m′ is greater than 1 (which we may assume). The reasoning above
justifies that #Iτ1 > 1 but not that it reaches the desired value of 3. Let us write
I1 , I2 for the two other O0 ideals of norm 2. It can be verified that I1 = I2 i.
Since (x′ + y ′ i + z ′ j + t′ k)i = −y ′ + x′ i + t′ j − z ′ k, it is easy to see that if some
outputs of FullRepresentInteger are contained in I1 , then the same must be true
for I2 (and conversely). This proves that #Iτ1 = 3, i.e., all three first steps are
possible. Yet there could still be a bias in the distribution of that step, which
would still give rise to an attack on Problem 5.5.6. We argue below that there
is no such exploitable bias.
Further analysis on the first steps of the response isogeny. We continue the analysis by looking at what happens beyond the first 2-isogeny ofthe elements ι ∈ PNτ . For any k ∈ N smaller than e, we define πk : ι 7→ ιkwhere ιk is the unique isogeny of degree 2k such that ι = ι′ ◦ ιk . We will
study the sets Iτk = πk (PNτ ). We will start by trying to estimate #Iτk for values of k ≈ 1/2 log(p). Our analysis culminates in Proposition 5.6.8, which we
prove under several plausible assumptions. Even though this does not provethat Problem 5.5.6 is hard, showing that #Iτk is exponential in the security
parameter rules out several possible attacks.
A truly meaningful result would be to show that the distribution Dτk of theπk (ι) when ι is uniformly random in PNτ is indistinguishable from the uniform
distribution on the isogenies of degree 2k . At the end of this section, we will try
to argue that Dτk is not biased when k is small. The results we obtain are notvery formal, but we back them up with experiments.
The size of Iτk . Our goal is to show that Iτk contains a good portion of theisogenies of degree 2k for values of k ≈ p1/2 . Our final result is stated in
Proposition 5.6.8 and basically follows from the fact that the isogenies of Iτkonly depend on the quaternion element γ of norm N ℓe0 when k ≤ e0 (thisfact follows from the analysis underlying Lemma 5.5.2). We recall that in thedefinition of PNτ , γ is a possible output of FullRepresentInteger such that theend of the computation in SigningKLPT terminates.
148

One of the main ingredients of our proof is a result (stated as Proposition 5.6.7) on the number of γ of norm M that can be obtained as output of
FullRepresentInteger. We use the notation ΓM for the set of primitive γ ∈ O0 of
norm M .
Proposition 5.6.7. (UPHA) Let M > p. Under plausible heuristics, there
exists a constant c1 > 0 such that the number of γ ∈ ΓM that are possible
outputs of FullRepresentInteger{M } is larger than #ΓM c1 / log(M ).
Proof. Let 2γ = x′ + iy ′ + jz ′ + kt′ and M ′ = 4M − p(fO (z ′ , t′ )). Given therequirements of Cornacchia, γ is going to be an admissible output if and only
if M ′ is a near-prime and the pair (z ′ , t′ ) can be sampled during the first two
steps of Algorithm 8. For (z ′ , t′ ) it is easy to verify that this is the case. Indeed,
the value of |z ′ | must be smaller than 2m. Thus, there is a possibility that
this value is picked. After that, we know that the correct value of |t′ | mustbe smaller than m′ , and so there is also a possibility that the correct value ispicked. Then, under the assumption that M ′ behaves as a normal integer of thesame size, we get that there exists a constant c1 such that a fraction c1 / log(M )of all the M ′ are near-primes. Thus, the same fraction of γ are possible outputsof FullRepresentInteger, and this concludes the proof.
Proposition 5.6.8. (UPHA) Let η0 be as in Remark 3.2.4, and η1 as in Remark 5.3.7. Let us take ε > 1 + 2η0 and e0 (N ) as in Proposition 5.3.5. If
k ∈ [ log(p)+ η0 + η1 , log(p)− η0 + η1 + ε], then there exists a constant c > 0 such2
2
that#Iτk ≥ c · 2 · 3k−1 /(log(p) + ε).
Proof. First note that the constraint ε > 1 + 2η0 ensures that the interval[ log(p)+ η0 + η1 , log(p)− η0 + η1 + ε] is not empty.
2
2
Let φ be an isogeny of degree 2k . We write Iφ for the corresponding ideal andLφ = EquivalentPrimeIdeal(Iφ ), Nφ = n(Lφ ). There exists a quaternion element
γφ of norm Nφ 2k such that O0 γφ = Iφ · Lφ . It can be easily verified that φ ∈ Iτkif and only γφ is in the set Γτ of possible γ involved in the definition of PNτ .
For γφ to be in Γτ , we need to verify the following things: k ∈ e0 (Nφ ), γφ isa possible output of FullRepresentInteger{Nφ 2k } and the rest of the computationof SigningKLPT (Step 4 to Step 7) must succeed from γφ .
From Lemma 3.2.3, we get that log(Nφ ) ∈ [log(p)/2 − η0 , log(p)/2 + η0 ]. If
we apply that to the definition of e0 (Nφ ) from Proposition 5.3.5, we get that kmust be in e0 (Nφ ) with overwhelming probability. Then, if we assume that γφis distributed correctly over the ΓNφ 2k , Proposition 5.6.7 tells us there exists a
constant c2 > 0 such that more than a fraction c2 /(log(p) + ε) of the γφ will bepossible outputs of FullRepresentInteger. Finally, we can make the assumptionthat a constant fraction of those γφ will lead to a successful computation of
Step 4 to Step 7 in SigningKLPT. Thus, we obtain that there exists someconstant c > 0 such that a fraction greater than c/(log(p) + ε) of all the γφ arecontained in Γτ , and we can conclude the proof.
Proposition 5.6.8 rules out distinguishing attacks by counting the elementsin Iτk , which is necessary for security, as explained in Section 5.6.1. To fully ruleout simple distinguishers, we need to understand the distribution Dτk .

149

4,000

2,000

3,000

1,500

2,000

1,000

1,000

500

0

0

1,200
1,000
800
600
400
200

1

2

(a) k = 1

3

0
1

2

3

4

5

6

(b) k = 2

1 2 3 4 5 6 7 8 9 10 11 12(c) k = 3

Figure 5.4: Distribution of the k first steps of σ for 10 SQISign keys and random
input ideal over 1000 attempts.
The distribution Dτk . Biased distributions Dτk , especially for small values ofk, can be easily detected; this would break Problem 5.5.6. Once again, our analysis focuses on the quaternion element γ. Under the Deuring correspondence,
any bias on the distribution Dτk is a consequence of a bias on the distribution ofO0 ⟨γ, ℓk ⟩ among the ideals of norm 2k . If 2γ = x + yi + zj + tk for x, y, z, t ∈ Z,
it can be shown that O0 ⟨γ, ℓk ⟩ depends on the values of (x, y, z, t) mod (2ℓk ).
It is easy to see that the values of z, t are sampled without any bias mod (2ℓk )when m′ , m′′ are big enough compared to ℓk (which we may assume since welook at small values of k). After that, we can only argue informally that thenear-primality condition on M − pf (z, t) should not introduce any bias on thevalue of z, t mod 2 · ℓk . It also seems plausible that the output of Cornacchia on
random near-prime inputs of a given size should not skew the distribution of x, y
but we cannot really prove it. Short of proving a positive result, we can at least
point out that our formulation of FullRepresentInteger avoids several pitfalls thatwould have led to a noticeable bias. The two examples that we give below arefocused on the case ℓ = 2 and k = 1. Both can be verified easily with small
experiments. When ℓ = 2, one might be tempted to allow the computation
to succeed even when the condition x′ = t′ mod 2 and y ′ = z ′ mod 2 is not
met. In the end, if M = N · 2e0 , then x′ + y ′ i + z ′ j + t′ k has norm N · 22+e0
and might be a suitable solution for the rest of the computation. However, thiswould result in a strong bias in the distribution of isogenies in Iτ1 , as it would
favor elements in ⟨1, i, j, k⟩ that are contained inside O0 ⟨1 + i, 2⟩. A skewed
distribution is also the explanation behind Remark 3.1.9. When swapping x′ , y ′to satisfy x′ = t′ mod 2 and y ′ = z ′ mod 2, one increases the chances that(x′ , y ′ , z ′ , t′ ) mod 2 ∈ ⟨(1, 0, 0, 1), (0, 1, 1, 0)⟩ and thus modifies the distributionDτ1 .
Experimental evidence. Figure 5.4 presents the result of an experimentstudying the distributions Dτk for small values of k. The results are consistent
with our informal analysis.

5.7

Improvement perspectives

The complexity of our signature scheme entails several choices for instantiation,some of which might differ critically from the solutions we described. We havealready described several ideas, but it is hard to find the optimal choices in the150

various tradeoffs that arise, so there are probably a lot of potential improvements.
Among the critical points for improvement are the norm equations algorithms presented in Chapter 3. The problem lies not in the efficiency of thesealgorithms in themselves, but in the size of the solutions. We have shown how
much the difference in size between the outputs of KLPT and SpecialEichlerNorm
can impact the performances of our schemes by allowing us to select better
primes. Given that all those algorithms are using the same building blocks, it isour hope that an improvement for one of them would result in an improvement
for all of them. This would allow us to improve upon every aspect of the signature computation. For instance, a smaller output to SigningKLPT would meana shorter signature and also a faster ideal to isogeny translation. But a smaller
output of KLPT would also mean faster executions of IdealToIsogenySmallFromKLPT. In the end, this would yield a huge improvement of the overall efficiencyof the signature computation. Given the improvement we obtained by switchingfrom IdealToIsogenyFromKLPT to IdealToIsogenyFromEichler, one might wonder
if we cannot find other ways to obtain faster algorithms for the translation.
Finally, there is still a lot of work to do on parameter selection.

151

Chapter 6

Encryption: SETA
In this chapter, we present SETA (short for Supersingular Encryption from
Torsion Attack) or Séta1 , a new isogeny-based encryption scheme. The content of this chapter is for all practical purpose identical to the paper “SETA:Supersingular Encryption from Torsion Attacks” authored jointly with L. De
Feo, C. Delpech de Saint Guilhem, T. B. Fouotsa, P. Kutas, C. Petit, J. Silva
and B. Wesolowski [DFFdSG+ 21]. At the end of this chapter, we introduce the“Uber” Isogeny problem, a new generic computational problem that is linked
with various known isogeny problems.
The construction that we will present in Section 6.2 relies on some results
originally published by C. Petit [Pet17] targeting the cryptanalysis of the key
exchange SIDH [JD11] and later improved in [QKL+ 21].

6.1

Preliminaries

In this section, we present several useful preliminaries for the content of thischapter. In particular, we introduce SIDH and CSIDH, two key exchanges
that are behind the two main families of schemes based on isogenies. Our
new protocol Séta is related to SIDH because its key mechanism is inspired by
an attack against SIDH that we present in Section 6.1.3. There is no direct
link between Séta and CSIDH, but our “Uber” isogeny problem introduced in
Section 6.5 is directly inspired by the group action framework of CSIDH.

6.1.1

The SIDH key exchange

The SIDH (short for Supersingular Isogeny Diffie-Hellman) key exchange wasintroduced in 2011 by De Feo and Jao [JD11]. It was one of the first scheme
based on isogenies between supersingular curves. To this day, it remains one of
the most promising protocols in isogeny-based cryptography. It is very compact,
and very efficient compared to every other protocol based on isogenies. SIKE
[ACC+ 20], the candidate representing isogenies in the NIST post-quantum competition, is derived from SIDH. The NIST has ranked it among the third-roundalternate candidates in its post-quantum competition.
1 which means “walk” in Hungarian

152

φA

EA

[φA ]∗ φB

E0

E
φB

EB

[φB ]∗ φA

Figure 6.1: SIDH-isogeny diagram.
The idea of SIDH is the following: given a common starting curve E0 , thetwo participants, Alice and Bob, generate isogenies φA , φB of degree NA , NB
with gcd(NA , NB ) = 1. Their public keys are the curves EA , EB , together withadditional pieces of information, to make possible the computation of the two
push-forward isogenies [φA ]∗ φB and [φB ]∗ φA depicted in Figure 6.1. We havealready explained in Section 1.1.2 that the codomains of these push-forward
isogenies are isomorphic. Thus, Alice and Bob can derive a common key as j(E).
In the case of SIDH the degrees are powers of two small primes ℓA , ℓB , whichmakes isogeny computations efficient from the kernels if the NA , NB torsion isdefined over Fp2 . To ensure that, we take a prime p with p = f NA NB ± 1. Moreprecisely, to compute the push-forwards we apply the formulas ker[φA ]∗ φB =φA (ker φB ) and this is why Alice’s SIDH public key is the curve EA together
with φA (PB ), φA (QB ) where ⟨PB , QB ⟩ = E0 [NB ] (and the reverse for Bob’s).
Because of the additional torsion points that Alice and Bob need to include
in their public keys, the problem behind the security of SIDH is not the SIP(Problem 6.5.7) but the CSSI presented as Problem 6.1.1 and its decisionalvariants. In fact, the CSSI is the SIDH key recovery problem but the decisionalvariant is the one underlying the security of the key exchange.
Problem 6.1.1. (CSSI) Let ℓA , ℓB be two distinct small prime numbers andNA = ℓeAA , NB = ℓeBB for some exponents eA , eB . Let φA : E0 → EA be an
isogeny whose kernel of degree NA . Given EA and the values φA (PB ), φA (QB )for PB , QB a basis of E0 [NB ] find a generator RA of ker φA .
Remark 6.1.2. In Problem 6.1.1, the starting curve E0 is fixed. In particular,
in some cases its endomorphism ring may be known. In Section 6.1.3, we willconsider the SSI-T, a generalization of the CSSI where the domain and codomain
can be any supersingular curves.
Remark 6.1.3. The most promising attacks against SIDH are really targeting
the CSSI and not the SIP in the sense that the additional torsion information
are often at the heart of the attack. This is the case with the torsion point
attacks that we present in Section 6.1.3.

6.1.2

The CSIDH key exchange

CSIDH (Commutative SIDH) is an alternative key exchange protocol introduced
in [CLM+ 18]. It is based on the group action induced by the class group of√Z[ −p] on the curves of EZ[√−p](p) (see Section 2.4 for the definition of this group
action). Since the class group is abelian we obtain naturally the commutative
diagram depicted in Figure 6.2. Despite the similarities between Figure 6.1 and
153

φE
a

Ea

a
φE
b

E0

E
φE
b

Eb

b
φE
a

Figure 6.2: CSIDH-isogeny diagram.
Figure 6.2, the isogenies involved are not the same and are not computed in thesame manner at all.
√Let us write O = Z[ −p]. It is easy to show that EO (p) = S(p)∩Fp . Indeed,
when the curve is defined over Fp , the p-power Frobenius π is an endomorphism√of the curve, and so the embedding of O is obtained by identifying π with −pand the scalars in Z with the scalar multiplication morphism. For any ideal aand curve E ∈ EO (p), the action a ⋆ E is realized through an isogeny φE
a ofdegree n(a). To obtain a key exchange, Alice and Bob will respectively picksecret ideals a, b and compute the curves Ea , Eb that constitutes their public
key. Then, the common key is Eab = Eba = (Ea )b = (Eb )a .
We state the CSIDH key recovery problem below [CLM+ 18, Problem 10].
As for SIDH, there is a decisional variant upon which holds the security of the
key exchange.
Problem 6.1.4. Given two supersingular elliptic curves E, E0 defined over Fp
with the same Fp -rational endomorphism ring O, find an ideal a of O such that
Ea = E0 . This ideal must be represented in such a way that the action of a on
any curve can be evaluated efficiently, for instance a could be given as a productof ideals of small norm.

6.1.3

Torsion attacks and trapdoor curves

In this section, we consider the following generalization of the CSSI.
Problem 6.1.5. (SSI-T) Let E1 , E2 two supersingular curves in S(p). Let D
and N be coprime integers. Let φ : E1 → E2 be a secret isogeny of degree D.
Assume that we know the action of φ on E1 [N ]. Compute φ.
The SSI-T problem makes sense for any D, N which are coprime. But weare going to restrict to the case where we have compact representation of the
input and output of our problem.
Definition 6.1.6. Let N be an integer and let p be a prime number. Let E bea curve in S(p). We call E[N ] efficiently representable if representing points in
E[N ] requires polynomial space in log p.
Henceforth, we assume that D, N are smooth and that E[DN ] is efficiently
representable (in particular, as in Chapter 5, we will focus on the case where
all the relevant torsion is defined over Fp2 ). This implies that we have polynomial time algorithms to manipulate all the objects involved in our problem (seeSection 4.1). The SSI-T is one of the problem underlying the security of theSéta.
154

The work of C. Petit in [Pet17] and the later improvements from [QKL+ 21]
targeted ways to solve the SSI-T using the knowledge of the endomorphism ringof E1 . The idea relies on the fact, proven in Section 2.3.2, that the existence ofan isogeny between E1 , E2 imply an embedding of a suborder of End(E1 ) inside
End(E2 ). The idea from Petit was that the torsion information given by theimage of E1 [N ] through φ could be used to compute one endomorphism of thisembedding.
We recall (slightly modified version of)[QKL+ 21, Theorem 3] how finding
one of those endomorphism of E2 relates to finding the secret isogeny φ:Theorem 6.1.7. Let φ : E1 → E2 be a secret isogeny of degree D. Assume
that E[N ] and E[D] are efficiently representable for any supersingular curve E
and that the action of φ on E1 [N ] is given. Suppose, furthermore, that we knowθ ∈ End(E1 ) and d, e ∈ Z such that the trace of θ is 0 and deg(φ ◦ θ ◦ φ̂ + [d]) =N 2 e. Let M be the largest divisor of D such that E2 [M ] ⊂ ker(φ ◦ θ ◦ φ̂) ∩ E2 [D].
Let k be the numberof distinct prime divisors of M . Then we can compute φe k √e) .
in time O(2Proof. We sketch the proof of the theorem. Let τ = φ ◦ θ ◦ φ̂ + [d]. Then if
ker(τ ) is cyclic, then τ = ψ ′ ◦ η ◦ ψ where deg(ψ) = deg(ψ ′ ) = N and deg(η) = e
and the kernels of ψ and ψ ′ are cyclic. [QKL+ 21, Theorem 3] shows that ker(τ )is always cyclic if N is odd and if N is even, then τ = ψ ′ ◦ η ◦ ψ ◦ [K] wheredeg(ψ) = deg(ψ ′ ) = N/K, deg(η) = e and K = 1 or K = 2.
Then one can compute ψ and K using the torsion point information and ψ ′using the observation that ker(ψ̂ ′ ) = τ (E2 [B]). The isogeny η can be computedby a meet-in-the-middle algorithm. Once τ is computed, one can compute φby looking at G = ker(φ ◦ θ ◦ φ̂) ∩ E2 [D]. If M = 1 then G is cyclic and canbe recomputed easily. If not, then one can use [Section 4.3][Pet17] to recover τ .
e k ) where k is the number of prime factors of M .
The cost of this step is O(2Remark
6.1.8. Theorem 6.1.7 in particular implies that one can recover φ ine √e) whenever the number of distinct prime divisors of D (and hence M )O(is smaller than log log p. In Section 6.2.3, we introduce a condition on thequadratic order Z[θ] to ensure that M is always equal to 1.
The key ingredient to Theorem 6.1.7 is the knowledge of θ. When M = 1(which will be the case for the concrete inversion procedure in Algorithm 35),
all we really need is the action of θ on E1 [N ]. Indeed, from the sketch of proofof Theorem 6.1.7, we see that θ is only used to compute the kernel of the two
isogenies ψ and ψ ′ of degree N . These kernels are computed by evaluating the
N -torsion τ = φ ◦ θ ◦ φ̂ + [d], which can be done with the action of θ and φ on
E1 [N ].
Note, that the action of θ on E1 [N ] is hard to recover from the knowledgeof E1 only (mainly because computing endomorphisms of E1 is hard). This
motivates a notion of (D, N )-trapdoor T to encompass any kind of informationthat enables the computation described in the proof of Theorem 6.1.7.
Definition 6.1.9. Let p be a prime number and let D and N be coprime smooth
integers. Then a tuple (E, T ) is called a (D, N )-trapdoor curve if one can use
T to solve any instance of the SSI-T problem (with parameters D, N, p) withstarting curve E in polynomial time. We sometimes call T the trapdoor.
155

In [QKL+ 21] the authors introduces a polynomial-time algorithm for constructing (D, N )-trapdoor curves whenever N > D2 and the number of prime
divisors of D < log log p. The main idea is to reproduce the set-up of Theorem
6.1.7. Thus, if one can construct a supersingular elliptic curve E together withan endomorphism θ ∈ End(E) verifying the requirements of Theorem 6.1.7, andcompute the action of this endomorphism θ on E[N ], then one can solve SSI-T
in polynomial time (by finding an e which is sufficiently small).
The conditions put on θ in Theorem 6.1.7 are essentially conditions on theminimal polynomial of θ, meaning that every trace zero element in the quaternion algebra whose norm is (N 2 e − d2 )/D2 can be used as a suitable θ. Thisimplies we can obtain potential (D, N )-trapdoor curves from curves in EO (p)for a quadratic order O of the form!
r
N 2 e − d2.
Z
D2
Let us now describe how such a θ can be generated. We have introduced in
Chapter 3 algorithms to solve norm equations in Z + DO where O is a maximal
order of Bp,∞ . But this is not enough here, because we need an element θ ofspecific norm and trace. In our case, we are happy to generate the maximal
order O (and the curve E) after the quadratic order O. Thus, our idea, is tofind an element in Bp,∞ with the correct norm and trace, take the quadraticorder O = Z[θ] and then find a curve E ∈ EO (p) by finding a maximal order
O containing θ. Since Tr(θ) = 0, the element θ ∈ Bp,∞ can be written as
ci + bj + aij. The degree of τ = [d] + φ ◦ θ ◦ φ̂ is D2 (p2 a + p2 b + c2 ) + d2 whenφ has degree D. Observe that a, b, c can be rational numbers, but since θ is an
integral element its norm p2 a2 + p2 b2 + c2 must be an integer. So one has tofind d, e such that N 2 e − d2 is divisible by D2 and is positive before expressingn = (N 2 e − d2 )/D2 as p2 a2 + p2 b2 + c2 .
This can be achieved when N > D2 . Let nD2 = N 2 e − d2 . Then one
has to find a rational solution to the equation p2 a2 + p2 b2 + c2 = nD2 , which
exists whenever n is a quadratic residue modulo p (if that is not the case, then
one chooses a different d and e). A solution can be found using Denis Simon’salgorithm [Sim05]. From there, we can find a maximal order O containing θand then compute a supersingular elliptic curve whose endomorphism ring isisomorphic to O (see Algorithm 37 in Section 6.3.2). After that, the actionof θ on the N -torsion can be found using an explicit representation of O andthe algorithms on the Deuring correspondence. Everything can be done inpolynomial time (see SetaQuadraticOrderGen and SetaCurveGen in Section 6.3
for more details), leading to the following theorem:
Theorem 6.1.10. Let p be a prime number and let D and N be smooth coprime
integers such that N > D2 and the number of distinct prime divisors of D issmaller than log log p. Then there exists a polynomial-time algorithm which
outputs a (D, N )-trapdoor curve E with the following information:• The j-invariant of E.
• Integers d, e with e = O(log(p)).
• A basis P, Q of E[N ] and the points θ(P ), θ(Q) for a trace 0 endomorphism
θ such that deg([D]θ + [d]) = N 2 e.
156

6.2

Séta trapdoor one way function and public
key encryption scheme

In this section we describe a general trapdoor one-way function where the mainidea is to turn the attacks from [QKL+ 21] into a trapdoor mechanism.
We first generalize the CGL hash function, and we describe a trapdoor subfamily of this generalization. We then provide more details on key generation,
evaluation, and inversion. We finally describe the Séta public key encryption
scheme and its CCA version.

6.2.1

Generalized Charles-Goren-Lauter hash function

We generalize the CGL hash function family introduced in [CLG09]. To select ahash function from this family, one selects a j-invariant j ∈ Jp which canonically
fixes a curve E/Fp2 with j(E) = j. There are ℓ + 1 isogenies of degree ℓconnecting E to other vertices. These ℓ + 1 vertices can be ordered canonically,
and one of them can be ignored. Then, given a message m = b1 b2 . . . bn , withbi ∈ [ℓ], hashing starts by choosing a degree-ℓ isogeny from E according tosymbol b1 to arrive at a first curve E1 . Not allowing backtracking, there arethen only ℓ isogenies out of E1 and one is chosen according to b2 to arrive at asecond curve E2 . Continuing in the same way, m determines a unique walk oflength n. The output of the CGL hash function hj is then the j-invariant of the
final curve in the path, i.e. hj (m) := j(En ), where the walk starts at the vertex
j and is defined as above. We see that starting at a different vertex j ′ results
in a different hash function hj ′ .
We modify this hash function family in three ways. First, we consider ageneralization where we do not ignore one of the ℓ+1 isogenies from the starting
curve E. That is, we take inputs m = b1 b2 . . . bn where b1 ∈ [ℓ + 1] and bi ∈ [ℓ]for 2 ≤ i ≤ n; this introduces a one-to-one correspondence between inputs andcyclic isogenies of degree ℓn originating from E.
Secondly, we consider a generalization
Qnwhere the walk takes place over multiple graphs Gℓi . Given an integer Q
D = i=1 ℓei i where the ℓi are prime factors,n
we introduce the notation µ(D) := i=1 (ℓi +1)·ℓei i −1 . We then take the message
m to be an element ofmi = bi1 bi2 . . . biei , bi1 ∈ [ℓi + 1], bij ∈ [ℓi ][µ(D)] = (m1 , . . . , mn )for 2 ≤ j ≤ ei , for 1 ≤ i ≤ nwhere each mi is hashed along the graph Gℓi . To ensure continuity, the jinvariants are chained along the hash functions, that is, we write ji = hji−1 (mi ),where ji−1 is the hash of mi−1 . Thus, only j = j0 parameterizes the overallhash function. As before, this generalization returns the final j-invariant jn =hjn−1 (mn ) as the hash of m.
Thirdly, we also modify the CGL hash function to return the images of two
canonically defined torsion points Pj and Qj of order N under the D-isogeny
φm : Ej → Ejn .
We call the resulting hash function family generalized CGL or G-CGL, andwe denote it by Hp,D,N , namely
n
o
:
m
→
7
(j(E
),
φ
(P
),
φ
(Q
))
|
j
∈
J
.
Hp,D,N = hD,N
n
m
j
m
j
p
j
157

Remark 6.2.1. The method that we just described is quite similar to the Compression/Decompression algorithms that we introduced in Section 4.1.5 in theway it takes an isogeny and convert it into a number.

6.2.2

A trapdoor function family from the G-CGL family

Given p, D and N , let JT,p ⊂ Jp be the set of j-invariants of (D, N )-trapdoor
curves defined over Fp2 (see Definition 6.1.9). By definition of a trapdoor curve,
for any jT ∈ JT,p , the hash function hD,Ncan be inverted using the trapdoor
jT
information. We hence obtain the following family of trapdoor functions:on: m 7→ (j(En ), φm (PjT ), φm (QjT )) | jT ∈ JT,p ,FTp,D,N = fjD,NT
where fjD,N:= hD,NjT .
T
Injectivity. We observe that, for a proper choice of parameters, the functions
are injective.
Lemma 6.2.2. Let N 2 > 4D. Then for any jT ∈ JT,p , fjD,Nis injective.
T
Proof. Let N 2 > 4D and jT ∈ JT,p , suppose that a function fjDT is not injective,
i.e. that there are two distinct isogenies φ and φ′ of degree D from EjT to Ec ,corresponding to two distinct messages, with the same action on EjT [N ], impliedby the colliding images of PjT and QjT . Then, following [MP19, Section 4], theirdifference is also an isogeny between the same curves whose kernel contains
the entire N -torsion. This, together with [Sil86, Lemma V.1.2], implies that
4D ≥ deg(φ − φ′ ) ≥ N 2 . Taking N 2 > 4D ensures that in fact φ = φ′ andis injective.
therefore that fjD,NT
One-wayness. One-wayness of our function family relies on Problem 6.2.3
below. This problem is a variant of the CSSI problem introduced in [JD11],
with the difference that the starting j-invariant is chosen at random from JT,p(instead of being fixed) and only the min-entropy of the distribution is specified.
Problem 6.2.3 (Trapdoor computational supersingular isogeny (TCSSI) problem). Given p and integers D and N , let jT be a uniformly random elementof JT,p and φm : EjT → Em be a random isogeny of degree D sampled froma distribution X with min-entropy H∞ (X) = O(λ). Let {PjT , QjT } be a basisof the torsion group EjT [N ]. Given EjT , PjT , QjT , Em , φm (PjT ) and φm (QjT ),compute φm .
Lemma 6.2.4. Let jT be a uniformly random element of JT,p . Then the function fjD,N∈ FTp,D,N is (quantum) one-way under the (quantum) hardness ofT
Problem 6.2.3.
Proof. It is easy to check that the distribution of isogenies resulting from hash$ing a uniform m∗ ← [µ(D)] has the required entropy; hence, the reduction isimmediate.

158

Algorithm 35 InverseTrapdoor(jT , T, c)
Input: jT ∈ JT,p , a trapdoor T and c.
Output: m ∈ [µ(D)] such that fjD,N(m) = c.
T
1: Parse c as (jm , Pm , Qm ) ∈ Fp2 × (Fp2 )2 × (Fp2 )2 .
2: Parse T as e, d, PJT , QjT , θ(PjT ), θ(QjT ).
3: Compute the canonical curve Em having j-invariant jm .
4: Let τ = φm ◦ θ ◦ φ̂m + [d] ∈ End(Em ).
5: Compute τ as described in the proof of Theorem 6.1.7.
6: Compute ker(φm ◦ θ ◦ φ̂m ) ∩ Em [D] = ker(τ − [d]) ∩ Em [D] = ker(φˆm ).
7: Compute ker(φm ) using ker(φ̂m ).
8: return m ∈ [µ(D)] that corresponds to ker(φm ).

6.2.3

Inversion

In this section, we concretely show how to use methods from [QKL+ 21] to invert
a given function fjD,N∈ FTp,D,N with trapdoor information T . We assume thatT
D is odd and that gcd(D, N ) = 1. p
We take EjT a supersingular curve inside EO ,where O is the quadratic order Z[ (N 2 e − d2 )/D2 ] for some integers d, e. We
write θ for the endomorphism of End(EjT ) of trace 0 and norm (N 2 e − d2 )/D2
such that Z[θ] ∼= O. Let us also take a basis PjT , QjT of EjT [N ]. If we define
T as e, d, PJT , QjT , θ(PjT ), θ(QjT ), then EjT , T is a (D, N )-trapdoor curve as
produced in Theorem 6.1.10.
To make the inversion mechanism efficient on all inputs, we require theadditional condition that the discriminant ∆ of O is a quadratic non-residue
modulo every prime divisor of D. The concrete statement can be found inLemma 6.2.5. We explain how to generate Ej,T , O and T in Sections 6.3.1
and 6.3.2.
We are given (jm , Pm , Qm ) as the output of fjD,Nfor some input m, whichT
we want to recover. Let the isogeny corresponding to m be denoted by φm . We
assume that Pm = φm (PjT ) and Qm = φm (QjT ). Let τ := φm ◦ θ ◦ φˆm + [d]and let G := ker(τ − [d]) ∩ Em [D].
Lemma 6.2.5. If ∆ = disc(O) is a non-quadratic residue, the group G is cyclic
and equal to ker(φ̂).
Proof. It is clear that ker(φˆm ) ⊂ G since it is contained in ker(φm ◦ θ ◦ φˆm ) andin Em [D] as well. We now show that G is cyclic. Let M be the largest divisorof D such that Em [M ] ⊂ G. Then φm can be decomposed as φD/M ◦ φM . Thenby [Pet17, Lemma 5] the kernel of φM is fixed by θ. The proof [Pet17, Lemma
6] shows that a subgroup of EjT [M ] can only be fixed by an endomorphism θ if
Tr(θ)2 − 4 deg(θ) = disc(Z)[θ] = ∆ is a square modulo M . Thus, the quadratic
residuosity condition on ∆ ensures that M = 1, which implies that G is cyclic.
The order of G is a divisor of D since G is cyclic and every element of G has
order dividing D. However, G contains ker(φˆm ), which is a group of order D.
This implies that G = ker(φˆm ).
The group G = ker(φ̂) can be computed by solving a double discrete logarithm problem, which is efficient as D is smooth. We summarize the steps
needed for inverting the one-way function in Algorithm 35.

159

In [QKL+ 21] it is shown that Algorithm 35 runs in polynomial time wheneverEm [D] is efficiently representable and ∆ = disc(Z)[θ] is as in Lemma 6.2.5.

6.2.4

Séta Public Key Encryption

We now build Séta, a Public Key Encryption scheme using the trapdoor oneway function family of Section 6.2.2, and we show that it is OW-CPA secure.
Concretely, we define the Séta PKE scheme as the tuple (keygen, enc, dec) of
PPT algorithms described below.
P arameters. Let λ denote the security parameter. Let p be a prime such thatp2 − 1 = DN f where D, N are smooth integers and f is a small co-factor suchthat 22λ < D, D2 < N . We let param = (λ, p, D, N ).
K ey generation. The keygen(param) algorithm proceeds as follows:
1. Compute a uniformly random (D, N )-trapdoor supersingular elliptic curve(EjT , T ) defined over Fp2 using SetaQuadraticOrderGen and SetaCurveGen(see Section 6.3).
2. Set pk := (jT ) and sk := T .
3. Return (pk, sk).
E ncryption. The enc(param, pk, m) algorithm proceeds as follows. For a givenm ∈ {0, 1}nm , where nm = ⌊log2 µ(D)⌋, first cast m as an integer in the set[µ(D)] and then:
1. Parse pk = jT ∈ JT,p .
2. Compute (jm , Pm , Qm ) ← fjD,N(m).
T
3. Return c = (jm , Pm , Qm ).
Decryption. The dec(param, pk, sk, c) algorithm proceeds as follows:
1. Given param, sk and c, parse c as (jc , Pc , Qc ) ∈ Fp2 × (Fp2 )2 × (Fp2 )2 ; ifthat fails, return ⊥.
2. Apply InverseTrapdoor to recover m̃ ∈ [µ(D)]; if this fails, set m̃ = ⊥.
3. If ⊥ was recovered, return ⊥.
4. Otherwise, from m̃ ∈ [µ(D)], recover m ∈ {0, 1}nm and return it.
Theorem 6.2.6. Let p be a prime, let D and N be integers such that D2 <N . Suppose that the output distribution of Algorithm 37 is statistically close
to uniform. Let EjT be an output of Algorithm 37. If Problem 6.2.3 withp, D, N, EjT and X such that H∞ (X) = λ is hard for quantum PPT adversaries,
then the PKE scheme above is quantum OW-CPA secure.
Proof. Let M = {0, 1}nm denote the message space of the encryption scheme,$with nm = O(λ). We see that a randomly sampled m ← M directly embedded
as an integer m ∈ [µ(D)] yields a distribution Y with min-entropy H∞ (Y ) ≥ λon isogenies of degree D starting from EjT . The challenge of opening a given
ciphertext c then reduces to recovering the secret isogeny of Problem 6.2.3 with
X =Y.
160

A ciphertext is composed of a j-invariant jc ∈ Fp2 , which can be represented
with 2 log p bits, and two torsion points Pc , Qc ∈ Ejc [N ], each of which can be
represented with 2 log N bits by identifying each N -torsion point with a pair ofelements in ZN . Therefore, the bit size of a ciphertext is
2 log p + 4 log N.
Further compression is possible, representing both torsion points with 3 log N
bits, using the techniques in [CJL+ 17, Section 6.1].

6.2.5

IND-CCA encryption scheme

We obtain an IND-CCA secure PKE scheme by applying the generic postquantum OAEP transformation [TU16, Section 5] (detailed at the end of thisis quantum partialsection) to Séta, for which we prove that our function fjD,NT
domain one-way.
Definition 6.2.7. Let k1 , k0 and nc be integers. A family F of functions f :{0, 1}λ+k1 × {0, 1}k2 → {0, 1}nc is partial domain one-way if for any polynomial
time adversary A, the following advantage is negligible in λ:hi$Advλ (A) = Pr s′ = s; s′ ← A(1λ , y), y ← f (s, t), (s, t) ← A × B, f ← F
Lemma 6.2.8. Let jT be a uniformly random element of JT,p . The function
fjD,Ndefined in Section 6.2.2 is a quantum partial-domain one-way function,Tunder the hardness of Problem 6.2.3.
Proof. We note that in our case, partial domain inversion is the same as domain
inversion where only the first part of the path is required. More precisely,
factor D as D1 · D2 such that gcd(D1 , D2 ) = 1, 2λ+k1 ≤ µ(D1 ) and 2k0 ≤ µ(D2 )(where λ+k0 +k1 is the bit-length of input strings) and then embed each of s andt into µ(D1 ) and µ(D2 ) respectively. Then we can set fjD,N(s, t) := fjD1 2 ,N (t)
T
D2 ,N
D1 ,N
uses {P1 , Q1 } as basis of Ej1 [N ]. Since
where (j1 , P1 , Q1 ) = fjT (s) and fj1
2λ+k1 ≤ µ(D1 ), then recovering s from y = fjD,N(s, t) is hard under the sameTassumption as Theorem 6.2.6 with D replaced by D1 .
Theorem 6.2.9 ([TU16], Theorem 2). If fjD,Nis a quantum partial-domainT
one-way function, then the OAEP-transformed scheme is IND-CCA secure in
the QROM.
The IND-CCA version adds an output of a hash function H ′ , which has thesame size as the input of the one-way function f . Thus, the total bit size of theciphertext is
2 log p + 4 log N + k.
Post-quantum OAEP transformation. We present here the post-quantum
OAEP generic transformation we use for SETA. Let
f : {0, 1}λ+k1 × {0, 1}k0 → {0, 1}nc161

be an invertible injective function. The function f is the public key of thescheme, its inverse f −1 is the secret key. The scheme makes use of three hashfunctions
G : {0, 1}k0 → {0, 1}k−k0 ,H : {0, 1}k−k0 → {0, 1}k0 ,H ′ : {0, 1}k → {0, 1}k ,modelled as random oracles, where k = λ + k0 + k1 . Given those, we define theencryption scheme as follows:$• Enc: given a message m ∈ {0, 1}λ , choose r ← {0, 1}k0 and set
s = m||0k1 ⊕ G(r),t = r ⊕ H(s),c = f (s, t),d = H ′ (s||t),and output the ciphertext (c, d).
• Dec: given a ciphertext (c, d), use the secret key to compute (s, t) =f −1 (c). If d ̸= H ′ (s||t) output ⊥. Otherwise, compute r = t ⊕ H(s) andm = s ⊕ G(r). If the last k1 bits of m are 0, output the first n bits of m,otherwise output ⊥.

6.3

Key generation method

In this section, we describe how to generate keys for Séta. We first describe SetaQuadraticOrderGen, as Algorithmp
36, to generate integers d, e from which we canderive a quadratic order O = Z[ (N 2 e − d2 )/D2 ] that satisfies the quadratic
residuosity conditions imposed in Section 6.2.3 to make a suitable candidate forSéta.
Then, we present how to generate a uniformly random supersingular elliptic
curve inside EO (p), together with the remaining part of the trapdoor information
T . This is done with SetaCurveGen, described as Algorithm 37.

6.3.1

Computing the trapdoor information
2

2

We recall that the required condition is that n = N De−dmust be a quadratic2
non-residue modulo every prime dividing D and also modulo p. For simplicity,
we fix e = 1 and look for d of a special form. We show how to find d in
SetaQuadraticOrderGen (described as Algorithm 36).
2

2

Lemma 6.3.1. If d, e is the output of SetaQuadraticOrderGen, then n = N De−d2
is a quadratic non-residue modulo all ℓi .

Proof. Let ri , sℓi , T and u be as in SetaQuadraticOrderGen. Let r be an integer such that r ≡ ri (mod ℓi ). Then we show that for every i, the integer2
2−N 2 e+(D 2 r+u)2
is not a quadratic residue modulo ℓi , which implies that − N De−d2
D2
is not a quadratic residue modulo every ℓi since T ℓ + r ≡ ri (mod ℓi ) for every
integer ℓ. We have that−N 2 e + (D2 r + u)2−N 2 e + u2=
+ D2 r2 + 2ur
2
D
D2
162

Algorithm 36 SetaQuadraticOrderGen(D, N )Input: D, N as above. Let S be the product of primes dividing D.
2
2
Output: (d, e) such that − N De−d
< 0 is a quadratic non-residue modulo every
2
prime dividing D and is a quadratic non-residue modulo p.
1: Set e = 1.
2: Find u such that u2 ≡ N 2 e (mod D 2 ).
3: for every prime ℓi dividing D do
4:
Let sℓi be a quadratic non-residue modulo ℓi .
22)(2u)−1 (mod ℓi ).
5:ri ← (sℓi − −NDe+u2
6: end for
7: Compute a residue r modulo S with the property that r ≡ ri (mod ℓi ).
8: c ← 0.
9: d ← D 2 (Sc + r) + u.
2
e−d2.
10: A ← N D
2
11: if A < 0 then12:
return ⊥13: end if
14: if A is not a square modulo p then15:c ← c + 1.
16:
go to Step 9.
17: end if
18: return (d, e). By our choice of r, we have that−N 2 e + u2
−N 2 e + u2
+ D2 r2 + 2ur ≡+ 2uri ≡ sℓi (mod ℓi ),2DD2
which is a quadratic nonresidue by the choice of sℓi .
Lemma 6.3.2. (UPHA) Let S be the product of all primes dividing D. If N >D2 S, then SetaQuadraticOrderGen returns a correct pair (d, e) with probabilityNhigher than 1 − 2− SD2 +1 .
Proof. Since u is found by solving an equation modulo D2 , we obtain u <D2 . Similarly, we have r < S. Under plausible heuristic assumptions, we canestimate to 1/2 the probability that the quadratic residuosity condition on A issatisfied. Thus, we obtain a bound on the failure probability by counting how
many values ℓ can be tried before A becomes negative. With the conservative−D 2 S
bound that D2 r + u ≈ D2 S, we obtain that we can try N DS
different values
2
for small d, which gives the result.
Correctness of the result follows from Lemma 6.3.1.

6.3.2

Trapdoor curve generation

Now we focus on generating a random supersingularelliptic curve whose endo√
morphism ring contains an embedding of O = Z[ −n] where n = (N 2 e−d2 )/D2
with d, e the outputs of SetaQuadraticOrderGen. In [QKL+ 21, Section 5.1] itis discussed how one can generate a specific curve inside EO (p). Essentially,163this is achieved by computing a maximal order O containing the suborder
O (with [Voi13, Algorithm 7.9]) and then computing a supersingular elliptic
curve whose endomorphism ring is isomorphic to O (with [EHL+ 18, Algorithm12]). This procedure can be made concretely efficient with our efficient idealto-isogeny algorithms (IdealToIsogenyFromKLPT or IdealToIsogenyFromEichler)
under some conditions on the prime p that partly underlie the choice of prime
described in Section 6.4.2. As usual, O0 is the special extremal order of Bp,∞
and E0 is the corresponding supersingular curve. However, this procedure isessentially deterministic, so an adversary knowing the quadratic order O canjust recompute the same trapdoor curve. The point of this subsection is to show
how to randomize the procedure.
We obtain randomization by first generating a curve with the deterministic
procedure, and then applying the action of a random class group element toderive another random curve with the same embedding. This operation would
be costly if it required to compute a lot of isogenies. However, we can do it overthe quaternions at a negligible cost before applying the translation algorithm
from maximal orders to elliptic curves.
For concrete randomization, we use the fact (see [JMV09]) that there exists
a bound B (polynomial in p) for which the graph whose vertices are curves in
EO (p) and edges are isogenies of prime degree smaller than B is an expandergraph. The fast mixing property of expander graphs implies that the distribution of curves obtained after a random walk of fixed length quickly converges
to the uniform distribution as the length of the walk grows. More precisely,
for any δ, we can find a length ε (logarithmic in the size of the graph and δ)
for which the statistical distance between the random walk distribution and theuniform distribution is less than δ. So once we fix the length ε (correspondingQn
to a sufficiently small δ), for any starting curve E0 in EO , the curve i=1 lεi i ⋆ E0
where l1 , . . . , ln are prime ideals above the n prime ℓ1 , . . . , ℓn smaller than Bthat are split P
in O and (ε1 , . . . , εn ) is uniformly random among the vectors inn
Zn such that i=1 |εi | = ε, is statistically close to a uniformly random elementin EO . This result underlies SetaCurveGen.
Proposition 6.3.3. SetaCurveGen is correct and terminates in polynomial time.
Proof. All the sub-algorithms run in polynomial time and, by choice of B andε, the number of iterations in the loop is also polynomial.
It is easy to verify that the ideal I corresponds through the Deuring correspondence to the isogeny φli . Thus, our method simulates a random walk overthe graph that we described at the beginning of this section. For the reasons
explained there, the curve EjT obtained in the end is statistically close to arandom element in EO (p).

6.3.3

Constraints on the prime

In Séta, we compute and evaluate isogenies of degree D and N . Hence, wealways require that D and N are smooth and that the DN -torsion groups are
efficiently representable, i.e., that they are defined on extensions of Fp2 of small
degree. For example, if we require that E[DN ] ⊂ E(Fp4 ), then DN must divide
p2 − 1. The smoothness bound B1 of D impacts the efficiency of encryption,and the smoothness bound B2 of N impacts the efficiency of decryption. For a164

Algorithm 37 SetaCurveGen(N, O, B, ε)Input: A prime p, an integer N , a quadratic order O, a bound B, a length ε.
Output: A uniformly random curve EjT ∈ EO (p), a basis PjT , QjT of EjT [N ],and θ(PjT ), θ(QjT ) with θ ∈ End(EjT ) such that Z[θ] ∼= O.
1: Find a max. order O ⊂ Bp,∞ with O embedded in O with the alg. from[QKL+ 21].
2: Compute ℓ1 , . . . , ℓn the n primes split in O smaller than B.
3: Select a random vector (ε1 , . . . , εn ) in Zn with L1 norm equal to ε.
4: Set OjT = O.
5: for 1 ≤ i ≤ n do
6:Compute αi ∈ O such that li = O⟨αi , ℓi ⟩ is a prime ideal above ℓi .
7:
for 1 ≤ j ≤ |εi | do
8:Compute the ideal I = OjT ⟨αi , ℓi ⟩.
9:
Set OjT as the right order of I.
10:
end for
11: end for
12: Compute J = ConnectingIdeal(O0 , OjT ) and select ℓ a small constant prime
coprime to N and disc(O).
13: Compute K = KLPTℓ• (J).
14: Compute φ = IdealToIsogenyFromKLPT(K, O0 , [1]E0 .
15: Set EjT as the codomain of φ.
16: Compute a canonical basis PjT , QjT of EjT [N ].
17: Select the correct element θ ∈ OjT such that O ∼= Z[θ].
18: Use OjT and φ to compute θ(PjT ), θ(QjT ).
19: return EjT , PjT , QjT of EjT [N ], θ(PjT ), θ(QjT ).

given security level λ, we require 22λ < D in order to protect the scheme against
the meet-in-middle attack.
Since we have the range D2 < D2 S < D3 depending on the value of S
(product of primes dividing D), and that Lemma 6.3.2 implies that N > D2 S,
then we can estimate that the value DN will be between 26λ and 28λ . If wewant DN dividing p2 − 1, we can estimate that the minimum size for the prime
p will be between 3λ and 4λ bits. The actual size will depend on the size of(p2 − 1)/DN .
Besides encryption and decryption, key generation also restricts the typesof primes to be used in Séta because we use IdealToIsogenyFromKLPT (when[DFFdSG+ 21] was published, the algorithm IdealToIsogenyFromEichler has notbeen discovered and so we used IdealToIsogenyFromKLPT instead) and so wehave the same constraints as in SQISign in Chapter 5. We will look for a primeof form p2 − 1 = lf T f2 , where ℓ is the small prime that we are going to use in
SetaCurveGen, T > p3/2 is a smooth integer co-prime to ℓ and f2 is a cofactor.

6.4

Implementation

We made a C implementation of Séta. Our code is available at https://github.
com/seta-isogeny-encryption/seta. It reuses large parts of the code base of165

SQISign2 for the Key generation.

6.4.1

Main building blocks

Key generation consists of two parts. An execution of SetaQuadraticOrderGenand an execution of SetaCurveGen. The difficult part of this procedure in practice is a subroutine for finding a supersingular elliptic curve whose endomorphism ring is isomorphic to a particular maximal order O. For this step, wereused a substantial amount of the code used for SQISign to implement the
IdealToIsogenyFromKLPT algorithm.
Encryption consists in the evaluation of an isogeny of degree D at points oforder N . In order to make this efficient, we choose parameters where D has
small prime factors and both D and N divide p2 − 1 to avoid using extension
fields.
Decryption also uses evaluations of isogenies, but for isogenies of degree
N . Furthermore, decryption requires some linear algebra modulo D (whencomputing the intersection ker(τ −[d])∩Em [D]) and modulo N (when computing
the isogenies ψ and ψ ′ ). In these steps one uses subroutines for solving discrete
logarithms but due to N and D being smooth, this step is negligible comparedto other computations.

6.4.2

Prime search

To efficiently implement Séta, it is necessary to select a prime satisfying themany constraints mentioned in Section 6.3.3. To maximize efficiency of encryption and decryption, while maintaining reasonably efficient key generation, we
opted to search for a prime satisfying the following constraints: (1) p2 −1 = DN ,with both D and N smooth; (2) D ≈ 22λ and N ≈ 24λ ; and (3) D has as few
prime factors as possible.
This search is quite similar to the one we made for SQISign, but the constraint are slightly different here (in terms of size of p and the amount of smoothtorsion required). This is why, contrary to SQISign, the method that gave thebest result is the one by Costello from[Cos19] where we look for primes of theform p = 2xn − 1 . Thanks to this technique, D can be taken as a factor of
p + 1, and has thus much fewer prime factors than a generic smooth prime ofthe same size. The drawback of the technique is that, as n increases, the search
space decreases, to the point where we cannot find smooth integers anymore.
Concretely, for λ = 128, we need to have log p ≈ 400. So we fixed n = 12
and we sieved within the space 232 < x < 233 , i.e., 2385 < p < 2397 . This yielded
four primes with the largest factor bounded by 225 , and three with bound
226 , corresponding to x = 4679747572, 4845958752, 4966654633, 5114946480,
6334792777, 8176556533, 8426067021. Unfortunately, we fully explored thesearch space, meaning that no better primes exist for n = 12.
The relatively large smoothness bounds negatively affect performance of allalgorithms in Séta. Unfortunately, it appears to be difficult to find better primes
given current knowledge. Even dropping the constraint on the number of prime
factors of D, the best algorithms known today can hardly beat a 220 smoothness
bound for a prime of 384 bits [CMN21, Table 3].
2 https://github.com/SQISign/sqisign

166Remark 6.4.1. [DFFdSG+ 21] was published before [DFLW22] and this is why
we use IdealToIsogenyFromKLPT rather than IdealToIsogenyFromEichler. Given
that the size of the prime is much bigger in Séta than for SQISign, the relaxed
requirement of torsion in IdealToIsogenyFromEichler should allow us to selecttorsion with much better torsion, and so we expect a huge improvement if we
use IdealToIsogenyFromEichler instead. We leave this to future work.

6.4.3

Experimental results

We ran experiments on a 4.00GHz Quad-Core Intel Core i7, using a single core.
We used the prime p = 2 · 842606702112 − 1, and the smooth factors
D = 4312 · 8471911 ,N = 321 · 5 · 7 · 13 · 17 · 19 · 23 · 73 · 25712 · 313 · 1009 · 2857 · 3733 · 5519 · 6961
· 53113 · 499957 · 763369 · 2101657 · 2616791 · 7045009 · 11959093· 17499277 · 20157451 · 33475999 · 39617833 · 45932333.
We run the key generation only once, and took 10.43 hours. The encryption
procedure took 4.63 seconds, and the decryption took 10.66 minutes, averaged
over six runs. The decryption time is almost entirely devoted to the evaluationof isogenies with degrees among the largest factors of N .

6.5“Uber” isogeny assumption

In this section, we introduce a generic framework, which we label Uber Isogeny
assumption in analogy to [Boy08], aiming at generalizing isogeny computation
problems encountered in the main families of isogeny-based schemes such as
SIDH [JD11], CSIDH [CLM+ 18], OSIDH [CK19] and Séta (presented in thiswork).
The Uber isogeny problem does not directly underlie the security of thesevarious schemes (in the sense that no formal reduction is yet known). However,for each of these protocols there exists a set of parameters for which if one cansolve the Uber isogeny problem, then one can break the scheme. At a higherlevel, our new problem can be seen as a generic key recovery problem.
By introducing this new assumption, our goal is twofold. First, we highlightthe proximity between the various isogeny schemes, and we provide a common target for cryptanalysis. Second, the generic attack that we describe in
Section 6.5.3 gives a lower-bound on the security of any future scheme whose
security may be related to our uber assumption similarly to SIDH, CSIDH,
OSIDH and Séta.

6.5.1

The new generic problem

The principal mathematical structure behind the uber isogeny problem is thegroup action on the curves of EO (p) that emerge through the class group Cl(O).
We introduced the main definitions and properties about this topic in Section 2.4.
Problem 6.5.1 (O-Uber Isogeny Problem (O − U IP )). Let p > 3 be a prime
and let O be a quadratic order of discriminant ∆. Given E0 , Es ∈ EO (p) and167

an explicit embedding of O into End(E0 ) (i.e., the knowledge of α0 ∈ End(E0 )such that Z[α0 ] ∼= O), find a powersmooth ideal a of norm coprime to ∆ suchthat [a] ∈ Cl(O) is such that Es ∼= a ∗ E0 .
Remark 6.5.2. In Problem 6.5.1, the powersmoothness condition on the norm
is to ensure that the resulting isogeny can always be computed in polynomial
time. In some special cases where the form of the prime p enables to compute
some smooth isogenies in polynomial time, this condition might be relaxed alittle.

6.5.2

Relation with various isogeny-based constructions

We start with the link with CSIDH [CLM+ 18] (see Section 6.1.2) which is quite
obvious.
Proposition 6.5.3. When p = 3 mod 4 and ∆ = −4p, Problem 6.5.1 is equivalent to the CSIDH key recovery Problem 6.1.4.
√
Proof. In the case of CSIDH, the curves admitting an embedding of Z[ −p] ∼=Z[π] in their endomorphism rings are the curves defined over Fp (i.e left stableby π the Frobenius morphism). Then, it is quite clear that Problem 6.5.1 isequivalent to Problem 6.1.4.
The OSIDH protocol [CK19] is a generalization of CSIDH where Z[π] is
replaced by a larger class of quadratic orders. The link between OSIDH and
Problem 6.5.1 is also straightforward. Let us fix some notations3 for this protocol
and briefly recall the principle. The OSIDH key exchange protocol starts froma descending chain of ℓ-isogenies of size n that we write φ0 : F0 → E0 where F0
admits an O0 -orientation (i.e., an embedding of O0 inside End(E0 ). From there,
φ0 induces an O-orientation on E0 . The secret keys of Alice and Bob are Oideals a, b whose action on E0 will lead to curves EA = a ∗ E0 and EB = b ∗ E0 .
These curves have also an O-orientation, which implies the existence of ℓn isogenies φA : F0 → EA and φB : F0 → EB , as in Proposition 2.4.25. Alice
public key is EA together with some torsion points (which allows Bob to computeb ⋆ EA ).
Proposition 6.5.4. When O0 is a quadratic order of class number 1 andO = Z + ℓn O0 , then if there exists a PPT algorithm that can break Problem 6.5.1, there is a PPT algorithm that can recover the keys of the OSIDH
protocol presented in [CK19].
Proof. From the definition of the group action of Cl(O) on the curves having
an O-orientation, finding a smooth ideal c such that EA = c ∗ E0 is enough torecover the secret key.
Note that we do not have equivalence in Proposition 6.5.4 because the OSIDH public keys include more information than just curves. This will be thesame for SIDH and Proposition 6.5.5.
3 These notations do not exactly agree with the ones introduced in [CK19] because we wantto highlight the link with our O-IOP.

168

For SIDH, we write4 F0 for the common starting curve. In SIDH, recovering the secret key from the public key is equivalent to the computational
supersingular isogeny problem (CSSI) that we introduced in Section 6.1.1 asProblem 6.1.1
The proposition below requires a bit more work, as the link between SIDH
and group actions is less obvious.
Proposition 6.5.5. Assume that F0 admits an O0 -orientation with O0 a maximal quadratic order of class number 1. If there exists a PPT algorithm solving
Problem 6.5.1 for O = Z + NA′ O0 where NA′ divides NA , then there exists a
PPT algorithm that breaks the CSSI problem with overwhelming probability.
Proof. First, note that NA is chosen so that the kernel points of A-isogenies havea polynomial-size representation. Then, since NA is also smooth, the discrete
logarithms can be solved in polynomial time in the A-torsion and isogenies ofdegree A can be computed in polynomial time.
For the rest of this proof, let us write α the endomorphism of F0 such that
Z[α] realizes the embedding of O0 inside End(F0 ).
If the curve EA is NA -isogenous to F0 , then EA admits an embedding of
Z + NA O0 . This embedding is not necessarily primitive, but we know there
exists NA′ dividing NA such that O = Z + NA′ O0 admits a primitive embedding
in End(EA ) (see Proposition 2.4.25). Conversely, since the class number of O0 is
1, then any Z + NA′ O0 -orientation on EA implies the existence of an A′ -isogeny
between EA and F0 . Let us write φA′ : F0 → EA this isogeny of degree NA′ .
Then φA , the secret isogeny in Problem 6.1.1 is the composition of φA with anendomorphism θA of O0 of degree NA /NA′ . Since NA /NA′ is a power of ℓA , there
are two possibilities for θA . Thus, the difficulty lies in recovering φA′ .
We can generate a curve E0 in EZ+NA′ O0 by generating φ0 : F0 → E0 a
descending isogeny of degree NA′ . Any ideal a such that EA = a ∗ E0 can beinterpreted as an isogeny φa : E0 → EA of degree n(a). We conclude the proof
with the fact that ker φ̂A′ = φa (ker φ̂0 ), which we prove below. Once ker φ̂A′
has been computed, it is easy to recover ker φA′ = φ̂A′ (EA [NA′ ]) and find asolution to the CSSI as we explained above.
To prove ker φ̂A′ = φa (ker φ̂0 ), we need to understand how the fact thata is an O-ideal translates to the action of φa on φ̂0 . As explained in Proposition 2.4.25 and the following paragraph, the embedding of O in E0 (resp. EA ) is
obtained as Z[φ0 ◦ α ◦ φ̂0 ] = Z[θ0 ] (resp. Z[φA′ ◦ α ◦ φ̂A′ ] = Z[θA′ ]). By definitionof a being an O-ideal, we have that φa (ker θ0 ) = ker θA . Thus, we need to provethat ker θ0 ∩ E0 [NA′ ] = ker φ̂0 and ker θA′ ∩ EA [NA′ ] = ker φ̂A (note that thisproperty is exactly what underlies the inversion mechanism in Section 6.2.3).
We will do it for θ0 , the property for θA′ holds for the exact same reasons. It isclear from the definition of θ0 = φ0 ◦ α ◦ φ̂0 that we have ker φ̂0 ⊂ ker θ0 . Let us
take P ∈ EA [NA′ ] ∖ ker φ̂0 , then Q = φ̂0 (P ) ∈ ker φ0 ∖ ⟨0⟩. If we assume thatP ∈ ker θ0 , it implies that α(Q) ∈ ker φ0 . Since ker φ0 is cyclic, we have thatα(Q) = λQ for some λ ∈ Z. This contradicts the fact that φ0 is descending.
Indeed, if we write φQ , the isogeny whose kernel is generated by Q, we have
φ0 = ψ0 ◦φQ for some isogeny φQ and the condition α(Q) = λQ implies that φQ
is not descending and so φ0 would not be descending, which is a contradiction.
4 In Proposition 6.5.5, we use this notation and note the one introduced in Section 6.1.1 inorder to highlight the link with Problem 6.5.1

169

Thus, we have proven that ker θ0 ∩E0 [NA′ ] = ker φ̂0 and this concludes the proof
as explained above.
We refer to√ Section 6.2 for the full details and notations about Séta. We
write O ∼= Z[ −n] ∼= Z[θ] and assume that n is public. This assumption isplausible, as SetaQuadraticOrderGen is essentially deterministic.
Proposition 6.5.6. If there exists a PPT algorithm solving Problem 6.5.1 forO, then there exists a PPT algorithm that takes a Séta public key Es and recovers
a trapdoor T such that EjT , T is a (D, N )-trapdoor curve.
Proof. Let EjT be a Séta public key. By applying Algorithm 37 in O andadding the integers e, d, a (D, N )-trapdoor curve E0 , T0 can be found in polynomial time with E0 ∈ EO . Thus, we can apply the PPT solver for Problem 6.5.1 on E0 and EjT to compute an isogeny φa : E0 → EjT corresponding to an O-ideal a. If we write θ0 ∈ End(E0 ) and θ ∈ End(EjT ) the endomorphisms such that O ∼= Z[θ]. Then, by definition of O-ideals,= Z[θ0 ] ∼we have that θ ◦ φa = φa ◦. So if T0 = e, d, P0 , Q0 , θ0 (P0 ), θ0 (Q0 ), then T =e, dφa (P0 ), φa (Q0 ), φa (θ0 (P0 )), φa (θ0 (Q0 )) is such that EjT , T is a (D, N )-trapdoor
curve.
We finish this section by proving that some instances of Problem 6.5.1 are
related to the more generic isogeny problem of finding a smooth isogeny between any two supersingular curves (Problem 6.5.7 below). For that, it suffices
to show that there exists some quadratic order that is embedded inside theendomorphism ring of any supersingular curve.
Problem 6.5.7. Let p > 3, be a prime number. Given E1 ,E2 two distinct
supersingular curves over Fp2 . Find φ : E1 → E2 , an isogeny of powersmooth
degree.
Proposition 6.5.8. There is an absolute constant c > 0 such that the following
holds. Let O be a quadratic order of conductor ℓe inside O0 , a maximal quadraticorder, such that ℓ is inert in O0 , and e ≥ c logℓ (p). If there exists a PPT
algorithm that can break Problem 6.5.1, then there is a PPT algorithm thatbreaks Problem 6.5.7.
Proof. From the fact that the ℓ-isogeny graph is Ramanujan, and the rapid
mixing of non-backtracking random walks in expander graphs [ABLS07], we
deduce that for e = Ω(logℓ (p)), there exists a non-backtracking path of degreeℓe between any two supersingular curves in the graph.
In particular, if E0 is any O0 -orientable curve, there exists a cyclic isogenyof degree ℓe from E0 to any other E, and since ℓ is inert in O0 , this isogeny must
be a sequence of descending isogenies. This implies that any E is O-orientable.
Thus, if we write E1 and E2 , the two curves in the generic isogeny problem,
then we can construct a middle curve E0 with an explicit embedding of O, thenuse the PPT algorithm to find paths between E0 , E1 and E0 , E2 , and finallyconcatenate the two paths to obtain a path between E1 and E2 of powersmooth
degree.
Remark 6.5.9. Recently, in [Wes21], Wesolowski proved some reductions between our uber isogeny assumption and other hard problems. Among otherthings, he studies the link with the endomorphism ring problem.
170

6.5.3

Analysis of the uber isogeny assumption

In this section, we investigate the complexity of solving Problem 6.5.1. We aregoing to see that there are various special cases leading to various complexities.
We start by giving a generic estimate which can be seen as the worst casecomplexity.
A first upper bound: exhaustive search. The simplest method to solve
Problem 6.5.1 is to apply an exhaustive search, for instance byQselecting a setof small primes ℓi all split in O and trying all combinations of lei i ⋆ E0 until
one is isomorphic to Es , where each li is a prime ideal above ℓi . The expectedrunning time of this algorithm is in O(#EO (p)).
√
Since we have #EO (p) ≤ h(O), the classical estimate h(O) = Θ̃( ∆) gives
a first upper-bound on the complexity to solve Problem 6.5.1. In particular,
it shows that solving Problem 6.5.1 is easy when the discriminant ∆ is small.
However, when ∆ grows, it is harder to estimate how this bound reflects on
the actual complexity of the problem. The whole point of the results we presented in Section 2.4 was to get more precise estimates on the complexity of thisproblem. An effective lower bound on #EO (p) can be obtained by combining
Proposition 2.4.19 and Proposition 2.4.26.
There are some special cases for which we can be a bit more precise thanthat. For instance, when the discriminant are short, we saw Corollary 2.4.8 thatproves we must have #EO (p) = h(O) when the discriminant is smaller than p.
When the conductor of O is big enough, Proposition 2.4.26 shows that EO (p)must contain all supersingular curves. This is what we used in Proposition 6.5.8.
The case of CSIDH. The key recovery problem of CSIDH has received a lotof attention from the community [CLM+ 18, BS20, Pei20, CSCDJRH20] since
it was the first scheme that naturally fits into this framework. In fact, there
are improvements over the exhaustive search strategy in both the classical andquantum settings. The main ingredient behind these speed-ups is the ability
for anyone to obtain a concrete embedding (through the Frobenius morphism)√of O = Z[ −p] inside End(E) for any E ∈ EO . In particular, computing a ⋆ E
becomes easy for any E ∈ EO when a has smooth norm. In the classical setting,this implies a quadratic speed-up over the generic exhaustive search by using
a meet-in-the-middle technique (see [CLM+ 18]). In the quantum setting, thespeed-up is even more radical, as it creates a malleability oracle (see [KMPW21])
that reduces CSIDH’s security to an instance of the hidden shift problem which
can be solved in quantum sub-exponential time as described in [Pei20, BS20]
for instance.
Note that neither of these attacks can be used in the generic case, as it seems
hard to obtain this malleability oracle for other group actions. For instance, in
OSIDH [CK19] the public keys are made of a curve E and some torsion points tomake possible the computation of a ⋆ E for some secret ideal a. These additional
torsion points are not needed in CSIDH because they can be easily computed.
Smooth conductor inside a maximal quadratic order. A better algorithm also exists when the conductor f of O is smooth. By Proposition 2.4.25,
there exists an isogeny of degree f between any curve E ∈ EO (p) and any curve
in EO0 (p), where O0 is the quadratic maximal order containing O. Let E0 , Es
171

given by in an instance of Problem 6.5.1, and let us write φ0 : F0 → E0 and
φs : Fs → Es the two isogenies of degree f .
The alternative resolution method enumerates through all possible Fs =a0 ⋆ F0 in EO0 (p), then tries to find φs of degree f . Since f is smooth,we√
can apply a meet-in-the-middle technique to reduce this part to O( f ). Onceφs : Fs → Es and an O0 -ideal a0 such that Fs = a0 ⋆ F0 has been found, we cancompute an O-ideal such that Es = a ⋆ E0 , as described in [CK19, Section 5.1].
If we write ∆ = f 2 ∆0 , where ∆0 √is √the fundamental discriminant √of O0 .
The √complexity of this algorithm is Θ( f ∆0 ), which is better than Θ( ∆) =Θ(f ∆0 ).
Other cases. When we are not in one of the above cases, there is no known
improvement over the exhaustive search (classically or quantumly). Thus, thepresumed security entirely relies on the size of EO . Our results in Section 2.4
give a lower bound on this number, but we explained that it do not scale well
asymptotically. Nonetheless, it seems sufficient for some cryptographic application, as we exhibit in Section 6.5.4.

6.5.4

A numerical application to the parameters of SETA

In this section, we are going to use Proposition 2.4.19 to provide a lower boundon the complexity of attack against the O-uber isogeny problem, where O is
the quadratic order used in our SETA encryption scheme. This will give alower bound on the hardness of SETA key recovery, as explained above. Moreprecisely, we are able to prove, under a few reasonable assumptions, that there
exists a fitting choice of quadratic order O such that the brute-force recovery
attack is hard enough for 128 bits of security with the parameters given in
Section 6.4.
In Section 6.4, we did not describe a concrete value of n = (N 2 − d2 )/D2
because solutions can be found quite easily. Below, we computed one such
solution where n is easy to factor so that we could compute the conductor of
O. For instance, we found the value:n = 113 · 337 · 43913 · 6952212991459355471346665735527500066018525790897249
2522431413808553767205401453148081325894556965991428307754649539266
03334287506802602337066783077022530457.
√
Since, n is square free and√equal to 1 mod 4, the order O = Z[ −n] is
the ring of integer of K = Q( −n). To derive the concrete lower-bound in
Corollary 6.5.10 from Proposition 2.4.19, the classical lower bound on h(O)stated in Eq. (1.2.3) and the upper-bound in Eq. (2.4.6) on the size of τ .
√Corollary 6.5.10. Let the values p, n be as above and O = Z[ n]. Assuming
GRH, the size of EO (p) is bigger than 2269 .
Proof. Proposition 2.4.19 tells us that #EO (p) is bigger than (1/2) min(A, B)
where:h(O)2p
A = h(O) and B =.
3(4p + 4n + 1)
max 2 τ (N )0≤N ≤4n /p172

Assuming that √our n is big enough for it to hold, we are going to use A =4nπ270h(O) > 24e. To get a lower bound on B, it remains to get an
γ log log(4n) > 2
upper bound on max0≤N ≤4n2 /p τ (N ).
We can compute this bound manually using Eq. (2.4.8). Indeed, it can beeasily verified that ω(4n2 /p) ≥ 98 ≥ 74 and so we can compute alllog(4n2 /p)
1+
k log(k)kfor all 1 ≤ k ≤ 98.

As expected, the maximum is reached for k = 98 and we have thatmax0≤N ≤4n2 /pτ (N ) < 2105 .

Thus, using the bound on h(O), we get that B > 2279 . So, under GRH andthe assumption that n is big enough so that our simplification of the Littlewood
bound hold, we get that#EZ[√−n] (p) > 2269 .

173

Chapter 7

Cryptographic applicationsof the suborderrepresentation
In this chapter, we explore the possibilities offered by the suborder representation introduced in Section 4.3. We start by motivating our approach in theparagraph below. Then, in Section 7.1, we argue that the suborder representation is not equivalent to the ideal representation under the hardness of a newcomputational problem. In Section 7.2, we introduce a new non-interactive key
exchange based on this new hard problem. Finally, in Section 7.3 we mention
other potential applications.
Limitations of the ideal representation for cryptographic applications.
Section 4.2 was dedicated to illustrate the collection of nice algorithms in ourpossession to handle the ideal representation and perform some computations
from it. However, the existence of those efficient algorithms is not necessarily agood thing in the context of cryptography. Indeed, the bottom line is that an
ideal I reveals pretty much everything there is to know about the corresponding
isogeny φI : E1 → E2 and the two curves E1 , E2 . With I we get all the isogenies
connecting these two curves, and we can do pretty much anything with the norm
equation algorithms from Chapter 3 to get nice degrees. Thus, there is not muchhope to use an ideal representation as anything else than secret keys. Even as
secret knowledge, ideal representations have their limitations. For instance,
practical zero-knowledge proofs of ideal representation knowledge appear hardto obtain. Since we have an efficient verification algorithm, there are some
generic constructions to obtain zero-knowledge proof systems for Lisog understandard cryptographic assumptions such as the existence of one way-functions[GMW91]. While this result is nice in theory, it is not really helpful to build apractical zero-knowledge proof-system for Lisog .
One of the main motivations behind the introduction of the suborder representation is to address the shortcomings of the ideal representation in thatregard. In particular, under the hardness of the new SOI problem (see Problem 7.1.1), we will see that it seems plausible to use suborder representations
as public elements. This idea is the basis of pSIDH, the new NIKE scheme that174

we introduce in Section 7.2. More generally, the gap between ideal and suborder representations open interesting cryptographical prospects, as we discuss in
Section 7.3.

7.1

Deducing the ideal representation from thesuborder representation

We saw with Proposition 4.3.2 that our new suborder representation can becomputed from the ideal representation in polynomial time. The goal of thissection is to study the reverse problem of extracting an ideal representationfrom a suborder representation. We are going to argue that this problem ishard. This supposed hardness and the resulting gap between the ideal andsuborder representations motivates our new construction. Some applications
discussed in Section 7.2 and Section 7.3 will specifically rely on the hardness ofProblem 7.1.1.
Problem 7.1.1. (SubOrder to Ideal, SOI) Let x = (D, E1 , E2 ) ∈ Lp−isog , and π
be a suborder representation such that SuborderVerification(x, π) = 1. ComputeI, an ideal such that IdealVerification(x, I) = 1 or IdealVerification((D, E1 , E2p ), I) =1.
We will show in Proposition 7.1.3 the equivalence of Problem 7.1.1 withthe problem of computing the endomorphism ring of the codomain from thesuborder representation (Problem 7.1.2).
Problem 7.1.2. (SubOrder to Endormophism Ring (SOER)) Let x ∈ Lp−isog ,and π be a suborder representation such that SuborderVerification(x, π) = 1. Let
x = (D, E1 , E2 ), compute O2 ⊂ Bp,∞ with O2 ∼= End(E2 ).
Proposition 7.1.3. (UPHA) The SOI and SOER problems are equivalent.
Proof. Since OR (I) ∼= End(E2 ) when VerifIdealProof((D, E1 , E2 ), I) = 1, it isclear that solving SOIP implies solving SOERP in polynomial-time. The reverse
direction is more complicated.
Assume that π, O2 is given with VerifSuborderProof((D, E1 , E2 ), π) = 1
and O2 ∼= End(E2 ). We describe an algorithm finding an ideal representation I for x ∈ Lisog (up to swapping E1 and E1p , we can assume that it istrue). Parse π = O1 , φ1 , . . . , φn . The isogenies φ1 , . . . , φn have their degree in ℓ• for some small ℓ, and so they can be translated into ideals using any efficient isogeny-to-ideal algorithm (for instance IdealToIsogenyFromKLPT). In that way, we obtain O2 α1 , . . . , O2 αn principal ideals. Computeθ1 , . . . , θn = GeneratingFamilyℓ• (O2 , D). Select β ∈ O1 such that D is inert
Q in Z[β] and gcd(n(β), D) = 1. Express Dβ as a linear combination ofθ for I ⊂ ⟨1, · · · , n⟩ and compute α as the same linear combination ofj∈IQj
the j∈I αj . Compute J = O2 ⟨α, D⟩. Find γ such that O1 = γOR (J)γ −1 andoutput I = γJγ −1 .
The important property is that if I0 is the O1 -ideal that we look for, thenI0 = OR (I0 )⟨Dβ, D⟩ when β ∈ O1 is such that D is inert in Z[β] and gcd(n(β), D) =1. This is a consequence of Lemma 6.2.5. The rest of the algorithm describedabove is just to compute the value of Dβ through the isomorphism between
175OR (I) and O2 to get the O2 -ideal J. Finally, we send J back through theinverse isomorphism to compute I = I0 .
With the knowledge of O2 , the isogeny-to-ideal translation algorithms canbe applied in polynomial time. The same is true for GeneratingFamily due to
Proposition 3.4.4 and the fact that we perform all the other operations over thequaternions in polynomial time.
Interestingly, we can show that the SOIP is also equivalent to another problem, the Torsion to Ideal Problem (TIP) that can be seen as a generalizationof the CSSI problem introduced by De Feo and Jao for SIDH [JDF11] (seeProblem 6.1.1) when the endomorphism ring of the domain curve is known.
This assumption is not part of the CSSIP but generating a curve with unknown
endomorphism ring is notoriously hard, and so the endomorphism ring of thedomain curve can be assumed to be known unless there is a trusted setup. This
assumption is central in most cryptanalysis papers against SIDH.
Problem 7.1.4. (T -Torsion to Ideal (T -TI)) Let x = (D, E1 , E2 ) ∈ Lisog where
D is coprime to T and let φ : E1 → E2 be an element of isogD . Let P, Q be abasis of E1 [T ]. Given End(E1 ) and φ(P ), φ(Q) ∈ E2 [T ], Compute I, an ideal
such that VerifIdealProof(x, I) = 1.
We prove Proposition 7.1.5 to highlight a link between our new problem andexisting hard problems in order to help build confidence in our new assumption.
Proposition 7.1.5. For every D, p, there exists a value of T , such that the
SOIP is equivalent to the T -TIP.
Proof. In this proof, we take a powersmooth value T big enough so that GeneratingFamilyD(T ) will terminate with overwhelming probability (we recall that D(T ) is
the set of divisors of T ). This assumption will be useful to prove that if we cansolve the SOIP, we can solve the TIP for T . For the other direction, we need notassume anything on the size T , only that it is powersmooth. The fact that T ispowersmooth implies that points of E1 [T ] and E2 [T ] have a polynomial representation, that discrete logarithms can be computed in E1 [T ] and that isogenies
of degree T can be computed in polynomial time.
Let us assume that we know how to solve the TIP for such a powersmoothvalue T . Let x, π be an instance of the SOIP and let us write φ for the isogeny
corresponding to the representation π. If we can compute the image of φ on
E1 [T ], then we can apply our solver of the TIP to solve the SOIP. Using thesuborder representation, we can apply SuborderEvaluation to compute the imageof three cyclic subgroups of order T through φ (the ideals corresponding to thesubgroups can be computed in polynomial time because we know End(E1 ) and
we can solve DLP efficiently over the T -torsion). Once we have the image ofthree subgroups, it easy to see that we can compute the image of any points
with some DLP and pairing computations. Thus, we get a valid entry to the
TIP and we use our solver to find a solution.
For the other direction, let us assume that we have a solver for the SOIP.
Let us take an instance of the TIP. By our assumption on the size of T , we canrun GeneratingFamilyD(T ) to get a generating family θ1 , · · · , θn of Z+D End(E1 )with norms dividing T . Since we know End(E1 ) we can compute the embeddingof Z + D End(E1 ) inside End(E1 ). Since the embedding of Z + D End(E1 ) inside
End(E2 ) induced by φ is obtained by push-forward through φ of the embedding176

Z+D End(E1 ) ,→ End(E1 ), it suffices to use the image of the basis P, Q given in
input of the TIP to find the kernel of the endomorphism φ1 , . . . , φn ∈ End(E2 )giving the generating family of the embedding Z + D End(E1 ) ,→ End(E2 ).
Once, we have these kernels, we can derive the corresponding isogeny and thisyields a valid suborder representation for φ. Now that we have this suborderrepresentation, we can simply apply our solver of the SOIP to find a correct
solution.
All the results and algorithms from Section 4.3 were obtained with a prime
degree D for simplicity. Yet, as we see from Proposition 2.3.16 and the explanations at the end of Section 4.3.2, nothing prevents us from having a suborderrepresentation for composite degree isogenies. It is interesting to consider thecase where D is not prime in the analysis of the SOIP because there are somecases where it is actually easy to solve. This happens, for instance, when D ispowersmooth.
A polynomial time algorithm to solve the composite SOIP when D ispowersmooth. The algorithm below is inspired by the inversion mechanism
underlying the trapdoor one-way function that we introduced in Chapter 6. Let
us fix an element x = (D, E1 , E2 ) ∈ Lisog where each prime-power factor of D
is in O(log(p)). If we write φ for an isogeny of degree D between E1 , E2 , weare going to describe informally an algorithm to compute ker φ̂ in poly(log(p)).
Since End(E1 ) is known and D is power-smooth, an ideal representation forx ∈ Lisog can Q
be easily derived from ker φ (or equivalently from ker φ̂).
m
Let D = i=1 ℓei i , it suffices to get ker φ̂ ∩ E2 [ℓei i ] for each i to be able toreconstruct ker φ̂. Let us fix an i ∈ [1, m]. The main idea introduced in the
inversion mechanism in Section 6.2.3 is that if α = [d] + φ ◦ α0 ◦ φ̂, then theequality ker(α − d) ∩ E2 [ℓei i ] = ker φ̂ ∩ E2 [ℓei i ] depends only on ℓ and Z[α0 ]. In
particular, when ℓi is inert in Z[α0 ], then we have ker(α − d) ∩ E2 [ℓei i ] = ker φ̂ ∩E2 [ℓei i ]. It is clear that such an α0 always exists and that it can be computed inO(log(p) + log(D)). Once, the correct α0 is found, Dα0 can be expressed as alinear combination of the generating family obtained from 1, φ1 , . . . , φn . With
the coefficients of this linear combination, it suffices to evaluate E2 [ℓei i ] throughthe φ1 , . . . , φn and solve a few DLPs to obtain ker φ̂ ∩ E2 [ℓei i ]. This algorithm
has to be repeated at most O(log(D)) times to obtain the full description ofker φ̂.
On the prime vs. composite case. Isogenies of degree D1 D2 can be decomposed as two isogenies of respective degrees D1 and D2 . Thus, we knowthat the ideal that we look for can be decomposed as I1 · I2 where n(Ii ) = Di .
The local-global principle tells us that each coprime part behaves independently,
and so there does not seem to be any reason why finding I2 from the suborderrepresentation for D1 D2 , E1 , E2 should be different from solving Problem 7.1.1
when the degree is simply D2 . Once we know I2 , it is easy to see that recovering I1 reduces to an instance of Problem 7.1.1 of degree D1 . This informal
reasoning justifies that taking D composite should only make Problem 7.1.1
easier to solve. The efficient algorithm that we described above in the case of
powersmooth D leads to the same conclusion. Indeed, in this algorithm, weclearly recover each coprime part of the isogeny φI independently.

177

The generic case: a heuristic quantum subexponential algorithm.
This paragraph presents informally the best-known algorithms to solve Problem 7.1.1. We will implicitly focus on the prime case, which appears to be
the hardest case, as argued in the previous paragraph. We start by classicalalgorithms and worst-case complexity estimates before introducing a subexponential quantum algorithm, which is the best known generic method to solve
Problem 7.1.1.
We start by analyzing the complexity of the brute-force algorithm. In fullgenerality, for a given D, the brute force will take O(min(p, D)). The idea is thatsince End(E1 ) is part of the suborder representation, it suffices to enumerate
through all End(E1 ) ideals of norm D until IdealVerification succeeds. This is
the reasoning we outlined in Section 5.3.2. There are O(D) such ideals, butsince there are only O(p) curves, we expect to have to test at most O(p) of
them. Thus, the generic complexity of the brute force is O(min(D, p)).
Another way to solve the problem generically is by computing End(E2 ) (seeProposition 7.1.3). Without using the proof π as a hint, the complexity isΘ̃(p1/2 ) for classical computers and Θ̃(p1/4 ) for quantum computers, as we explained already (see Section 5.3.2 for instance).
Now, let us look at the algorithm described above for powersmooth D in
the generic case. Indeed, the algorithm remains correct and valid for any valueof D. The only problem is that it becomes exponentially hard for a generic D.
First, we need to be able to perform operations over the D-torsion. The smallest
field of definition for the D-torsion can have degree in Θ(D) over Fp . In thatcase, any operation over the D-torsion will have exponential complexity. Even
assuming that the degree of definition is logarithmic in p, D, we still need toperform a D-isogeny computation from its kernel. When D is prime, the best
known
√ algorithm is the one we introduced in Section 4.1, and it has complexity
O( D) . Thus, the complexity is exponential in the worst case.
We conclude by introducing a quantum algorithm with sub-exponential complexity in D. For that, we use the result from [KMPW21] that a one-way function f : E → F can be inverted at f (e) by solving an instance of the hidden
shift problem when there is a group action ⋆ : G × E → E for which there exists
a malleability oracle: an efficient way to evaluate the function g 7→ f (g ⋆ e)on any g ∈ G. The hidden shift problem can be solved in quantum subexponential time. The authors from [KMPW21] proposed a key recovery attack
on an imbalanced version of the SIDH scheme by using the group action of(End(E1 )/D End(E1 ))∗ on the set of cyclic subgroups of order D. This set isin correspondence with cyclic ideals of norm D inside End(E1 ), and so we caninvert the function I 7→ E/E[I] in subexponential time if we have a malleability
oracle. In [KMPW21], the authors showed that this malleability oracle could beobtained as soon as the image of a big enough torsion-group was given throughthe secret isogeny. With our algorithm SuborderEvaluation, we presented a way
to use the suborder representation π to evaluate φI on any torsion subgroup.
As a consequence, we can evaluate φI on any subgroup of powersmooth suborder, and this is more than enough to obtain a malleability oracle with the ideasof [KMPW21]. Thus, we can apply the reduction from [KMPW21] and get a
sub-exponential quantum method to solve Problem 7.1.1.
Remark 7.1.6. The existence of a sub-exponential attack is inevitable as soon
as one non-trivial endomorphism σ : E2 → E2 is revealed. The attack stems

178

from the existence of a group action of Cl(Z[σ]) on the set of Z[σ]-orientations(see [Wes21] for instance). With the knowledge of σ, one can apply the idea
(first introduced by Biasse, Jao and Sankar [BJS14] in the special case where√Z[σ] = Z[ −p]) that the algorithm from Childs et al. [CJS14] can be adapted tofind a path of powersmooth degree between two Z[σ]-oriented curves. When thisalgorithm is applied between E2 and E1 , a curve of known endomorphism ring,
the path obtained in output allows the attacker to compute the endomorphismring of E2 . This algorithm has sub-exponential complexity in log h(Z[σ]) as it
reduces to an instance of the hidden shift problem.
Further analysis of the security problem. Even after seeing our analysis,
the hardness of the SOERP may still come as a surprise to a reader familiar
with isogeny-based cryptography. In particular, the fact that we reveal several
endomorphisms of E2 might seem like a very troublesome thing to do. This concern is legitimate: the algorithm from [EHL+ 20] to compute the endomorphismring of any supersingular curve that we outlined in Section 2.2.1 is based on
the principle that knowing two distinct non-trivial endomorphisms is enough torecover the full endomorphism ring in polynomial-time. However, this was only
true under the conjecture that the order generated by two random non-trivial
endomorphisms had a good probability of being Bass, which implied that they
are contained in a few maximal orders. The endomorphisms that we reveal in
the suborder representation are not random cycles. By design, the suborder
they generate is not Bass and we know that it is contained in an exponential
number of maximal orders (this number is equal to the number of D-isogenies
by Lemma 2.3.15). As such, when using the endomorphisms of the suborderrepresentation, the algorithm described in Section 2.2.1 is essentially the brute
force attack where each ideal of norm D is tested.
Readers might also be concerned with the quaternion alternate path problem. A way to break the SOERP would be to use the embedding of Z +D End(E1 ) inside End(E2 ) to compute a path from E2 to a curve E0 of a known
endomorphism ring. Following the (now standard) blueprint that underlies mostof the algorithms in this work, such an attack would be divided in two steps:
first a computation over the quaternions (analog to KLPT) and then a conversion through the Deuring Correspondence to obtain an isogeny connecting E2
to E0 (analog to IdealToIsogenyFromKLPT or IdealToIsogenyFromEichler). This
supposed attack would have to work over orders of non-trivial Brandt invariant
rather than maximal orders to exploit the suborder representation. It appears
that the first part of this method can be made to work over non-Gorenstein orders. In fact, the IdealSuborderEichlerNorm from Chapter 3 is exactly the analog
of KLPT for orders of the form Z + DO. However, the fact that the BrandtInvariant is non-trivial appears like a serious obstacle to the second part of the
proposed attack. Indeed, as the number of curves admitting an embedding of
Z + DO inside their endomorphism ring is big, it becomes hard to tell whichpairs of curves are connected by any ideal of the form (Z + DO) ∩ J (which was
not the case for maximal orders because we have almost a 1 − to − 1 correspondence between curves and maximal orders). Thus, it seems implausible that
one may find a path between E2 and a given curve E0 in that manner. Anotherway of seeing this is that since Z + DO is a generic suborder shared by a lot of
curves, we cannot compute anything that will be specific to a given curve from179

the knowledge of Z + DO only.

7.2

A new NIKE based on a generalization of
SIDH for large prime degrees.

We present here pSIDH (prime-SIDH) a new Non-interactive Key Exchange(NIKE) scheme. It is based on a SIDH-style isogeny diagram (see Section 6.1.1,
Figure 6.1 and Figure 7.1) but with prime degrees.
Validation of public keys. The difference between a NIKE and a simple key
exchange protocol is the validation of public keys. If we cannot verify that the
public key sent by another participant is well-formed, we might be exposed toattacks by malicious adversaries who would create bad keys in order to recover
our secret by observing the failures of the key exchange. For instance, thisis what is done in [GPST16]. SIDH public key validation is an active topic ofresearch [GPST16, FP22, UXT+ 22, DFDGZ21]. The active attacks by malicious
adversaries can be prevented by providing a proof that the public key has been
constructed correctly, or we can use the Fujisaki-Okamoto transform [FO99].
The former is rather costly in the case of SIDH [DFDGZ21] and the latter has
several downsides (e.g. we cannot build a NIKE). A NIKE is a key exchangethat has a validation mechanism to verify correctness of the public keys. The
Elliptic Curve Diffie-Hellman protocol is an example of a very simple NIKE (butit is not post-quantum). The absence of such feature is one of the downsides
of SIDH in comparison to the CSIDH protocol [CLM+ 18]. In fact, CSIDH is
one of the few examples of practical post-quantum secure NIKE. Our protocol
pSIDH is an alternate solution based on different isogeny-based assumptions
than CSIDH.
The pSIDH protocol. The principle of our key exchange is quite simple, as
it is an adaptation of SIDH for prime degrees. For secret keys, we propose to use
ideal representations and then take suborder representations as public keys. The
key exchange will be made possible with the SuborderEvaluation algorithm from
Section 4.3.4. In terms of security, the pSIDH key recovery problem is exactly
the SOIP and the NIKE is secure under the hardness of a decisional variant of
the SOIP similarly to SIDH with the CSSI and SSDDH problems introduced in[JDF11]. We stress that we leave efficiency considerations to future work andmerely show that the scheme can be executed in polynomial-time.
To adapt SIDH to the setting of two prime degrees DA , DB , we need a
new method to compute the codomain of the push-forward isogenies (since theVélu formulas and the algorithms from Section 4.1 are not practical for prime
degrees). If the ideal representations are secret keys and the suborder representations are public keys, the computation of the common key j(E) can bedone as follows. Given an ideal I of norm DA and the suborder Z + DB O,
it is possible to find an element θ ∈ (Z + DB O0 ) ∩ I of norm DA S where S
is a powersmooth integer with the algorithm IdealSuborderEichlerNorm (Algorithm 14). The embedding ιB : Z + DB O0 ,→ End(EB ), is obtained by pushing
forward the embedding of Z+DB O0 inside End(E0 ) through φB and so we have
ιB (θ) = ψA ◦ [φB ]∗ φA where ψA has degree S. Thus, using πB , the suborder

180

ψ̂B
φA

EA

[φA ]∗ φB

E0

E
φB

EB

[φB ]∗ φAψ̂A

Figure 7.1: pSIDH-isogeny diagram.
representation of φB , we can use SuborderEvaluation to compute ker ψ̂A and ψ̂A .
The codomain of ψ̂A is isomorphic to E, and so the common secret j(E) can bederived from that.
These ideas are summarized in Figure 7.1 and the full description of the
key exchange mechanism is given as pSIDHKeyExchange. The key generation
algorithm pSIDHKeyGen is also described as Algorithm 38. To be able to run
this algorithm in polynomial-time, we need to be able to compute efficiently
isogenies of degree ψA and to be able to manipulate the full deg ψA torsion.
This is why we take the degree of ψA as a divisor of a powersmooth integer
T . To be able to apply SuborderEvaluation, we also need that T is coprime tothe degree of the endomorphisms of the suborder representation (so we take T
coprime to ℓ).
The public parameters should include a prime p and a starting curve E0 ,together with a description of End(E0 ).
Algorithm 38 pSIDHKeyGen(D)Input: A prime number D ̸= p.
Output: The pSIDH public key pk = E, π and the pSIDH secret key sk =I where π is a suborder representation and I an ideal representation for(D, E0 , E) ∈ Lp−isog .
1: Sample I as a random O0 -ideal of norm D.
2: Compute π = IdealToSuborder(I) and set E as the domain of the endomorphisms in π.
3: return pk, sk = (E, π), I.

Proposition 7.2.1. (UPHA) pSIDHKeyExchange terminates in expected O(poly(log(pDD′ ))).
Proof. Since B = O(poly(log(pDD′ ))), T can be chosen with a smoothness
bound equal in O(poly(log(pDD′ ))). Thus, the final computation of ψ can bedone in O(poly(log(pD′ D))). The remaining computations terminate in expected O(poly(log(pD′ D))) due to Propositions 3.4.4 and 3.4.6 and Propositions 2.2.4, 4.3.6 and 4.3.8.

181

Algorithm 39 pSIDHKeyExchangeℓ• (I, D′ , E ′ , π)Input: I an ideal of degree D and a prime D′ ̸= D, p. A curve E ′ and asuborder representation π.
Output: A j-invariant or ⊥.
1: Parse π = (O, φ1 , . . . , φn ).
2: Compute θ1 , · · · , θn = GeneratingFamilyℓ• (O0 , D ′ ).
3: if !SuborderVerificationM ((D ′ , E0 , E ′ ), π) or O ≠ O0 then4:
Return ⊥.
5: end if
6: Take a powersmooth integer T coprime to ℓ.
7: Compute L = ConnectingIdeal(O0 , O)
and J = RandomEquivalentPrimeIdeal(L) with J = Lα.
8: Compute θ = IdealSuborderEichlerNormM(T ) (D ′ , J, I).
Qm ei
9: Factorize T =i=1 ℓi .
10: Set G = ⟨0E ′ ⟩.
11: for i ∈ [1, m] do
12:Compute Ji = O0 ⟨α−1 θα, ℓei i ⟩.
13:
G = G + SuborderEvaluation(π, D′ , Ji ).
14: end for
15: Compute ψ : E ′ → E ′ /G.
16: return j(E ′ /G).

Proposition 7.2.2. Let DA , DB ̸= p be two distinct prime numbers. If EA , πA , IA =pSIDHKeyGen(DA ) and EB , πB , IB = pSIDHKeyGen(DB ), thenpSIDHKeyExchange(IA , DB , EB , πB ) = pSIDHKeyExchange(IB , DA , EA , πA ).
Proof. Let us write φA , φB the isogenies corresponding to the two ideals IA , IB .
−1
Then, the quaternion element αA
θA αA obtained at Step 8 during the execution of pSIDHKeyExchange(IA , DB , EB , πB ) corresponds to the endomorphism
ψ0,A ◦ φA ∈ (Z + DB End(E0 )) ∩ IA ,→ End(EB ). Since it is contained in(Z + DB End(E0 )) ∩ IA , this endomorphism is equal to ψA ◦ [φB ]∗ φA whereψ̂A = [φB ]∗ ψ̂A,0 for some isogeny ψA,0 : E0 → EA . In particular, the codomainof ψ̂A is isomorphic to the codomain of [φB ]∗ φA . We can make the same reasoning by swapping A and B and by definition of push-forward isogenies andProposition 4.3.8, the two j-invariants obtained at the end of the two executionsof pSIDHKeyExchange are equal.
Security. By design, we have the algorithm SuborderVerification to validate
public keys, and so we obtain a NIKE. For key validation, the public parameters
for pSIDH also include a value M = pk − 1 as in Proposition 4.3.5. By design,
the pSIDH key recovery problem is simply the SOIP (Problem 7.1.1). To provesecurity of our key exchange, we need a decisional variant, which we call thepSSDDH (prime supersingular DDH) problem (see Problem 7.2.3).
Problem 7.2.3. (pSSDDH) Let DA , DB ̸= p be two distinct prime numbers
and EA , πA , IA = pSIDHKeyGen(DA ) and EB , πB , IB = pSIDHKeyGen(DB ).
The problem is to distinguish between the two distributions:182

1. (EA , πA ), (EB , πB ), EAB where End(EAB ) ∼= OR (IA ∩ IB ).
2. (EA , πA ), (EB , πB ), EC where EC is a random curve NA NB -isogenous toE0 .
With the pSSDDH problem, we can state the security of the key agreement
protocol we just outlined. The proof mimics the one made in [JDF11].
Proposition 7.2.4. Under the pSSDDH assumption, the key-agreement protocol made of pSIDHKeyGen and pSIDHKeyExchangen is session-key secure in theauthenticated-links adversarial model of Canetti and Krawczyk [CK01].

7.2.1

About efficiency

We have proven (at least heuristically) that all our new algorithms can be executed in polynomial time. However, this does not prove anything on the concrete
efficiency. For instance, it would be interesting to compare pSIDH with otherexisting isogeny-based key exchanges. The only thing that we can claim withcertainty is that pSIDH will be a lot slower than SIDH. In fact, we will rather
estimate the complexity of pSIDH by comparing it to that of SQISign. This
comparison is relevant for two reasons: we can take the same size of prime p(and measure relative efficiency by counting the number of operations over Fp2 )and the bottlenecks should be the same. We elaborate on that below.
Our analysis in Section 7.1 indicates that the only security constraint on theprime p is that it needs to be large enough to prevent the exponential attacks
against the endomorphism ring problem. Once p has been fixed, the hardnessof our new SOIP depends on the value of D. The main attack against the SOIP
that we introduce in Section 7.1 has quantum sub-exponential complexity in D.
So we can expect the value of D to be significantly larger than p. This gap
between p and D will also induce a gap between the performances of SQISignand the performances of pSIDH. Based on empirical observations, we can predictthat the bottleneck in our algorithms is going to be the same as the bottleneck in
SQISign’s signature: executions of the IdealToIsogenyFromEichler sub-algorithm.
Our method requires performing a number of arithmetic operations over Fp2 thatis linear in the length of the isogeny to be translated. For SQISign the lengthis equal to O(log(p)) = O(λ) where λ is the security parameter. For pSIDH,
the size estimates from Chapter 3 show that the length is in O(log(pD)). Thus,
we can expect pSIDH to be slower than the signature computation in SQISign(a more concrete analysis is required to obtain a more precise estimate of therelative efficiencies). Since SQISign is orders of magnitude slower than SIDH
we conclude that it will be the same for pSIDH.

7.3

Potential for other cryptographic applications

We have introduced a new NIKE scheme, pSIDH, as a way to illustrate the possibilities offered by our new isogeny representation. When making the comparison
with SIDH, the two main advantages of our construction are the different security assumption and the non-interactive key validation mechanism. These two
properties probably do not make up for the huge efficiency gap between SIDH
183

and pSIDH (see Section 7.2.1) but they could be important for more complicated primitives. As such, pSIDH should only be considered as a first example
of what can be done with our suborder representation. We discuss below otherpotential applications. We propose directions to explore for future work rather
than concrete protocols.
Adaptation of protocols based on SIDH. A lot of isogeny-based primitives are based on the mechanism underlying the SIDH key exchange. We
can mention n-party key exchange [AJJS19], signatures [YAJ+ 17] built upon
the SIDH identification scheme from [JDF11], oblivious transfers [BOBN19,dSGOPS20] and oblivious PRF [BKW20]. It is natural to ask if we can adapt
them to the setting of pSIDH.
A multi-party key exchange can easily be designed in the SIDH setting. It
suffices to take coprime degrees D1 , D2 , . . . , Dn , and the commutative diamondin Figure 7.1 can be extended to a n-dimensional commutative diagram that
leads naturally to a multi-party key exchange. The main problem with thisprotocol in the setting of SIDH is security, as it is under serious threat of themost recent advances on torsion point attacks from [KMP+ 20] (the constructionis broken as soon as n ≥ 6). It seems plausible to adapt this multi-party key
exchange to the setting of pSIDH using the successive suborders Z + Di Dj O,
Z+Di Dj Dk O, . . .. In terms of security, this n-party pSIDH could be addressing
some shortcomings of the SIDH version. Indeed, as explained in Section 7.1, thecomposite version of the SOIP (Problem 7.1.1) appears to be reducing to theprime case, which tends to suggest that the multi-party key exchange could be
as secure as the two-party version. Remains to see how exactly the successive
suborders can be computed from the suborder representations. We leave thatto future work.
The flexibility offered by pSIDH could also be useful in a simpler setting.
Let us assume that there are three parties, Alice, Bob and Charlie, who want toagree on three keys (one for each pair of parties). In the setting of SIDH, they
will need at least 4 public keys. Indeed, if Alice has a key of degree DA and
Bob a key of degree DB , then Charlie will need a key of degree DB (resp. DA )to interact with Alice (resp. Bob). In pSIDH, each party can select a different
degree, and so they need only 3 public keys.
Contrary to the multi-party key exchange, the adaptation of SIDH signatures
to the setting of pSIDH seems like a complicated task. It would require a zeroknowledge ideal-representation proof of knowledge, which seems hard to build.
However, if it is possible to build one, the suborder representation appear likea good starting point, so there could be more to that story.
The OT protocols that we mentioned should not be complicated to adapt to
pSIDH given that they mostly require a DH-like commutative diagram. However, it is not clear that using pSIDH would be more interesting than SIDH forthat primitive.
The oblivious PRF from [BKW20] appears like a more interesting application. First, verifiability is a big issue for this primitive and the construction
proposed in [BKW20] includes some zero-knowledge isogeny proof-of-knowledge,
which are quite expensive and not very compact in the setting of SIDH. Given
that verifying computations is inherently a lot easier with pSIDH, it mightprove a good match. Second, [BKM+ 21] have presented some attacks against184

the SIDH-based OPRF from [BKW20]. These attacks might be avoided witha pSIDH variant. Of course, as for the n-party key exchange, new algorithmic
tools are needed before we can hope to obtain the analog of the OPRF in thesetting of pSIDH, and it requires some more work.
Group action. The sub-exponential quantum attack that we presented in
Section 7.1 was based on the existence of a group action on the set of ideals
of norm D. After a quick glance, it seems like this group action could also
be cryptographically relevant and be used to instantiate the increasing list ofgroup-action based protocols in the literature. It is not exactly clear that thisnew group action could be more interesting than the one based on CSIDH[CLM+ 18], but it is probably worth studying further to better understand thedifferences between the two. One hope is that the structure of the underlying
group could be easier to compute. The signature scheme CSI-FiSh [BKV19]
is a good example of the interest of having computed this structure, but theirsolution, based on the CSIDH group action, does not scale well asymptotically.
If we could do the same with our new group action but without the scaling issue,
it could be interesting.
Zero-knowledge proof of suborder representation knowledge. We mentioned several times already the interest of zero-knowledge proofs of isogeny
knowledge. We know there exist somewhat practical instantiations in the setting of SIDH and CSIDH. We explained and argued that it seems complicatedto do the same with ideal representations. The next natural question is whether
we can hope to do it for the new suborder representations. Proving the knowledge of several endomorphisms of a given norm might be feasible, but making
the additional verification that they generate a specific quaternion order mightprove a lot more arduous. Alas, there does not seem to be an easy way to dothat.
Trapdoor mechanism from endomorphisms revelation. One of the mainnovelties behind our suborder representation construction is the revelation ofsuborders of rank 4 contained inside endomorphism rings of supersingular curves.
Until our work, revealing more than one non-trivial endomorphisms has always
been considered as dangerous, but we conjecture with the hardness of the SOIP
that it is not problematic when done carefully. It might be possible to exploit
this mechanism for further applications. For instance, we can look at the trapdoor one-way function (TOWF) of the SETA scheme from [DFFdSG+ 21]. In
this primitive, the trapdoor is some endomorphism of the public key curve. In
the instantiation proposed in [DFFdSG+ 21], the endomorphism ring of the public key curve is typically computed during key generation, but we could imagine
a situation where one participant P1 generates a curve E (and computes its endomorphism ring along the way) before revealing a well-chosen endomorphismof E to another participant P2 . Then, P2 could use this endomorphism to perform some protocols (for instance the SETA-TOWF) without knowing anythingelse on the curve E.
It seems tempting to try to build IBE from this setting. For instance, themaster public key could be a curve E with the master secret key as End(E),identities would be isogenies from E to curves Eid and the corresponding secret185key would be an endomorphism of Eid that could be used as a SETA secretkey. Unfortunately, it seems hard to choose these secret keys in a way thatwould prevent an adversary who has access to several of them to recover enoughinformation to generate secret keys for himself. Even though IBE appears to beout of reach from this idea, lesser primitives could still be achievable.

186

Bibliography[AABN02]

Michel Abdalla, Jee Hea An, Mihir Bellare, and Chanathip
Namprempre. From identification to signatures via the fiatshamir transform: Minimizing assumptions for security andforward-security. In I nternational Conference on the Theory
and Applications of Cryptographic Techniques, pages 418–433.
Springer, 2002.

[ABLS07]

Noga Alon, Itai Benjamini, Eyal Lubetzky, and Sasha Sodin.
Non-backtracking random walks mix faster. C ommunications
in Contemporary Mathematics, 9(04):585–603, 2007.

[ACC+ 20]

Reza Azarderakhsh, Matthew Campagna, Craig Costello, Luca
De Feo, Basil Hess, Aaron Hutchinson, Amir Jalali, David Jao,
Koray Karabina, Brian Koziel, Brian LaMacchia, Patrick Longa,
Michael Naehrig, Geovandro Pereira, Joost Renes, Vladimir
Soukharev, and David Urbanik. Supersingular isogeny key encapsulation, 2020.

[ACL+ 22]

Sarah Arpin, Mingjie Chen, Kristin E Lauter, Renate Scheidler,
Katherine E Stange, and Ha TN Tran. Orienteering with one
endomorphism. arXiv preprint arXiv:2201.11079, 2022.

[ACVCD+ 19] Gora Adj, Daniel Cervantes-Vázquez, Jesús-Javier ChiDomı́nguez, Alfred Menezes, and Francisco Rodrı́guezHenrı́quez. On the cost of computing isogenies between supersingular elliptic curves. In Carlos Cid and Michael J. Jacobson Jr., editors, S elected Areas in Cryptography – SAC 2018,
pages 322–343, Cham, 2019. Springer International Publishing.
[AFMP20]

Navid Alamati, Luca De Feo, Hart Montgomery, and Sikhar
Patranabis. Cryptographic group actions and applications. In
I nternational Conference on the Theory and Application of
Cryptology and Information Security, pages 411–439. Springer,
2020.

[AIL+ 21]

Laia Amorós, Annamaria Iezzi, Kristin Lauter, Chloe Martindale, and Jana Sotáková. Explicit connections between supersingular isogeny graphs and bruhat–tits trees. C ryptology ePrint
Archive, 2021.

187

[AJJS19]

Reza Azarderakhsh, Amir Jalali, David Jao, and Vladimir
Soukharev. Practical supersingular isogeny group key agreement. I ACR Cryptol. ePrint Arch., 2019:330, 2019.

[AJK+ 16]

Reza Azarderakhsh, David Jao, Kassem Kalach, Brian Koziel,
and Christopher Leonardi. Key compression for isogeny-based
cryptosystems. In P roceedings of the 3rd ACM International
Workshop on ASIA Public-Key Cryptography, pages 1–10.
ACM, 2016.

[Ank52]

Nesmith Cornett Ankeny. The least quadratic non residue.
Annals of mathematics, pages 65–72, 1952.

[Arp22]

Sarah Arpin. Adding level structure to supersingular elliptic
curve isogeny graphs. arXiv preprint arXiv:2203.03531, 2022.

[BCL08]

Reinier Bröker, Denis Charles, and Kristin Lauter. Evaluatinglarge degree isogenies and applications to pairing based cryptography. In I nternational Conference on Pairing-Based Cryptography, pages 100–112. Springer, 2008.

[BCP97]

Wieb Bosma, John Cannon, and Catherine Playoust. The
Magma algebra system. I. The user language. J. Symbolic Comput., 24(3-4):235–265, 1997. Computational algebra and number theory (London, 1993). https://www.math.ru.nl/~bosma/
pubs/JSC1997Magma.pdf.

[BCS97]

Peter Bürgisser, Michael Clausen, and Mohammad Amin
Shokrollahi.
Algebraic complexity theory, volume 315 ofGrundlehren der mathematischen Wissenschaften. Springer,
1997.

[BDFLS20]

Daniel J. Bernstein, Luca De Feo, Antonin Leroux, and Benjamin Smith. Faster computation of isogenies of large prime
degree. ANTS XIV, 2020.

[Bel08]

Juliana V Belding. N umber theoretic algorithms for elliptic
curves. University of Maryland, College Park, 2008.

[BJS14]Jean-François Biasse, David Jao, and Anirudh Sankar. A quantum algorithm for computing isogenies between supersingularelliptic curves. In I nternational Conference on Cryptology inIndia, pages 428–442. Springer, 2014.

[BKM+ 21]

Andrea Basso, Péter Kutas, Simon-Philipp Merz, Christophe
Petit, and Antonio Sanso. Cryptanalysis of an oblivious prf
from supersingular isogenies. C ryptology ePrint Archive, 2021.

[BKV19]Ward Beullens, Thorsten Kleinjung, and Frederik Vercauteren.
Csi-fish: Efficient isogeny based signatures through class group
computations. In I nternational Conference on the Theory andApplication of Cryptology and Information Security, pages 227–
247. Springer, 2019.

188

[BKW20]Dan Boneh, Dmitry Kogan, and Katharine Woo. Oblivious
pseudorandom functions from isogenies. In I nternational Conference on the Theory and Application of Cryptology and Information Security, pages 520–550. Springer, 2020.

[BOBN19]

Paulo Barreto, Glaucio Oliveira, Waldyr Benits, and Anderson
Nascimento. Supersingular isogeny oblivious transfer. In Anais
do XIX Simpósio Brasileiro de Segurança da Informação e deSistemas Computacionais, pages 99–112. SBC, 2019.

[Bos20]Alin Bostan. Computing the N-th term of a q-holonomic sequence. Preprint, 2020. https://specfun.inria.fr/bostan/
NthQhol-s.pdf.

[Boy08]

Xavier Boyen. The uber-assumption family. In Steven D.
Galbraith and Kenneth G. Paterson, editors, P airing-Based
Cryptography - Pairing 2008, Second International Conference,
Egham, UK, September 1-3, 2008. Proceedings, volume 5209
of Lecture Notes in Computer Science, pages 39–56. Springer,
2008.

[Brz83]

Juliusz Brzezinski.
On orders in quaternion algebras.
C ommunications in algebra, 11(5):501–522, 1983.

[BS07]

William D Banks and Igor E Shparlinski. Integers with a largesmooth divisor. I ntegers, 7:A17, 2007.

[BS20]

Xavier Bonnetain and André Schrottenloher. Quantum security
analysis of CSIDH. In Advances in Cryptology - EUROCRYPT
2020, pages 493–522, 2020.

[Cas91]J. W. S. Cassels. Lectures on Elliptic Curves, volume 24 of
London Mathematical Society Student Texts. Cambridge University Press, 1991.

[Cer04]

Juan Marcos Cervino. On the correspondence between supersingular elliptic curves and maximal quaternionic orders. arXiv
preprint math/0404538, 2004.

[CFMR+ 19]

Antoine Casanova, Jean-Charles Faugere, Gilles Macario-Rat,
Jacques Patarin, Ludovic Perret, and Jocelyn Ryckeghem.
GeMSS: a great multivariate short signature. NIST PostQuantum Cryptography Standardization, 2019.

[CH17]

Craig Costello and Hüseyin Hisil. A simple and compact algorithm for SIDH with arbitrary degree isogenies. In ASIACRYPT(2), volume 10625 of Lecture Notes in Computer Science, pages
303–329, 2017. https://eprint.iacr.org/2017/504.

[CJL+ 17]

Craig Costello, David Jao, Patrick Longa, Michael Naehrig,
Joost Renes, and David Urbanik. E fficient Compression of SIDH
Public Keys, pages 679–706. Springer International Publishing,
2017.

189

[CJS14]

Andrew Childs, David Jao, and Vladimir Soukharev. Constructing elliptic curve isogenies in quantum subexponential time.
J ournal of Mathematical Cryptology, 8(1):1–29, 2014.

[CK01]Ran Canetti and Hugo Krawczyk. Analysis of key-exchange
protocols and their use for building secure channels. In
I nternational conference on the theory and applications of cryptographic techniques, pages 453–474. Springer, 2001.

[CK19]

Leonardo Colò and David Kohel. Orienting supersingularisogeny graphs. N umber-Theoretic Methods in Cryptology
2019, 2019.

[CLG09]Denis X. Charles, Kristin E. Lauter, and Eyal Z. Goren. Cryptographic hash functions from expander graphs. J ournal of Cryptology, 22(1):93–113, Jan 2009.

[CLM+ 18]

Wouter Castryck, Tanja Lange, Chloe Martindale, Lorenz
Panny, and Joost Renes. CSIDH: an efficient post-quantum
commutative group action. In I nternational Conference on the
Theory and Application of Cryptology and Information Security,
pages 395–427. Springer, 2018.

[CMN21]

Craig Costello, Michael Meyer, and Michael Naehrig. Sieving fortwin smooth integers with solutions to the prouhet-tarry-escottproblem. In Annual International Conference on the Theory
and Applications of Cryptographic Techniques, pages 272–301.
Springer, 2021.

[Cor08]Giuseppe Cornacchia. Su diPun metodo per la risoluzione innnumeri interi dell’equazione h=0 ch xn−h y h = p. Giornale diMatematiche di Battaglini, 46:33–90, 1908.

[Cos19]Craig Costello. B-SIDH: supersingular isogeny Diffie-Hellman
using twisted torsion, 2019. https://ia.cr/2019/1145.

[Cou06]

Jean Marc Couveignes. Hard homogeneous spaces. I ACR Cryptology ePrint Archive, 2006:291, 2006.

[Cox11]David A Cox. P rimes of the form x2+ ny2: Fermat, class field
theory, and complex multiplication, volume 34. John Wiley &Sons, 2011.

[CPV20]

Wouter Castryck, Lorenz Panny, and Frederik Vercauteren. Rational isogenies from irrational endomorphisms. Advances in
Cryptology–EUROCRYPT 2020, 12106:523, 2020.

[CS18]

Craig Costello and Benjamin Smith. Montgomery curves
and their arithmetic. J ournal of Cryptographic Engineering,8(3):227–240, 2018.

[CSCDJRH20] Jorge Chávez-Saab, Jesús-Javier Chi-Domınguez, SamuelJaques, and Francisco Rodrıguez-Henrıquez. The SQALE of
CSIDH: square-root vélu quantum-resistant isogeny action with190

low exponents. Technical report, Cryptology ePrint Archive,
Report 2020/1520, 2020. https://eprint. iacr. org . . . , 2020.
[CSV21]

Sara Chari, Daniel Smertnig, and John Voight. On basic andbass quaternion orders. P roceedings of the American Mathematical Society, Series B, 8(2):11–26, 2021.

[Dam10]Damgård. On Σ protocols. http://www.cs.au.dk/%7eivan/
Sigma.pdf, 2010.

[Deu41]

Max Deuring. Die Typen der Multiplikatorenringe elliptischer
Funktionenkörper. Abhandlungen aus dem Mathematischen
Seminar der Universität Hamburg, 14(1):197–272, Dec 1941.

[DFDGZ21]

Luca De Feo, Samuel Dobson, Steven D Galbraith, and Lukas
Zobernig. Sidh proof of knowledge. C ryptology ePrint Archive,
2021.

[DFFdSG+ 21] Luca De Feo, Tako Boris Fouotsa, Cyprien Delpechde Saint Guilhem, Péter Kutas, Antonin Leroux, Christophe Petit, Javier Silva, and Benjamin Wesolowski. Séta: Supersingular
encryption from torsion attacks. In ASIACRYPT, 2021.
[DFG19]Luca De Feo and Steven D Galbraith. Seasign: Compact isogeny
signatures from class group actions. In Annual International
Conference on the Theory and Applications of Cryptographic
Techniques, pages 759–789. Springer, 2019.

[DFJP14]

Luca De Feo, David Jao, and Jérôme Plût. Towards quantumresistant cryptosystems from supersingular elliptic curve isogenies. J ournal of Mathematical Cryptology, 8(3):209–247, 2014.

[DFKL+ 20]

Luca De Feo, David Kohel, Antonin Leroux, Christophe Petit,
and Benjamin Wesolowski. Sqisign: compact post-quantum signatures from quaternions and isogenies. In I nternational Conference on the Theory and Application of Cryptology and Information Security, pages 64–93. Springer, 2020.

[DFLW22]

Luca De Feo, Antonin Leroux, and Benjamin Wesolowski. New
algorithms for the deuring correspondence: Sqisign twice as fast.
C ryptology ePrint Archive, 2022.

[DFMS19]

Jelle Don, Serge Fehr, Christian Majenz, and ChristianSchaffner. Security of the fiat-shamir transformation in thequantum random-oracle model. In Annual International Cryptology Conference, pages 356–383. Springer, 2019.

[DG16]

Christina Delfs and Steven D. Galbraith. Computing isogenies
between supersingular elliptic curves over Fp . Designs, Codes
and Cryptography, 78(2):425–440, February 2016.

[DH76]

Whitfield Diffie and Martin Hellman. New directions in cryptography. I EEE transactions on Information Theory, 22(6):644–
654, 1976.
191

[DKL18]

Jean-Marie De Koninck and Patrick Letendre. New upperbounds for the number of divisors function. arXiv preprint
arXiv:1812.09950, 2018.

[Dor87]David R Dorman. Global orders in definite quaternion algebras
as endomorphism rings for reduced cm elliptic curves. T héorie
des nombres (Quebec, PQ, 1987), pages 108–116, 1987.

[dSGOPS20]

Cyprien Delpech de Saint Guilhem, Emmanuela Orsini,
Christophe Petit, and Nigel P Smart. Semi-commutative masking: A framework for isogeny-based protocols, with an application to fully secure two-round isogeny-based ot. In I nternational
Conference on Cryptology and Network Security, pages 235–258.
Springer, 2020.

[EB92]

M Eichler and J Brzezinski. On the imbeddings of imaginary
quadratic orders in definite quaternion orders. J ournal für die
reine und angewandte Mathematik, 426:91–106, 1992.

[EHL+ 18]

Kirsten Eisenträger, Sean Hallgren, Kristin Lauter, Travis Morrison, and Christophe Petit. Supersingular isogeny graphs andendomorphism rings: Reductions and solutions. In Jesper Buus
Nielsen and Vincent Rijmen, editors, Advances in Cryptology– EUROCRYPT 2018, pages 329–368, Cham, 2018. Springer
International Publishing.

[EHL+ 20]

Kirsten Eisenträger, Sean Hallgren, Chris Leonardi, Travis Morrison, and Jennifer Park. Computing endomorphism rings ofsupersingular elliptic curves and connections to path-finding in
isogeny graphs. Open Book Series, 4(1):215–232, 2020.

[Eic36]

Martin Eichler. Untersuchungen in der zahlentheorie der rationalen quaternionenalgebren. J ournal für die reine und angewandte Mathematik, 174:129–159, 1936.

[Eic38]Martin Eichler. Über die Idealklassenzahl total definiter Quaternionenalgebren.
M athematische Zeitschrift, 43(1):102–109,
1938.

[FHK+ 19]

Pierre-Alain Fouque, Jeffrey Hoffstein, Paul Kirchner, Vadim
Lyubashevsky, Thomas Pornin, Thomas Prest, Thomas Ricosset, Gregor Seiler, William Whyte, and Zhenfei Zhang. Falcon:
Fast-Fourier lattice-based compact signatures over NTRU. NIST
Post-Quantum Cryptography Standardization, 2019.

[FKM21]

Tako Boris Fouotsa, Péter Kutas, and Simon-Philipp Merz. On
the isogeny problem with torsion point information. I ACRCryptol. ePrint Arch., 2021:153, 2021.

[FO99]

Eiichiro Fujisaki and Tatsuaki Okamoto. Secure integration ofasymmetric and symmetric encryption schemes. In Annual international cryptology conference, pages 537–554. Springer, 1999.

192

[FP22]

Tako Boris Fouotsa and Christophe Petit. A new adaptive attack
on sidh. In C ryptographers’ Track at the RSA Conference, pages
322–344. Springer, 2022.

[FS86]

Amos Fiat and Adi Shamir. How to prove yourself: Practical solutions to identification and signature problems. In C onference
on the theory and application of cryptographic techniques, pages
186–194. Springer, 1986.

[GHS02]

Steven D Galbraith, Florian Hess, and Nigel P Smart. Extending
the ghs weil descent attack. In I nternational Conference on the
Theory and Applications of Cryptographic Techniques, pages
29–44. Springer, 2002.

[GMW91]

Oded Goldreich, Silvio Micali, and Avi Wigderson. Proofs thatyield nothing but their validity or all languages in np havezero-knowledge proof systems. J ournal of the ACM (JACM),
38(3):690–728, 1991.

[GPS17]

Steven D. Galbraith, Christophe Petit, and Javier Silva. Identification protocols and signature schemes based on supersingularisogeny problems. In ASIACRYPT, 2017.

[GPST16]

Steven D Galbraith, Christophe Petit, Barak Shani, and Yan Bo
Ti. On the security of supersingular isogeny cryptosystems.
In I nternational Conference on the Theory and Application of
Cryptology and Information Security, pages 63–91. Springer,
2016.

[IK21]

Henryk Iwaniec and Emmanuel Kowalski. Analytic number theory, volume 53. American Mathematical Soc., 2021.

[JD11]David Jao and Luca De Feo. Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. In Bo-Yin
Yang, editor, I nternational Workshop on Post-Quantum Cryptography – PQCrypto 2011, pages 19–34, 2011.

[JDF11]David Jao and Luca De Feo. Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. In BoYin Yang, editor, P ost-Quantum Cryptography, pages 19–34,
Berlin, Heidelberg, 2011. Springer Berlin Heidelberg.

[JMV09]D. Jao, S. D. Miller, and R. Venkatesan. Expander graphs
based on GRH with an application to elliptic curve cryptography. J ournal of Number Theory, 129(6):1491–1504, 2009.

[Kan89]Masanobu Kaneko. Supersingular j-invariants as singular moduli
mod p. Osaka Journal of Mathematics, 26(4):849–855, 1989.

[Kat76]

N Katz. An overview of deligne’s proof of the riemann hypothesis
for varieties over finite fields. M athematical developments arising from Hilbert problems (Proc. Sympos. Pure Math., XXVIII,
Northern Illinois Univ., De Kalb, Ill., 1974), pages 275–305,
1976.
193

[Kat10]

Jonathan Katz. Digital signatures. Springer Science & BusinessMedia, 2010.

[KLPT14]David Kohel, Kristin E. Lauter, Christophe Petit, and JeanPierre Tignol. On the quaternion ℓ-isogeny path problem. I ACRCryptology ePrint Archive, 2014:505, 2014.

[KMP+ 20]Péter Kutas, Chloe Martindale, Lorenz Panny, Christophe Petit, and Katherine E Stange. Weak instances of SIDH variants under improved torsion-point attacks. arXiv preprint
arXiv:2005.14681, 2020.

[KMPW21]Péter Kutas, Simon-Philipp Merz, Christophe Petit, and Charlotte Weitkämper. One-way functions and malleability oracles:
Hidden shift attacks on isogeny-based protocols. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 242–271. Springer, 2021.

[Koh96]David Kohel. E ndomorphism rings of elliptic curves over finite
fields. PhD thesis, University of California, Berkeley, 1996.

[Lan87]Serge Lang. Elliptic functions. In E lliptic functions, pages 5–21.
Springer, 1987.

[LB20]

Jonathan Love and Dan Boneh. Supersingular curves with small
noninteger endomorphisms. Open Book Series, 4(1):7–22, 2020.

[Ler21]

Antonin Leroux. A new isogeny representation and applications
to cryptography. C ryptology ePrint Archive, 2021.

[Ler22]

Antonin Leroux. An effective lower bound on the number of orientable supersingular elliptic curves. C ryptology ePrint Archive,
2022.
√
John E Littlewood. On the class-number of the corpus p ( −k).
P roceedings of the London Mathematical Society, 2(1):358–372,
1928.

[Lit28][LPS86]

Alexander Lubotzky, Ralph Phillips, and Peter Sarnak.
Hecke operators and distributing points on the spherei.
C ommunications on Pure and Applied Mathematics,
39(S1):S149–S186, 1986.

[LV15]

Kristin Lauter and Bianca Viray. On singular moduli for arbitrary discriminants. I nternational Mathematics Research Notices, 2015(19):9206–9250, 2015.

[LZ19]

Qipeng Liu and Mark Zhandry. Revisiting post-quantum fiatshamir. In Annual International Cryptology Conference, pages
326–355. Springer, 2019.

[Mon87]

Peter L. Montgomery.
Speeding the Pollard and elliptic
curve methods of factorization. M athematics of Computation,
48(177):243–264, 1987.

194

[MP19]Chloe Martindale and Lorenz Panny. How to not break SIDH.
Cryptology ePrint Archive, Report 2019/558, 2019. https://eprint.iacr.org/2019/558.

[MR18]

Michael Meyer and Steffen Reith. A faster way to the CSIDH.
In INDOCRYPT , volume 11356 of Lecture Notes in Computer
Science, pages 137–152. Springer, 2018. https://ia.cr/2018/
782.

[MS16]

Dustin Moody and Daniel Shumow. Analogues of Vélu’s
formulas for isogenies on alternate models of elliptic curves.
M athematics of Computation, 85(300):1929–1951, 2016. https://ia.cr/2011/430.

[Mum66]David B. Mumford. On the equations defining abelian varieties.
I. I nventiones Mathematicae, 1(4):287–354, 1966. https://dash.harvard.edu/handle/1/3597241.

[NR19]

Michael Naehrig and Joost Renes. Dual isogenies and their application to public-key compression for isogeny-based cryptography. In Steven D. Galbraith and Shiho Moriai, editors, Advancesin Cryptology – ASIACRYPT 2019, pages 243–272, Cham, 2019.
Springer International Publishing.

[Onu21]Hiroshi Onuki. On oriented supersingular elliptic curves. F inite
Fields and Their Applications, 69:101777, 2021.

[PDJ20]Geovandro C. C. F. Pereira, Javad Doliskani, and David Jao. xonly point addition formula and faster torsion basis generation incompressed sike. Cryptology ePrint Archive, Report 2020/431,
2020.

[Pei20]Chris Peikert. He gives C-sieves on the CSIDH. In Advances in
Cryptology - EUROCRYPT 2020, pages 463–492, 2020.

[Pet17]

Christophe Petit. Faster algorithms for isogeny problems using
torsion point images. In I nternational Conference on the Theory
and Application of Cryptology and Information Security, pages
330–353. Springer, 2017.

[Piz80]Arnold Pizer. An algorithm for computing modular forms on
γ0 (n). J ournal of Algebra - J ALGEBRA, 64:340–390, 06 1980.

[Piz90]Arnold K Pizer. Ramanujan graphs and Hecke operators.
B ulletin of the American Mathematical Society, 23(1):127–137,
1990.

[Pol74]

John M. Pollard. Theorems on factorization and primality testing. M athematical Proceedings of the Cambridge Philosophical Society, 76(3):521–528, 1974. https://doi.org/10.1017/
S0305004100049252.

[PS18]

Christophe Petit and Spike Smith. An improvement to thequaternion analogue of the l-isogeny path problem, 2018. Conference talk at MathCrypt.
195

[QKL+ 21]

Victoria de Quehen, Péter Kutas, Chris Leonardi, Chloe Martindale, Lorenz Panny, Christophe Petit, and Katherine E Stange.
Improved torsion-point attacks on sidh variants. In Annual
International Cryptology Conference, pages 432–470. Springer,
2021.

[Ren18]

Joost Renes. Computing isogenies between Montgomery curves
using the action of (0, 0). In P ost-Quantum Cryptography 9th International Conference, PQCrypto 2018, Fort Lauderdale,
FL, USA, April 9–11, 2018, Proceedings, PQCrypto 2018, pages
229–247, 2018. https://ia.cr/2017/1198.

[RS06]

Alexander Rostovtsev and Anton Stolbunov. Public-key cryptosystem based on isogenies, 2006. https://ia.cr/2006/145.

[Sch95]René Schoof. Counting points on elliptic curves over finite fields.
J ournal de théorie des nombres de Bordeaux, 7(1):219–254,
1995.

[Sho97]

Peter W. Shor. Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. S IAM
Journal on Computing, 26(5):1484–1509, 1997.

[Sil86]

Joseph H. Silverman. T he Arithmetic of Elliptic Curves, volume
106 of Gradute Texts in Mathematics. Springer-Verlag, 1986.

[Sim05]

Denis Simon. Quadratic equations in dimensions 4, 5 and more.
P reprint, 2005.

[Stö03]

Carl Störmer. Quelques propriétés arithmétiques des intégrales
elliptiques et leurs applications a la théorie des fonctions entièrestranscendantes. Acta Mathematica, 27:185–208, 1903.

[Sto10]Anton Stolbunov.
Constructing public-key cryptographic
schemes based on class group action on a set of isogenous elliptic
curves. Advances in Mathematics of Communications, 4(2):215,
2010.

[Str76]

Volker Strassen. Einige Resultate über Berechnungskomplexität.
J ahresbericht der Deutschen Mathematiker-Vereinigung, 78:1–
8, 1976.

[Tes06]

Edlyn Teske. An elliptic curve trapdoor system. J ournal of
cryptology, 19(1):115–133, 2006.

[The20]

The PARI Group, Université de Bordeaux. PARI/GP version
2.11.4 , 2020. available from http://pari.math.u-bordeaux.
fr/.

[TU16]

Ehsan Ebrahimi Targhi and Dominique Unruh. Post-quantum
security of the Fujisaki-Okamoto and OAEP transforms. In
T heory of Cryptography Conference, pages 192–216. Springer,
2016.

196

[Unr15]

Dominique Unruh. Non-interactive zero-knowledge proofs in thequantum random oracle model. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pages 755–784. Springer, 2015.

[UXT+ 22]

Rei Ueno, Keita Xagawa, Yutaro Tanaka, Akira Ito, Junko Takahashi, and Naofumi Homma. Curse of re-encryption: A generic
power/em analysis on post-quantum kems. I ACR Transactions
on Cryptographic Hardware and Embedded Systems, pages 296–
322, 2022.

[Vél71]

J. Vélu. Isogénies entre courbes elliptiques. C omptes rendus del’Académie des Sciences, Séries A-B, 273:A238–A241, 1971.

[Ven15]

Daniele Venturi. Zero-knowledge proofs and applications, 2015.

[Vig06]

M-F Vignéras. Arithmétique des algebres de quaternions, volume 800. Springer, 2006.

[Voi13]

John Voight. Identifying the matrix ring: algorithms for quaternion algebras and quadratic forms. In Quadratic and higher
degree forms, pages 255–298. Springer, 2013.

[Voi18]John Voight. Quaternion Algebras. Springer Graduate Texts in
Mathematics series, 2018.

[Voi21]

John Voight. Quaternion algebras. Springer Nature, 2021.

[Wat69]William C. Waterhouse. Abelian varieties over finite fields.
Annales scientifiques de l’École Normale Supérieure, 2(4):521–
560, 1969.

[Wes21]

Benjamin Wesolowski. Orientations and the supersingular endomorphism ring problem. Cryptology ePrint Archive, Report
2021/1583, 2021. https://ia.cr/2021/1583.

[Wes22]

Benjamin Wesolowski. The supersingular isogeny path and endomorphism ring problems are equivalent. In F OCS 2021-62nd
Annual IEEE Symposium on Foundations of Computer Science,2022.

[Wig07]

Carl Severin Wigert. S ur l’ordre de grandeur du nombre desdiviseurs d’un entier. Almqvist & Wiksell, 1907.

[YAJ+ 17]

Youngho Yoo, Reza Azarderakhsh, Amir Jalali, David Jao, andVladimir Soukharev. A post-quantum digital signature scheme
based on supersingular isogenies. In I nternational Conference
on Financial Cryptography and Data Security, pages 163–181.
Springer, 2017.

[ZG85]Don Zagier and B. Gross. On singular moduli. J ournal Fur
Die Reine Und Angewandte Mathematik - J REINE ANGEW
MATH, 1985:191–220, 01 1985.

197

[ZSP+ 18]

Gustavo H. M. Zanon, Marcos A. Simplicio, Geovandro C.
C. F. Pereira, Javad Doliskani, and Paulo S. L. M. Barreto.
Faster isogeny-based compressed key agreement. In Tanja Lange
and Rainer Steinwandt, editors, P ost-Quantum Cryptography,
pages 248–268. Springer International Publishing, 2018.

198