Constructing Cycles in Isogeny Graphs of Supersingular Elliptic Curves

Guanju Xiao; Lixia Luo; Yingpu Deng

doi:10.1515/jmc-2020-0029

Article Open Access

Constructing Cycles in Isogeny Graphs of Supersingular Elliptic Curves

Guanju Xiao , Lixia Luo and Yingpu Deng

Published/Copyright: May 15, 2021

Published by

Become an author with De Gruyter Brill

Submit Manuscript Author Information

From the journal Journal of Mathematical Cryptology Volume 15 Issue 1

Abstract

Loops and cycles play an important role in computing endomorphism rings of supersingular elliptic curves and related cryptosystems. For a supersingular elliptic curve E defined over 𝔽_p², if an imaginary quadratic order O can be embedded in End(E) and a prime L splits into two principal ideals in O, we construct loops or cycles in the supersingular L-isogeny graph at the vertices which are next to j(E) in the supersingular ℓ-isogeny graph where ℓ is a prime different from L. Next, we discuss the lengths of these cycles especially for j(E) = 1728 and 0. Finally, we also determine an upper bound on primes p for which there are unexpected 2-cycles if ℓ doesn’t split in O.

Keywords: Elliptic Curves; Isogeny Graphs; Loops; Cycles

MSC 2010: 11G05; 11G15; 14H52; 94A60

1 Introduction

Elliptic curves over finite fields play an important role in cryptography. A recent research area, called isogeny-based cryptography, studies cryptosystems whose security is based on the difficulty of finding a path in isogeny graphs of supersingular elliptic curves. Moreover, the only known quantum algorithm for this problem, due to Biasse, Jao and Sankar [2], has exponential complexity. Until now, the efficient algorithms in [7, 12] to compute endomorphism rings or isogenies between supersingular elliptic curves use the isogeny graph, which is a Ramanujan graph introduced in [16]. These algorithms have exponential complexity.

Let 𝔽_p be a finite field of characteristic p with p > 3, and let 𝔽¯p denote its algebraic closure. Let ℓ be a prime different from p. The supersingular isogeny graph 𝒢ℓ(𝔽¯p) is a directed graph whose vertices are the 𝔽¯p -isomorphism classes of supersingular elliptic curves defined over 𝔽¯p , and whose directed arcs represent ℓ-isogenies (up to a certain equivalence) defined over 𝔽¯p . We label the vertices of 𝒢ℓ(𝔽¯p) with their j-invariants.

Cryptographic applications based on the hardness of computing isogenies between supersingular elliptic curves were first proposed in 2006. Charles, Goren and Lauter constructed a hash function in [3] from the supersingular isogeny graph 𝒢ℓ(𝔽¯p) . Finding collisions for the CGL hash function is connected to finding loops or cycles in the supersingular isogeny graph 𝒢ℓ(𝔽¯p) .

In 2011, Jao and De Feo [10] (see also [6]) presented a key agreement scheme whose security is based on the hardness of finding paths in the isogeny graph 𝒢ℓ(𝔽¯p) for small ℓ (typically ℓ = 2, 3). There is also a submission [5] to the NIST PQC standardization competition based on supersingular isogeny problems. Moreover, Eisenträger et al. [9] proved that finding paths in the supersingular ℓ-isogeny graph is equivalent to computing the endomorphism rings of supersingular elliptic curves. Constructing cycles in supersingular isogeny graphs is important in algorithmic number theory and cryptography.

Adj et al. [1] defined the supersingular isogeny graph 𝒢_ℓ(𝔽_p²) whose vertices are (representatives of) the 𝔽_p²-isomorphism classes of supersingular elliptic curves defined over 𝔽_p², and whose directed arcs represent degree-ℓ𝔽_p²-isogenies between the elliptic curves. Adj et al. [1] described clearly the three subgraphs of 𝒢_ℓ(𝔽_p²), denoted respectively by 𝒢_ℓ(𝔽_p², 0), 𝒢_ℓ(𝔽_p², −p), and 𝒢_ℓ(𝔽_p², p), whose vertices correspond to supersingular elliptic curves E over 𝔽_p² with t = p² + 1 − #E(𝔽_p²) ∈ {0, −p, p}, and they also proved the following result:

𝒢ℓ(𝔽¯p)≅𝒢ℓ(𝔽p2,2p)≅𝒢ℓ(𝔽p2,-2p).

Moreover, Adj et al. and Ouyang-Xu [15] proved the following results about the loops at the vertices 1728 and 0 in 𝒢_ℓ(𝔽_p², 2p). For ℓ > 3 a prime integer, if p ≡ 3 mod 4 and p > 4ℓ, there are either 2 or 0 loops at 1728 if ℓ ≡ 1 mod 4 or 3 mod 4 respectively; and if p ≡ 2 mod 3 and p > 3ℓ, there are either 2 or 0 loops at 0 if ℓ ≡ 1 mod 3 or 2 mod 3 respectively. Li-Ouyang-Xu [13] also described the neighborhood of vertices 1728 and 0 in 𝒢ℓ(𝔽¯p) .

The methods in [15] and [13] are based on the knowledge of the endomorphism rings of the supersingular elliptic curves corresponding to the vertices 0 and 1728. For a general supersingular elliptic curve E, it is very difficult to compute the endomorphism ring End(E), but we may know a non-trivial endomorphism of E. Assume an imaginary quadratic order O can be embedded in the endomorphism ring of E, we construct loops or cycles in the supersingular L-isogeny graph if a prime L splits into two principal ideals in O. We also discuss the lengths of these cycles. Since the results for j = 1728 and 0 are more explicit, we will discuss these special cases separately. For a prime p, the vertices in different supersingular isogeny graphs are the same, and our results show a deeper connection between these supersingular isogeny graphs. In this paper, a m-cycle means a simple cycle (as defined in [12]) with m vertices and a loop is a 1-cycle. We will denote by ℓ and L two different primes.

The remainder of this paper is organized as follows. In Section 2, we provide preliminaries on elliptic curves over finite fields, maximal orders of B_p,∞ and modular polynomials. We construct loops and cycles in Section 3 and discuss the lengths of these cycles in Section 4. In Section 5, we determine an upper bound on primes p for which there are unexpected 2-cycles in 𝒢L(𝔽¯p) . Finally, we make a conclusion in Section 6.

2 Preliminaries

2.1 Elliptic Curves over Finite Fields

We recall basic facts about elliptic curves over finite fields. The general references are [18, 22]. In the remainder of this paper, p and ℓ will denote different prime integers with p > 3.

Let 𝔽_q be a finite extension of 𝔽_p, and let 𝔽¯p be its algebraic closure. An elliptic curve E over a finite field 𝔽_q is defined by a Weierstrass equation Y² = X³ + aX + b where a, b ∈ 𝔽_q and 4a³ + 27b² ≠ 0. The chord-and-tangent addition law makes of E(𝔽q)={(x,y)∈𝔽q2:y2=x3+ax+b}∪{∞} an abelian group, where ∞ is the point at infinity. For any integer n ≥ 2 with p ∤ n, the group of n-torsion points on E is isomorphic to ℤ_n ⊕ ℤ_n. In particular, if n is prime then E has exactly n + 1 distinct subgroups of order n.

Let E₁ and E₂ be elliptic curves defined over 𝔽_q. An isogeny from E₁ to E₂ is a morphism ϕ : E₁ → E₂ satisfying ϕ(∞) = ∞. In this paper, the isogenies are always nonconstant. An isogeny ϕ is a surjective group homomorphism with finite kernel. Every 𝔽_q-isogeny can be represented as ϕ = (r₁(X), r₂(X) · Y) where r₁, r₂ ∈ 𝔽_q(X). Let r₁(X) = p₁(X)/q₁(X), where p₁, q₁ ∈ 𝔽_q[X] with gcd(p₁, q₁) = 1. The degree of ϕ is max(deg p₁, deg q₁) and ϕ is said to be separable if r1′(X)≠0 . Note that all isogenies of prime degree ℓ ≠ p are separable. If ϕ : E₁ → E₂ is an isogeny of degree m, then there exists a unique isogeny ϕ^:E2→E1 satisfying ϕ^∘ϕ=[m] and ϕ∘ϕ^=[m] , where [m] is the multiplication-by-m map with degree m². We call ϕ^ the dual of ϕ. The following lemma is in chapter 3 of [18].

Lemma 1

Let ϕ : E₁ → E₂ and ψ : E₁ → E₃ be nonconstant isogenies, and assume that ϕ is separable. If ker(ϕ) ⊆ ker(ψ), then there is a unique isogeny λ : E₂ → E₃ satisfying ψ = λ ∘ ϕ.

An endomorphism of E is an isogeny from E to itself. The Frobenius map π : (x, y) ⟼ (x^q, y^q) is an inseparable endomorphism. The characteristic polynomial of π is x² − tx + q, where t is the trace of π and the Hasse’s Theorem implies that |t|≤2q and #E(𝔽_q) = q + 1 − t. Tate’s Theorem asserts that E₁ and E₂ are 𝔽_q-isogenous if and only if #E₁(𝔽_q) = #E₂(𝔽_q). It is well known that E is supersingular (resp. ordinary) if and only if p | t (resp. p ∤ t).

The j-invariant of E is j(E) = 1728 · 4a³/(4a³ + 27b²). One can easily check that j(E) = 0 if and only if a = 0, and j(E) = 1728 if and only if b = 0. Different elliptic curves with the same j-invariant are isomorphic over the algebraic closure 𝔽¯p . An automorphism of E is an isomorphism from E to itself. The group of all automorphisms of E that are defined over 𝔽¯p is denoted by Aut(E). As we know (see [18, Chapter 3.10]), Aut(E) ≅ {±1} if j(E) ≠ 0, 1728. If j(E) = 1728, then Aut(E) is a cyclic group of order 4 with generator θ : (x, y) ⟼ (−x, iy) where i is a primitive fourth root of unity. If j(E) = 0, then Aut(E) is a cyclic group of order 6 with generator ω : (x, y) ⟼ (ηx, −y) where η is a primitive third root of unity.

Moreover, the j-invariant of any supersingular elliptic curve over 𝔽¯p is proved to be in 𝔽_p² [18] and it is called a supersingular j-invariant. From now on, we suppose that E is supersingular, and, since j(E) ∈ 𝔽_p², we assume that E is defined over 𝔽_p². Schoof [17] determined the number of isomorphism classes of elliptic curves over a finite field. The number of supersingular j-invariants is [p12]+ϵ , where ɛ = 0, 1, 1, 2 if p ≡ 1, 5, 7, 11 (mod 12) respectively.

The supersingular isogeny graph 𝒢ℓ(𝔽¯p) is a Ramanujan graph (see [3]) whose vertices are the supersingular j-invariants and edges are equivalent classes of ℓ-isogenies defined over 𝔽¯p . Let ϕ₁, ϕ₂ : E(j₁) → E(j₂) be two ℓ-isogenies defined over 𝔽¯p . We say that ϕ₁ and ϕ₂ are equivalent if they have the same kernel, or equivalently, if there exists an automorphism ρ₂ ∈ Aut(E(j₂)) such that ϕ₂ = ρ₂ ∘ ϕ₁. Adj et al. proved 𝒢ℓ(𝔽p2,2p)≅𝒢ℓ(𝔽p2,-2p)≅𝒢ℓ(𝔽¯p) . In the remainder of this paper, we will use the symbol 𝒢ℓ(𝔽¯p) .

2.2 Endomorphism Ring and Quaternion Algebra

If E is a supersingular elliptic curve, the endomorphism ring End(E) is a maximal order of B_p,∞ where B_p,∞ is a quaternion algebra [20, 21] defined over ℚ and ramified at p and ∞. The reduced trace Trd and the reduced norm Nrd of α ∈ B_p,∞ are defined as:

Trd(α)=α+α¯, Nrd(α)=αα¯

where α¯ is the canonical involution of α.

An order 𝒪 of B_p,∞ is a subring of B_p,∞ which is also a lattice, and it is called a maximal order if it is not properly contained in any other order. Two orders 𝒪₁ and 𝒪₂ are equivalent if and only if there exists α∈Bp,∞* such that 𝒪₁ = α⁻¹𝒪₂α. For 𝒪 a maximal order of B_p,∞, let I be a left ideal of 𝒪. Define the left order 𝒪_L(I) and the right order 𝒪_R(I) of I by

𝒪L(I)={x∈Bp,∞:xI⊆I}, 𝒪R(I)={x∈Bp,∞:Ix⊆I}.

Moreover, 𝒪_L(I) = 𝒪 and 𝒪_R(I) = 𝒪′ is also a maximal order, in which case we say that I connects 𝒪 and 𝒪′. Moreover, if 𝒪 is maximal, then 𝒪_R(I) = 𝒪 if and only if I is principal. The reduced norm of I can be defined as

Nrd(I)=gcd({Nrd(α)|α∈I}).

Fix a maximal order 𝒪. Any left ideal of 𝒪 with reduced norm ℓ can be written as I = 𝒪ℓ + 𝒪α where α ∈ 𝒪 is such that ℓ | Nrd(α). For any I₁, I₂ left ideals of 𝒪, I₁ and I₂ belong to the same ideal class if and only if there exists an element μ∈Bp,∞* such that I₁ = I₂µ. Moreover, if Nrd(I₁) = Nrd(I₂), then Nrd(µ) = 1. Let X_ℓ be the set of all left 𝒪-ideals of reduced norm ℓ, there are ℓ + 1 ideals in X_ℓ. Given a quadratic order O and a maximal order 𝒪 of B_p,∞, we say that O is optimally embedded in 𝒪 if O = 𝒪 ∩ K for some subfield K ⊆ B_p,∞.

A theorem by Deuring [8] gives an equivalence of categories between the supersingular j-invariants and the maximal orders in the quaternion algebra B_p,∞. Furthermore, if E is an elliptic curve with End(E) = 𝒪, there is a one-to-one correspondence between isogenies ϕ : E → E′ and left 𝒪-ideals I. More details on the correspondence can be found in Chapter 42 of [21].

2.3 j-Function and Modular Polynomials

In this subsection, we present some properties of the j-function. The reader can refer to [4, 22] for more details. Given τ in the upper half plane ℋ, we get a lattice [1, τ] and the j-function j(τ) is defined by

j(τ)=j([1,τ])=1728(1+240∑k=1∞k3qk1-qk)3(1+240∑k=1∞k3qk1-qk)3-(1-504∑k=1∞k5qk1-qk)2.

Let K be an imaginary quadratic field. If τ ∈ K \ ℚ, then L = [1, τ] is a lattice in K. We can define the order O of L to be the set of elements λ ∈ K such that λL ⊆ L. It is well known that the elliptic curve E(j(τ)) defined over ℂ with j-invariant j(τ) has complex multiplication by O. Cox lists the 13 orders with class number one and the corresponding j-invariants in §12 of [4].

Deuring’s reducing and lifting theorems in [8] describe the structures of endomorphism rings which are preserved in passing between elliptic curves over every field.

For any τ ∈ ℋ, the complex numbers j(τ) and j(Nτ) are the j-invariants of elliptic curves defined over ℂ that are related by an isogeny whose kernel is a cyclic group of order N. The minimal polynomial Φ_N(Y) of the function j(Nz) over the field ℂ(j(z)) has coefficients that are integer polynomials in j(z). If we replace j(z) with X, we obtain the modular polynomial Φ_N ∈ ℤ[X, Y] which is symmetric in X and Y and has degree N∏ℓ|N(1+1ℓ) in both variables.

When N is a prime integer, every N-isogeny is cyclic, and we have

ΦN(j(E1),j(E2))=0⇔E1 and E2 are N-isogenous.

This moduli interpretation remains valid over every field, even those of positive characteristic.

3 Constructing Cycles

In this section, we will construct loops or cycles at some vertices in supersingular isogeny graphs. We assume that L and ℓ are different primes.

Let E be a supersingular elliptic curve defined over 𝔽_p², and assume that an imaginary quadratic order ℤ[τ] can be optimally embedded in 𝒪 ≅ End(E). Suppose E[ℓ] = ⟨P, Q⟩, where P and Q are two linearly independent ℓ-torsion points. Recall that there are ℓ + 1 subgroups of E[ℓ] with order ℓ. If G_n is one of these ℓ + 1 subgroups, then ϕ_n : E → E_n(≅ E/G_n) is an ℓ-isogeny with kernel G_n. Let 𝒢L(𝔽¯p,ℓ+1) denote the subgraph of 𝒢L(𝔽¯p) which consists of j(E_n) for n = 0, . . . , ℓ. We have the following theorem.

Theorem 1

If an imaginary quadratic order ℤ[τ] is optimally embedded in 𝒪 ≅ End(E), then there are loops or cycles at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) for every n ∈ {0, . . . , ℓ} where L splits into two principal ideals in ℤ[τ].

Proof

We assume τ=-d where d is a positive integer, and the other case τ=1+-d2 can be proved similarly.

If ℤ[-d] is optimally embedded in End(E), then ℤ[ℓ-d] can be embedded in 𝒪_n where 𝒪_n is the endomorphism ring of E_n. Since L splits into two principal ideals in ℤ[-d] , we can write L = a² + db² with a, b ∈ ℤ.

If ℓ | b, then L can be written as L=αα¯ with α, α¯∈ℤ[ℓ-d] . In this case, there are at least 2 loops at j(E_n) for n = 0, . . . , ℓ in 𝒢L(𝔽¯p,ℓ+1) .

If ℓ ∤ b, then [a±b-d](E[ℓ])=E[ℓ] since deg([a±b-d])=L≠ℓ . In other words, [a±b-d] is a bijection on E[ℓ], so that [a±b-d] acts as a permutation on the set of subgroups {G_i}_i=0,...,ℓ. Considering the following two isogenies:

Ψn,±:En→ϕ^nE→[ a±b−d ]E

where ϕ^n is the dual isogeny of ϕ_n, we have Ψn,+(En[ℓ])=[a+b-d](Gn) (resp. Ψn,-(En[ℓ])=[a-b-d](Gn) ) is the kernel of some ϕ_n₁ (resp. ϕ_n₂). The isogenies ϕ_n₁ ∘ Ψ_n,+ : E_n → E_n₁ and ϕ_n₂ ∘ Ψ_n,− : E_n → E_n₂ factor through [ℓ] ∈ End(E_n) by Lemma 1, so there are two L-isogenies Ψ_n,+ : E_n → E_n₁ and Ψ_n,− : E_n → E_n₂ such that ϕ_n₁ ∘ Ψ_n,+ = Ψ_n,+ ∘ [ℓ] and ϕ_n₂ ∘Ψ_n,− = Ψ_n,− ∘ [ℓ]. Since ker(ψn,+)⊆ker([L])∩ker([ℓ(a+b-d)]) and gcd(deg([L]), deg([ℓ(a+b-d)]))=L , the kernel ideal of Ψ_n,+ is In,1=(L,ℓ(a+b-d)) . Similarly, the kernel ideal of Ψ_n,− is In,2=(L,ℓ(a-b-d)) .

If E_n₁ is isomorphic to E_n, then I_n,1 is a principal left ideal of 𝒪_n and Ψ_n,+ is an endomorphism of E_n. Because I_n,2 is the conjugate ideal of I_n,1, I_n,2 is also principal and Ψ_n,− is an endomorphism of E_n. In this case, j(E_n₂) = j(E_n₁) = j(E_n) and we construct two loops at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) .

If E_n₁ is not isomorphic to E_n and E_n₁ is isomorphic to E_n₂, then j(E_n₁) = j(E_n₂) and Ψ_n,+ and Ψ_n,− are two different L-isogenies since I_n,1 ≠ I_n,2. Therefore ψ^n,-∘ψn,+ and ψ^n,+∘ψn,- are two 2-cycles at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) . Furthermore, we have 𝒪_n₁ = 𝒪_n₂ and the right order of I_n,1 and I_n,2 is 𝒪_n₁, so the right order of I_n₁,1 and I_n₁,2 is 𝒪_n. Since the corresponding isogenies of I_n₁,1 and I_n₁,2 are Ψ_n₁,+ and Ψ_n₁,−, we also construct two 2-cycles at j(E_n₁) in 𝒢L(𝔽¯p,ℓ+1) .

If E_n, E_n₁ and E_n₂ are not isomorphic, we denote the target elliptic curve of Ψ_n₁,+ by E_n₃. We have that E_n₃ is not isomorphic to E_n or E_n₁, otherwise there exists a contradiction with the above two cases. If E_n₃ is isomorphic to E_n₂, then Ψ_n₂,+ ∘ Ψ_n₁,+ ∘ Ψ_n,+ is a cycle through j(E_n), j(E_n₁) and j(E_n₂) in 𝒢L(𝔽¯p,ℓ+1) . If E_n₃ is not isomorphic to E_n₂, we denote the target elliptic curves of Ψ_n₃,+ by E_n₄. We have that E_n₄ is not isomorphic to E_n₁ or E_n₃, Moreover, we claim that E_n₄ is not isomorphic to E_n. If E_n₄ is isomorphic to E_n, then the dual of Ψ_n₃,+ is Ψ_n,− which is the dual of Ψ_n₂,+. This means that E_n₃ is isomorphic to E_n₂, so we get a contradiction. If E_n₄ is isomorphic to E_n₂, then we construct a cycle through j(E_n), j(E_n₁), j(E_n₃) and j(E_n₂) in 𝒢L(𝔽¯p,ℓ+1) . The following process is similar. Since there are at most ℓ + 1 vertices, we construct cycles at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) .

Remark 3.1

If ℤ[-d] can be embedded in the endomorphism ring of E_n, then I_n,1 and I_n,2 are principal and there exist two loops at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) .

The following example illustrates Theorem 1.

Example 1

Let p = 3461 and ℓ = 5. Since (-73461)=-1 , j(-7)=2553≡3185mod3461 is a supersingular j-invariant in 𝔽_p. Let 𝔽_p² = 𝔽_p(β) where β² + β + 1 = 0 in 𝔽_p². The solutions of Φ₅(X, 3185) are j₀ = 819, j₁ = 2402, j₂ = 2591β + 1415, j₃ = 1039β + 2586, j₄ = 870β + 2285 and j₅ = 2422β + 1547 in 𝔽_p². By computing modular polynomials [19], we get the subgraph 𝒢L(𝔽¯p,ℓ+1) which consists of these 6 vertices.

For L = 11 = 2² + 7 · 1², we have the following graph 𝒢11(𝔽¯3461,6) .

For L = 23 = 4² + 7 · 1², we have the following graph 𝒢23(𝔽¯3461,6) .

Next, we will discuss the usefulness of Theorem 1 in CGL hash function and the imaginary quadratic order O which can be embedded in 𝒪 ≅ End(E). The following example implies that we can find cycles in supersingular isogeny graphs by Theorem 1.

Example 2

Let p = 12601 ≡ 6 mod 11, we have that j(1+-112)=-323≡5035 is a supersingular j-invariant in 𝔽_p. Moreover 4825 is a root of H₋₄₄(x) in 𝔽_p and j₀ = 5035, j₁ = 7022β + 1350 and j₂ = 5579β + 1350 are the vertices next to 4825 in 𝒢2(𝔽¯p) where β² + 11 = 0 in 𝔽_p². We have the following subgraph of 𝒢47(𝔽¯p) which consists of j₀, j₁ and j₂.

Charles, Goren and Lauter proved in [3] that if 𝒢2(𝔽¯p) has no 2-cycles then p ≡ 1 mod 840. In this example, we construct 2-cycles in 𝒢47(𝔽¯p) for p = 12601 ≡ 1 mod 840.

Based on Theorem 1 and these examples, we can say more about the collision resistance of the hash function defined in [3]. In addition to choosing an appropriate prime p as discussed in [3], the prime ℓ cannot split in imaginary quadratic orders which can be embedded in the endomorphism rings.

The order ℤ[τ] plays an important role in Theorem 1. What can we say about the discriminant of ℤ[τ]? Kaneko [11] proved that the endomorphism ring of any supersingular elliptic curve defined over 𝔽_p contains an imaginary quadratic order O_−D with discriminant −D satisfying D≤43p . Recently, Love and Boneh [14] proved that the endomorphism ring of any supersingular elliptic curve contains an imaginary quadratic order O_−D with D<2p23+1 .

4 Lengths of These Cycles

We will discuss the lengths of the cycles which we construct in Section 3. We also assume that ℤ[τ] is optimally embedded in 𝒪 ≅ End(E). As in the proof of Theorem 1, Ψ_n,+ : E_n → E_n₁ and Ψ_n,− : E_n → E_n₂ are two L-isogenies. If ℤ[τ] can be embedded in 𝒪_n ≅ End(E_n), then I_n,1 and I_n,2 are principal and we construct two loops at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) . If Lℤ[ℓτ] = 𝔏𝔏^′, we define m to be the order of 𝔏 in the class group of ℤ[ℓτ]. Let D be the absolute value of the discriminant of ℤ[τ], then D = 4d if τ=-d and D = d if τ=1+-d2 with d ≡ 3 mod 4.

Theorem 2

Suppose j(E) ≠ 0, 1728. Assume that ℤ[τ] and ℤ[ℓτ] are optimally embedded in 𝒪 and 𝒪_n respectively where E and E_n are ℓ-isogenous. If p > ℓ²LD and ℓ does not split in ℤ[τ], then there exist two m-cycles at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) where L splits into two principal ideals in ℤ[τ].

Proof

Since j(E) ≠ 0, 1728, we have ℤ[τ] ≠ ℤ[i], ℤ[1+-32] and the unit group of ℤ[τ] is {±1}. If τ=-d and write L=(a+b-d)(a-b-d) , then m is the smallest positive integer such that (a+b-d)m=x+y-d with ℓ | y.

If ℓ | b, then m = 1 and we construct two loops at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) . We assume ℓ ∤ b in the following.

We claim that E_n is not isomorphic to E_n₁ or E_n₂. If E_n is isomorphic to E_n₁, then the right order of In,1=(L,ℓ(a+b-d)) is 𝒪_n and I_n,1 is principal. There exists an element α ∈ 𝒪_n such that Nrd(α) = L. We are under the assumption that ℤ[ℓτ] is optimally embedded in 𝒪_n and ℓ ∤ b, so α ∉ ℤ[ℓτ]. The absolute value D^′ of the discriminant of ℤ[α] satisfies D^′ ≤ 4Nrd(α) = 4L. By Theorem 2 in [11], we have 4p < 4ℓ²DL since two different imaginary orders ℤ[ℓτ] and ℤ[α] can be embedded in 𝒪_n. If p > ℓ²LD, then such α does not exist and I_n,1 is not principal.

If m = 2, then [a±b-d]2(Gn)=Gn . Since j(E_n) ≠ j(E_n₁), Ψ_n₁,+ ∘ Ψ_n,+ : E_n → E_n₁ → E_n is a 2-cycle at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) . In this case, ψn,-=ψ^n1,+ and j(E_n₁) = j(E_n₂).

If m > 2, then [a+b-d]m(Gn)=[x+y-d](Gn)=Gn and j(E_n₁) ≠ j(E_n₂). The composition of the following 3m isogenies

En→ϕ^nE→[ a+b−d ]E→ϕn1En1→ϕ^n1E→[ a+b−d ]…→E→[ a+b−d ]E→ϕnEn

factors through [ℓ^m].

As in the proof of Theorem 1, the isogenies E_n → E → E → E_n₁ factor through [ℓ] ∈ End(E_n) and we get an L-isogeny Ψ_n,+ : E_n → E_n₁. By repeating the process, we get a cycle E_n → E_n₁ → . . . → E_n in the L-isogeny graph. We want to prove that the cycle E_n → E_n₁ → . . . → E_n is simple, which means that every vertex in this cycle appears only once. Rewrite the isogenies as following:

(1) En→ϕ^nE→[ a+b−d ]E→[𝓁]E→[ a+b−d ]…→E→[ a+b−d ]E→ϕnEn.

First, we claim that different G_n’s generate non-isomorphic elliptic curves, so the isogeny E_n → E_n₁ → . . . can return to E_n if and only if there exists a positive integer k such that [a+b-d]k(Gn)=Gn .

Let I_s and I_t be the kernel ideals of ϕ_s : E → E_s and ϕ_t : E → E_t with s, t ∈ {0, 1, . . . , ℓ}. We recall that E_s and E_t are isomorphic if and only if there exists an element μ∈Bp,∞* such that I_sµ = I_t with Nrd(µ) = 1 and µ ≠ ±1. Moreover, ℓ ∈ I_s, so ℓµ ∈ I_t ⊆ 𝒪. If ℓ does not split in ℤ[τ], then there exists an element β ∈ 𝒪 with Nrd(β) = ℓ² but β ∉ ℤ[τ]. Then ℤ[β] is an imaginary quadratic order which can be embedded in 𝒪, and the absolute value D^′′ of the discriminant of ℤ[β] satisfies D^′′ ≤ 4Nrd(β) = 4ℓ². By Theorem 2 in [11], we have 4p < 4ℓ²D since ℤ[τ] and ℤ[β] are embedded in 𝒪. If p > ℓ²LD > ℓ²D, then such µ does not exist and E_s is not isomorphic to E_t. Moreover, we have proved that different G_n’s generate non-isomorphic elliptic curves.

Next, we prove [s+t-d](Gn)=Gn if and only if ℓ|t for s, t ∈ ℤ, so m is the smallest positive integer such that [a+b-d]m(Gn)=Gn . If ℓ | t, then [s+t-d](Gn)=Gn . On the contrary, if [s+t-d](Gn)=Gn , then [s+t-d]P∈Gn for any P ∈ G_n. We have [t-d]P∈Gn for any P ∈ G_n, then ℓ | t and [t-d]P=∞ . If not, we have [-d]P∈Gn and [a+b-d](Gn)⊆Gn which is a contradiction.

We have proved that the cycle E_n → E_n₁ → . . . → E_n is an m-cycle. Moreover, since [a-b-d]m=x-y-d , there is another m-cycle at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) .

If τ=1+-d2 , the proof is similar.

Remark 4.1

Assume ℓ splits in ℤ[τ], we can discuss whether I_s and I_t are in the same class as in [13] if we know the endomorphism ring of E. In general, if p > ℓ²LD and ℓ splits in ℤ[τ], we can construct two cycles with lengths m at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) without backtracking but they may not be simple.

The following example shows that the conditions in Theorem 2 are not necessary.

Example 3

Because j₀, . . . , j₅ are different in Example 1, the conclusion of Theorem 2 also holds even if p = 3461 < 5² × 28L. Since the class number of ℤ[-7] is one, by Deuring’s reducing and lifting theorems, ℤ[5-7] is optimally embedded in 𝒪_n ≅ End(E(j_n)) for n = 0, . . . , 5. For 11=(2+-7)(2--7) , we compute m = 3, so there exist 3-cycles at j_n in 𝒢11(𝔽¯p,ℓ+1) by Theorem 2. For L = 23 = 4² + 7 · 1², we compute m = 6, so there exist 6-cycles at j_n in 𝒢23(𝔽¯p,ℓ+1) by Theorem 2.

In the following of this section, we will deal with the special cases when j(E) = 1728 or 0. Let us recall a result in [13]:

Lemma 2

Suppose ℓ > 3.

(1) If p ≡ 3 mod 4 and p > 4ℓ², there are 12(ℓ-(-1ℓ)) vertices adjacent to 1728 in 𝒢ℓ(𝔽¯p) , each connecting 1728 with 2 edges.

(2) If p ≡ 2 mod 3 and p > 3ℓ², there are 13(ℓ-(ℓ3)) vertices adjacent to 0 in 𝒢ℓ(𝔽¯p) , each connecting 0 with 3 edges.

For j(E) = 1728, first, we suppose ℓ > 3. If p ≡ 3 mod 4 and p > 4ℓ², by Lemma 2, we can label the vertices adjacent to 1728 in 𝒢ℓ(𝔽¯p) with j_n for n=1,…,12(ℓ-(-1ℓ)) and denote E_n = E(j_n). We know ℤ[i] is optimally embedded in End(E(1728)).

Theorem 3

Let ℓ be an odd prime and j1,…,j12(ℓ-(-1ℓ)) be the vertices adjacent to 1728 in 𝒢ℓ(𝔽¯p) . If p ≡ 3 mod 4 and p > 4ℓ²L, then there exist two m-cycles at every j_n in 𝒢L(𝔽¯p) for L ≡ 1 mod 4.

Proof

Suppose ℓ > 3. If p ≡ 3 mod 4 and p > 4ℓ²L, then ℤ[ℓi] is optimally embedded in End(E(j_n)) and I_n,1 and I_n,2 are not principal for every n∈{1,…,12(ℓ-(-1ℓ))} . If L = (a + bi)(a − bi), then m is the smallest positive integer such that (a + bi)^m = x + yi with ℓ | y or ℓ | x. Let Gn′=[i](Gn) , then Gn′ is the kernel of ϕ_n ∘ [i] : E(1728) → E(1728) → E(j_n). ϕ^n and ϕ^n∘[i] are the two ℓ-isogenies between E(1728) and E(j_n). For s, t ∈ ℤ, we have that [s + ti](G_n) = G_n (resp. Gn′ ) if and only if ℓ | t (resp. ℓ | s). As in the proof of Theorem 2, there exist two m-cycles at j_n in the supersingular isogeny graphs 𝒢L(𝔽¯p) .

For ℓ = 3, we have Φ₃(X, 1728) = (X² − 153542016X − 1790957481984)². If p ≡ 3 mod 4 and p > 31, then there are two vertices j₁ and j₂ adjacent to 1728 in 𝒢ℓ(𝔽¯p) , each connecting 1728 with 2 edges. For L = a² + b², if 3 | a or 3 | b, there are two loops at j₁ and j₂ in 𝒢L(𝔽¯p) . If 3 ∤ ab, we have 3 | (a² − b²). There are two 2-cycles at j₁ and j₂ in 𝒢L(𝔽¯p) .

Remark 4.2

For ℓ = 2, we have Φ₂(X, 1728) = (X − 1728)(X − 66³)². If p ≡ 3 mod 4 and p > 11, then 66³ is a supersingular j-invariant which is different from 1728. ℤ[2i] is optimally embedded in 𝒪(66³). For L = a² + b², there are at least two loops at 66³ in 𝒢L(𝔽¯p) .

For j(E) = 0 and ℓ > 3, if p ≡ 2 mod 3 and p > 3ℓ², by Lemma 2, we can label the vertices adjacent to 0 in 𝒢ℓ(𝔽¯p) with j_n for n=1,…,13(ℓ-(ℓ3)) . Let ɛ=1+-32 , we have ℤ[ɛ] is optimally embedded in End(E(0)).

Theorem 4

Let ℓ be an odd prime and j1,…,j13(ℓ-(ℓ3)) be the vertices adjacent to 0 in 𝒢ℓ(𝔽¯p) . If p ≡ 2 mod 3 and p > 3ℓ²L, then there exist two m-cycles at every j_n in 𝒢L(𝔽¯p) for L ≡ 1 mod 3.

Proof

For ℓ > 3, the proof is similar to that of Theorem 3.

For ℓ = 3, we have Φ₃(X, 0) = X(X − 12288000)³. If p ≡ 2 mod 3 and p > 23, we have −12288000 is a supersingular j-invariant which is different from 0. ℤ[3ɛ] is optimally embedded in 𝒪(−12288000). For L ≡ 1 mod 3, there are at least two loops at −12288000 in 𝒢L(𝔽¯p) .

Remark 4.3

For ℓ = 2, we have Φ₂(X, 0) = (X − 54000)³. If p ≡ 2 mod 3 and p > 11, then 54000 is a supersingular j-invariant which is different from 0. It is easy to show that ℤ[-3] is optimally embedded in 𝒪(54000). For L ≡ 1 mod 3, there are at least two loops at 54000 in 𝒢L(𝔽¯p) .

As we can see, m plays an important role in our theorems. Denote O = ℤ[τ] and O^′ = ℤ[ℓτ]. Let h and h^′ be the class number of O and O^′ respectively. We have the following formula in Chapter 7 of [4]

h′h=ℓ[O*:O′*](1-(Oℓ)1ℓ),

where O^* and O^′* are the unit groups of O and O^′ respectively.

It is easy to see that m|h′h . The following example shows that m can take any possible value.

Example 4

Let us return to Example 1. For τ=-7 and ℓ = 5, we know that 5 is inert in ℤ[-7] and h′h=6 . We have m = 3 or 6 if L = 11 or 23. Furthermore, when L = 179 or 53, we have m = 1 or 2 respectively.

5 2-Cycles

As in Section 4, suppose that ℤ[τ] is optimally embedded in 𝒪 ≅ End(E). If E_n and E are ℓ-isogenous, we can get the sufficient conditions under which there are 2-cycles at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) .

Corollary 5.1

Suppose that ℤ[τ] and ℤ[ℓτ] are optimally embedded in End(E) and End(E_n) respectively and p > ℓ²LD where D is the absolute value of the discriminant of ℤ[τ].

(1)Suppose p ≡ 3 mod 4. If τ = i and ℓ > 2, then there exist 2-cycles at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) if L = a² + b² with ℓ | (a² − b²) and ℓ ∤ a.

(2)Suppose p ≡ 2 mod 3. If τ = ɛ and ℓ > 3, then there exist 2-cycles at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) if L = a² + 3b² with ℓ ∤ a, ℓ ∤ b, ℓ ∤ (a + b) and ℓ | (a² − b²) (or ℓ | (b² + 2ab), or ℓ | (a² + 2ab)).

(3)If τ ≠ ℤ[i], ℤ[ɛ] and ℓ > 2, then there exist 2-cycles at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) if L = (a + bτ)(a − bτ) with ℓ | a and ℓ ∤ b.

(4)If τ=-d≠i and ℓ = 2, then there exist 2-cycles at j(E_n) in 𝒢L(𝔽¯p,ℓ+1) if L=(a+b-d)(a-b-d) with 2 ∤ b.

For m = 1, there are loops at j(E_n) in 𝒢L(𝔽¯p) . The method in [1] can be used to determine an upper bound on p for which j(E_n) has unexpected loops in 𝒢L(𝔽¯p) . If E, E_n and L=(a+bτ)(a+bτ¯) satisfy the conditions in Corollary 5.1, we denote the target elliptic curve of the two L-isogenies Ψ_n,± from E_n by En′ . In the remainder of this section, we will determine an upper bound on p for which there exist unexpected isogenies from E_n to En′ of degree L.

Since ℤ[ℓτ] is optimally embedded in 𝒪_n and L=(a+bτ)(a+bτ¯) , we have that I_n,1 = (L, ℓ(a + bτ)) and In,2=(L,ℓ(a+bτ¯)) are the kernel ideals corresponding to Ψ_n,+ and Ψ_n,−. Moreover, we know that I_n,1 and I_n,2 are in the same ideal class if L satisfies the conditions in Corollary 5.1. Let D denote the absolute value of the discriminant of ℤ[τ].

Theorem 5

Suppose that ℓ is ramified or inert in ℤ[τ] and L satisfies the condition in Corollary 5.1. If p > Dℓ²L, then there are only two L-isogenies from E_n to En′ .

Proof

If there is another L-isogeny from E_n to En′ , the corresponding kernel ideal J must belong to X_L and I_n,1 = Jµ, where μ∈Bp,∞* with Nrd(µ) = 1. Since L ∈ J, we have Lµ ∈ I_n,1 and µ ∈ L⁻¹I_n,1. There exist x, y ∈ 𝒪_n such that μ=L-1(xL+yℓ(a+bτ))=L-1(x(a+bτ¯)+ℓy)(a+bτ) , and α=x(a+bτ¯)+ℓy with Nrd(α) = L. We have ℓα ∈ 𝒪 since ℓx, ℓy and a+bτ¯ are in 𝒪.

If ℓα ∈ ℤ[τ], then α ∈ ℓ⁻¹ℤ[τ]. Since ℓ is ramified or inert in ℤ[τ], the set of elements with norm ℓ² in ℤ[τ] is {ɛℓ : ɛ ∈ ℤ[τ]^*}. For simplicity, we can assume α = a + bτ or a+bτ¯ . If α=a+bτ¯ , then µ = 1 and J = I_n,1. If α = a + bτ, then μ=a+bτa+bτ¯ and J = I_n,2. If ℓα is not in ℤ[τ], by Theorem 2 in [11], we have 4p ≤ 4DNrd(ℓα) = 4Dℓ²L since ℤ[τ] and ℤ[ℓα] are embedded in 𝒪. We assume p > Dℓ²L, so such α does not exist. This proves the theorem.

The following examples show that the bound in Theorem 5 is sharp.

Example 5

If p ≡ 3 mod 4 and ℓ = 2, then j(2i) = 66³ is a supersingular j-invariant in 𝔽_p and 2 is ramified in ℤ[2i]. For L = 13 = (3 + 2i)(3 − 2i) and p = 827, j₁ = 774β + 169, j₂ = 53β + 169 and j₃ = 1728 are the vertices adjacent to 66³ in 𝒢2(𝔽¯p) where β² + 1 = 0. There exist three 13-isogenies from j₁ to j₂. In fact, p = 827 is the largest prime satisfying p ≡ 3 mod 4 and p < 16 × 2² × 13 = 832.

If (-7p)=-1 and ℓ = 3, then j(1+-72)=-153 is a supersingular j-invariant in 𝔽_p and 3 is inert in ℤ[1+-72] . For L=37=(3+2-7)(3-2-7) and p = 2309, j₁ = 860β + 1506 and j₂ = 1449β + 1506 are two vertices adjacent to −15³ in 𝒢3(𝔽¯p) where β² + β + 1 = 0. There exist three 37-isogenies from j₁ to j₂. In fact, p = 2309 is the largest prime satisfying (-7p)=-1 and p < 7 × 3² × 37 = 2331.

6 Conclusion

For a supersingular elliptic curve E, if an imaginary quadratic order ℤ[τ] can be optimally embedded in End(E) and a prime L splits into two principal ideals in ℤ[τ], we construct loops or cycles in the supersingular L-isogeny graph at the vertices {j(E_n)}_n=0,...,ℓ which are neighbors of j(E) in the ℓ-isogeny graph, where ℓ is a prime different from L. If ℤ[ℓτ] is optimally embedded in End(E_n) and Lℤ[ℓτ] = 𝔏𝔏^′, then the length of each cycle which we construct at j(E_n) is the order of 𝔏 in the class group of ℤ[ℓτ] essentially.

If we walk two steps from E in the supersingular ℓ-isogeny graph, we can get ℓ(ℓ + 1) vertices in general and construct loops and cycles at these vertices in the L-isogeny graph by our method. In general, similar results hold for any number of steps. These results show a deeper connection between different supersingular isogeny graphs.

Acknowledgement

This work was supported by National Key R&D Program of China (No. 2020YFA0712300).

References

[1] Gora Adj, Omran Ahmadi, and Alfred Menezes. On isogeny graphs of supersingular elliptic curves over finite fields. Finite Fields Appl. 55 (2019), 268–283.10.1016/j.ffa.2018.10.002Search in Google Scholar

[2] Jean-François Biasse, David Jao, and Anirudh Sankar. A quantum algorithm for computing isogenies between supersingular elliptic curves. In Progress in cryptology—INDOCRYPT 2014, volume 8885 of Lecture Notes in Comput. Sci., pages 428–442. Springer, Cham, 2014.10.1007/978-3-319-13039-2_25Search in Google Scholar

[3] Denis X. Charles, Eyal Z. Goren, and Kristin E. Lauter. Cryptographic hash functions from expander graphs. J. Cryptology 22 (2009), no. 1, 93–113.10.1007/s00145-007-9002-xSearch in Google Scholar

[4] David A. Cox. Primes of the form x² + ny². Pure and Applied Mathematics (Hoboken). John Wiley & Sons, Inc., Hoboken, NJ, second edition, 2013.10.1002/9781118032756Search in Google Scholar

[5] Jao David, Azarderakhsh Reza, Campagna Matthew, Costello Craig, De Feo Luca, Hess Basil, Jalali Amir, Koziel Brian, LaMacchia Brian, Longa Patrick, Naehrig Michael, Pereira Geovandro, Renes Joost, Soukharev Vladimir, and Urbanik David. Supersingular isogeny key encapsulation. https://www.sike.org/, 2019.Search in Google Scholar

[6] Luca De Feo, David Jao, and Jérôme Plût. Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. J. Math. Cryptol. 8 (2014), no. 3, 209–247.10.1515/jmc-2012-0015Search in Google Scholar

[7] Christina Delfs and Steven D. Galbraith. Computing isogenies between supersingular elliptic curves over 𝔽_p. Des. Codes Cryptogr. 78 (2016), no. 2, 425–440.10.1007/s10623-014-0010-1Search in Google Scholar

[8] Max Deuring. Die Typen der Multiplikatorenringe elliptischer Funktionenkörper. Abh. Math. Sem. Hansischen Univ. 14 (1941), 197–272.10.1007/BF02940746Search in Google Scholar

[9] Kirsten Eisenträger, Sean Hallgren, Kristin Lauter, Travis Morrison, and Christophe Petit. Supersingular isogeny graphs and endomorphism rings: reductions and solutions. In Advances in cryptology—EUROCRYPT 2018. Part III, volume 10822 of Lecture Notes in Comput. Sci., pages 329–368. Springer, Cham, 2018.10.1007/978-3-319-78372-7_11Search in Google Scholar

[10] David Jao and Luca De Feo. Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies. In Post-quantum cryptography, volume 7071 of Lecture Notes in Comput. Sci., pages 19–34. Springer, Heidelberg, 2011.10.1007/978-3-642-25405-5_2Search in Google Scholar

[11] Masanobu Kaneko. Supersingular j-invariants as singular moduli mod p. Osaka Journal of Mathematics 26 (1989), 849–855.Search in Google Scholar

[12] David Russell Kohel. Endomorphism rings of elliptic curves over finite fields. ProQuest LLC, Ann Arbor, MI, 1996. Thesis (Ph.D.)–University of California, Berkeley.Search in Google Scholar

[13] Songsong Li, Yi Ouyang, and Zheng Xu. Neighborhood of the supersingular elliptic curve isogeny graph at j = 0 and 1728. Finite Fields Appl., 61 (2020), 101600.10.1016/j.ffa.2019.101600Search in Google Scholar

[14] Jonathan Love and Dan Boneh. Supersingular curves with small non-integer endomorphisms. https://arxiv.org/abs/1910.03180, 2019.Search in Google Scholar

[15] Yi Ouyang and Zheng Xu. Loops of isogeny graphs of supersingular elliptic curves at j = 0. Finite Fields Appl., 58 (2019), 174–176.10.1016/j.ffa.2019.04.002Search in Google Scholar

[16] Arnold K. Pizer. Ramanujan graphs and Hecke operators. Bull. Amer. Math. Soc. (N.S.) 23 (1990), no. 1, 127–137.10.1090/S0273-0979-1990-15918-XSearch in Google Scholar

[17] René Schoof. Nonsingular plane cubic curves over finite fields. J. Combin. Theory Ser. A, 46 (1987), no. 2, 183–211.10.1016/0097-3165(87)90003-3Search in Google Scholar

[18] Joseph H. Silverman. The arithmetic of elliptic curves, volume 106 of Graduate Texts in Mathematics. Springer, Dordrecht, second edition, 2009.10.1007/978-0-387-09494-6Search in Google Scholar

[19] Andrew V. Sutherland. Modular polynomials. http://math.mit.edu/~drew/ClassicalModPolys.html.Search in Google Scholar

[20] Marie-France Vignéras. Arithmétique des algèbres de quaternions, volume 800 of Lecture Notes in Mathematics. Springer, Berlin, 1980.10.1007/BFb0091027Search in Google Scholar

[21] John Voight. Quaternion algebras. https://math.dartmouth.edu/~jvoight/quat/quat-book-v0.9.13.pdf.Search in Google Scholar

[22] Lawrence C. Washington. Elliptic curves: Number theory and cryptography. Discrete Mathematics and its Applications (Boca Raton). Chapman & Hall/CRC, Boca Raton, FL, second edition, 2008.Search in Google Scholar

Received: 2020-07-15

Accepted: 2021-02-17

Published Online: 2021-05-15

This work is licensed under the Creative Commons Attribution 4.0 International License.

Articles in the same Issue

https://doi.org/10.1515/jmc-2020-0029

Keywords for this article

Elliptic Curves; Isogeny Graphs; Loops; Cycles

Creative Commons

BY 4.0