A Subexponential Algorithm for Evaluating Large Degree Isogenies
نویسندگان
چکیده
An isogeny between elliptic curves is an algebraic morphism which is a group homomorphism. Many applications in cryptography require evaluating large degree isogenies between elliptic curves efficiently. For ordinary curves of the same endomorphism ring, the previous best known algorithm has a worst case running time which is exponential in the length of the input. In this paper we show this problem can be solved in subexponential time under reasonable heuristics. Our approach is based on factoring the ideal corresponding to the kernel of the isogeny, modulo principal ideals, into a product of smaller prime ideals for which the isogenies can be computed directly. Combined with previous work of Bostan et al., our algorithm yields equations for large degree isogenies in quasi-optimal time given only the starting curve and the kernel.
منابع مشابه
Constructing elliptic curve isogenies in quantum subexponential time
Given two elliptic curves over a finite field having the same cardinality and endomorphism ring, it is known that the curves admit an isogeny between them, but finding such an isogeny is believed to be computationally difficult. The fastest known classical algorithm takes exponential time, and prior to our work no faster quantum algorithm was known. Recently, public-key cryptosystems based on t...
متن کاملEvaluating Large Degree Isogenies and Applications to Pairing Based Cryptography
We present a new method to evaluate large degree isogenies between elliptic curves over finite fields. Previous approaches all have exponential running time in the logarithm of the degree. If the endomorphism ring of the elliptic curve is ‘small’ we can do much better, and we present an algorithm with a running time that is polynomial in the logarithm of the degree. We give several applications...
متن کاملA Simple and Compact Algorithm for SIDH with Arbitrary Degree Isogenies
We derive a new formula for computing arbitrary odd-degree isogenies between elliptic curves in Montgomery form. The formula lends itself to a simple and compact algorithm that can efficiently compute any low odd-degree isogenies inside the supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol. Our implementation of this algorithm shows that, beyond the commonly used 3-isogenies, th...
متن کاملTowards Quantum-Resistant Cryptosystems from Supersingular Elliptic Curve Isogenies
We present new candidates for quantum-resistant public-key cryptosystems based on the conjectured difficulty of finding isogenies between supersingular elliptic curves. The main technical idea in our scheme is that we transmit the images of torsion bases under the isogeny in order to allow the two parties to arrive at a common shared key despite the noncommutativity of the endomorphism ring. Ou...
متن کاملFast algorithms for computing isogenies between elliptic curves
We survey algorithms for computing isogenies between elliptic curves defined over a field of characteristic either 0 or a large prime. We introduce a new algorithm that computes an isogeny of degree ` (` different from the characteristic) in time quasi-linear with respect to `. This is based in particular on fast algorithms for power series expansion of the Weierstrass ℘-function and related fu...
متن کامل