Computing endomorphism rings of supersingular elliptic curves and connections to path-finding in isogeny graphs
Kirsten Eisenträger, Sean Hallgren, Christopher Leonardi, Travis Morrison, Jennifer Park
Abstract
Computing endomorphism rings of supersingular elliptic curves is an important problem in computational number theory, and it is also closely connected to the security of some of the recently proposed isogeny-based cryptosystems. We give a new algorithm for computing the endomorphism ring of a supersingular elliptic curve E defined over p 2 that runs, under certain heuristics, in time O((log p) 2 p 1/2 ). The algorithm works by first finding two cycles of a certain form in the supersingular -isogeny graph G( p, ), generating an order End(E). Then all maximal orders containing are computed, extending work of The final step is to determine which of these maximal orders is the endomorphism ring. As part of the cycle-finding algorithm, we give a lower bound on the set of all j-invariants j that are adjacent to j p in G( p, ), answering a question of