Hash functions from superspecial genus-2 curves using Richelot isogenies

Abstract

In 2018 Takashima proposed a version of Charles, Goren and Lauter’s hash function using Richelot isogenies, starting from a genus-2 curve that allows for all subsequent arithmetic to be performed over a quadratic finite field 𝔽p2. In 2019 Flynn and Ti pointed out that Takashima’s hash function is insecure due to the existence of small isogeny cycles. We revisit the construction and show that it can be repaired by imposing a simple restriction, which moreover clarifies the security analysis. The runtime of the resulting hash function is dominated by the extraction of 3 square roots for every block of 3 bits of the message, as compared to one square root per bit in the elliptic curve case; however in our setting the extractions can be parallelized and are done in a finite field whose bit size is reduced by a factor 3. Along the way we argue that the full supersingular isogeny graph is the wrong context in which to study higher-dimensional analogues of Charles, Goren and Lauter’s hash function, and advocate the use of the superspecial subgraph, which is the natural framework in which to view Takashima’s 𝔽p2-friendly starting curve.

Counting Richelot isogenies between superspecial abelian surfaces

“…Since P i − σ (P i ) is a divisor of order 2, we have P i − σ (P i ) ∼ σ (P i ) − P i . Comparing the calculation in [1,Proposition 1(2)] with the one in [13,Lemma 2.4], we see that π : [12,Proof of Proposition 7.18 (iii)]). We will use the bijection above to calculate decomposed Richelot isogenies.…”

“…Therefore, we have By [1,Section 3.3], if the curve C of genus 2 is obtained from a decomposed principally polarized abelian surface by a Richelot isogeny, then the curve C has a long reduced automorphism of order 2. As is well-known, for a curve C of genus 2, the Jacobian variety J (C) has 15 Richelot isogenies (see [1,Section 3.2], for instance). If we have a Richelot isogeny (A, C) → (A , C ), then we also have a Richelot isogeny (A , C ) → (A, C).…”

“…We denote P i by i for the sake of simplicity. Then, the action σ is given by the permutation (1, 2)(3, 4) (5,6), and by the action of RA(C), the set { (P i 1 , P i 2 ), (P i 3 , P i 4 ), (P i 5 , P i 6 ) } of 15 elements is divided into the following 11 loci: 2), (3,4), (5,6)]}, {[(1, 2), (3,5), (4,6)]}, {[ (1,2), (3,6), (4,5)]}, {[ (1,3), (2,4), (5,6)]}, {[ (1,3), (2,5), (4,6)], [ (1,6), (2,4), (3,5)]}, {[ (1,3), (2,6), (4,5)], [ (1,5), (2,4), (3,6)]}, {[ (1,4), (2,…”

“…In the genus-2 case, the isogenies may have decomposed principally polarized abelian surfaces as codomain, and we call them decomposed isogenies. In [1], the authors gave explicit formulas for the decomposed isogenies and a theorem stating that the number of decomposed Richelot isogenies outgoing from the Jacobian J (C) of a superspecial curve C of genus 2 is at most six [1,Theorem 2], but they do not precisely determine this number. Moreover, their proof is computer-aided, that is, using the Gröbner basis computation.…”

“…Based on the classical results, we first count the number of Richelot isogenies from a superspecial Jacobian to decomposed surfaces (Cases (0)-( 6) in Section 5) in terms of involutive (i.e., of order 2) reduced automorphisms which are called long elements. As a corollary, we give an algebraic geometric proof of Theorem 2 in [1] together with a precise count of decomposed Richelot isogenies (Remark 5.1). Moreover, by extending the method, we also count the total number of (decomposed) Richelot isogenies up to isomorphism outgoing from irreducible superspecial curves of genus 2 (resp.…”