The Supersingular Isogeny Problem in Genus 2 and Beyond

Abstract

Let A/Fp and A ′ /Fp be superspecial principally polarized abelian varieties of dimension g > 1. For any prime ℓ = p, we give an algorithm that finds a path φ : A → A ′ in the (ℓ, . . . , ℓ)-isogeny graph in O(p g−1 ) group operations on a classical computer, and O( p g−1 ) calls to the Grover oracle on a quantum computer. The idea is to find paths from A and A ′ to nodes that correspond to products of lower dimensional abelian varieties, and to recurse down in dimension until an elliptic path-finding algorithm (such as Delfs-Galbraith) can be invoked to connect the paths in dimension g = 1. In the general case where A and A ′ are any two nodes in the graph, this algorithm presents an asymptotic improvement over all of the algorithms in the current literature. In the special case where A and A ′ are a known and relatively small number of steps away from each other (as is the case in higher dimensional analogues of SIDH), it gives an asymptotic improvement over the quantum claw finding algorithms and an asymptotic improvement over the classical van Oorschot-Wiener algorithm.

Counting Richelot isogenies between superspecial abelian surfaces

“…In characteristic 13, we know h(z) = 7z 3 + 12z 2 + 12z + 7, and the zeros are −1 and −5 ± √ 6. We also know g(z) = 2z 4 + 3z 3 + 4z 2 + 3z + 2, and one of the zeros is −4 + √ 2. The Legendre polynomial is given by (z) = z 6 + 10z 5 + 4z 4 + 10z 3 + 4z 2 + 10z + 1, and one of the zeros is 3 − 2 √ 2.…”

“…We denote P i by i for the sake of simplicity. Then, the action σ is given by the permutation (1, 2)(3, 4) (5,6), and by the action of RA(C), the set { (P i 1 , P i 2 ), (P i 3 , P i 4 ), (P i 5 , P i 6 ) } of 15 elements is divided into the following 11 loci: 2), (3,4), (5,6)]}, {[(1, 2), (3,5), (4,6)]}, {[ (1,2), (3,6), (4,5)]}, {[ (1,3), (2,4), (5,6)]}, {[ (1,3), (2,5), (4,6)], [ (1,6), (2,4), (3,5)]}, {[ (1,3), (2,6), (4,5)], [ (1,5), (2,4), (3,6)]}, {[ (1,4), (2,…”

“…The reduced automorphism σ is a long one of order 2 and the element [(1, 2), (3,4), (5,6)] is fixed by σ . Therefore, the element [(1, 2), (3,4), (5,6)] gives a decomposed isogeny. The other 10 loci give nondecomposed isogenies.…”

Fast Computation of Hyperelliptic Curve Isogenies in Odd Characteristic

“…Researchers began to inspect principally polarized abelian varieties, especially Jacobians of genus two and three curves and compute isogenies between them [CR15, CE15,Mil19,Tia20]. Their main interest was to calculate the number of points of these varieties over finite fields [GS12, LL06, BGG + 17] and more recently to instantiate isogeny-based cryptography schemes [FT19,CS20]. In this work, we concentrate on the problem of computing explicitly isogenies between Jacobians of hyperelliptic curves over finite fields of odd characteristic, this will be a generalization to [CE15] and [Mil19].…”

Hash functions from superspecial genus-2 curves using Richelot isogenies

“…The isogeny-path-computing algorithm described in the recent paper[29, §7] does not produce preimages for our hash function: indeed, with overwhelming probability the resulting isogeny path does not consist of good extensions, as is apparent from the proof of[29, Lem. 3].…”