Failing to hash into supersingular isogeny graphs
Abstract
An important open problem in supersingular isogenybased cryptography is to produce, without a trusted authority, concrete examples of "hard supersingular curves," that is, concrete supersingular curves for which computing the endomorphism ring is as difficult as it is for random supersingular curves. Or, even better, to produce a hash function to the vertices of the supersingular $\ell$isogeny graph which does not reveal the endomorphism ring, or a path to a curve of known endomorphism ring. Such a hash function would open up interesting cryptographic applications. In this paper, we document a number of (thus far) failed attempts to solve this problem, in the hopes that we may spur further research, and shed light on the challenges and obstacles to this endeavour. The mathematical approaches contained in this article include: (i) iterative rootfinding for the supersingular polynomial; (ii) gcd's of specialized modular polynomials; (iii) using division polynomials to create small systems of equations; (iv) taking random walks in the isogeny graph of abelian surfaces; and (v) using quantum random walks.
 Publication:

arXiv eprints
 Pub Date:
 April 2022
 arXiv:
 arXiv:2205.00135
 Bibcode:
 2022arXiv220500135B
 Keywords:

 Mathematics  Number Theory;
 Computer Science  Cryptography and Security;
 11G05;
 11T71;
 14G50;
 14K02;
 81P94;
 94A60;
 68Q12
 EPrint:
 31 pages, 7 figures