On the quaternion $\ell$-isogeny path problem

TL;DR

This paper presents a probabilistic algorithm for computing representatives of left ideal classes with $\ell$-power norm in maximal orders of quaternion algebras, impacting cryptographic hash functions based on supersingular elliptic curves.

Contribution

It introduces an efficient probabilistic algorithm for the quaternion $\ell$-isogeny path problem, with implications for cryptographic security.

Findings

Algorithm runs in expected polynomial time

Breaks the quaternion analog of CGL hash function

Implications for security of supersingular elliptic curve cryptography

Abstract

Let $\cO$ be a maximal order in a definite quaternion algebra over $\mathbb{Q}$ of prime discriminant $p$, and $\ell$ a small prime. We describe a probabilistic algorithm, which for a given left $O$-ideal, computes a representative in its left ideal class of $\ell$-power norm. In practice the algorithm is efficient, and subject to heuristics on expected distributions of primes, runs in expected polynomial time. This breaks the underlying problem for a quaternion analog of the Charles-Goren-Lauter hash function, and has security implications for the original CGL construction in terms of supersingular elliptic curves.