Orienteering with one endomorphism

TL;DR

This paper explores path-finding in supersingular isogeny graphs using a single endomorphism, introducing new algorithms and a hard problem related to primitive order computation, with implications for cryptography.

Contribution

It presents new path-finding algorithms that do not require prior knowledge of the primitive order, expanding understanding of endomorphism-based cryptographic problems.

Findings

Developed algorithms for path-finding without primitive order knowledge

Introduced a new hard problem of computing primitive order from an endomorphism

Provided a sub-exponential quantum algorithm for the primitive order problem

Abstract

In supersingular isogeny-based cryptography, the path-finding problem reduces to the endomorphism ring problem. Can path-finding be reduced to knowing just one endomorphism? It is known that a small endomorphism enables polynomial-time path-finding and endomorphism ring computation (Love-Boneh [36]). An endomorphism gives an explicit orientation of a supersingular elliptic curve. In this paper, we use the volcano structure of the oriented supersingular isogeny graph to take ascending/descending/horizontal steps on the graph and deduce path-finding algorithms to an initial curve. Each altitude of the volcano corresponds to a unique quadratic order, called the primitive order. We introduce a new hard problem of computing the primitive order given an arbitrary endomorphism on the curve, and we also provide a sub-exponential quantum algorithm for solving it. In concurrent work (Wesolowski [54]), it was shown that the endomorphism ring problem in the presence of one endomorphism with known primitive order reduces to a vectorization problem, implying path-finding algorithms. Our path-finding algorithms are more general in the sense that we don't assume the knowledge of the primitive order associated with the endomorphism.