Finding Orientations of Supersingular Elliptic Curves and Quaternion Orders

TL;DR

This paper explores the complexity of finding orientations of supersingular elliptic curves and embeddings into quaternion algebras, providing algorithms, complexity analysis, and practical implementations for cryptographic applications.

Contribution

It introduces explicit algorithms and complexity analysis for determining orientations and embeddings related to supersingular elliptic curves and quaternion orders, with practical code implementations.

Findings

Access to an oracle for $rak{O}$-orientability informs endomorphism computation.

Algorithms for embedding quadratic orders into quaternion maximal orders are efficient for large primes.

Code implementations in Sagemath demonstrate practical feasibility for cryptographic-sized parameters.

Abstract

Orientations of supersingular elliptic curves encode the information of an endomorphism of the curve. Computing the full endomorphism ring is a known hard problem, so one might consider how hard it is to find one such orientation. We prove that access to an oracle which tells if an elliptic curve is $\mathfrak{O}$-orientable for a fixed imaginary quadratic order $\mathfrak{O}$ provides non-trivial information towards computing an endomorphism corresponding to the $\mathfrak{O}$-orientation. We provide explicit algorithms and in-depth complexity analysis. We also consider the question in terms of quaternion algebras. We provide algorithms which compute an embedding of a fixed imaginary quadratic order into a maximal order of the quaternion algebra ramified at $p$ and $\infty$. We provide code implementations in Sagemath which is efficient for finding embeddings of imaginary quadratic orders of discriminants up to $O(p)$, even for cryptographically sized $p$.