International Association for Cryptologic Research (IACR)
Abstract
Finding isogenies between supersingular elliptic curves is a natural algorithmic problem which is known to be equivalent to computing the curves\u27 endomorphism rings.
When the isogeny is additionally required to have a specific degree d, the problem appears to be somewhat different in nature, yet it is also considered a hard problem in isogeny-based cryptography.
Let E1,E2 be supersingular elliptic curves over Fp2. We present improved classical and quantum algorithms that compute an isogeny of degree d between E1 and E2 if it exists. Let the sought-after degree be d=p1/2+ϵ for some ϵ>0.
Our essentially memory-free algorithms have better time complexity than meet-in-the-middle algorithms, which require exponential memory storage, in the range 1/2≤ϵ≤3/4 on a classical computer and quantum improvements in the range 0<ϵ<5/2