Talks and presentations

The security of many isogeny-based cryptographic constructions relies on the hardness of finding the endomorphism ring of a random supersingular elliptic curve over 𝔽_{p²} The state-of-the-art algorithms to solve the EndRing problem are based on the Delfs-Galbraith algorithm: given a random input curve, randomly walk in the supersingular isogeny graph until you hit a curve over 𝔽ₚ; this walk reduces EndRing to a vectorization problem on the 𝔽ₚ-subgraph, which is easier to solve. In this talk, we see that we can explore the isogeny graph more efficiently via SIDH isogeny ladders and expand the choice of destination subgraphs via orientations. As a result, we get asymptotic as well as concrete improvements: via these optimizations we realized a memory-effective GPU implementation, solving random instances of the EndRing problem for primes p ≈ 2^100 in approximately 100 GPU hours.

In this talk, we present an efficient recipe to lift an isogeny defined over a finite field of characteristic p to an isogeny over a p-adic field, with arbitrarily high precision. This recipe is general and applies to all isogeny representations used in isogeny-based cryptography (e.g. Vélu chains, HD representations). As an application, we adapt the approach of Satoh’s point counting algorithm to the problem of computing traces of separable endomorphisms of elliptic curves over finite fields by p-adically lifting these endomorphisms. The resulting trace computation algorithm is faster than the Schoof-style state-of-the-art. Based on joint work with Lorenz Panny and Damien Robert.

Discussion of eprint 2025/672, with focus on the relevant aspects to pairing-based cryptography.

Discussion of eprint 2025/672, with focus on the relevant aspects to pairing-based cryptography.

Pairings are an important tool in elliptic curve- and isogeny-based cryptography. We show pairing computations can be practical even over generic elliptic curves and field characteristics without optimized parameters, via an approach proposed by Robert (2024). Using cubical arithmetic on an elliptic curve, resulting from a small adjustment to standard projective x-only point arithmetic, pairing information comes as a direct by-product of Montgomery ladders. Cubical pairings are simpler and more performant than state-of-the-art pairings computed using Miller’s algorithm, in the case of generic base fields and curves. We observe speedups in use-cases in isogeny based cryptography (around 1.7x in SQIsign, 1.075x in CSIDH) and we discuss the practicality of the new approach when applied to other contexts.