Deuring for the people: supersingular elliptic curves with prescribed endomorphism ring in general characteristic
Presenter
July 13, 2023
Abstract
Constructing a supersingular elliptic curve whose endomorphism ring is isomorphic to a given quaternion maximal order
(one direction of the Deuring correspondence) is known to be polynomial-time assuming the generalized Riemann hypothesis [KLPT14;
Wes21], but notoriously daunting in practice when not working over carefully selected base fields. In this work, we speed up the
computation of the Deuring correspondence in general characteristic, i.e., without assuming any special form of the characteristic. Our
algorithm follows the same overall strategy as earlier works, but we add simple (yet effective) optimizations to multiple subroutines to
significantly improve the practical performance of the method. To demonstrate the impact of our improvements, we show that our
implementation achieves highly practical running times even for examples of cryptographic size. One implication of these findings is
that cryptographic security reductions based on KLPT-derived algorithms (such as [EHLMP18; Wes22]) have become tighter, and
therefore more meaningful in practice. Another is the pure bliss of fast(er) computer algebra: We provide a Sage implementation which
works for general primes and includes many necessary tools for computational number theorists’ and cryptographers’ needs when working
with endomorphism rings of supersingular elliptic curves. This includes the KLPT algorithm, translation of ideals to isogenies, and
finding supersingular elliptic curves with known endomorphism ring for general primes. Finally, the Deuring correspondence has recently
received increased interest because of its role in the SQISign signature scheme [DeF+20]. We provide a short and self-contained
summary of the state-of-the-art algorithms without going into any of the cryptographic intricacies of SQISign.