1
$\begingroup$

Let $E$ be a supersingular elliptic curve over $\mathbb{F}_{p^2}$, where $p = \ell_A^{e_A} \ell_B^{e_B} f \pm 1$ for some primes $\ell_A, \ell_B$. Let $R \in E[\ell_A^{e_A}]$ be a point of order $\ell_A^{e_A}$ and suppose $\phi:E \to E' = E/\langle R \rangle$ is an isogeny with kernel $\langle R \rangle$. Let $\widehat{\phi}:E' \to E$ be the dual isogeny.

My question is: suppose we know the kernel of $\widehat{\phi}$, say $\langle S \rangle$. How can we recover $\langle R \rangle$?

$\endgroup$
  • $\begingroup$ It looks similar to some kind of homework, can you provide some a bit of background on where you encounter this problem? Also, can you explain why you feel this is more cryptography than purely mathematics? $\endgroup$ – DannyNiu Oct 30 '19 at 8:10
  • 2
    $\begingroup$ @DannyNiu This kind of questions shows up in isogeny-based cryptography, specifically SIDH/SIKE. $\endgroup$ – yyyyyyy Oct 30 '19 at 9:05
  • $\begingroup$ Hint: Consider another point $Q\in E'$ such that $\{S,Q\}$ is a basis of the $\ell_A^{e_A}$-torsion of $E'$ and look how $\phi\circ\widehat\phi$ acts on these points. $\endgroup$ – yyyyyyy Oct 30 '19 at 9:11
  • $\begingroup$ my guess (cmiiw) is that $\ker(\phi) = \langle \widehat{\phi}(Q) \rangle$ because $\phi(\widehat{\phi}(Q)) = [\ell_A^{e_A}]Q = $ identity. However, it is still unclear to me why should $\langle \widehat{\phi}(Q) \rangle = \langle R \rangle$. $\endgroup$ – tfp Oct 30 '19 at 9:24
  • $\begingroup$ @tfp You are right that $\ker(\phi)=\langle\widehat\phi(Q)\rangle$, but your argument only shows the $\supseteq$ inclusion. Re: "why should $\langle\widehat\phi(Q)\rangle=\langle R\rangle$", note that you've assumed $\ker(\phi)=\langle R\rangle$. $\endgroup$ – yyyyyyy Oct 31 '19 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.