Computing isogenies between supersingular elliptic curves over $${\mathbb {F}}_p$$ F p

Abstract

Let $$p>3$$ be a prime and let $$E$$ , $$E'$$ be supersingular elliptic curves over $${\mathbb {F}}_p$$ . We want to construct an isogeny $$\phi :E\rightarrow E'$$ . The currently fastest algorithm for finding isogenies between supersingular elliptic curves solves this problem in the full supersingular isogeny graph over $${\mathbb {F}}_{p^2}$$ . It takes an expected $$\tilde{\mathcal {O}}(p^{1/2})$$ bit operations, and also $$\tilde{\mathcal {O}}(p^{1/2})$$ space, by performing a “meet-in-the-middle” breadth-first search in the isogeny graph. In this paper we consider the structure of the isogeny graph of supersingular elliptic curves over $${\mathbb {F}}_p$$ . We give an algorithm to construct isogenies between supersingular curves over $${\mathbb {F}}_p$$ that works in $$\tilde{\mathcal {O}}(p^{1/4})$$ bit operations. We then discuss how this algorithm can be used to obtain an improved algorithm for the general supersingular isogeny problem.