Finding Orientations of Supersingular Elliptic Curves and Quaternion Orders
Sarah Arpin, James Clements, Pierrick Dartois, Jonathan Komada Eriksen, Péter Kutas, Benjamin Wesolowski
TL;DR
Orientations of supersingular curves by a fixed imaginary quadratic order $\mathfrak{O}$ encode endomorphisms; the paper analyzes the hardness of obtaining a full endomorphism ring by studying the $\mathfrak{O}$-Orienting Problem and its decisional variant. It proves reductions from search to decision when $\mathrm{disc}(\mathfrak{O})<p$ and provides explicit subexponential algorithms with complexity analyses, along with a polynomial-time special-discriminant case and a SageMath implementation. On the quaternion side, it develops embedding algorithms for a fixed $\mathfrak{O}$ into maximal quaternion orders in $B_{p,\infty}$, with heuristics showing practical efficiency up to $|\Delta_{\mathfrak{O}}|=O(p)$ and discussions of rerandomization for small discriminants. The results tie orienting problems to quaternionic embeddings and isogeny-graph frameworks, offering concrete algorithms, complexity bounds, and practical tools relevant to the security assumptions of isogeny-based cryptography.
Abstract
Orientations of supersingular elliptic curves encode the information of an endomorphism of the curve. Computing the full endomorphism ring is a known hard problem, so one might consider how hard it is to find one such orientation. We prove that access to an oracle which tells if an elliptic curve is $\mathfrak{O}$-orientable for a fixed imaginary quadratic order $\mathfrak{O}$ provides non-trivial information towards computing an endomorphism corresponding to the $\mathfrak{O}$-orientation. We provide explicit algorithms and in-depth complexity analysis. We also consider the question in terms of quaternion algebras. We provide algorithms which compute an embedding of a fixed imaginary quadratic order into a maximal order of the quaternion algebra ramified at $p$ and $\infty$. We provide code implementations in Sagemath which is efficient for finding embeddings of imaginary quadratic orders of discriminants up to $O(p)$, even for cryptographically sized $p$.