Cycles and Cuts in Supersingular L-Isogeny Graphs

TL;DR

The paper extends supersingular isogeny graphs to L-isogeny graphs and analyzes two core aspects: cycles and graph cuts. It develops two complementary cycle-counting approaches—Brandt-matrix traces and ideal-embedding interpretations in quaternion algebras—along with explicit algorithms and runnable code. It also investigates graph cuts, comparing spectral and non-spectral methods and showing that a greedy-neighbor approach often yields better edge-expansion minima, with practical cryptographic motivation. The work includes concrete examples, discussions of limitations, and several directions for future research in cycle counting, scalar-endomorphism analysis, and advanced clustering of isogeny graphs.

Abstract

Supersingular elliptic curve isogeny graphs underlie isogeny-based cryptography. For isogenies of a single prime degree $\ell$, their structure has been investigated graph-theoretically. We generalise the notion of $\ell$-isogeny graphs to $L$-isogeny graphs (studied in the prime field case by Delfs and Galbraith), where $L$ is a set of small primes dictating the allowed isogeny degrees in the graph. We analyse the graph-theoretic structure of $L$-isogeny graphs. Our approaches may be put into two categories: cycles and graph cuts. On the topic of cycles, we provide: a count for the number of cycles in the $L$-isogeny graph with cyclic kernels using traces of Brandt matrices; an efficiently computable estimate based on this approach; and a third ideal-theoretic count for a certain subclass of $L$-isogeny cycles. We provide code to compute each of these three counts. On the topic of graph cuts, we compare several algorithms to compute graph cuts which minimise a measure called the edge expansion, outlining a cryptographic motivation for doing so. Our results show that a greedy neighbour algorithm out-performs standard spectral algorithms for computing optimal graph cuts. We provide code and study explicit examples. Furthermore, we describe several directions of active and future research.

Figures (8)

• Figure 1: An isogeny diamond.
• Figure 2: A $\{2^2,3^3\}$-isogeny cycle in the $\{2,3\}$-isogeny graph. The (solid line) isogenies $\varphi_{2,1}$ and $\varphi_{2,2}$ are degree-2 and the (dashed line) isogenies $\varphi_{3,1},\varphi_{3,2},\varphi_{3,3}$ are degree-3. This $\{2^2,3^3\}$-isogeny cycle can be specified by the tuple $(\varphi_{3,3},\varphi_{3,2},\varphi_{2,2},\varphi_{3,1},\varphi_{2,1})$, starting at the vertex $j_1$.
• Figure 3: Isogeny cycle decompositions.
• Figure 4: The supersingular $\{2,3\}$-isogeny graph over $\overline{\mathbb{F}}_{61}$, with vertices labelled by $j$-invariant in $\mathbb{F}_{61^2}$. Solid lines are $2$-isogenies, dashed lines are $3$-isogenies, and $\alpha,\overline{\alpha}$ denote conjugate $j$-invariants in $\mathbb{F}_{61^2}\setminus\mathbb{F}_{61}$. Loops may only be traversed in one direction, while all other edges are undirected and may be traversed in either direction.
• Figure 5: A subgraph of the supersingular $\{2,3\}$-isogeny graph over $\overline{\mathbb{F}}_{61}$ (see Figure \ref{['fig:examplecounting_2']}).

Theorems & Definitions (52)

• Definition 1: l-isogeny graph
• Definition 2: Arbitrary assignment, Arpin2022OrientationsAC
• Definition 3: $L$-isogeny graph
• Proposition 4: gross1987heights
• Theorem 5: gross1987heights
• Theorem 6: hurwitz1885ueber
• Definition 7: Edge expansion
• Definition 8: Isogeny cycle
• Remark 9
• Definition 10