Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

On the Spectral theory of Isogeny Graphs and Quantum Sampling of Hard Supersingular Elliptic curves

David Jao, Maher Mamah

TL;DR

This work tackles the cryptographic challenge of sampling random supersingular elliptic curves with unknown endomorphism rings, a key hardness assumption for isogeny-based protocols. It introduces the first provable quantum-polynomial-time sampler that outputs hard curves with high probability, achieving heuristical complexity $ ilde{O}(\log^{4} p)$ and, under GRH, $ ilde{O}(\log^{13} p)$, and it thereby enables secure instantiations like the CGL hash function. The analysis hinges on a new spectral delocalization result for supersingular $\ell$-isogeny graphs, establishing Quantum Unique Ergodicity and strong eigenvector delocalization, plus a rigorous $\varepsilon$-separation bound for eigenvalues that removes prior heuristic gaps in quantum-money constructions. The approach yields a near-uniform sampling distribution over hard curves with unconditional min-entropy bounds and provides explicit parameter regimes for practical evaluation, potentially transforming post-quantum cryptographic infrastructure while enriching the spectral theory of isogeny graphs.

Abstract

In this paper we study the problem of sampling random supersingular elliptic curves with unknown endomorphism rings. This task has recently attracted significant attention, as the secure instantiation of many isogeny-based cryptographic protocols relies on the ability to sample such ``hard'' curves. Existing approaches, however, achieve this only in a trusted-setup setting. We present the first provable quantum polynomial-time algorithm that samples a random hard supersingular elliptic curve with high probability.Our algorithm runs heuristically in $\tilde{O}\!\left(\log^{4}p\right)$ quantum gate complexity and in $\tilde{O}\!\left(\log^{13} p\right)$ under the Generalized Riemann Hypothesis. As a consequence, our algorithm gives a secure instantiation of the CGL hash function and other cryptographic primitives. Our analysis relies on a new spectral delocalization result for supersingular $\ell$-isogeny graphs: we prove the Quantum Unique Ergodicity conjecture, and we further provide numerical evidence for complete eigenvector delocalization; this theoretical result may be of independent interest. Along the way, we prove a stronger $\varepsilon$-separation property for eigenvalues of isogeny graphs than that predicted in the quantum money protocol of Kane, Sharif, and Silverberg, thereby removing a key heuristic assumption in their construction.

On the Spectral theory of Isogeny Graphs and Quantum Sampling of Hard Supersingular Elliptic curves

TL;DR

This work tackles the cryptographic challenge of sampling random supersingular elliptic curves with unknown endomorphism rings, a key hardness assumption for isogeny-based protocols. It introduces the first provable quantum-polynomial-time sampler that outputs hard curves with high probability, achieving heuristical complexity and, under GRH, , and it thereby enables secure instantiations like the CGL hash function. The analysis hinges on a new spectral delocalization result for supersingular -isogeny graphs, establishing Quantum Unique Ergodicity and strong eigenvector delocalization, plus a rigorous -separation bound for eigenvalues that removes prior heuristic gaps in quantum-money constructions. The approach yields a near-uniform sampling distribution over hard curves with unconditional min-entropy bounds and provides explicit parameter regimes for practical evaluation, potentially transforming post-quantum cryptographic infrastructure while enriching the spectral theory of isogeny graphs.

Abstract

In this paper we study the problem of sampling random supersingular elliptic curves with unknown endomorphism rings. This task has recently attracted significant attention, as the secure instantiation of many isogeny-based cryptographic protocols relies on the ability to sample such ``hard'' curves. Existing approaches, however, achieve this only in a trusted-setup setting. We present the first provable quantum polynomial-time algorithm that samples a random hard supersingular elliptic curve with high probability.Our algorithm runs heuristically in quantum gate complexity and in under the Generalized Riemann Hypothesis. As a consequence, our algorithm gives a secure instantiation of the CGL hash function and other cryptographic primitives. Our analysis relies on a new spectral delocalization result for supersingular -isogeny graphs: we prove the Quantum Unique Ergodicity conjecture, and we further provide numerical evidence for complete eigenvector delocalization; this theoretical result may be of independent interest. Along the way, we prove a stronger -separation property for eigenvalues of isogeny graphs than that predicted in the quantum money protocol of Kane, Sharif, and Silverberg, thereby removing a key heuristic assumption in their construction.
Paper Structure (16 sections, 11 theorems, 104 equations, 2 figures, 1 algorithm)

This paper contains 16 sections, 11 theorems, 104 equations, 2 figures, 1 algorithm.

Table of Contents

  1. Introduction
  2. Contributions and organization.
  3. Notation.
  4. Preliminaries
  5. Background on Elliptic curves.
  6. Supersingular elliptic curves with level structure.
  7. Quaternion Algebras and the Deuring Correspondence
  8. The Deuring Correspondence.
  9. Brandt Operators of Isogeny Graphs
  10. Automorphic Forms
  11. Space of Quaternionic forms
  12. The sup-norm problem of Hecke eigenforms
  13. $\varepsilon$-Separation of Hecke Eigenvalues
  14. Quantum Sampling of Hard Curves
  15. Practical parameters.
  16. ...and 1 more sections

Key Result

Proposition 2.1

Let $p\neq 2,3$ and set $K=\mathbb{F}_{p^2}$. Fix $\alpha\in K^*$ a generator of $K^*$. We represent $K$-isomorphism classes of elliptic curves over $K$ by pairs $(j,b)\in K\times\mathbb{Z}$ with Define the curve attached to $(j,b)$ by Then $E_{j,b}\cong_{K}E_{j,b'}$ iff $b\equiv b'\pmod{2}$ for $j\neq 0,1728$, $b\equiv b'\pmod{4}$ for $j=1728$, and $b\equiv b'\pmod{6}$ for $j=0$.

Figures (2)

  • Figure 1: Sup-norm values versus $\frac{\log p}{\sqrt{p}}$ for $\ell = 2, 3, 5$.
  • Figure 2: $\varepsilon$-separation for $\log p<\ell_i<4\log p$

Theorems & Definitions (26)

  • Proposition 2.1
  • proof
  • Theorem 2.2
  • proof
  • Proposition 3.1
  • proof
  • Theorem 3.2
  • Theorem 3.3
  • proof
  • Theorem 3.4: Fourth Moment bound
  • ...and 16 more