2

I am trying to understand the basic idea behind supersingular isogeny cryptography. With very little knowledge about the group theory and elliptic curve, I find it very hard to thoroughly understand the underlying math of this protocol. Then I read several friendly introductions, and am still confused about the following questions. To be honest, I am not sure if I am asking the right question, or maybe I have misunderstood some concepts. Any answer will be helpful.

According to the pp8 of introductions, supersingular curves $E/\mathbb{F}_{p^2}$ always have their full rational $(p-1)$ or $(p+1)$-torsion defined over $\mathbb{F}_{p^2}$. Taking $E/\mathbb{F}_{431^2}$ for example, $E/\mathbb{F}_{431^2}$ is precisely the $(p+1)$-torsion. Also, according to $$ker([p+1]) \cong \mathbb{Z}_{p+1} \times \mathbb{Z}_{p+1}$$ We have $$E/\mathbb{F}_{p^2}\cong \mathbb{Z}_{p+1} \times \mathbb{Z}_{p+1}$$ Then all $E/\mathbb{F}_{p^2}$ are isomorphic to each other, which I think should be wrong. Could anyone tell me where is wrong?

Alex Su
  • 23

1 Answers1

0

There are a few possible explanations to your dilemma. Without a clearer statement of what exactly your problem is, it is impossible to be more precise.

  1. Not all supersingular elliptic curves over $\mathbb{F}_{p^2}$ are isomorphic as abelian groups over $\mathbb{F}_{p^2}$. For example, taking $p=431$, the curve $E : y^2 = x^3 + x$ has group structure $E(\mathbb{F}_{p^2}) \cong (\mathbb{Z}/(p+1)\mathbb{Z})^2$ whereas its quadratic twist $E' : y^2 = x^3 + (2+i)x$ has group structure $E'(\mathbb{F}_{p^2}) \cong (\mathbb{Z}/(p-1)\mathbb{Z})^2$.

  2. Even if two elliptic curves are isomorphic over $\mathbb{F}_{p^2}$ as abelian groups over $\mathbb{F}_{p^2}$, this does not mean they are isomorphic as elliptic curves. An elliptic curve has more structure than just merely that of an abelian group.

  3. Even if you are only looking at abelian groups, isomorphic abelian groups may not be equivalent for the purposes of cryptography. For example the abelian groups $G_1 = (\mathbb{Z}/p\mathbb{Z})^*$ and $G_2 = \mathbb{Z}/(p-1)\mathbb{Z}$ are isomorphic as abelian groups, but the discrete logarithm problem is believed to be hard on $G_1$ whereas the same problem is known to be easy on $G_2$. In this case the issue is that the isomorphism, though it exists, is not efficiently computable in both directions, which makes a difference in cryptography.

djao
  • 1,267
  • If $G_1$ is isomorphic to $G_2$ then solving discrete logarithm on $G_2$ isn't equal to solving Dlog on $G_1$. At the and, the isomorphism is just relabelling the elements, right? – kelalaka Mar 20 '22 at 12:22
  • 1
    If $G_1$ is isomorphic to $G_2$ via $\iota \colon G_1 \to G_2$, then solving discrete log on $G_1$ may or may not be equivalent to solving discrete log on $G_2$. It depends on a host of factors, including what is $G_1$, what is $G_2$, what is $\iota$, and various other things including whether or not P is NP. A complete answer is impossible to fit within the character limit of a comment -- if you want a full explanation, I suggest asking another question. – djao Mar 21 '22 at 13:40
  • Thanks for your detailed explanation. Now I have a better understanding. It looks like in that introduction, the author wants to say that $E/\mathbb{F}_{p^2}$ is precisely its $ker([p+1])$, where $p=431$ and a particular curve equation. And with a different curve equation, this will not hold. – Alex Su Mar 22 '22 at 11:55
  • For item 2, I am still confused. If an elliptic curve is a group, why elliptic curve isomorphism is different from a group isomorphism. Could you give me a quick answer? – Alex Su Mar 22 '22 at 12:01
  • Btw, just curious, are you Prof. David Jao? :) – Alex Su Mar 22 '22 at 12:02
  • A simple example. Every ring is a group under addition. The rings $\mathbb{Z}$ and $2\mathbb{Z}$ are isomorphic as groups (both are infinite cyclic abelian groups), but they are not isomorphic as rings ($\mathbb{Z}$ has a multiplicative identity, and $2\mathbb{Z}$ does not). The problem is that treating a ring as a group grossly oversimplifies what a ring is. Saying that "an elliptic curve is a group" likewise grossly oversimplifies what an elliptic curve is. – djao Mar 23 '22 at 05:16