Supersingular Curves in Cryptography

Abstract

In 1941, Max Deuring coined the term supersingular for elliptic curves with endomorphism algebra isomorphic to a definite quaternion algebra over ℚ. The low embedding degree of such curves makes them unsuitable for elliptic curve cryptography that relies on the group structure of points on an elliptic curve over a finite field. However, their pairing friendliness and rich endomorphism ring structure make them ideal candidates for pairing-based and isogeny-based cryptography, respectively. Pairing-based cryptography enables construction of a variety of cryptographic primitives and protocols, including identity-based encryption, short signatures, group signatures, commitment schemes, and SNARKs. We build lollipops using supersingular curves' cycles, providing an alternative to cycles and chains based on ordinary curves for composing proof systems. Isogeny-based cryptography is a candidate for the quantum-resistant cryptography paradigm. We seek to understand the security assumptions that underpin the leading isogeny-based key-exchange and signature scheme proposals. First, we study the geometry of endomorphism rings of supersingular curves using Gross lattices and demonstrate a potential way of attacking CSIDH, a non-interactive key-exchange protocol. Subsequently, using refined Humbert invariants, we design algorithms to study the degree of isogenies between supersingular curves, shedding light on the heuristic assumptions made in KLPT-based SQIsign, a signature scheme based on Σ-protocol.