The SEA algorithm for endomorphisms of supersingular elliptic curves

Abstract

For a prime $p>3$ and a supersingular elliptic curve $E$ defined over ${\mathbb{F}}_{p^2}$ with $j(E)\notin \{0,1728\}$, consider an endomorphism $\hat{I}\pm$ of $E$ represented as a composition of $L$ isogenies of degree at most $d$. We prove that the trace of $\hat{I}\pm$ may be computed in $O(n^4(\log n{)}^2+dL{n}^3)$ bit operations, where $n=\log (p)$, using a generalization of the SEA algorithm for computing the trace of the Frobenius endomorphism of an ordinary elliptic curve. When $L\in O(\log p)$ and $d\in O(1)$, this complexity matches the heuristic complexity of the SEA algorithm. Our theorem is unconditional, unlike the complexity analysis of the SEA algorithm, since the kernel of an arbitrary isogeny of a supersingular elliptic curve is defined over an extension of constant degree, independent of $p$. We also provide practical speedups, including a fast algorithm to compute the trace of $\hat{I}\pm$ modulo $p$.

16 pages, 2 figures. Section 3.1 simplified. Accepted for publication in Research in Number Theory