Séminaire d'arithmétique à Lyon

The supersingular Endomorphism Ring and One Endomorphism problems are equivalent

by Benjamin Wesolowski (CNRS, ENS de Lyon)


The supersingular Endomorphism Ring problem is the following: given a supersingular elliptic curve, compute all of its endomorphisms. The presumed hardness of this problem is foundational for isogeny-based cryptography. The One Endomorphism problem only asks to find a single non-scalar endomorphism. We prove that these two problems are equivalent, under probabilistic polynomial time reductions. We prove a number of consequences: on the security of cryptosystems, on the hardness of computing isogenies between supersingular elliptic curves, and on solving the endomorphism ring problem.