Paper 2022/518

Failing to hash into supersingular isogeny graphs

Jeremy Booher, Ross Bowden, Javad Doliskani, Tako Boris Fouotsa, Steven D. Galbraith, Sabrina Kunzweiler, Simon-Philipp Merz, Christophe Petit, Benjamin Smith, Katherine E. Stange, Yan Bo Ti, Christelle Vincent, José Felipe Voloch, Charlotte Weitkämper, and Lukas Zobernig


An important open problem in supersingular isogeny-based cryptography is to produce, without a trusted authority, concrete examples of ''hard supersingular curves,'' that is, concrete supersingular curves for which computing the endomorphism ring is as difficult as it is for random supersingular curves. Or, even better, to produce a hash function to the vertices of the supersingular ℓ-isogeny graph which does not reveal the endomorphism ring, or a path to a curve of known endomorphism ring. Such a hash function would open up interesting cryptographic applications. In this paper, we document a number of (thus far) failed attempts to solve this problem, in the hopes that we may spur further research, and shed light on the challenges and obstacles to this endeavour. The mathematical approaches contained in this article include: (i) iterative root-finding for the supersingular polynomial; (ii) gcd's of specialized modular polynomials; (iii) using division polynomials to create small systems of equations; (iv) taking random walks in the isogeny graph of abelian surfaces; and (v) using quantum random walks.

Available format(s)
Public-key cryptography
Publication info
Preprint. MINOR revision.
supersingularisogenyelliptic curvehashing
Contact author(s)
kstange @ math colorado edu
2022-05-02: received
Short URL
Creative Commons Attribution


      author = {Jeremy Booher and Ross Bowden and Javad Doliskani and Tako Boris Fouotsa and Steven D.  Galbraith and Sabrina Kunzweiler and Simon-Philipp Merz and Christophe Petit and Benjamin Smith and Katherine E.  Stange and Yan Bo Ti and Christelle Vincent and José Felipe Voloch and Charlotte Weitkämper and Lukas Zobernig},
      title = {Failing to hash into supersingular isogeny graphs},
      howpublished = {Cryptology ePrint Archive, Paper 2022/518},
      year = {2022},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.