On the wikipedia page for supersingular isogenies, it says:

The supersingular isogeny Diffie-Hellman method works with the set of supersingular elliptic curves $E$ over $F_{p^2}$, where the number of points on any such curve will be $(p ± 1)^2$. An isogeny of an elliptic curve $E$ is a rational map from $E$ to another elliptic curve $E'$ such that the number of points on both curves is the same. For supersingular elliptic curves, isogenies are equivalently defined by points inside their kernel.

What does the bold statement mean?

  • $\begingroup$ Who knows? ... it's not a well-written page. Maybe it's saying that isogenies are essentially determined by their kernels, but that is true for all elliptic curves. $\endgroup$ – Lord Shark the Unknown Dec 27 '17 at 7:06
  • $\begingroup$ For $C$ a finite subgroup of an elliptic curve $E$ then $E/C$ is an elliptic curve isogeneous to $E$. The elliptic curve is $(x,y) \in \overline{\mathbf{F}_p},f(x,y) = 0$ plus the point at $\infty$, but in cryptography you restrict to the subgroups $E(\mathbf{F}_{p^k})= \{ (x,y) \in \mathbf{F}_{p^k}, f(x,y)=0\}\cup \{\infty\}$ $\endgroup$ – reuns Dec 27 '17 at 8:40

This is false, and so is the claim about the number of points being $(p \pm 1)^2$, as described here. It's true for separable isogenies, where "points" means $\overline{\mathbb{F}_p}$-points, but not in general, e.g. if $E$ is supersingular then $[p] : E \to E$, by definition, has trivial kernel in the sense of $\overline{\mathbb{F}_p}$-points but isn't isomorphic as an isogeny out of $E$ to the identity (because they can be distinguished by their group scheme kernels).

The bolded statement has now been corrected; I think I'll just remove the claim about the number of points since I don't think it's used anywhere else in the text anyway.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.