⚛️ quantum physics

On the Spectral theory of Isogeny Graphs and Quantum Sampling of Secure Supersingular Elliptic curves

This paper presents the first provable quantum polynomial-time algorithms for sampling secure supersingular elliptic curves with unknown endomorphism rings, relying on new spectral delocalization results for isogeny graphs that prove the Quantum Unique Ergodicity conjecture and strengthen eigenvalue separation properties to remove key heuristic assumptions in cryptographic constructions.

Original authors: Maher Mamah, Jake Doliskani, David Jao

Published 2026-03-24

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Maher Mamah, Jake Doliskani, David Jao

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The "Safe House" Problem

Imagine you are building a high-security digital vault (a cryptographic system) that needs to be safe even against future quantum computers. To build this vault, you need a specific type of "key" or starting point: a supersingular elliptic curve.

However, there's a catch. To make the vault truly secure, you must pick a starting curve without knowing its secret "blueprint" (mathematically called its endomorphism ring).

The Problem: If you know the blueprint, a hacker can reverse-engineer the vault's locks.
The Current Dilemma:
- Old Way: You could ask a trusted authority (like a government or a central bank) to pick the curve for you. But this requires trusting them completely. If they are corrupt or hacked, the whole system fails.
- The "Honest" Way: You could try to pick a curve yourself by taking a random walk through a maze of curves. But if you do this on a classical computer, you leave a trail. A hacker watching your computer could see the path you took and deduce the blueprint.
- The Quantum Solution: This paper presents a way to pick a secure curve using a quantum computer that leaves no trail. It's like teleporting to a random spot in the maze without ever walking the path.

The Core Concepts (The Metaphors)

1. The Isogeny Graph: The "Infinite Maze"

Imagine a giant city where every building is an elliptic curve. The streets connecting them are called isogenies.

This city is a Ramanujan Graph, which is a fancy way of saying it's a perfectly connected maze. You can get from any building to any other building very quickly, and the streets are arranged so that random walks mix up perfectly.
The Goal: We want to end up at a random building in this city, but we don't want to know which streets we took to get there.

2. The "Spectral" Approach: Tuning a Radio

The authors use a concept from physics called spectral theory.

The Analogy: Imagine the maze of curves is a giant musical instrument. Every curve is a note, and the connections between them create specific "frequencies" or "vibrations" (eigenvalues).
The Quantum Trick: Instead of walking through the maze, the quantum computer acts like a radio tuner. It starts with a signal and uses Quantum Phase Estimation to "listen" to the frequencies of the maze.
By tuning into specific frequencies, the computer can isolate a single "note" (a specific curve) without ever traversing the streets. It's like finding a specific room in a hotel by listening to the hum of the ventilation system rather than walking down the hallway.

3. The "Delocalization" Guarantee: The "No Hiding Spots" Rule

A major fear in this field is: "What if the random curve we pick is actually a 'trap' curve that looks random but has a known secret?"

The Paper's Proof: The authors prove a mathematical theorem called Quantum Unique Ergodicity.
The Analogy: Imagine a crowd of people (the curves) in a stadium. "Delocalization" means that the "mass" or "energy" of the crowd is spread out evenly. No small group of people is huddled in a corner hiding a secret.
Why it matters: Because the "vibrations" of the maze are spread out so evenly, any curve you land on is guaranteed to be a "normal" curve with no hidden secrets. You can't accidentally land on a trap because there are no traps to hide in; the energy is too spread out.

4. The "Separation" Property: The Unique Fingerprint

To make sure the quantum computer picks the right curve and not a similar-looking one, the authors prove a property called $\epsilon$ -separation.

The Analogy: Imagine every curve has a unique ID card made of numbers. The authors prove that these ID cards are so different from each other (like fingerprints) that even if your quantum measurement is slightly fuzzy, you can still tell exactly which curve you have.
The Improvement: Previous methods guessed that these IDs were different enough. This paper proves they are different enough (under a famous math hypothesis called the Generalized Riemann Hypothesis), removing the need for guesswork.

The Two Algorithms (The Tools)

The paper offers two ways to do this:

Algorithm 1 (The "Spectral Filter"):
- How it works: It uses the "radio tuner" method described above. It filters out all curves until only one remains.
- Pros: It works for the general case and provides a very strong security proof.
- Cons: It is mathematically complex and requires heavy quantum computing power (simulating Hamiltonians).
Algorithm 3 (The "Group Action" Method):
- How it works: This is for a specific type of curve called an "oriented" curve. It uses a different quantum trick involving Fourier Transforms (shifting the perspective of the data).
- Pros: It is simpler and faster. It relies on the difficulty of a problem called "Vectorization" (finding the specific move that turns one curve into another).
- Cons: It requires the curves to have a specific structure (an "orientation"), but this is useful for many modern cryptographic protocols.

Why This Matters for You

No Trusted Setup: In the past, to use these super-secure encryption methods, you had to trust a central authority to generate the starting numbers. If that authority was compromised, everyone was in danger. This paper allows anyone to generate these numbers themselves using a quantum computer, without trusting anyone.
Future-Proofing: As quantum computers get better, they will break current encryption (like RSA). This paper helps build the next generation of encryption (Post-Quantum Cryptography) that will survive the quantum era.
Verifiable Security: The paper suggests that if you use a "verification protocol" (a way to prove the computer did the math correctly), you can be 100% sure the curve is secure, even if you don't trust the person running the computer.

Summary in One Sentence

This paper invents a quantum method to randomly pick a cryptographic "key" (an elliptic curve) that is mathematically guaranteed to be secure and free of hidden backdoors, eliminating the need to trust a central authority and leaving no trace of how the key was found.

1. Problem Statement

The paper addresses a fundamental open problem in isogeny-based cryptography: how to efficiently sample "secure" supersingular elliptic curves without relying on a trusted setup.

Context: Many post-quantum cryptographic protocols (e.g., CGL hash functions, VDFs, commitment schemes) require a starting supersingular elliptic curve $E$ whose endomorphism ring $\text{End}(E)$ is unknown. If the ring is known, the security of these schemes collapses because an adversary can compute the ring and find collisions or break the scheme.
Current Limitations:
- Classical methods to generate such curves require exponential resources.
- Existing quantum proposals (e.g., [BBD+24], [KSS22]) are heuristic and lack provable security guarantees.
- Trusted setup protocols (e.g., distributed generation) exist but are cumbersome and often limited to specific fields ( $\mathbb{F}_{p^2}$ ) or lack orientation capabilities required for protocols like CSIDH.
Goal: Develop provable quantum polynomial-time (QPT) algorithms to sample curves with unknown endomorphism rings, ensuring security based on well-studied hardness assumptions.

2. Methodology

The authors leverage the spectral theory of supersingular isogeny graphs and quantum algorithms (specifically Hamiltonian simulation and Quantum Phase Estimation) to achieve their goals.

A. Spectral Properties of Isogeny Graphs

The core of their approach relies on the properties of the supersingular $\ell$ -isogeny graph $G(p, \ell)$ , which is a Ramanujan graph.

Delocalization: They prove that eigenvectors of the adjacency operators (Brandt matrices) are "delocalized," meaning their mass is spread uniformly across the graph rather than concentrating on a few vertices.
- They establish a sup-norm bound: $\|\phi\|_\infty \ll_\epsilon (pN)^{-1/4+\epsilon}$ .
- They provide numerical evidence for the stronger "complete delocalization" conjecture ( $\|\phi\|_\infty \ll \frac{\log p}{\sqrt{p}}$ ).
$\epsilon$ -Separation: A critical requirement for their quantum algorithm is that distinct eigenvectors must have distinct eigenvalue "tags" (spectral signatures).
- Previous works assumed this separation heuristically.
- The authors prove a rigorous $\epsilon$ -separation bound for eigenvalues under the Generalized Riemann Hypothesis (GRH). They show that the eigenvalues are separated by a constant (or $\gg 1$ ), which is strictly stronger than previous heuristic predictions.

B. Quantum Algorithms

The paper presents two distinct quantum sampling algorithms:

Algorithm 1: Sampling from the Full Isogeny Graph
- Mechanism: Uses Hamiltonian simulation and Quantum Phase Estimation (QPE).
- Process:
  1. Start with a superposition of eigenvectors of the adjacency operators $A_\ell$ .
  2. Apply QPE to measure the eigenvalues (spectral tags) of the state.
  3. Due to the $\epsilon$ -separation property, the measured tags uniquely identify a specific eigenvector.
  4. Measure the curve register. Because the eigenvectors are delocalized, the output curve is distributed nearly uniformly over the graph.
- Complexity:
  - Heuristic variant: $\tilde{O}(\log^4 p)$ .
  - Provable variant (under GRH): $\tilde{O}(\log^{13} p)$ .
Algorithm 3: Sampling Oriented Curves
- Mechanism: Exploits the regular group action of the class group $\text{Cl}(\mathcal{O})$ on $\mathcal{O}$ -oriented supersingular curves.
- Process:
  1. Prepare a superposition of Fourier states (eigenstates of the group action operators).
  2. Use a phase-kickback procedure (via Quantum Fourier Transform) to compute the group index $h$ in superposition.
  3. Apply a quadratic refinement function to flatten the Fourier magnitude, ensuring a uniform distribution upon measurement.
- Complexity: Runs in quantum polynomial time.

3. Key Contributions

First Provable QPT Sampling Algorithms: The paper provides the first algorithms with rigorous security proofs for sampling secure supersingular curves without trusted setup.
Resolution of Heuristic Assumptions:
- Delocalization: Proves the Quantum Unique Ergodicity (QUE) conjecture for these graphs and provides bounds on eigenvector sup-norms.
- Eigenvalue Separation: Removes the key heuristic assumption in prior works (like [KSS22] and [Dol23]) by proving $\epsilon$ -separation of eigenvalues under GRH.
Security Proofs:
- Algorithm 1: Security is based on the average-case hardness of the EndRing problem (computing the endomorphism ring). The proof shows that even if an adversary knows the spectral tags (eigenvalues) measured during the algorithm, they cannot compute the endomorphism ring of the output curve.
- Algorithm 3: Security is based on the hardness of the Vectorization problem for the class group action (the underlying hardness of CSIDH).
Interactive Verification: The authors note that these algorithms can be combined with interactive quantum verification protocols (e.g., [FK17]) to allow a verifier to confirm that a curve was generated honestly, enabling a "trustless" public parameter generation (e.g., by NIST).

4. Results and Complexity

Gate Complexity:
- The heuristic version of Algorithm 1 runs in $\tilde{O}(\log^4 p)$ .
- The rigorous version (assuming GRH) runs in $\tilde{O}(\log^{13} p)$ .
- Algorithm 3 (Oriented) runs in QPT, with the most expensive step being the evaluation of the group action in superposition (using algorithms like CLAPOTIS).
Distribution: The output curves are proven to be distributed $\epsilon$ -close to uniform over the set of supersingular curves (or oriented curves).
Numerical Evidence: The paper includes numerical experiments (Figures 1 and 2) confirming the sup-norm bounds and the $\epsilon$ -separation of eigenvalues, showing that the separation is constant ( $\approx 1$ ) rather than vanishing as $p$ grows, contradicting earlier heuristic estimates.

5. Significance

This work represents a major theoretical breakthrough in isogeny-based cryptography:

Foundational Security: It resolves the "chicken-and-egg" problem of generating secure parameters for isogeny protocols. Previously, one had to trust a setup or use inefficient methods; now, secure parameters can be generated algorithmically with provable guarantees.
Bridging Analysis and Cryptography: By rigorously connecting the spectral theory of automorphic forms (sup-norm bounds, QUE) to cryptographic security, the paper elevates the field from heuristic reliance to mathematical rigor.
Post-Quantum Readiness: As quantum computers advance, the ability to generate parameters that are secure against quantum adversaries (via the hardness of EndRing and Vectorization) is critical. This paper provides the necessary tools to instantiate CGL hashes, VDFs, and other primitives in a quantum-safe, trust-minimized manner.
Removal of Trusted Setup: It paves the way for "authority-free" cryptographic standards where a public authority can generate a hard base curve that is verifiably secure, removing the need for complex multi-party trusted setups.

In summary, the paper transforms the generation of secure elliptic curves from a heuristic or trusted-setup-dependent task into a provably secure, efficient quantum procedure, grounded in deep results from analytic number theory and spectral graph theory.