Computing endomorphism rings of supersingular elliptic curves and\n connections to pathfinding in isogeny graphs

Computing endomorphism rings of supersingular elliptic curves is an important\nproblem in computational number theory, and it is also closely connected to the\nsecurity of some of the recently proposed isogeny-based cryptosystems. In this\npaper we give a new algorithm for computing the endomorphism ring of a\nsupersingular elliptic curve $E$ that runs, under certain heuristics, in time\n$O((\\log p)^2p^{1/2})$. The algorithm works by first finding two cycles of a\ncertain form in the supersingular $\\ell$-isogeny graph $G(p,\\ell)$, generating\nan order $\\Lambda \\subseteq \\operatorname{End}(E)$. Then all maximal orders\ncontaining $\\Lambda$ are computed, extending work of Voight. The final step is\nto determine which of these maximal orders is the endomorphism ring. As part of\nthe cycle finding algorithm, we give a lower bound on the set of all\n$j$-invariants $j$ that are adjacent to $j^p$ in $G(p,\\ell)$, answering a\nquestion in arXiv:1909.07779.\n