Abstract An important open problem in supersingular isogeny-based cryptography is to produce, without a trusted authority, concrete examples of ‘hard supersingular curves’ that is equations for supersingular curves for which computing the endomorphism ring is as difficult as it is for random supersingular curves. A related open problem is to produce a hash function to the vertices of the supersingular $\ell $-isogeny graph, which does not reveal the endomorphism ring, or a path to a curve of known endomorphism ring. Such a hash function would open up interesting cryptographic applications. In this paper, we document a number of (thus far) failed attempts to solve this problem, in the hope that we may spur further research, and shed light on the challenges and obstacles to this endeavour. The mathematical approaches contained in this article include: (i) iterative root-finding for the supersingular polynomial; (ii) gcd’s of specialized modular polynomials; (iii) using division polynomials to create small systems of equations; (iv) taking random walks in the isogeny graph of abelian surfaces, and applying Kummer surfaces and (v) using quantum random walks.

Abstract Elliptic curves are abelian varieties of dimension one; the two-dimensional analogues are abelian surfaces. In this work we present an algorithm to compute $$(2^n,2^n)$$ ( 2 n , 2 n ) -isogenies between abelian surfaces defined over finite fields. These isogenies are the natural generalization of $$2^n$$ 2 n -isogenies of elliptic curves. The efficient computation of such isogeny chains gained a lot of attention as the runtime of the attacks on SIDH (Castryck–Decru, Maino–Martindale, Robert) depends on this computation. Different results deduced in the development of our algorithm are also interesting beyond these applications. For instance, we derive a formula for the evaluation of (2, 2)-isogenies. Given an element in Mumford coordinates, this formula outputs the (unreduced) Mumford coordinates of its image under the (2, 2)-isogeny. Furthermore, we study 4-torsion points on Jacobians of hyperelliptic curves and explain how to extract square roots of coefficients of 2-torsion points from these points.