Solving the isogeny problem using orientations

We introduce WayFinder, a framework for generalizing the Delfs–Galbraith and SuperSolver algorithms for the supersingular isogeny problem. Our framework extends the search for elliptic curves with an orientation by an order containing ℤ [ ℓ − p ] to more general orders, and we derive a heuristic cost model for such generalisations. Our cost model not only works in a more general context, but also provides more accurate predictions when applied to SuperSolver. We instantiate WayFinder for orders containing ℤ [ ℓ 1 − ℓ 2 p ] where ℓ i are 1 or primes such that the modular curve X 0 ( ℓ 2 ) has genus 0 . We then introduce a low-storage algorithm for computing an isogeny between two oriented supersingular elliptic curves, even when the curves are oriented by distinct orders. Together, these provide an algorithm that improves on the state of the art for solving the isogeny problem, and a cost model with potential applications to parameter selection in isogeny-based cryptography.