Isogeny Atlas
Supersingular Isogeny Graph · eprint 2026/1431
Renders a real supersingular isogeny graph over GF(431²) — computed live in your browser from the modular polynomials — and walks the seven foremost open problems of isogeny-based cryptography as paths, cycles, and endomorphisms on that graph.
The atlas, computed — not drawn
Each dot is a supersingular elliptic curve, each line an isogeny between two of them — all computed just now, in your browser, by factoring the modular polynomial Φ_ℓ(j, Y) over GF(431²). Tap, click, or focus a vertex — or use the Inspect menu — to see its curve. Squares are the GF(431) "spine" (problem six).
Real math, toy size: p = 431, so the whole graph fits on screen; at cryptographic sizes (p ≈ 2²⁵⁶) it would have ~2²⁵² vertices. Not production crypto — a teaching demo.
- curve (j ∈ GF(431²))
- spine curve (j ∈ GF(431))
- start
- target
Select a vertex (tap, click, or use the menu) to inspect its curve.
How the graph is computed (and how it checks itself)
Vertices are found by breadth-first search: the ℓ-isogeny neighbors of a vertex j are the roots of the classical modular polynomial Φ_ℓ(j, Y) in GF(431²), found by square-free reduction and Cantor–Zassenhaus splitting — real polynomial factorization, seeded so every build is identical. The result self-checks against classical theorems, live:
A separate road to the same answer: the test suite rebuilds every vertex as an actual curve y² = x³ + ax + b and verifies with point arithmetic that its Frobenius trace is supersingular. Raw adjacency (ℓ = 2), straight from the computation:
What is this?
An elliptic curve can be boiled down to a single number, its j-invariant. An isogeny is a structure-preserving map between two curves. Put a dot for every special ("supersingular") curve and a line for every small isogeny between them, and you get the graph above — a tangled maze with no discernible pattern. The central hard problem of isogeny-based cryptography is embarrassingly simple to state: given two dots, find a path between them. At real-world sizes the maze has about 2²⁵² rooms (the vertex count is ≈ p/12, with p ≈ 2²⁵⁶) and nobody knows how to navigate it — and the field's frontier is a short list of precisely-stated open questions about this maze, which this page walks through one by one.
What this isn't: not a key-exchange demo, not an attack lab, and not cryptographic-size — this is a real graph over the small prime p = 431, honestly labelled. For the SIDH key exchange, its 2022 collapse, and a working toy CSIDH, see crypto-lab-isogeny-gate. Not production crypto — a teaching demo.
Find the path — feel the hard problem
Pick two curves and try to walk from one to the other by clicking neighbors — you are now doing, by hand, the exact task whose difficulty protects isogeny-based signatures. Then let breadth-first search do it and watch how much of the graph it has to flood: that flood is what costs ~√p steps, hopeless when p has 256 bits.
Choose a start and target, then walk yourself or run the search.
Why this stops working at real sizes
This graph has 37 vertices because p = 431 and the vertex count is always ⌊p/12⌋ + ε. The graph is an expander: short paths exist between any two vertices (here, at most 7 steps) — the hardness is purely about finding them. The best known generic attack meets in the middle at cost about √p; quantum algorithms improve on that somewhat, but no known attack is efficient:
| Prime p | Vertices (~p/12) | Meet-in-middle (~√p) | Feasible? |
|---|---|---|---|
| 431 (this page) | 37 | ~2⁴ work | instant — you just did it |
| ~2⁶⁴ | ~2⁶⁰ | ~2³² work | minutes on a laptop |
| ~2²⁵⁶ (SQIsign) | ~2²⁵² | ~2¹²⁸ work | beyond any conceivable computer |
Costs are the standard generic estimates; scheme-specific security also depends on the problems in Exhibit 3.
The seven open problems, drawn on the graph
The frontier of isogeny-based cryptography is not one equation — it is a short list of precisely-stated open questions about this graph. Each one below is shown as a concrete structure: a path, a cycle, a walk, a subset of vertices. Newcomer text first; expand "The precise problem" when you want the sharp statement.
The seven-problem framing follows Castryck, De Feo, Galbraith, Kutas, Reijnders and Wesolowski, "The Isogeny Problems" (ePrint 2026/1431), which collects expert write-ups of the field's foremost unsolved problems. The wording on this page is a teaching paraphrase of these long-studied problems — read the paper for the experts' precise statements.