Ramanujan Graphs for Post-Quantum Cryptography

We introduce a cryptographic hash function based on expander graphs, suggested by Charles et al. ’09, as one prominent candidate in post-quantum cryptography. We propose a generalized version of explicit constructions of Ramanujan graphs, which are seen as an optimal structure of expander graphs in a spectral sense, from the previous works of Lubotzky, Phillips, Sarnak ’88 and Chiu ’92. We also describe the relationship between the security of Cayley hash functions and word problems for group theory. We also give a brief comparison of LPS-type graphs and Pizer’s graphs to draw attention to the underlying hard problems in cryptography.


Introduction
In the era of post-quantum cryptography, there exist four dominant research areas: Lattice-based, Code-based, Multivariate-based and Isogeny-based cryptography. Specifically, studies in the area of Isogeny-based cryptography have been numerous in the past decade, mainly due to the difficulty of finding a path in the Isogeny graph of supersingular elliptic curves.
In 2009, Charles et al. (2009aCharles et al. ( , 2009b introduced cryptographic hash functions from expander graphs and explained the hardness of problems behind those schemes. They proposed two kinds of hash functions based on two families of Ramanujan graphs. One of their proposals is based on Ramanujan graphs by Lubotzky et al. (1988) (in short, LPS), which are Cayley graphs over the projective group with respect to well-chosen generating sets. The other is based on Ramanujan graphs by Pizer (1990), which are not (expected to be) Cayley graphs. So far, the variants of their proposal still survive against a quantum attack except the only known exponential complexity attack (Biasse et al. 2014).
In this article, we focus on not only the background of the families of LPS's graphs and their generalization (LPS-type Jo et al. 2020Jo et al. , 2018 with respect to the security of their Cayley-based hash functions, but also on the relationship between the families of LPS-type graphs and Pizer's graphs. This article is organized as follows: In Sect. 2, we present some required preliminaries of expander graphs and Ramanujan graphs, and also of quaternion algebra theory. We summarize the security on Cayley hash functions and their cryptanalysis (variants of lifting attacks) related to solving word problems in group theory. In Sect. 3, we explain a way to generalize the explicit constructions of LPS and Chiu's Ramanujan graphs, and give a proof of the Ramanujan-ness of our graphs in the special case of "P = 13". In Sect. 4, we describe the relationship between the families of LPS-type graphs and Pizer's graphs. In Sect. 5, we summarize the arguments in this article and expound upon some unclarified problems and the relationships between explicit families of Ramanujan graphs.

Ramanujan Graphs and Their Cryptographic Applications
An expander graph is well known as a ubiquitous object in various research areas, especially in computer science for designing communication networks. It is said to be a sparse, but highly connected graph. The quality of the network on expander graphs is considered as the expanding ratio. Throughout this article, we assume that all graphs are finite, undirected, simple (i.e. no loops or multi-edges) and connected. Suppose that X = (V, E) is a k-regular graph, composed of a vertex set V = V (X ) with n vertices and an edge set E = E(X ). For a subset T of V , the boundary ∂ T of T is defined as where V \ T is the complement of T in V . The expanding constant h(X ) of X , which is defined as below, is a discrete analogue of the Cheeger constant in differential geometry (Lubotzky 1994): We give the definition of an expander graph.
Definition 1 A family of k-regular graphs (X j ) j≥1 such that |V (X j )| → +∞ as j → +∞ is called an expander family if there is an > 0 such that the expanding constant h(X j ) satisfies h(X j ) ≥ for all j.
For analysis of graphs, the adjacency matrix A of the graph X plays an important role; it is a square matrix indexed by pairs of vertices u, v whose (u, v)-entry A u,v is the number of edges between u and v. Since we assume that X has n vertices, A is an n-by-n, symmetric (0, 1)-matrix without diagonal entries (i.e. A u,u = 0). For such a graph X , the adjacency matrix A of X has the spectrum k = λ 0 > λ 1 ≥ · · · ≥ λ n−1 . It is known (Alon and Milman 1985;Dodziuk 1984 If the spectral gap k − λ 1 is larger, the quality of the network of X is getting better as well. However, it is shown by Alon-Boppana as follows that it cannot be too large. Theorem 1 Let (X j ) j≥1 be a family of k-regular graphs with |V (X j )| → +∞ as j → +∞. Then This fact motivates the definition of a Ramanujan graph.
Definition 2 A k-regular graph X is Ramanujan if, for every member λ of the spectrum of the adjacency matrix of X other than ±k, one has |λ| ≤ 2 √ k − 1. We call 2 √ k − 1 the Ramanujan bound (RB).
For a more detailed exposition of the theory, see Davidoff et al. (2003), Lubotzky (1994), Terras (2010. In order to explain how to construct explicit Ramanujan graphs in the style of LPS, Chiu, LPS-type and Pizer, we recall basic facts and terminologies of quaternion algebras Vignéras (1980). Let F be a field and F × its unit group. Let A = A F be a quaternion algebra over F, i.e. a central simple algebra of dimension 4 over F. In this article, we always assume that F is not of characteristic 2. Then, there exist a, b ∈ F × such that it can be written as where i, j, k satisfy i 2 = a, j 2 = b and i j = − ji = k (and hence k 2 = −ab). For α = x + yi + z j + wk ∈ A, its conjugate, the reduced trace and the reduced norm Quaternion algebras over F q Throughout this article, we denote by P the set of all prime numbers. For a prime p ∈ P and d ∈ N, let F p d be the field of p d elements. Let us fix q ∈ P \ {2}. It is known that, for any a, b ∈ F × q , the quaternion algebra A = A F q (a, b) is isomorphic to the matrix algebra M 2 (F q ) of the 2-by-2 matrices over F q . Let · · be the Kronecker symbol. When a q = −b q = 1, that is, √ a, √ −b ∈ F q , one has the following isomorphism. Here, For a ring R, we denote by R × the group of units of R.
Here, for a group G, we denote by Z (G) the center of G. We can naturally see that PSL 2 (F q ) is a subgroup of PGL 2 (F q ) of index 2 because now q is odd. Additionally, we remark that |PGL 2 (F q )| = q(q 2 − 1) and |PSL 2 (F q )| = q(q 2 −1) 2 . Since A M 2 (F q ), we have A × GL 2 (F q ) via (the restriction of) ψ q and hence obtain the isomorphism We need the following lemma later.

Quaternion algebras over
where Q v is the v-adic completion of Q and is said to be ramified if A v is a division algebra. We denote by Ram(A) the set of all places which are ramified in A. Notice that Ram(A) is a finite set, has an even cardinality, and determines an isomorphism class of quaternion algebras over Q. The product of all primes (= finite places) in Ram(A) is called the discriminant of A and is denoted by D. From now on, we assume that A is definite, that is, the infinite place ∞ is ramified in A, whence there are an odd number of primes which are ramified in A.
it is a ring with unity. In particular, it is called maximal if it is not properly contained in any other order. Notice that, if O is an order of A, then O ⊗ Z Z p is an order of A p for p ∈ P. Here, Z p is the ring of p-adic integers. Let O be an order of A.
. We say that two left (resp. right) O-ideals I and J are equivalent, if there exists α ∈ A × such that I = Jα (resp. I = αJ). This is an equivalence relation. We denote by H (O) the number of equivalence classes, which is shown to be finite, independent on left or right. We call H (O) the class number of O.
We next give the definition of Eichler orders. To do that, we first recall the local situations. If p ∈ P is ramified in A, then A p is a division algebra which has a maximal order O p = {α ∈ A p | N (α) ∈ Z p }. On the other hand if p ∈ P is split in A, then A p is isomorphic to M 2 (Q p ) and a maximal order of A p is isomorphic to a conjugate of the maximal order M 2 ( Let D be the discriminant of A, and M be a positive square-free integer which is prime to D. An order O of A is called an Eichler order of level (D, M) if the following local conditions are satisfied: For all p ∈ P being ramified in A (i.e., On the other hand, for all p ∈ P being split in A (i.e. p D), Remark that an Eichler order is maximal when M = 1. If p | M, in this case we call p an Eichler prime. Notice that an Eichler order can be characterized as an order which is the intersection of two maximal orders. It is shown in Pizer (1976) that the class number of an Eichler order depends only on its level. Hence Let G be a group and S a generating set, which is symmetric (i.e. S = S −1 ) and does not contain the identity of G. A Cayley graph over G with respect to S is a |S|-regular graph with a vertex set V and an edge set E, where V = G and E consists of (g 1 , g 2 ) ∈ G × G such that g 1 = g 2 s for some s ∈ S.
The families of LPS's graphs Let p and q ( 2 √ p) be distinct primes congruent to 1 (mod 4). In Lubotzky et al. (1988), described how to construct a family of Ramanujan graphs of degree p + 1 having O(q 3 ) vertices as q → +∞. These graphs are Cayley graphs over the groups G = PGL 2 (F q ) or PSL 2 (F q ) with respect to the generating set S L P S defined as for odd a 0 > 0 and even a 1 , a 2 , a 3 , (1) originally comes from the norm of their based-algebra A Q (−1, −1), where i 2 = −1, j 2 = −1 and i j = − ji = k, and is called the Hamiltonian quaternion algebra. By Jacobi's four-squares theorem Hirschhorn (1987), there are 8( p + 1) integer solutions (a 0 , a 1 , a 2 , a 3 ) ∈ Z 4 of (1). Since there are 8 units as ±1, ±i, ± j, ±k, we see |S L P S | = p + 1. The families of Chiu's graphs In Margulis (1988), independently of LPS, alluded to the existence of essentially the same graphs as shown by LPS, but without an explicit description. In Chiu (1992), described how to construct a family of Ramanujan graphs, and explicitly covered the case of p = 2. Since the Hamiltonian quaternion algebra is not split at p = 2, Chiu chose a specific quaternion algebra A Q (−2, −13), which is split at 2 and has a maximal order of class number 1. Take a prime q ∈ P \ {2, 13} such that −2 q = 13 q = 1. Chiu's cubic graphs are also Cayley graphs over the groups G = PGL 2 (F q ) or PSL 2 (F q ) with respect to the generating set S C defined as respectively. The families of Morgenstern's graphs In Morgenstern (1994), described how to construct, for any prime power q, a family of Ramanujan graphs of degree q + 1. These graphs are given as Cayley graphs over the groups G = PGL 2 (F q d ) or PSL 2 (F q d ) for some d ∈ N with respect to the generating set S M odd when q is odd and S M even when q is even. For an odd prime power q, let be a non-square in F q . Let Then S M odd is defined as For an even prime power q, let be a non- Then S M even is defined as

Security on Cayley Hashes and Word Problems
A hash function is a function that accepts a message as an arbitrarily long string of bits and outputs a hash value as a finite, fixed-length string of bits. An efficiency of the hashing process is a basic requirement in a practical point. Such a function should satisfy certain properties such as collision resistant, second preimage resistant and preimage resistant. Let n ∈ N and let H : , 1} * is the set of bit strings of arbitrary length and {0, 1} n is the set of bit strings of a fixed length n. The function H is said to be Let G be a non-commutative group and S = {s 0 , . . . , s r } ⊂ G be a generating set for the group G, symmetric and not having the identity. Charles et al. (2009a) and Petit et al. (2007), Petit and Quisquater (2010b) described a definition of Cayley hash functions, by which the input to hash is used as directions for walking around a graph, and the ending vertex is the output of the hash function as depicted in Fig. 1.
A message m is given as a string m 1 . . . m , where m i ∈ {0, . . . , r }. Then the resulting hashing value h of m will be obtained as a group product where g ST is a fixed starting element in G. (We usually put g ST as the identity in G.) To dispose a proper sequence of hashing bits inductively, we define a choice function π which assigns a next hashing bit with the bit of the message m and the previous hashing bit, while avoiding a back-tracking (i.e. ss −1 or s −1 s ). We choose a function such that for any s ∈ S the set π({0, . . . , r } × {s}) is equal to S \ {s −1 }. The security of Cayley hash functions lies on the hardness of solving word problems for group theory (Lubotzky 1994;Meier 2008;Petit and Quisquater 2010b), which are one of the most challenging open problems. There are three problems (balance, representation and factorization problems), which are related to the three properties of Cayley hash functions, respectively.
Let L ∈ N be small (approximately, log |G|). We denote the product of group elements s m 1 , s m 2 , . . . , s m by s m i = s m 1 s m 2 . . . s m . A Cayley hash function is collision resistant if and only if the balance problem is hard; it is second preimage resistant only if the representation problem is hard; it is preimage resistant if and only if the corresponding factorization problem is hard (as described in Fig. 2).
The diameter of a Cayley graph over G with respect to S, which naturally came up from the problems above, is defined as the smallest such that every element of G can be expressed as a word of length at most in S. Babai and Seress (1992) conjectured that the diameter of any Cayley graph over any noncommutative simple group is polylogarithmic in the size of the group such as exp ((|G| log |G|) 1/2 (1 + o(|G|))). Helfgott and Seress (2014) gave a quasipolynomial upper bound exp (log log |G|) O(1) , which is the best known upper bound for permutation groups.
Even after more than two decades of research in various areas (pure mathematics, computer sciences, cryptography, etc.), the hardness of the word problems is still difficult to break. For example, since suggested in Petit and Quisquater (2010b) as a challenge, it seems still open to solve the balance/representation/factorization problems for G = SL 2 (F 2 n ) with some specific generating set, which is tweaked from the generating set of Tillich and Zémor (1994). They also mentioned that it is an important challenge that we identify groups and their corresponding specific generating sets for the groups in which the balance, representation and factorization problems are difficult.

Lifting Attacks
In Zémor (1991), proposed the first scheme of hash functions from Cayley graphs upon SL 2 over a finite field having a large girth, which is the length of a shortest cycle. Right after the advent, Tillich and Zémor found a way to break Zémor's scheme by a lifting attack and suggested its improved version with SL 2 over a finite field of characteristic 2. Tillich-Zémor's scheme (Tillich and Zémor 1994) in resisted being cryptanalyzed for a decade and a half until Grassl et al. (2010) and Petit et al. (2009), Petit and Quisquater (2010a) found their collisions and even preimages in practical. A critical observation for both attacks is that the hardness of balance/representation/factorization problems does not change if we replace the generators for SL 2 (F 2 n ) in order to use the Euclidean algorithm. Even Cayley hash functions based on LPS Ramanujan graphs proposed from Charles et al. (2009a) have been broken by Tillich and Zémor (2008) using a variant of a lifting attack.
In this subsection, we give a brief example of a lifting attack, which was used by Tillich and Zémor (2008). We have conditions on distinct prime numbers p and q that p and q satisfy p ≡ q ≡ 1 (mod 4) and p q = 1. First, the elements of PSL 2 (F q ) are lifted to elements of SL 2 (Z[i]), where i is the imaginary unit. Even though the lifts of the generators do not generate the whole SL 2 (Z[i]) and only a subset of SL 2 (Z[i]) with specific conditions shown in Tillich and Zèmor (2008), the lifting attack still works because has a very simple nature as shown below.
Tillich and Zémor solved the representation problem by lifting the identity to , which amounts to solving the norm equation with λ, x, y, z, w ∈ Z and ∈ N (Once the identity is lifted, reduction by q and factoring become trivial). The equation is solved as follows: we arbitrarily fix = 2 with p > mq 2 and λ + xq = p − 2mq 2 for some m. We substitute them for each variable in the norm Eq. (3). The norm equation can be deformed by 4q 2 , resulting in the equation of the form y 2 + z 2 + w 2 = N := m( p − mq 2 ). The last equation is solved by generating random variables for w, checking the right parity to ensure that the resulting equation y 2 + z 2 = N := N − w 2 has a solution, and we finally solve this equation with the continued fraction method (or with the advanced Euclidean algorithm, Cornacchia's algorithm, Pell's equation).
Subsequently, most of the existing Cayley hash functions based on explicit Ramanujan graphs Chiu (1988), Lubotzky (1994), Morgenstern (1992) have been broken by variants of a lifting attack Jo et al. (2008), Petit et al. (2008), Tillich and Zémor (2017) as lifting attacks are able to solve the factorization/representation problems for each case. As we can see in Table 1, when we attack Cayley hash func-  (Lubotzky 1988) x 2 + y 2 + z 2 + w 2 = p N := p − z 2 − w 2 Chiu's Ramanujan graph ( p = 2) (Chiu 1992) x 2 + 2y 2 + 13z 2 + 26w 2 = 2 N := 2 − 13z 2 − 26w 2 LPS-type Ramanujan graph (Jo et al. 2020) x 2 + Py 2 + Qz 2 + P Qw 2 = p N := p − Qz 2 − P Qw 2 tions, we can apply a lifting attack, which corresponds to a norm equation of their base algebra with a Euclidean algorithm. Thus, we want to make explicit Ramanujan graphs which have more various norm equations that use P and Q as coefficients (P ∈ {2, 3, 5, 7, 13} and Q ∈ P satisfying Q ≡ 3 (mod 8), −Q P = −1 unless P = 2). At the very least, for applying variants of a lifting attack, we should set up an attack corresponding to each norm equation. It is also possible to put partial information (P, Q or both) unrevealed during the process of hashing as a private key. From this, we can build the digital signature schemes which mainly resist variants of a lifting attack. This motivates the study of a generalization of LPS's and Chiu's Ramanujan graphs.

The Families of LPS-Type Graphs
Now we recall Ibukiyama's construction (Ibukiyama 1982) of maximal orders of definite quaternion algebras over Q which is ramified at given primes.
Proposition 1 (Ibukiyama 1982) Let r be an odd positive integer and P 1 , P 2 , . . . , P r distinct prime numbers. Set M = P 1 P 2 · · · P r . Take a prime number Q such that Q ≡ 3 (mod 8) and ( −Q P i ) = −1 for all i except for i with P i = 2. Moreover, take an integer T such that T 2 ≡ −M (mod Q). Then, A Q (−M, −Q) is a definite quaternion algebra which is ramified only at ∞, P 1 , P 2 , . . . , P r . Moreover, let Then, O −M,−Q = Z + Zω 1 + Zω 2 + Zω 3 is a maximal order of A Q (−M, −Q).

Find all elements in
Define S by the suitable complete representative. Then |S| is exactly equal to p + 1, which follows by the class number 1 condition Chiu (1992, Proposition 3.4). 6. Take a q ∈ P \ {2} satisfying q = p, −P q = Q q = 1 and p q = 1. 7. Via the isomorphism ψ q in Lemma 1 and using Lemma 2, we realize S as a subset of PSL 2 (F q ). Write S J SY for the subset. 8. We have a Cayley graph X ( p,q) P,Q = Cay(PSL 2 (F q ), S J SY ).
In Table 2, we present some numerical results by Magma and MATLAB which show the Ramanujan-ness of our constructions. Actually, we will show in the next subsection that our LPS-type graphs are Ramanujan when P = 13, which is the only choice of P ∈ {2, 3, 5, 7, 13} such that O × is equal to {±1}. For the cases of P ∈ {2, 3, 5, 7}, at present, we have no ideas to prove or disprove the Ramanujan-ness of our graphs.

Proof of the Ramanujan-Ness of Graphs X ( p,q) P, Q when P = 13
We show that our graph X ( p,q) P,Q constructed as above is Ramanujan when P = 13. Let O = Z + Zω 1 + Zω 2 + Zω 3 be the maximal order we constructed as above for a fixed p, P, Q, T . Then, O has the class number 1.
The unit group O × is {±1} only when P = 13. In such a case, we can prove the Ramanujan-ness of our graph X ( p,q) P,Q in the same way as Lubotzky (1988). For the variable v = (x, y, z, w), we set It is a positive-definite quadratic form of order 4 corresponding to the reduced norm on O. Let A q be the symmetric matrix such that Hence, A q is an even matrix, i.e. A q ∈ M 4 (Z) and every diagonal component is contained in 2Z. The level of Q q is defined as the smallest positive integer N such that N A −1 q is an even matrix (cf. Schoeneberg 2012, Chap. IX). By det(A q ) = P 2 q 6 and the level of Q q is equal to Pq 2 . Set r Q q (n) := |{α ∈ O |N (α) = n}| for n ∈ N. Then, the theta series Q q (z) := ∞ n=0 r Q q (n)e 2πinz = v∈Z 4 e 2πi Q q (v)z for z ∈ C with Im(z) > 0 is absolutely and locally uniformly convergent by Schoeneberg (2012, Chap. IX, Sect. 1.1). Referring to Schoeneberg (2012, Chap. IX, Theorem 4) and Schoeneberg (2012, Chap. IX, Theorem 5) for h = 0, the theta series Q q (z) is a holomorphic modular form of weight 2 and level 0 (Pq 2 ) with trivial nebentypus. Here, 0 (Pq 2 ) is the Hecke congruence subgroup of level Pq 2 . We remark that Q q , A q , Q q , are valid for a general q ∈ N.
For proving Ramanujan-ness, let λ 0 = p + 1 > λ 1 ≥ · · · ≥ λ n−1 be the spectrum of the adjacency matrix of X ( p,q) 13,Q (so we set n = |X ( p,q) 13,Q | = |PSL 2 (F q )|). Then, we have only to show θ j ∈ R for all j ∈ {1, . . . , n − 1}, where θ j ∈ C is taken so that λ j = 2 √ p cos θ j for each j ∈ {0, . . . , n − 1}. By the trace formula for a regular graph as in Lubotzky (1988, p. 270-272 and p. 274, Remark 2), we have the expression Recall that this is the p k -th Fourier coefficient of the modular form Q q . Since the theta series is a sum of a linear combination of cuspidal Hecke eigenforms and that of Eisenstein series of weight 2 and level 0 (Pq 2 ), we may take a cusp form f 1 and a non-cusp form f 2 of weight 2 so that Q q = f 1 + f 2 . Let a(m) and C(m) be the m-th Fourier coefficients of f 1 and f 2 at the cusp ∞ for m ∈ N, respectively. Then, r Q q ( p k ) has the following expression: By Deligne's bound as a resolution of the Ramanujan-Petersson conjecture (Deligne 1969(Deligne , 1974, we have |a( p k )| = O ( p k(1/2+ ) ). Due to the explicit nature of Fourier coefficients of Eisenstein series, C(m) can be described as C(m) = d|m F(d) for a periodic function F : N → C (cf. Lubotzky 1988, p. 272). By p q = 1 and θ 0 = i log √ p, we have By the Deligne bound of a( p k ) and Lubotzky (1988, Lemma 4.4), we have C( p k ) = 2 n p k+1 −1 p−1 because of p q = 1. As a consequence, for any > 0, 2 n n−1 j=1 which leads us that every θ j for j ∈ {1, . . . , n − 1} is real. Therefore, we obtain |λ j | ≤ 2 √ p for all j = 1, . . . , n − 1, which implies that X ( p,q) 13,Q is a Ramanujan graph.
We remark an adelic approach toward Ramanujan-ness. As we see Costache et al. (2018, Sect. 7.2) (see also Lubotzky 1994, Theorem 7.1.1), we can prove the Ramanujan-ness of X ( p,q) P,Q for P = 13 by using an adelic interpretation as well as by using the Jacquet-Langlands correspondence between automorphic representations of the adelic group GL 2 (A Q ) and those of A × (A Q ) = (A ⊗ A Q ) × , which is the adelization of the anisotropic inner form A × of GL 2 .

Relationship Between LPS-Type Graphs and Pizer's Graphs
While research in the field of Cayley-based cryptography has been declining, research in the field of Isogeny-based cryptography is quite robust, in part due to its key role in post-quantum cryptography. However, it is also natural to investigate whether attacks on group word problems of Cayley hash functions based on LPS's graphs are related to the problem of finding a path in an isogeny graph of supersingular elliptic curves, which is explained in detail in Charles et al. (2009b). Costache et al. (2018) described a wide range of usage of Ramanujan graphs in cryptography and also pointed out some different aspects of LPS's graphs and Pizer's graphs with specific features. They presented the construction of LPS's graphs as Cayley graphs, in terms of local double cosets. They used strong approximation (Costache et al. 2018, Sect. 7;Lubotzky 1994, Sect. 6.3) as a main tool to present the connection between local and adelic double cosets for LPS's and Pizer's graphs. They also compared the two types of graphs in an aspect of appearance by restricting the degree of the graphs (i.e. p = 5).
In this section, we give some comparisons between LPS-type graphs and Pizer's graphs as Costache et al. did. First, we describe Pizer's Ramanujan graphs referred to in Pizer (1990Pizer ( , 1998, Costache et al. (2018). Pizer (1990Pizer ( , 1998 showed how to construct the family of Ramanujan graphs as follows: Let A be the quaternion algebra over Q that is ramified exactly at odd q ∈ P and ∞. We shall consider special orders, which are generalizations of Eichler orders, of level L = (q, M) and L = (q 2 , M). The vertex set of Pizer's graph G (L , p) shall be in bijection with (a subset of) the isomorphism classes of left ideals of an order. Since the class number of the order depends only on its level, we may write H (L) for it, which is equal to the size of such a graph. Notice that, by Pizer (1998, Proposition 4.4), we have

The families of Pizer's graphs
Here, the product is over all primes d dividing M.
We give a definition of a Brandt matrix. Let i, j associated to an order of level L is a square matrix of size H (L) where N (I ) is the norm of an ideal I defined as the greatest common divisor of the norms of its nonzero elements. Let p be a prime which is coprime to q M. If we restrict the parameters p and q, the edge set of G(L , p) is given by a Brandt matrix B(L; p), namely, the adjacency matrix of G(L , p) is given by B (L; p). By Pizer (1998, Proposition 4.6), we see that G (L , p) is undirected (i.e. B(L; p) is symmetric) when L = (q, M) with q ≡ 1 (mod 12) and L = (q 2 , M) with q > 3. Moreover, it has no loops if tr B(L; p) = 0 and no multiple edges if tr B(L; p 2 ) = H (L) (Costache et al. 2018;Pizer 1998). The regularity p + 1 Table 3 The families of Pizer's graphs G (L , p)  ( p + 1)-regular of G (L , p) and its connectedness can be obtained from using B(L; p) as the adjacency matrix, as shown in Pizer (1998, Proposition 5.1). We summarize the necessary properties of the families of Pizer's graphs G (L , p) in Table 3.

Similarities and Differences
As Costache et al. (2018) argued, we explicate the similarities and differences among LPS, LPS-type and Pizer's graphs from a number-theoretic perspective. These families can be viewed as sets of local double cosets, i.e. as graphs of the form where is a discrete cocompact subgroup.

Discrete local double cosets (LPS-type) Let p be a split prime in
It is a discrete cocompact subgroup in A × p . We have for some suitable S. For LPS-type graphs, the local double cosets are also isomorphic to adelic double cosets, but in this case the corresponding set of adelic double cosets is smaller relative to the quaternion algebra and we do not have the same chain of isomorphisms as shown below. On the other hand, Pizer's graphs, via strong approximation (Costache et al. 2018;Lubotzky 1994), can be viewed as graphs on adelic double cosets which are in turn the set of classes of an order of A that is related to a discrete cocompact subgroup . Moreover, the class set Cl(O) of a maximal order O from Pizer's graph is in bijection with supersingular elliptic curves (Charles et al. 2009b, Sect. 5.3.1) and offers convincing evidence that an isomorphism is obtained with a supersingular isogeny graph (SSIG).

The chain of isomorphisms (LPS)
Cay(PSL 2 (F q ), S L P S ) ∼ = (2q)\PGL 2 (Q p )/PGL 2 (Z p ) (LPS-type with P = 13) Cay(PSL 2 (F q ), S J SY ) ∼ = (q)\PGL 2 (Q p )/PGL 2 (Z p ) Each of the underlying quaternion algebras vary with their own choice of parameters. In the case of LPS's graphs, we use the Hamiltonian quaternion algebra, ramified at 2 and ∞ and split at p. In the case of LPS-type graphs, we use the definite quaternion algebra, ramified at 13 and ∞ and split at p. Varying the parameter q, we can have different Ramanujan graphs of LPS and LPS-type, depending on the congruence subgroup (2q) and (q), respectively, without changing each of their underlying quaternion algebras. On the other hand, in the case of Pizer's graphs, we use the definite quaternion algebra, ramified at q and ∞.

Open Problems
It is unknown whether the link exists between the hardness of the path-finding problem in Supersingular Isogeny (Pizer) graphs and the the hardness of group word problems in Cayley-type Ramanujan graphs. If it is possible to connect those two problems theoretically or schematically, there are some expected ways to analyze the hardness of the path-finding problem in Pizer's graphs by employing the approach previously used for Cayley graphs. As a part of these approaches, it is also important to investigate much more general versions of explicit constructions of Ramanujan graphs. It is in the process to construct the family of (2 p + 1)-regular graphs, where p is an Eichler prime based on the quaternion algebra with an explicit construction of Eichler order having class number 1 in Jo et al. (2020). We now study the Ramanujan-ness of these graphs by similar arguments in LPS-type graphs.
Additionally, even though it is difficult to predict that Pizer's graph can be represented as a Cayley graph over a group with respect to a suitable generating set (actually, all graphs with a small number of vertices, suggested as examples in Pizer 1998 are not Cayley graphs), it is not clear whether a Pizer's graph with a sufficiently large number of vertices is a Cayley graph or not. M.F. Vignéras, Arithmétique des algèbres de quaternions. Lecture Notes in Mathematical, vol. 800 (Springer, Berlin, 1980) G. Zémor, Hash functions and graphs with large girths, in Workshop on the Theory and Application of Cryptographic Techniques (Springer, Berlin, Heidelberg, 1991), 508-511 Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made. The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.