Optimizing the evaluation of \(\ell\)-isogenous curve for isogeny-based cryptography (Q2169440)

In the paper under review, the authors propose a method that can serve as a useful technique for faster implementation of isogeny-based cryptography. Actually, some explicit formulas for evaluating an \(l\)-isogenous curve from three differential points on different curve models are presented: 1. The recovery of the \(l\)-isogenous curve in the Montgomery model is optimized in projective coordinates \((X:Z)\). The operation requires a cost of 9M + 1S + 18A, thus outperforming the previous best algorithm, which needs a cost of 11M + 1S + 13A. 2. The computation for evaluating an \(l\)-isogenous curve in the Edwards model is proposed in two different projective coordinates: in projective coordinates \((Y:Z)\), the operation costs 8M + 7S + 12A; in projective coordinates \((W:Z)\), the operation costs 9M + 1S + 20A. 3. These computations with respect to the Extended Jacobi model or the Huff model are given in projective coordinates \((W:Z)\) and require a cost of 9M + 1S + 17A and 9M + 1S + 18A, respectively. Based on these formulas, the authors present the efficiency analysis and optimize the implementation of supersingular isogeny Diffie-Hellman (SIDH) using twisted torsion (B-SIDH).