Optimized method for computing odd-degree isogenies on Edwards curves (Q2176652)

The paper presents a method to compute isogenies (of prime odd degree) on elliptic curves given by Edwards equations. The method has computational advantages over a previous proposal of \textit{J. Woodage} and \textit{D. Shumow} [Lect. Notes Comput. Sci. 11477, 151--180 (2019; Zbl 1428.94097)]. Edwards curves were introduced because their efficient arithmetic, see [\textit{D. J. Bernstein} et al., ibid. 5023, 389--405 (2008; Zbl 1142.94332)]. This make them suitable for the implementation of the cryptography based on the elliptic discrete logarithm problem. But the recent proposal of isogenies of elliptic curves, mainly the supersingular ones, like a tool for the postquantum cryptography has caused a growing interest for optimal isogenies formulas, using particular models of elliptic curves, as Montgomery and Edwards curves. Section 1 discusses the problem and some of the proposed schemes, as the supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol of \textit{L. De Feo} et al. [J. Math. Cryptol. 8, No. 3, 209--247 (2014; Zbl 1372.94419)] and the CSIDH (commutative SIDH) of \textit{W. Castryck} et al. [Lect. Notes Comput. Sci. 11274, 395--427 (2018; Zbl 1407.81084)]. Section 2 summarizes the arithmetic in Edwards curves using the \(w\)-coordinate system of \textit{R. R. Farashahi} and \textit{S. G. Hosseini} [ibid. 10343, 366--378 (2017; Zbl 1420.94060)], as well as the SIDH and CSIDH protocols. Section 3 gives the proposed isogeny formulas in a similar way to \textit{D. Moody} and \textit{D. Shumow} [Math. Comput. 85, No. 300, 1929--1951 (2016; Zbl 1339.14026)] but using \(w\)-coordinates (Theorems 1 and 3). Theorems 2 and 4 provide the image coefficient in \(w\)-coordinates. Finally, Section 4 studies the computational cost comparing it with the corresponding to Montgomery curves (Table 1) and shows an implementation of CSIDH using the obtained formula For the entire collection see [Zbl 1428.94009].