Isogenies on Kummer surfaces (Q6965674)

In [\textit{P. Gaudry}, J. Math. Cryptol. 1, No. 3, 243--265 (2007; Zbl 1145.11048)], the Fast Kummer surface model was introduced in the context of cryptographic applications. This model, which enables particularly efficient computations, had previously been explored from an algorithmic perspective in [\textit{D. V. Chudnovsky} and \textit{G. V. Chudnovsky}, Adv. Appl. Math. 7, 385--434 (1986; Zbl 0614.10004)]. The present work undertakes a detailed study of the Fast Kummer surface model.\N\NThe first main contribution of this article is a fully algebraic rederivation of the fast Kummer surface \(K^{\text{fast}}\). This is accomplished by identifying a genus-2 curve \(D\) of the form \N\[\Ny^2 = x(x -1)(x -\rho)(x - \sigma)(x - \tau), \N\]\Ntogether with an explicit linear map from the general Kummer surface of \(D\) to the Fast Kummer surface, defined by an equation of the form: \N\[\N\begin{aligned} X^4 + Y^4 + Z^4 + T^4 &- F (X^2T^2 + Y^2Z^2) - G(X^2Z^2 + Y^2T^2) \\\N&- H(X^2Y^2 + Z^2T^2) + 2EXYZT = 0. \end{aligned} \N\]\NAll computations are carried out over the ground field of the parameters. As a result, an explicit model of the Jacobian variety of \(D\) is obtained, with \(K^{\text{fast}}\) as its associated Kummer surface.\N\NIn addition, the article describes a general algebraic method for constructing \((N, N)\)-isogenies between Kummer surfaces that admit efficiently computable biquadratic forms, for any odd integer \(N\). The isogeny is expressed as a composition \N\[\N\phi = \lambda \circ \psi, \N\]\Nwhere \(\psi\) has the desired kernel, and \(\lambda\) is a linear map that transforms the image into the appropriate Kummer form. An algorithm is presented for the computation of \(\psi\) for any Kummer surface model with efficiently computable biquadratic forms.\N\NThe paper is accompanied by software implementations developed in MAGMA and Maple.