Optimized method for computing odd-degree isogenies on Edwards curves
The paper presents a method to compute isogenies (of prime odd degree) on elliptic curves given by Edwards equations. The method has computational advantages over a previous proposal of \textit{J. Woodage} and \textit{D. Shumow} [Lect. Notes Comput. Sci. 11477, 151--180 (2019; Zbl 1428.94097)]. Edwards curves were introduced because their efficient arithmetic, see [\textit{D. J. Bernstein} et al., ibid. 5023, 389--405 (2008; Zbl 1142.94332)]. This make them suitable for the implementation of the cryptography based on the elliptic discrete logarithm problem. But the recent proposal of isogenies of elliptic curves, mainly the supersingular ones, like a tool for the postquantum cryptography has caused a growing interest for optimal isogenies formulas, using particular models of elliptic curves, as Montgomery and Edwards curves. Section 1 discusses the problem and some of the proposed schemes, as the supersingular isogeny Diffie-Hellman (SIDH) key exchange protocol of \textit{L. De Feo} et al. [J. Math. Cryptol. 8, No. 3, 209--247 (2014; Zbl 1372.94419)] and the CSIDH (commutative SIDH) of \textit{W. Castryck} et al. [Lect. Notes Comput. Sci. 11274, 395--427 (2018; Zbl 1407.81084)]. Section 2 summarizes the arithmetic in Edwards curves using the \(w\)-coordinate system of \textit{R. R. Farashahi} and \textit{S. G. Hosseini} [ibid. 10343, 366--378 (2017; Zbl 1420.94060)], as well as the SIDH and CSIDH protocols. Section 3 gives the proposed isogeny formulas in a similar way to \textit{D. Moody} and \textit{D. Shumow} [Math. Comput. 85, No. 300, 1929--1951 (2016; Zbl 1339.14026)] but using \(w\)-coordinates (Theorems 1 and 3). Theorems 2 and 4 provide the image coefficient in \(w\)-coordinates. Finally, Section 4 studies the computational cost comparing it with the corresponding to Montgomery curves (Table 1) and shows an implementation of CSIDH using the obtained formula For the entire collection see [Zbl 1428.94009].
- A simple and compact algorithm for SIDH with arbitrary degree isogenies
- How to construct CSIDH on Edwards curves
- Isogeny formulas for Jacobi intersection and twisted Hessian curves
- Optimizing the evaluation of \(\ell\)-isogenous curve for isogeny-based cryptography
- Optimized arithmetic operations for isogeny-based cryptography on Huff curves
- Computing isogenies between Montgomery curves using the action of (0,0)
- A simple and compact algorithm for SIDH with arbitrary degree isogenies
- Optimized arithmetic operations for isogeny-based cryptography on Huff curves
- Isogenies on twisted Hessian curves
- Simplified isogeny formulas on twisted Jacobi quartic curves
- Optimizing the evaluation of \(\ell\)-isogenous curve for isogeny-based cryptography
- L₁-norm ball for CSIDH: optimal strategy for choosing the secret key space
- Special properties of the point addition law for non-cyclic Edwards curves
- Faster isogeny computation on twisted Hessian curves
- An Interactive Tool to Explore and Improve the Ply Number of Drawings
- Explicit construction of the square-root Vélu's formula on Edwards curves
- Radical isogenies on Montgomery curves
- Isogeny computation on twisted Jacobi intersections
- Application of Velusqrt algorithm to Huff's curves
- How to construct CSIDH on Edwards curves
- Improvement of the square-root Vélu's formulas for isogeny-based cryptography
- PQC CSIKE algorithm on non-cyclic Edwards curves
- Radical isogenies and modular curves
- A note on (2, 2)-isogenies via theta coordinates
- Lower bounds of costs of 3-isogenies formulas in the framework of generalized Montgomery coordinates
- How to construct CSIDH on Edwards curves
This page was built for publication: Optimized method for computing odd-degree isogenies on Edwards curves
Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q2176652)
