Explicit construction of the square-root Vélu's formula on Edwards curves

Abstract

The square-root Vélu's formula ( √ élu's formula) is known to be effective way to speed up the computations of higher-degree isogeny used for isogeny-based cryptosystems such as CSIDH and B-SIDH. The original formula was proposed using Montgomery curves, and Moriya et al. then extended it to Edwards curves without specific construction method. In this study, we explicitly show how to construct √ élu's formula on Edwards curves. In particular, we provide a method for adjusting for the differences between two resultants. We also compare the computational complexity with the original √ élu's formula and find that it is up to 8% faster.

Improvement of the square-root Vélu's formulas for isogeny-based cryptography

“…We evaluate the cost on Edwards curves using the scaled remainder tree algorithm for the resultant calculation. We use sibc library and its modification to Edwards curves [9].…”

“…Conventionally, the index system is constructed to represent a subset of the set S. Here, we propose a construction that has a redundant part other than the set S, and show a formula for computing isogeny using this construction. We discuss the speedup of isogeny computation using the proposed method and show that a new redundant index system speeds up the computation of isogeny by using sibc library and its modification on Edwards curves [9]. We also search for an optimal index system consisting of the original method and our method for degrees (97 ≤ ≤ 2689), and show that it improves by 44% of the 367 primes and is 6.6% faster for = 1279, 2687.…”

“…Moriya et al [8] extended √ élu's formulas to Edwards curves. Later, an efficient implementation of √ élu's formulas on Edwards curves based on sibc library was given by Takahashi et al [9]. Their implementation shows that √ élu's formulas are more efficient than Vélu's formulas for degrees greater than or equal to 97, and that those on Edwards curves are faster than those on Montgomery curves for isogeny computations of most of these degrees.…”