Radical Isogenies on Montgomery Curves

Onuki, Hiroshi; Moriya, Tomoki

doi:10.1007/978-3-030-97121-2_17

Cited by 5 publications

(19 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is because in supersingularity testing, it is necessary to verify for not only the elliptic curve of the destination of 4-isogeny, but also the 2isogenous elliptic curve in between, that it is an elliptic curve on F p 2 . We also note that a variant of radical isogenies on Montgomery curves is proposed in [17], but this is also not directly applicable to supersingularity testing by the same reason as above.…”

Section: Relation To Radical Isogeniesmentioning

confidence: 97%

Efficient Supersingularity Testing of Elliptic Curves Using Legendre Curves

Hashimoto

Nuida

2023

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

There are two types of elliptic curves, ordinary elliptic curves and supersingular elliptic curves. In 2012, Sutherland proposed an efficient and almost deterministic algorithm for determining whether a given curve is ordinary or supersingular. Sutherland's algorithm is based on sequences of isogenies started from the input curve, and computation of each isogeny requires square root computations, which is the dominant cost of the algorithm. In this paper, we reduce this dominant cost of Sutherland's algorithm to approximately a half of the original. In contrast to Sutherland's algorithm using j-invariants and modular polynomials, our proposed algorithm is based on Legendre form of elliptic curves, which simplifies the expression of each isogeny. Moreover, by carefully selecting the type of isogenies to be computed, we succeeded in gathering square root computations at two consecutive steps of Sutherland's algorithm into just a single fourth root computation (with experimentally almost the same cost as a single square root computation). The results of our experiments using Magma are supporting our argument; for cases of characteristic p of 768-bit to 1024-bit lengths, our proposed algorithm for characteristic p ≡ 1 (mod 4) runs in about 61.5% of the time and for characteristic p ≡ 3 (mod 4) also runs in about 54.9% of the time compared to Sutherland's algorithm.

show abstract

Section: Relation To Radical Isogeniesmentioning

confidence: 97%

Efficient Supersingularity Testing of Elliptic Curves Using Legendre Curves

Hashimoto

Nuida

2023

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

show abstract

“…In [19], Onuki and Moriya introduced radical isogeny formulas of degrees 3 and 4 on Montgomery curves. A Montgomery curve over a field k is an elliptic curve of the form E : y 2 = x 3 + Ax 2 + x, where A ∈ k and A 2 ̸ = 4.…”

mentioning

confidence: 99%

“…This equality implies the existence of radical isogenies formulas for the modular curve X 0 (4). The Montgomery coefficient A represents a class in the set S 0 (4), see [19,Section 2.3]. In other words, we can say that the coefficient A describes an enhanced elliptic curve where the additional torsion data is a cyclic subgroup of order 4.…”

mentioning

confidence: 99%

“…In other words, we can say that the coefficient A describes an enhanced elliptic curve where the additional torsion data is a cyclic subgroup of order 4. The Montgomery coefficient for the curve E ′ can be calculated by a rational expression depending on the fourth root from 4(A + 2) see [19,Theorem 8].…”

mentioning

confidence: 99%

“…The authors of [19] explored the possibility of extending radical isogeny formulas to the modular curve X 0 (N ) when N ≥ 5. The idea behind this can be summarized in a few informal steps.…”

mentioning

confidence: 99%

See 2 more Smart Citations

Radical isogenies and modular curves

Pribanić

2024

AMC

View full text Add to dashboard Cite

This article explores the connection between radical isogenies and modular curves. Radical isogenies are formulas designed for the computation of chains of isogenies of fixed small degree N , introduced by Castryck, Decru, and Vercauteren at Asiacrypt 2020. One significant advantage of radical isogeny formulas over other formulas with similar purpose is that they eliminate the need to generate a point of order N that generates the kernel of the isogeny. While radical isogeny formulas were originally developed using elliptic curves in Tate normal form, Onuki and Moriya have proposed radical isogeny formulas of degrees 3 and 4 on Montgomery curves and attempted to obtain a simpler form of radical isogenies using enhanced elliptic and modular curves. In this article, we translate the original setup of radical isogenies in Tate normal form into the language of modular curves. Additionally, we solve an open problem introduced by Onuki and Moriya regarding radical isogeny formulas on X 0 (N ).

show abstract

Fully Projective Radical Isogenies in Constant-Time

Chi-Domínguez

Reijnders

2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

At PQCrypto-2020, Castryck and Decru proposed CSURF (CSIDH on the surface) as an improvement to the CSIDH protocol. Soon after that, at Asiacrypt-2020, together with Vercauteren they introduced radical isogenies as a further improvement. The main improvement in these works is that both CSURF and radical isogenies require only one torsion point to initiate a chain of isogenies, in comparison to Vélu isogenies which require a torsion point per isogeny. Both works were implemented using non-constant-time techniques, however, in a realistic scenario, a constant-time implementation is necessary to mitigate risks of timing attacks. The analysis of constant-time CSURF and radical isogenies was left as an open problem by Castryck, Decru, and Vercauteren. In this work we analyze this problem. A straightforward constant-time implementation of CSURF and radical isogenies encounters too many issues to be cost effective, but we resolve some of these issues with new optimization techniques. We introduce projective radical isogenies to save costly inversions and present a hybrid strategy for integration of radical isogenies in CSIDH implementations. These improvements make radical isogenies almost twice as efficient in constant-time, in terms of finite field multiplications. Using these improvements, we then measure the algorithmic performance in a benchmark of CSIDH, CSURF and CRADS (an implementation using radical isogenies) for different prime sizes. Our implementation provides a more accurate comparison between CSIDH, CSURF and CRADS than the original benchmarks, by using state-ofthe-art techniques for all three implementations. Our experiments illustrate that the speed-up of constant-time CSURF-512 with radical isogenies is reduced to about 3% in comparison to the fastest state-of-the-art constant-time CSIDH-512 implementation. The performance is worse for larger primes, as radical isogenies scale worse than Vélu isogenies.

show abstract

Radical Isogenies on Montgomery Curves

Cited by 5 publications

References 18 publications

Efficient Supersingularity Testing of Elliptic Curves Using Legendre Curves

Efficient Supersingularity Testing of Elliptic Curves Using Legendre Curves

Radical isogenies and modular curves

Fully Projective Radical Isogenies in Constant-Time

Contact Info

Product

Resources

About