Abstract
Elliptic curves are typically defined by Weierstrass equations. Given a kernel, the well-known Vélu's formula shows how to explicitly write down an isogeny between Weierstrass curves. However, it is not clear how to do the same on other forms of elliptic curves without isomorphisms mapping to and from the Weierstrass form. Previous papers have shown some isogeny formulas for (twisted) Edwards, Huff, and Montgomery forms of elliptic curves. Continuing this line of work, this paper derives explicit formulas for isogenies between elliptic curves in (twisted) Hessian form. In addition, we examine the numbers of operations in the base field to compute the formulas. In comparison with other isogeny formulas, we note that our formulas for twisted Hessian curves have the lowest costs for processing the kernel and our X-affine formula has the lowest cost for processing an input point in affine coordinates.
1 Introduction
An elliptic curve is defined as a nonsingular irreducible projective curve of genus one, with a specified point as additive identity on the curve. An elliptic curve is said to be defined over a field k if the curve is defined over k and the specified point additive identity is k-rational.
Let E be an elliptic curve defined over k with the specified point additive identity O. It is well known that there exist functions x, y ∈ k(E) such that the rational map ϕ defined over k by ϕ = (x : y : 1) is an isomorphism from E to an elliptic curve in Weierstrass form:
and ϕ (O) = (0 : 1 : 0), where a1, a2, . . . , a6 ∈ k (see [1, III.3.1]). Therefore, elliptic curves are typically identified with curves defined by such a Weierstrass equation with the specified point additive identity (0 : 1 : 0).
Let E and E′ be elliptic curves with specified point additive identities O and O′ respectively. An isogeny from E to E′ is defined as a morphism ϕ : E → E′ such that ϕ (O) = O′. It is a theorem (see [1, III.4.8]) that an isogeny is also a group homomorphism. As a corollary, the kernel of an isogeny is a finite subgroup of the domain. Conversely, if F is a finite subgroup of E, there exists an elliptic curve E′ and a separable isogeny ϕ : E → E′ such that the kernel of ϕ is F (see [1, III.4.12]). Given E and F, Vélu's formula in [2] shows an explicit expression for ϕ and E′, where E and E′ are both in Weierstrass form.
However, the Weierstrass equation is only one way to represent an elliptic curve. Other forms of elliptic curves are possible and have been proposed, some with applications in cryptography. Examples include Montgomery curves in [3, 4], (twisted) Edwards curves in [5, 6, 7], Huff curves in [8, 9], and (twisted) Hessian curves in [10]. The first formulas for isogenies defined directly for non-Weierstrass curves was for (twisted) Edwards curves and Huff curves [11]. Shortly thereafter, similar work, [12] and [13], showed formulas for computing isogenies on Montgomery curves. In this paper, we derive a formula for isogenies on twisted Hessian curves and consider the computational cost of computing image points. Furthermore, in our main proof, we make explicit and rigorous the techniques and justifications that are required but omitted in proving isogeny formulas in previous works. Compared to other isogeny formulas, we note that our formulas for twisted Hessian curves have the lowest costs for preprocessing the kernel points to determine the rational map prior to input evaluation, and our X-affine formula has the lowest cost for processing an input point in affine coordinates.
Isogenies have found applications in counting the number of points on an elliptic curve over a finite field (e.g. see [14, 15]), analyzing the complexity of elliptic-curve discrete logarithms in [16], and cryptographic constructions (e.g. [17, 18, 19]). More efficient isogeny formulas could lead to performance benefits in the above applications.
The organization of the paper is as follows. Section 2 introduces Hessian curves and their generalization called twisted Hessian curves. A summary of the point addition formulas on twisted Hessian curves is included. Section 3 derives formulas for 3-isogenies. Section 4 states and proves the main result for isogenies with a kernel of size ℓ ≢ 0 (mod 3). Finally, Section 5 examines the main formula's computational cost of computing image points. Some open problems and directions for future work are given in Section 6.
2 Twisted Hessian Curves
A Hessian curve in projective coordinates is defined by the equation
with 27 − d3 ≠ 0. The Hessian form of elliptic curves has been studied, for example, in [20, 21, 22, 23], to optimize point addition and scalar multiplication formulas, as well as to optimize pairing computations. In addition, as a step towards resistance against side-channel attacks, the Sylvester addition formula (described below) on Hessian curves can also be used for point doubling and subtraction after a permutation of input coordinates [24]. A generalization of Hessian curves, called twisted Hessian curves, is defined by the equation
with a(27a − d3) ≠ 0. Twisted Hessian curves were used in [10] to provide a complete unified addition formula and improve efficiency for point doubling and tripling over fields of arbitrary characteristic. Other works that optimized arithmetic on (twisted) Hessian curves include [25, 26, 27].
Definition 1
A twisted Hessian curve over a field k is a projective curve H(a, d) defined by the polynomial aX3 + Y3 + Z3 = dXYZ with the specified point (0 : −1 : 1) as additive identity in the projective space ℙ(k)2, with a, d ∈ k and a(27a − d3) ≠ 0. If a = 1, the curve is called a Hessian curve.
As an elliptic curve, each twisted Hessian curve must be isomorphic over k to a curve given by a Weierstrass equation. Over a finite field of characteristic not equal to 3, we can find an explicit isomorphism from any twisted Hessian curve to a Weierstrass curve, and conversely, from any Weierstrass curve with a k-rational point of order 3 to a twisted Hessian curve. Such isomorphisms are given in [10, Theorem 5.3 and 5.4] and [28].
For convenience, we summarize below the formulas for point addition on twisted Hessian curves. Let (X1 : Y1 : Z1) and (X2 : Y2 : Z2) be points on H(a, d). The inverse of (X1 : Y1 : Z1) is
The (Sylvester) standard addition formula is given by:
If (X3, Y3, Z3) ≠ (0, 0, 0), then (X1 : Y1 : Z1) + (X2 : Y2 : Z2) = (X3 : Y3 : Z3). Another addition formula, called rotated addition, is defined by the formula:
If
3 3-isogenies
In this section, we show how to compute 3-isogenies on twisted Hessian curves, and in the next section, we provide a formula for ℓ-isogenies with ℓ ≢ 0 (mod 3). To compute an isogeny with kernel of size divisible by 3, we can write the kernel as an internal product of a subgroup of size ℓ not divisible by 3 and one or more subgroups of size 3, and compose the formulas for each factor. Together, these formulas are sufficient for kernels of any size. In particular, to obtain an isogeny with kernel of size 3rℓ where ℓ ≢ 0 (mod 3), we can compose an ℓ-isogeny with r isogenies of degree 3.
To derive the result for 3-isogenies, we begin by characterizing all points of order 3 on a twisted Hessian curve. Let c be a cubic root of a. It can be easily verified that the point (1 : 0 : −c) and its inverse (1 : −c : 0) both have order 3. In addition, if ω3 = 1 and ω ≠ 1, then (0 : −ω : 1) and its inverse (0 : 1 : −ω) have order 3. The verification has been done in [10, Theorem 5.1]. In fact, based on the cardinality of the 3-torsion on elliptic curves (e.g. see [29, Theorem 3.2]), these are the only points of order 3 on a twisted Hessian curve. Moreover, using the defining equation of H(a, d), it can be easily verified that the 3-torsion is the precisely the set of points (X : Y : Z) such that XYZ = 0.
We now turn to formulas for 3-isogenies of twisted Hessian curves. As seen in the preceding paragraph, a kernel of size 3 is either generated by (0 : −ω : 1) with ω3 = 1 and ω ≠ 1 or by (1 : −c : 0) with c3 = a. First, we consider 3-isogenies with their kernel generated by (0 : −ω : 1). Such a map can be obtained by composing the 3-isogeny given in [10, Theorem 5.4] from a twisted Hessian curve to a Weierstrass curve of the form Y2Z + a1XYZ + a3YZ2 = X3 with the isomorphism given in [10, Theorem 5.4] between such a Weierstrass curve and a twisted Hessian curve. The result of such composition is stated in Theorem 1.
Theorem 1
Let ω3 = 1 and ω ≠ 1. The map
is an isogeny from H(a, d) to H(d3 − 27a, 3d) with the kernel
Proof
We leave the straightforward verification to the reader.
Next, we consider 3-isogenies with kernel generated by the point (1 : −c : 0) with c3 = a. The only formula for such isogenies that we are aware of is given in [30, Proposition 4] for Hessian curves over characteristic 3. We restate the result here.
Theorem 2
Let k have characteristic 3. The map σ : H(1, d3i+1) → H(1, d3i) defined by
is an isogeny. Moreover, f : H(1, d3i) → H(1, d3i+1) defined by f (X : Y : Z) = (X3 : Y3 : Z3) is an isogeny, and f ○ σ (P) = 3P for each P on H(1, d3i+1). The kernel of σ is {(0 : −1 : 1), (−1 : 1 : 0), (−1 : 0 : 1)}.
We generalize Theorem 2 to 3-isogenies on twisted Hessian curves H(a, d) over any characteristic with kernel 〈(1 : −c : 0)〉, where c3 = a.
Theorem 3
The rational map
is an isogeny from H(a, d) to H(A, D), where c3 = a,
with kernel
Proof
Let f = xy, g = c2x2 + cxy2 + y, and h = c2x2y + cx + y2 be the dehomogenized coordinate maps of ϕ. Also let A and D be as given in the theorem statement. Then,
This shows that the range of the rational map ϕ is indeed H(A, D). It remains to check that the kernel is as claimed. Let P = (X : Y : Z) and suppose ϕ (P) = (0 : −1 : 1), then XYZ = 0.
If X = 0, then YZ2 = −Y2Z, i.e. Z = −Y and P = (0 : −1 : 1).
If Y = 0, then c2X2Z = −cXZ2, i.e. cX = −Z and P = (1 : 0 : −c).
If Z = 0, then cXY2 = −c2X2Y, i.e. Y = −cX and P = (1 : −c : 0).
4 Isogenies of degree ℓ ≢ 0 (mod 3)
In this section, we look at the ℓ-isogeny formulas, where ℓ ≢ 0 (mod 3). One approach for obtaining such an ℓ-isogeny between twisted Hessian curves is to compose the isogeny given by Vélu's formula with isomorphisms to and from Weierstrass curves. This approach, however, doesn’t lead to a simple formula. Moreover, the resulting codomain twisted Hessian curve is dependent on the choice of point of order 3 on the codomain Weierstrass curve produced by Vélu's formula. We prove our main twisted Hessian isogeny result as follows.
Theorem 4
Let
where A = aℓ and
Note that in the equation for ϕ, for each point P + R, the choice of representative of P + R in projective coordinates does not affect the result ϕ (P). Moreover, siti ≠ 0 for each i ∈ {1, 2, . . ., n}.
Proof
Without loss of generality, let k be algebraically closed. We start by writing down a rational form of the map ϕ given in the theorem, which is derived from the standard addition formula. Let
That is, ϕ (x : y : 1) = (1 : ϕY : ϕZ). Define
where A, D ∈ k are to be determined.
Our goal is show that G = 0 for A, D ∈ k as stated in the theorem. To this end, by Proposition [1, II.1.2], it suffices to show that G has no poles and G(Q) = 0 for some Q on H. By the definitions of ϕY and ϕZ, if P is a pole of G, then X(ϕ (P)) = 0, which is equivalent to X(P + R) = 0 for some R ∈ F. Let Q = P + R. From the formula of ϕ, it can be seen that ϕ is invariant under translation by any point in F. So ϕ (P) = ϕ (Q) and X(Q) = 0. Therefore, if G has a pole at some point P, then G also has a pole at some point Q with X(Q) = 0. By subsituting X = 0 into the defining equation of H, we find that the only points Q with X(Q) = 0 are {(0 : −ω : 1) | ω3 = 1}.
Let P = (0 : −ω : 1) with ω3 = 1. We’ll show that P is not a pole of G for some A and D in k and hence by the arguments in the preceding paragraph, G has no pole at all and thus is constant.
First, we assume that the characteristic of k is not 3. We need the following facts:
k(H) is the field of quotients of k[H]P.
The field k is a subring of k[H]P, and the map b ↦ b + Mp from k to k[H]p/MP is a field isomorphism.
Next, we find the series expansion of y in terms of x. The order of y at P is ordP(y) = 0, since y is defined and is nonzero at P. Thus y has a power series expansion
Since y − c0 vanishes at P, we have c0 = −ω. Then, solving for c1 and c2 gives
Then,
Note that by the characterization of the 3-torsion in the preceding section, that the kernel does not contain a point of order 3 is equivalent to siti ≠ 0. In the remainder of the proof, we use the definition
Moreover, we also use the following formula for the product of power series:
assuming
Thus, we have
where
Moreover,
where
Substitution into G, with some additional simplifying using (1), yields
where
Hence, G−2 = G−1 = 0 if
i.e. G has no pole and thus is constant.
Finally, we consider the case when k has characteristic 3. In particular, x is not a uniformizer for k[H]P. Instead, ω = 1, and u = y + 1 is a uniformizer for k[H]P. Since x is defined and vanishes at P, i.e. ordP(x) ≥ 1, x has a power series expansion
Solving for b1, b2, . . . , we get
Note that in characteristic 3, by the definition of twisted Hessian curves, d ≠ 0. Then,
Therefore,
Using the identities in (1), since
we obtain the simplified expression
Substitution into the definition of G, with additional simplification in characteristic 3, yields
Therefore, if D = (1 − 2n)d/S, G = O(1) and thus is constant.
We have proved that for the value of D stated in theorem, G is constant. So if G(Q) = 0 for some Q, then G = 0. Next, we find A ∈ k such that G vanishes at Q = (1 : −c : 0) ∈ H where c3 = a. By [10, Theorem 4.1], i.e. (X : Y : Z) + (1 : −c : 0) = (Y : cZ : c2X),
So G(Q) = A − c3ℓ = A − aℓ. Solving G(Q) = 0 for A gives A = aℓ.
It remains to check that the kernel of ϕ is indeed F. It's clear that ϕ (P) = (0 : −1 : 1) if P ∈ F. For the converse, suppose ϕ (P) = (0 : −1 : 1). Then X(Q) = 0 where Q = P + R for some R ∈ F. So Q = (0 : −1 : 1) or Q = (0 : −ω : 1) for some ω ≠ 1 such that ω3 = 1. If Q = (0 : −1 : 1), P = −R ∈ F. Else, by [10, Theorem 4.6],
since 3 ∤ ℓ. However, this contradicts ϕ (Q) = ϕ (P) = (0 : −1 : 1). That concludes the proof.
5 Rational-map representations
In this section, we derive efficient rational-map representations of the isogeny in Theorem 4 and examine their computational complexity by counting the number of multiplications, squarings, and inversions. We denote by S, M, Ma, and I the cost of squaring, multiplication, multiplication by a, and inversion respectively.
In general, the computational cost depends on many factors, for examples, how the points are represented: projective, affine, or both (mixed), how much we want to avoid inversions, how the coordinate maps are represented (e.g. polynomials or rational functions), and the particular applications and their amortized running time. In our analysis, we will work with purely affine coordinates or purely projective coordinates, and allow up to one inversion operation. Furthermore, we separate the computation into two parts: one that involves only the kernel and one that requires the input point.
5.1 Affine coordinates
Due to the symmetry between the Z and Y coordinates, we have a choice whether to work with the X-affine and Z-affine patch. We will analyze both cases.
5.1.1 Z-affine coordinates
Lemma 1
If ax3 + y3 + 1 = dxy and aα3 + β3 + 1 = dαβ, then,
Proof
The lemma is implied by the following polynomial identities:
Corollary 1
Let
Proof
Equation (5) follows from Theorem 4, the rotated addition formula, and simplification using equations (2) and (3) in Lemma 1. Equation (6) follows from Theorem 4, the standard addition formula, and simplification using equations (2) and (4) in Lemma 1.
In counting the number of operations, we separate the computation into two parts: one that involves only the kernel and one that requires the input point. First, we look at (5).
To process the kernel, we compute the following values:
Then, we compute xy, x2, y2 for 2S + 1M.
Next, we compute
The products
A final step takes 2M + 1I.
In total, processing the kernel takes sS + (2s + r)Ma + rM and the input point takes 2S + (8s + 5r + 2)M + 1I. By similar counting, using (6), processing the kernel takes (r + s)S + 2sMa and the input point takes 2S + (8s + 5r + 2)M + 1I.
5.1.2 X-affine coordinates
Lemma 2
If a + y3 + z3 = dyz and a + β3 + γ3 = dβγ, then,
Proof
Corollary 2
Let
Moreover, using the notation of Theorem 4,
Note that the expression for D doesn’t involve any inversion.
Proof
Equation (10) follows from Theorem 4, the rotated addition formula, and simplification using equations (7) and (8) in Lemma 2. Equation (11) follows from Theorem 4, the standard addition formula, and simplification using equations (8) and (9) in Lemma 2. The expression for D follows because, using the notation in Theorem 4,
and straightforward counting as before, the costs of (12) and (13) are given in Table 1.
Computational cost of our isogeny formulas on twisted Hessian curves.
| Process kernel | Process input point | |
|---|---|---|
| Z-affine (5) | sS + rM + (r + 2s)Ma | 2S + (8s + 5r + 2)M + 1I |
| Z-affine (6) | (r + s)S + 2sMa | 2S + (8s + 5r + 2)M + 1I |
| X-affine (12) | rS + (r + s − 1)M | 2S + (6r + 5s + 4)M + 2Ma + 1I |
| X-affine (13) | rS + (r + s − 1)M | 2S + (5r + 5s + 4)M + 2Ma + 1I |
| Projective (14) | (2r + s)S + (r + s)M + (s + 2r)Ma | 3S + (9s + 9r + 3)M |
| Projective (15) | (2r + s)S + (r + s)M + sMa | 3S + (9s + 9r + 3)M |
5.2 Projective coordinates
Corollary 3
Let
Proof
The corollary follows by projectivizing the expressions in previous corollaries.
By straightforward counting, (15) takes (2r + s)S + (r + s)M + sMa to process the kernel and (9s + 9r + 3)M + 3S for the input point, and (14) takes additional 2rMa for processing the kernel. The results are summarized in Table 1.
5.3 Comparison with other formulas
For comparison, consider the isogeny formula from [11] for Edwards curves, which is the most efficient to our knowledge so far. We note that the authors reported the cost of (6s + 1)M + 2S + I in affine coordinates or (6s + 3)M + 4S in mixed coordinates (the kernel is in affine coordinates and the input point is in projective coordinates), for computing an image point. However, in each case, up to sI were required for preprocessing the kernel points. Here, we consider a different approach that avoids inversions entirely in the projective case and uses only 1 inversion in the affine case. First, we consider the projective case. Suppose the kernel is
The isogeny is
For processing the kernel, one can compute
Each factor
Similarly, in affine coordinates, we can compute the Edwards isogeny map
using (3s + 1)S + 2sM for processing the kernel and (6s + 1)M + 2S + I + cost(2s) for the input point.
The comparison is summarized in Table 2, where we assume the kernel size is odd and 1S = 0.8M. We note that our formulas for twisted Hessian curves have the lowest costs for processing the kernel and our X-affine formula has the lowest cost for processing an input point in affine coordinates.
Comparison of the computational costs for various isogeny formulas. We denote by cost(2s) the cost of computing 2s.
| Formula | Process kernel | Process input point |
|---|---|---|
| twisted Hessian (Z-affine) [this work] | 0.8sM + 2sMa | (8s + 3.6)M + 1I |
| twisted Hessian (X-affine) [this work] | (s − 1)M | (5s + 5.6)M + 2Ma + 1I |
| twisted Hessian (projective) [this work] | 1.8sM + sMa | (9s + 5.4)M |
| Edwards (affine) [11] + [this work] | (4.4s + 0.8)M | (6s + 2.6)M + 1I + cost(2s) |
| Edwards (projective) [11] + [this work] | (8s + 0.8)M | (7s + 7.2)M + cost(2s) |
| Huff (affine) [11] | (3.6s + 1.6)M | (6s − 0.4)M + 2I |
| Vélu's [2] | 9.8M | (13s + 1.8)M + 1I |
6 Conclusion
In this work we looked at computing isogenies between elliptic curves represented as twisted Hessian curves. There still exist other models of curves for which direct isogeny formulas are not known, such as Jacobi quartics and Jacobi intersections [32, 33]. It would be interesting to see if simple isogeny formulas exist for these models. We note that the original Velu isogeny formulas are expressed as a sum, while the more recent Edwards, Hessian, and Montgomery formulas all involve a product of expressions involving the kernel points. Is there a multiplicative version of Velu's formulas? Or additive expressions for isogenies of the alternate models of elliptic curves?
We leave it as future work to further optimize the formulas presented and integrate them into specific applications. For example, this could include efficient computation of low degree isogenies. Low-degree isogenies are used in post-quantum cryptographic isogeny schemes, and if optimized formulas can be found, they may lead to implementing these isogeny cryptosystems using twisted Hessian curves. In particular, it may be interesting to compute the 9-isogeny formulas for Hessian curves, similar to the work on 4-isogenies over Montgomery and Edwards models [19, 34].
It would also be interesting to use low degree isogenies to compute scalar multiplication formulas on Hessian curves for small scalars like 2, 3, and 5, as done in [35, 36], especially for curves with j-invariant zero.
References
[1] J. H. Silverman, The arithmetic of elliptic curves. Graduate Texts in Mathematics, Springer, 2nd ed., 2009.10.1007/978-0-387-09494-6Search in Google Scholar
[2] J. Vélu, “Isogénies entre courbes elliptiques,” CR Acad. Sci. Paris, Séries A, vol. 273, pp. 305–347, 1971.Search in Google Scholar
[3] P. L. Montgomery, “Speeding the Pollard and elliptic curve methods of factorization,” Mathematics of Computation, vol. 48, no. 177, pp. 243–264, 1987.10.1090/S0025-5718-1987-0866113-7Search in Google Scholar
[4] K. Okeya, H. Kurumatani, and K. Sakurai, “Elliptic curves with the Montgomery-form and their cryptographic applications,” in International Workshop on Public Key Cryptography, pp. 238–257, Springer, 2000.10.1007/978-3-540-46588-1_17Search in Google Scholar
[5] H. Edwards, “A normal form for elliptic curves,” Bulletin of the American Mathematical Society, vol. 44, no. 3, pp. 393–422, 2007.10.1090/S0273-0979-07-01153-6Search in Google Scholar
[6] D. J. Bernstein and T. Lange, “Faster addition and doubling on elliptic curves,” in International Conference on the Theory and Application of Cryptology and Information Security, pp. 29–50, Springer, 2007.10.1007/978-3-540-76900-2_3Search in Google Scholar
[7] D. J. Bernstein, P. Birkner, M. Joye, T. Lange, and C. Peters, “Twisted Edwards curves,” in International Conference on Cryptology in Africa, pp. 389–405, Springer, 2008.10.1007/978-3-540-68164-9_26Search in Google Scholar
[8] M. Joye, M. Tibouchi, and D. Vergnaud, “Huff’s model for elliptic curves,” in International Algorithmic Number Theory Symposium, pp. 234–250, Springer, 2010.10.1007/978-3-642-14518-6_20Search in Google Scholar
[9] H. Wu and R. Feng, “Elliptic curves in Huff’s model,” Wuhan University Journal of Natural Sciences, vol. 17, no. 6, pp. 473–480, 2012.10.1007/s11859-012-0873-9Search in Google Scholar
[10] D. J. Bernstein, C. Chuengsatiansup, D. Kohel, and T. Lange, “Twisted Hessian curves,” in International Conference on Cryptology and Information Security in Latin America, pp. 269–294, Springer, 2015.10.1007/978-3-319-22174-8_15Search in Google Scholar
[11] D. Moody and D. Shumow, “Analogues of Vélu’s formulas for isogenies on alternate models of elliptic curves,” Mathematics of Computation, vol. 85, no. 300, pp. 1929–1951, 2016.10.1090/mcom/3036Search in Google Scholar
[12] C. Costello and H. Hisil, “A simple and compact algorithm for SIDH with arbitrary degree isogenies,” in International Conference on the Theory and Application of Cryptology and Information Security, pp. 303–329, Springer, 2017.10.1007/978-3-319-70697-9_11Search in Google Scholar
[13] J. Renes, “Computing isogenies between Montgomery curves using the action of (0, 0),” in The Eighth International Conference on Post-Quantum Cryptography, PQCrypto, pp. 229–247, Springer, 2017.10.1007/978-3-319-79063-3_11Search in Google Scholar
[14] T. Izu, J. Kogure, M. Noro, and K. Yokoyama, “Efficient implementation of Schoof’s algorithm,” in International Conference on the Theory and Application of Cryptology and Information Security, pp. 66–79, Springer, 1998.10.1007/3-540-49649-1_7Search in Google Scholar
[15] R. Lercier and F. Morain, “Computing isogenies between elliptic curves over
[16] D. Jao, S. D. Miller, and R. Venkatesan, “Do all elliptic curves of the same order have the same difficulty of discrete log?,” in International Conference on the Theory and Application of Cryptology and Information Security, pp. 21–40, Springer, 2005.10.1007/11593447_2Search in Google Scholar
[17] E. Teske, “An elliptic curve trapdoor system,” Journal of Cryptology, vol. 19, no. 1, pp. 115–133, 2006.10.1007/s00145-004-0328-3Search in Google Scholar
[18] D. X. Charles, K. E. Lauter, and E. Z. Goren, “Cryptographic hash functions from expander graphs,” Journal of Cryptology, vol. 22, no. 1, pp. 93–113, 2009.10.1007/s00145-007-9002-xSearch in Google Scholar
[19] L. De Feo, D. Jao, and J. Plût, “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies,” Journal of Mathematical Cryptology, vol. 8, no. 3, pp. 209–247, 2014.10.1515/jmc-2012-0015Search in Google Scholar
[20] N. P. Smart, “The Hessian form of an elliptic curve,” in International Workshop on Cryptographic Hardware and Embedded Systems, pp. 118–125, Springer, 2001.10.1007/3-540-44709-1_11Search in Google Scholar
[21] H. Hisil, G. Carter, and E. Dawson, “New formulae for efficient elliptic curve arithmetic,” in International Conference on Cryptology in India, pp. 138–151, Springer, 2007.10.1007/978-3-540-77026-8_11Search in Google Scholar
[22] H. Hisil, K. K.-H. Wong, G. Carter, and E. Dawson, “Faster group operations on elliptic curves,” in Proceedings of the Seventh Australasian Conference on Information Security, vol. 98, pp. 7–20, Australian Computer Society, Inc., 2009.Search in Google Scholar
[23] E. Fouotsa, “Parallelizing pairings on Hessian elliptic curves,” Arab Journal of Mathematical Sciences, vol. 25, no. 1, pp. 29 – 42, 2019.10.1016/j.ajmsc.2018.06.001Search in Google Scholar
[24] M. Joye and J.-J. Quisquater, “Hessian elliptic curves and side-channel attacks,” in International Workshop on Cryptographic Hardware and Embedded Systems, pp. 402–410, Springer, 2001.10.1007/3-540-44709-1_33Search in Google Scholar
[25] R. R. Farashahi and M. Joye, “Efficient arithmetic on Hessian curves,” in International Workshop on Public Key Cryptography, pp. 243–260, Springer, 2010.10.1007/978-3-642-13013-7_15Search in Google Scholar
[26] R. R. Farashahi, H. Wu, and C.-A. Zhao, “Efficient arithmetic on elliptic curves over fields of characteristic three,” in International Conference on Selected Areas in Cryptography, pp. 135–148, Springer, 2012.10.1007/978-3-642-35999-6_10Search in Google Scholar
[27] D. Kohel, “The geometry of efficient arithmetic on elliptic curves,” Arithmetic, Geometry, Coding Theory and Cryptography, vol. 637, pp. 95–109, 2015.10.1090/conm/637/12751Search in Google Scholar
[28] D. Moody and H. Wu, “Families of elliptic curves with rational 3-torsion,” Journal of Mathematical Cryptology, vol. 5, no. 3–4, pp. 225–246, 2012.10.1515/jmc-2011-0013Search in Google Scholar
[29] L. C. Washington, Elliptic curves: number theory and cryptography. CRC press, 2008.10.1201/9781420071474Search in Google Scholar
[30] T. S. Gustavsen and K. Ranestad, “A simple point counting algorithm for Hessian elliptic curves in characteristic three,” Applicable Algebra in Engineering, Communication and Computing, vol. 17, no. 2, pp. 141–150, 2006.10.1007/s00200-006-0013-xSearch in Google Scholar
[31] W. Fulton, Algebraic curves: An introduction to algebraic geometry. 2008. http://www.math.lsa.umich.edu/~wfulton/CurveBook.pdf.Search in Google Scholar
[32] O. Billet and M. Joye, “The Jacobi model of an elliptic curve and side-channel analysis,” in Applied Algebra, Algebraic Algorithms and Error-Correcting Codes (M. Fossorier, T. Høholdt, and A. Poli, eds.), (Berlin, Heidelberg), pp. 34–42, Springer Berlin Heidelberg, 2003.10.1007/3-540-44828-4_5Search in Google Scholar
[33] P. Y. Liardet and N. P. Smart, “Preventing SPA/DPA in ECC systems using the Jacobi form,” in Cryptographic Hardware and Embedded Systems — CHES 2001 (Ç. K. Koç, D. Naccache, and C. Paar, eds.), (Berlin, Heidelberg), pp. 391–401, Springer Berlin Heidelberg, 2001.10.1007/3-540-44709-1_32Search in Google Scholar
[34] S. Kim, K. Yoon, Y. Park, and S. Hong, “Optimized method for computing odd-degree isogenies on Edwards curves,” in International Conference on the Theory and Application of Cryptology and Information Security, pp. 273–292, Springer, 2019.10.1007/978-3-030-34621-8_10Search in Google Scholar
[35] C. Doche, T. Icart, and D. R. Kohel, “Efficient scalar multiplication by isogeny decompositions,” in International Workshop on Public Key Cryptography, pp. 191–206, Springer, 2006.10.1007/11745853_13Search in Google Scholar
[36] D. Moody, “Using 5-isogenies to quintuple points on elliptic curves,” Information Processing Letters, vol. 111, no. 7, pp. 314–317, 2011.10.1016/j.ipl.2010.12.014Search in Google Scholar
© 2020 Fouazou Lontouo Perez Broon et al., published by De Gruyter
This work is licensed under the Creative Commons Attribution 4.0 International License.
