Complete Analysis of Implementing Isogeny-Based Cryptography Using Huff Form of Elliptic Curves

In this paper, we present the analysis of Huff curves for implementing isogeny-based cryptography. In this regard, we first investigate the computational cost of the building blocks when compression functions are used for Huff curves. We present a new formula for recovering the coefficient of the curve, from a given point on a Huff curve, which is essential for implementing SIDH. We also apply the square-root Vélu formula on Huff curves and further optimize Huff-CSIDH by exploiting Edwards curves for computing the coefficient of the image curve and present the Huff-Edwards hybrid model. From our implementation, the performance of Huff-SIDH and Montgomery-SIDH is almost the same, and the performance of Huff-CSIDH is 6% faster than Montgomery-CSIDH. The performance of Huff-Edwards CSIDH is almost the same as Montgomery-Edwards CSIDH. The result of our work shows that Huff curves can be quite practical for implementing isogeny-based cryptography but has some limitations.


I. INTRODUCTION
As the development of a quantum computer that is capable of implementing Shor's algorithm becomes visible, researches are being actively conducted to find quantum-resistant algorithms that can substitute the currently used public-key cryptography. These are called post-quantum cryptography (PQC), and among PQC primitives, isogeny-based cryptography is known to have the smallest key sizes.
Quantum-resistant cryptography based on isogenies was first proposed by Couveignes [1] and later rediscovered by Stolbunov [2], which are currently called the CRS scheme. However, not only the quantum sub-exponential attack exists for the scheme [3], but the algorithm was also inefficient for practical use. After the introduction of the Supersingular Isogeny Diffie-Hellman (SIDH) by Jao and De Feo [4], the isogeny-based cryptography gained back its attention. Due to the non-commutative structure of the endomorphism ring of supersingular curves, SIDH resists the attack proposed in [3]. The security of SIDH relies on the problem of computing an isogeny between two given elliptic curves having the same order over a finite field, which is known to The associate editor coordinating the review of this manuscript and approving it for publication was Ahmed Farouk .
have quantum-exponential complexity [5]. The Supersingular Isogeny Key Encapsulation (SIKE), a key encapsulation mechanism based on SIDH, was submitted as one of the candidates to the NIST PQC standardization project [6], and is currently an alternative candidate of Round 3. Recently, CRS was revisited by De Feo et al. [7], and independently by Castryck et al. in [8]. The advantage of CRS is that CCA-secure encryption can be constructed so that a non-interactive key exchange can be obtained. In [7], they modernized the parameter selection of CRS for better performance and presented an efficient way to compute the CRS group action. CRS was further optimized by Castryck et al. in [8]. In [8], they proposed CSIDH (Commutative SIDH), which solves the parameter selection problem in CRS by using supersingular elliptic curves defined over F p . Currently, the full key exchange of CSIDH at a 128-bit classical security level requires approximately 80ms, which is slower than SIDH. However, the vital aspect of CSIDH is that a relatively efficient digital signature can be constructed based on CSIDH [9]. CSI-FiSh [9] offers a practical digital signature that requires 390ms to sign a message. For isogeny-based cryptography, this was a significant result at that time, which facilitated the construction of various cryptographic primitives through elliptic curve isogenies.
To summarize, SIDH and CSIDH have their own advantages, and their common disadvantage is that the performance is slower than other quantum-resistant algorithms.
The implementation of isogeny-based cryptography involves isogeny operations in addition to the standard elliptic curve arithmetic over a finite field. Regarding the isogeny operations, the degree of an isogeny used in the algorithm depends on the prime chosen for the scheme. The SIDH-based algorithms use the prime p of the form p = e A A e B B f ± 1, where A and B are coprime to each other. The A and B corresponds to the degree of isogenies used in the algorithm. Since the complexity of computing isogenies increases as the degree increases, isogenies of degrees 3-and 4-were mostly considered for implementation. The CSIDH-based algorithms use the prime p of the form p = 4 1 2 · · · n − 1, where i are odd-primes. Similarly, as i are degrees of isogenies used in the scheme, demands for an efficient odd-degree isogeny formula have increased after the proposal of CSIDH. In [10], Costello and Hisil proposed an efficient way to compute arbitrary odd-degree isogenies on Montgomery curves. Classical ways for computing -isogeny requiresÕ( ) field operations. In [11], Bernstein et al. proposed the square-root Vélu formula which computes the -isogeny inÕ( √ ) field operations. This ground-breaking work allows computing higher odd-degree isogenies efficiently, which suits well for implementing B-SIDH [12] and CSIDH, where the recent quantum analysis on CSIDH shows that larger odd-degree isogenies are required to provide sufficient security level [13]- [15]. Regarding the elliptic curve arithmetic, it is important to select the form of elliptic curves that can provide efficient curve operations. The majority of implementations in isogeny-based cryptography use Montgomery curves as it offers fast isogeny computation and elliptic curve arithmetic. The state-of-the-art implementation proposed in [16], [17] is also based on Montgomery curves.
Currently, there is ongoing research on whether other forms of the elliptic curve can yield efficient arithmetic or isogeny computation. The primary candidate is twisted Edwards curves, as it is birationally equivalent to Montgomery curves, and mapping a point on one curve to a point on the other curve is cost-less when projective coordinates are used. The first use of Edwards curves was by Meyer et al. in [18], which used twisted Edwards curves for elliptic curve arithmetic and Montgomery curves for isogeny computation [18]. This was further optimized in [19], which used the Edwards curves for isogeny computation and Montgomery curves for the elliptic curve arithmetic. However, as stated in [19] and [20], using only Edwards curves for implementing SIDH-based algorithms is not as efficient as using only Montgomery curves.
The efficiency of using Edwards curves began to stand out when used for implementing CSIDH. Unlike SIDH-based algorithms, CSIDH-based algorithms use higher odd-degree isogenies. Montgomery curves offer efficient isogeny evaluation of arbitrary odd-degree isogenies [10]. However, it is hard to obtain an efficient formula for recovering the coefficient of the image curve on Montgomery curves. On the other hand, Edwards curves can provide an efficient formula for computing the coefficient of the image curve. Therefore, in [21], they implemented CSIDH by using Montgomery curves for isogeny evaluation and twisted Edwards curves for recovering the coefficient of the image curve. In [22], they proposed an optimized odd-degree isogeny formula by using the w-coordinate on Edwards curves. By adapting the formula in [22], Edwards-only CSIDH can be implemented, which is faster than Montgomery-CSIDH [8] or Hybrid-CSIDH [21]. The work of [22] shows that a certain form of an elliptic curve can lead to a better result for certain isogeny-based algorithms. Hence, it is important to check the implementation results on various elliptic curves.

A. OUR CONTRIBUTIONS
This work aims to provide an insight to exploit Huff curves in isogeny-based cryptography. Isogenies on Huff curves were first proposed in [23]. However, due to inefficient elliptic curve arithmetic and isogeny formula, it has not been studied until the work of [24], and in [25]. The proposed compression functions in [24] and [25] for the points on a Huff curve allow Montgomery-like elliptic curve arithmetic formulas. Considering the fact that implementing SIDH entirely on Edwards curves is not faster than Montgomery curves as differential addition is slower in Edwards curves, it is very appealing that the compression functions in the Huff curve lead to an elliptic curve arithmetic formula having the same computational cost as on Montgomery curve.
In this paper, based on the formula presented in [24] and [25], we examine the applicability of Huff curves for isogeny-based cryptography. The following list details the main contributions of this work.

1) ANALYSIS OF THE COMPUTATIONAL COSTS
We examine the computational costs of the lower-level functions for implementing isogeny-based cryptography on Huff curves when a compression method in [24] and [25] are used. Previous works do not explicitly consider the cost in projective coordinates or exclude the cost of some functions that are used in the implementation. In this paper, we analyze the cost of all functions that are used to implement isogeny-based cryptography. Details of the functions and their computational costs are presented in Section 4. Also, we present 4-isogeny on Huff curves using the compression method proposed in [24], by applying a similar method to derive the 4-isogeny formula presented in [25]. The formulas for 4-isogeny are presented in the Appendix.

2) FORMULA FOR RECOVERING THE CURVE COEFFICIENT OF HUFF CURVES
We additionally present the formula to recover the coefficient of the Huff curve for SIDH-based algorithms. Recovering the coefficient of a curve from given points is essential for implementing SIDH-based algorithms as it can reduce the key size. In this paper, we present the formula in both compression methods. Based on our analysis, using the compression method in [24] is faster for recovering the coefficient, so that it is an efficient choice for implementing SIDH. The details of the formula are presented in Section 3.

3) SQUARE-ROOT VÉLU FORMULA ON HUFF CURVES
We apply the square-root Vélu formula on Huff curves to compute higher-odd degree isogenies efficiently. To use the square-root Vélu formula proposed in [11], biquadratic polynomials must be redefined to express the relationship between points P, Q, P − Q, and P + Q on a Huff curve. We derive biquadratic polynomials for Huff curves and demonstrate that the computational cost for evaluating the main polynomial used in the square-root Vélu formula is the same as Montgomery curves. The details of the formula are presented in Section 4.

4) THE HUFF-EDWARDS HYBRID MODEL FOR CSIDH
We further optimize the odd-degree isogeny formula on Huff curves by exploiting Edwards curves for recovering the coefficient of the image curves in Huff form. The Montgomery-Edwards hybrid model has been studied extensively. We noticed that the cost of the conversion between the x-coordinate on Montgomery curves and w-coordinate on Huff curve is free so that Edwards curves can also be exploited to enhance the performance of Huff isogeny. The details are presented in Section 4.

5) IMPLEMENTATION OF ISOGENY-BASED CRYPTOGRAPHY ON HUFF CURVES
We present the implementation result of SIDH and CSIDH using Huff curves. We choose the compression function in [24] for implementing SIDH. For CSIDH-based algorithms, one has to examine whether supersingular Huff curves exist for a chosen prime. We deduce that for a prime p ≡ 7 mod 8, there exist supersingular Huff curves over F p , and F p has no supersingular Huff curves when p ≡ 3 mod 8.
For SIDH, the performance of Montgomery-SIDH and Huff-SIDH is almost the same. For CSIDH, Huff-CSIDH is 6% faster than Montgomery-CSIDH. Also, the performance of Huff-Edwards CSIDH is almost the same as Montgomery-Edwards CSIDH. The details of the results are presented in Section 5.

B. ORGANIZATION
This paper is organized as follows: In Section 2, we introduce two main isogeny-based key exchange algorithms and a form of Huff curves that will be used for the implementation. In Section 3, we demonstrate the computational cost of lower-level functions for implementing isogeny-based cryptography. In Section 4, we introduce the square-root Vélu formula and present the main polynomials for Huff curves to exploit the square-root Vélu formula. In Section 5, we present the implementation result of SIDH and CSIDH on Huff curves. We draw our conclusion in Section 6.

II. PRELIMINARY
In this section, we provide the necessary background that will be used throughout the paper. First, we introduce two main streams in isogeny-based cryptography -SIDH and CSIDH. Lastly, we describe variants of Huff curves and their arithmetic.

A. ISOGENY-BASED CRYPTOGRAPHY
We recall the SIDH and CSIDH key exchange protocol proposed in [4] and [8]. For more information, please refer to [4] and [8] for SIDH and CSIDH, respectively. The notations used in this section will continue to be used throughout the paper.
For the key establishment, Alice computes the subgroup . By using Vélu's formula, Alice computes a curve E AB = E B / R A . Bob repeats the same operation as Alice and computes a curve E BA = E A / R B . The shared secret between Alice and Bob is the j-invariant of E AB , i.e. j(E AB ) = j(E BA ).

2) CSIDH PROTOCOL
CSIDH uses commutative group action on supersingular elliptic curves defined over a finite field F p . Let O be an imaginary quadratic order. Let E p (O) denote the set of elliptic curves defined over F p with the endomorphism ring O. It is well-known that the class group Cl(O) acts freely and transitively on E p (O). We call the group action as CM-action and denote the action of an ideal class [a] ∈ Cl(O) on an elliptic curve E ∈ E p (O) by [a]E.
Let p = 4 1 2 · · · n − 1 be a prime where 1 , · · · , n are small distinct odd primes. Let E be a supersingular elliptic curve over F p such that End p (E) = Z[π ], where End p (E) is the endomorphism ring of E over F p . Note that End p (E) is a commutative subring of the quaternion order End(E). Then the trace of Frobenius is zero, hence E(F p ) = p + 1. Since Suppose Alice and Bob want to exchange a secret key. Alice chooses a vector (e 1 , · · · , e n ) ∈ Z n , where e i ∈ [−m, m], for a positive integer m. The vector represents an isogeny associated to the group action by the ideal class

B. HUFF CURVES AND THEIR ARITHMETIC
We describe forms of Huff curves and their arithmetic. The implementation of isogeny-based cryptography focuses on Montgomery curves as it offers fast computations. However, it is important to examine whether other forms of elliptic curves are also efficient, and in particular, a form of elliptic curve that provides similar efficiency as Montgomery curves can be a good candidate. Hence, we focus on Huff curves as it offers elliptic curve arithmetic as fast as Montgomery curves when a certain compression function is used.

1) HUFF CURVES
Huff models for elliptic curves were first introduced by Joye et al. [26]. They proposed the group law and formula for computing Tate pairings on Huff form of elliptic curves. Let K be a finite field of characteristic not equal to 2. The Huff form of an elliptic curve is given by the equation: where a 2 = b 2 and a, b = 0. The point O = (0, 0) is the neutral element and −(x, y) = (−x, −y). Also, every Huff curve has three points at infinity, which are also points of order 2. The curve H a,b can also be simplified as The general Huff curves which contains the Huff form of elliptic curves is introduced in [27]. General Huff curves are given by the equation where a = b and a, b = 0. Similar to the Huff curves,

2) ISOMORPHISMS
The Huff curve H a,b is isomorphic to a Weierstrass curve of the form The Huff curve H a,b is isomorphic to an Edwards curve of the form 2 , and corresponding Montgomery curve of the form

3) ARITHMETIC ON HUFF CURVES
For points P = (x p , y p ) and Q = (x q , y q ) on a Huff curve H a,b , the addition of two points P + Q = (x r , y r ) is defined as below, and doubling can be performed with exactly the same formula.
The above formula is same for the curve H c . For a general Huff curve G a,b , the unified addition is performed as below: where P = (x p , y p ) and Q = (x q , y q ) are points on G a,b , and P + Q = (x r , y r ).

C. w -COORDINATES ON HUFF CURVES
Recently, in [24] and independently in [25], they proposed a compression function on Huff curves, which allows faster elliptic curve arithmetic and isogeny computation. We shall express this compression function as w-coordinate. For the simplicity of the explanation, we shall denote w-function for the compression method proposed in [24], and w inv -function for the compression method proposed in [25].

1) COMPRESSION FUNCTION w ON HUFF CURVES
In [24], they proposed a compression method for Huff curves and presented an isogeny formula. As they proposed the formulas for elliptic curve arithmetic and isogenies for Huff curve of the form H a,b , we shall present the formulas in this setting. However, for the implementation, we apply the compression function w on H c , for simplicity. Note that this is equivalent to the case on H a,b , with b = 1. For the exact formula on H c using w, please refer to the Appendix.
For a point P = (x, y) on a Huff curve H a,b , define the compression function w as w(P) = xy. Then w(P) = w(−P) and w(O) = 0. Using this function, doubling and differential addition can be expressed as follows [24].
For P 1 , P 2 ∈ H a,b , let w 1 = w(P 1 ) and w 2 = w(P 2 ). Let w 0 = w(2P 1 ), w 3 = w(P 1 +P 2 ), and w 4 = w(P 1 −P 2 ). Then, where e = b a + a b . Using this compression function an efficient odd-degree isogeny formula can be induced, which is as follows: Theorem 1 (Odd-Degree Isogeny on H a,b Using w-Function [24]): Let P be a point on a Huff curve H a,b of odd order

2) COMPRESSION FUNCTION w inv ON HUFF CURVES
Huang et al. proposed an alternate compression method for Huff curves and presented an isogeny formula on Huff curves [25]. For the simplicity of the formula, they used the Huff curve of the form H c .
Let P = (x, y) be a point on a Huff curve H c . In [25], they defined the compression function w inv as w(P) = 1/xy. Then w(P) = w(−P) and w(O) = ∞. Using this function, doubling and differential addition formula are defined in [25]. Now, for P 1 , P 2 ∈ H c , let w 1 = w(P 1 ) and w 2 = w(P 2 ). Let w 0 = w(2P 1 ), w 3 = w(P 1 + P 2 ), and w 4 = w(P 1 − P 2 ). Then, Using this compression function an efficient odd-degree isogeny formula can be induced, which is as follows: Theorem 2 (Odd-Degree Isogeny on H c Using w inv -Function [25]): Let P be a point on a Huff curve H c of odd order Remark 2 (Coefficient Transformation): When w inv -function is used for elliptic curve arithmetic on Huff curves, instead of using the projective curve coefficients C and D for c = C/D, we use (C −D) 2 and 4CD for efficient computation. Hence, after obtaining the coefficient of the image curve, c = C /D , (C − D ) 2 and 4C D must be computed in order to proceed with elliptic curve arithmetic on the image curve. Intuitively, this requires 2S.
Remark 3: Note that when w-function is used for H c , the formula for doubling, differential addition, and odd-degree isogenies is almost the reciprocal of the case when w inv -function is used for H c . Let P 1 = (x 1 , y 1 ) and P 2 = (x 2 , y 2 ) be the points on H c , and w(P) = xy for P 2 , which is almost the reciprocal of the case when w inv -function is used. Hence every computational cost for elliptic curve arithmetic and isogeny is the same when H c with w is used and when H c with w inv is used.

3) RELATIONSHIP WITH MONTGOMERY CURVES
In this section, we shall examine the relationship between w-coordinate on a Huff curve and x-coordinate of a corresponding Montgomery curve. As denoted in Section 2, a Huff curve H c is isomorphic to a Montgomery curve M D for D = (c 2 + 1)/c, and Weierstrass curve W A,B for A = c 2 + 1 and B = c 2 , given by the following maps: y When XZ -only Montgomery arithmetic and WZ -only Huff arithmetic is used, switching between Huff curves and Montgomery curves is simple. A Montgomery point (X M : Z M ) can be transformed to the corresponding Huff WZ -coordinates as follows, when w inv -function is used as a compression method: When w-function is used as a compression method, then the transformation is as follows: When implementing arbitrary odd-degree isogenies on Montgomery curves as in CSIDH, Edwards curves are exploited to compute the coefficient of the image curve for efficiency [21]. By using the fact that the transformation between Montgomery curves and Huff curves is just a swapping of the coordinates, and the transformation between Montgomery curves and Edwards curves is costless, Edwards curves can also be exploited to enhance the performance of Huff isogenies. More details are introduced in the next section.  [11]. The conventional Vélu formula computes -isogeny inÕ( ) field operations. The high-level view of the Vélu formula can be considered as evaluation of polynomials over K whose roots are values of a function from a cyclic group to K . Let G be a cyclic group with generator P. Then for a finite subset S of Z, define a polynomial where [s]P denotes computing the group operation on P with itself for s − 1 times. In isogeny-based setting, let E(K ) be an elliptic curve, P ∈ E(K ). Then G = P is a kernel of an -isogeny φ : E → E , and f ([s]P) can be considered as the x-coordinate of [s]P, for a scalar multiplication [s]P.
Let M a be a Montgomery curve, P ∈ M a be a point of prime order = 2. The isogeny φ : M a → M a with kernel P is given by the equation below, expressed in terms of equation (3): The key for evaluating h S inÕ( √ ) field operations is to decompose the set S into smaller set I and J , having size similar to √ S, satisfying certain conditions. In [11], I and J are chosen so that most of the elements in S is represented as elements of (I +J )∪(I −J ). For details on the conditions of the set and algorithms, please refer to [11]. Hence, the problem of evaluating a polynomial whose roots are [s]P for s ∈ P is transformed to the problem of evaluating a polynomial, whose roots are [i]P and [j]P for i ∈ I and j ∈ J , respectively. Then, by computing the resultant of polynomials relating to the set I and J , we can obtain the evaluation of h S . To do this, we need to find the relations between the x-coordinate of [i]P, [j]P, [i + j]P, and [i − j]P for i ∈ I and j ∈ J . Below, Lemma 1 states the existence of biquadratic polynomials of an elliptic curve E that shows the relationship between points P, Q, P + Q, and P − Q for P, Q ∈ E.
Lemma 1 (Biquadratic Relations on x-Coordinates [11]): Let q be a prime power. Let E(F q ) be an elliptic curve. There exist biquadratic polynomials F 0 , F 1 , and If E is defined by affine Montgomery equation By 2 = x 3 + Ax 2 + x, then the polynomials F 0 , F 1 , and F 2 are defined as follows [11].
To use the square-root formula, we define the following biquadratic polynomials specifically for Huff curves of the form H c . Similarly, the relationship between the w-coordinates of points P, Q, P+Q, and P−Q on Huff curves can be written as follows: , w(Q)) G 0 (w(P), w(Q)) W + G 2 (w(P), w(Q)) G 0 (w(P), w(Q)) For the curve H c using the w-function, then the polynomials G 0 , G 1 , and G 2 are defined as follows: When w inv -function is used for compression, then the polynomials G 0 , G 1 , and G 2 are defined as follows: Using this biquadratic polynomials, the square-root formula for Huff curves directly follows [11]. The following proposition states the isogeny formula on Huff curves H c using w-and w inv -function, expressed in terms of equation (3).

B. RECOVERING THE CURVE COEFFICIENT
When implementing SIDH-based algorithms, P A − Q A and P B − Q B are also considered as a public key for faster kernel computation using the Montgomery ladder. Hence φ A (P B − Q B ) and φ B (P A − Q A ) are also computed and exchanged to compute the shared secret key efficiently. This can be thought of as an increase in the public key size. But using the fact that the coefficient a of the Montgomery curve M a relates to the x-coordinates of P, Q, and P − Q for P, Q ∈ M a , sending the coefficient of the image curve is omitted [16]. Therefore, ) are exchanged during the protocol, and upon the receipt of the public key, the coefficient is recovered using the relationship, which costs 4M + 1S + 1I. The I denotes the field inversion. For Huff curves, similar relationship can be obtained. Let H c be a Huff curve using w as a compression function. For P, Q, and P − Q in H c , let w(P) = w p , w(Q) = w q , and w(P − Q) = w pq . Then the following holds: 4w pq w p w q = ((w p − w q ) − (w pq (w p w q − 1))) 2 4w pq w p w q − 4w pq (w p + w p w 2 q + 2w p w q ) 4w pq w p w q (4) wherec = c + 1 c − 2. The computational cost is 3M + 1S + 1I. Similar relationship can be obtain for w inv -function, which is as follows.

C. THE HUFF-EDWARDS HYBRID MODEL AND COMPUTATIONAL COSTS
Note that computing the coefficient of the image of Montgomery curves using the square-root Velu formula exploits the relationship between Montgomery curves and Edwards curves [11]. This not only enhances the performance of computation but also the formula for computing the coefficient of the image curve follows the expression of the square-root Vélu formula for evaluating an isogeny. Hence, Montgomery curves only need to compute h S (1), h S (−1), while Huff curves need to compute h S (−c), h S (−1/c) for c ∈ F p . However, as stated in Section 3, the cost of the transformation between Montgomery curves and Huff curves is free, so that a similar idea can also be applied to Huff curves. Note that when Edwards curves are exploited for recovering the coefficient of the image curve in the Huff-Edwards hybrid model, the performance gain not only comes from computing h S (1), h S (−1) instead of h S (−c), h S (−1/c), but also from the fact that no more coefficient transformation is required. The isogeny formula on Huff curves computes c of the image curve H c , expressed in terms of c of the domain curve H c . Therefore, coefficient transformation is required afterwards asĉ = 1 4 c + 1 c − 2 is used for elliptic curve arithmetic, and c must be kept to proceed with isogeny computations. On the other hand, when Edwards curves are exploited to recover the coefficient of the Huff curve, the formula directly usesĉ andĉ so that coefficient transformation is not required nor c is kept to proceed with isogeny computation.
Summarizing the section, we compare the computational cost of the building blocks for implementing isogeny-based cryptography between Montgomery curves and Huff curves. First, in Table 1 we compare the computational costs of biquadratic polynomials for Montgomery curves and Huff curves. Computing -isogeny consists of isogeny evaluation and recovering the coefficient of the image curve. In Table 1, eval refers to isogeny evaluation and coeff refers to computing the coefficient of the image curve. The Huff-Edwards in Table 1 refers to the case when Huff curves are used to evaluate isogeny, and Edwards curves are used to compute the coefficients. Table 2 denotes the computational cost of the building blocks of isogeny-based cryptography on Montgomery curves and on Huff curves. The middle rule in Table 2 divides the functions into two groups -the upper half is the functions that are commonly used in SIDH and CSIDH, and the lower half is the functions that are explicitly used in SIDH.
In Table 2, DBLADD refers to the differential addition and doubling in projective coordinates, and DBL refers to the doubling. -isog eval refers to the evaluation of an -isogeny and -isog coeff refers to the computation of the coefficient of the -isogenous image curve, where = 2s + 1. CoeffTrans refers to the cost of transforming the coefficient for efficient elliptic curve arithmetic, which only occurs on Huff curves. The TPL refers to tripling of a point, and 3-isogeny and 4-isogeny are the combined computational cost of isogeny evaluation and coefficient computation. Lastly, get_coeff refers to recovering of the curve coefficient using points P, Q and P − Q on an elliptic curve.
Also, Mont refers to Montgomery curve, and Mont-Edwards Hybrid refers to the hybrid method proposed in [21], where Montgomery curves are used for elliptic curve arithmetic and isogeny evaluation, and Edwards curves are used for computing the coefficient of the image curve. Huff-Edwards Hybrid refers to the hybrid method where Huff curves are used for elliptic curve arithmetic and isogeny evaluation, and Edwards curves are used for computing the coefficient of the image curve. As the hybrid methods are used for implementing CSIDH, the computational cost of the lower half of the table is omitted. The function w( ) refers to w( ) = (h−1)M+(t −1)S. In w( ), h denotes the hamming weight of and t is the bit length of . Table 2, except for the -isogeny coeff, the computational cost of the lower-level functions is the same for Montgomery curves and Huff curves. Also, as the compression function w and w inv are reciprocals of each other, the formula of the lower-level functions are almost reciprocals of each other so that w-function and w inv -function induce the same computational cost. Hence, when implementing CSIDH on Huff curves, the compression function is free of one's choice. On the other hand, for SIDH, w-function is preferred as get_coeff is slightly efficient than w inv -function.

As shown in
Remark 4: On Huff curves, the CoeffTrans can be omitted when division polynomial is used to represent the curve coefficient in terms of the kernel points. This can be easily done for 3-and 4-isogenies. For general higher degree isogenies, as representing the coefficient of the curve using kernel point is difficult, extra CoeffTrans operation is required to proceed with the elliptic curve arithmetic further or Huff-Edwards hybrid can be used to omit the transformations.

IV. IMPLEMENTATION
In this section, we provide the performance result of isogeny-based cryptography. To evaluate the performance, the algorithms are implemented in the C language. For implementing SIDH, we use the field arithmetic of Round 3 version of SIKE, submitted to NIST. For implementing CSIDH, we use the field arithmetic implemented in [8]. All the cycle counts were obtained on one core of an Intel Core i7-7700 at 3.60 GHz, running Ubuntu 16.04 LTS. For the compilation, we used GCC version 9.3.0 with an optimization level -O3. The source code is available at https://github.com/suhrikim/HuffSIDH for SIDH and https://github.com/suhrikim/HuffCSIDH for CSIDH.

A. IMPLEMENTATION OF SIDH
We first present the parameter settings for SIDH implementation. Then we present the implementation result with analysis. For implementing SIDH, we used the Huff curve of the form H c with w as compression function, as w-function is more efficient than w inv for recovering the coefficient of the curve after the first round of the protocol.

1) PARAMETER SETTINGS
The prime used in SIDH-based algorithms is of the form p = As an extra coefficient transformation is required for Huff curves for higher degree isogenies, the latter is to examine the performance change caused by this.
For { A , B } = {2, 3}, we used the 751-bit prime proposed in [28], which is as follows: x, which is isomorphic to the Huff curve H c 621 . When (P A , Q A ) and (P B , Q B ) are found, we compute the Weil paring e(P A , Q A ) ∈ E [3 175 ] and e(P B , Q B ) ∈ E [5 119 ] to check that the result has order 3 175 and 5 119 , respectively. When the points are found, we transform the points on W to points on H c 621 , and express in w-coordinate. The generator points on Montgomery curves are found in a similar manner.
Also, when implementing 5-isogeny, we used the formula from [10] for isogeny evaluation. For recovering the coefficient of the image curve, we used the 2-torsion method described in [10]. The reason is that using the 2-torsion method, the cost for recovering the coefficient of the image curve is 8M + 4S, while using the projectivized formula of [10] presented in [8], the cost is 10M + 3S. Table 3 presents the implementation results of SIDH on Montgomery curves and Huff curves. Using the prime p 621 and p 751 , the performance of SIDH is compared between Montgomery curves and Huff curves. The implementation using p 621 uses 3-and 5-isogeny formula, which is presented in Section 3.2. The prime p 751 uses 3-and 4-isogeny, and the corresponding formula on H c using w-function is in the Appendix.

2) IMPLEMENTATION RESULTS
As denoted in Table 3, for p 751 , the performance of the Montgomery-SIDH and Huff-SIDH are almost the same. This is obvious as the computational cost for the formulas for implementing isogeny-based cryptography is almost the same. For p 621 , although the Huff curve requires the transformation of the curve coefficient on Bob's side, the performance of the Montgomery-SIDH and Huff-SIDH is almost the same. We shall analyze the results in detail by dividing them into key generation and shared key computation phases.

a: PUBLIC KEY GENERATION
During this phase, it is natural that there is no difference when comparing the computational cost of the two curves for Alice's side. For Bob's side on Huff curves, after calculating the coefficient of the image curve, extra coefficient transformation is required for efficient quintupling. Hence, computing the coefficient on Huff curves costs 8M + 4S for a total. For Montgomery curves, 2-torsion is used for recovering the coefficient of the image curve. Hence, after evaluating isogeny at a 2-torsion point for a Montgomery curve, recovering the curve coefficient is required, and total also costs 8M + 4S. Therefore, the computation of 5-isogeny on both curves is almost the same.

b: COMPUTING THE SHARED KEY
The difference in the computation between two curves occurs when calculating the curve coefficient upon the receipt of of H c is recovered using equation (4), not c itself. For Alice, asĉ is directly used for tripling and isogeny computation, the performance on Huff curves and Montgomery curves is almost the same. However, on Bob's side in Huff curves, recoverinĝ c is not enough -ĉ is used for quintupling, but we need the actual c to compute the coefficient of the isogenous curve. For Montgomery curves, Bob uses the extra 2-torsion point on the base curve to compute the image curve's coefficient. To reduce the key size, when computing the shared key on Bob's side, we compute the 2-torsion, given the coefficient of the Montgomery curve. Hence both curves require solving quadratic equation over F p 2 , which requires 1 field squaring and 1 square-root computation for both curves. Hence, the performance of Montgomery-SIDH and Huff-SIDH is almost the same.

B. IMPLEMENTATION OF CSIDH
For CSIDH-based algorithms, the compression function to use is free of one's choice as the computational cost of the building blocks for CSIDH is the same for w and w inv . In this paper, we used w inv for implementing CSIDH. To implement CSIDH-based algorithms, we first need to check whether a supersingular curve exists over a given prime field. In this section, we examine the existence of a supersingular Huff curve over F p for a prime p and present the base curve H c for the implementation. Then we present the implementation result of CSIDH using Huff curves.

1) PRIME FIELD AND BASE CURVE
In order to implement the CSIDH, we need to search for a supersingular Huff curve H a,b over a prime field p of the form p = f · i − 1, where i s are small distinct primes. Below is the theorem proving that a supersingular Huff curve over F p exists when p ≡ 7 mod 8. If p ≡ 3 mod 8, there is no supersingular Huff curve over F p .
Theorem 3: There exists a supersingular Huff curve of the form H a,b over F p when p ≡ 7 mod 8.
Proof: In the CSIDH setting, for every supersingular elliptic curve over F p , there exists a corresponding supersingular Montgomery curve over F p . Hence it suffices to show that for a given supersingular Montgomery curve, there exists an isomorphic Huff curve over F p . Now, Huff curve H a,b is isomorphic to a Montgomery curve of the form: Then, M is supersingular if and only if H a,b is supersingular. Let (a 2 + b 2 )/ab = A. If we find a supersingular Montgomery curve y 2 = x 3 + Ax 2 + x over F p , then by using the equation (6) The original implementation of CSIDH uses the prime of the form p ≡ 3 mod 8. However, from Theorem 3. we use the 511-bit prime presented in [30], which works over F p where p = 2 4 · 3 3 · 5 · 7 · 11 2 · 13 · · · 373 − 1.
In this field, we choose a supersingular Huff curve of the form as the base curve: 8 ∈ F p . Remark 5: For a prime p such that p ≡ 3 mod 8, there exist a supersingular general Huff curve over F p . However, as the computational cost of elliptic curve arithmetic and isogeny evaluations is slower than the Huff curve, we omit this case. VOLUME 9, 2021 2) SELECTING A RANDOM POINT OVER F p When implementing CSIDH, one has to select a random point on a curve over F p of a certain order to compute an isogeny using Vélu's formula. For a Montgomery curve, first, a random element in F p is selected, and we consider it as an x-coordinate of a given Montgomery curve. Then, by using the curve equation x is computed and checked whether r is a square or non-square in F p . The computational cost for checking whether a random point on a Montgomery curve is in F p or F p 2 \F p costs 2M + 1S (we omit the computational costs for computing the Legendre symbol).
The following method checks whether the point (x, y) ∈ H c is on F p or F p 2 \F p . Since w = 1/xy for a point (x, y) ∈ H c , y = 1/wx. Now, from the curve equation, the following holds: The computational cost for checking whether a random point is in F p or F p 2 \F p costs 2M + 1S.

3) IMPLEMENTATION RESULTS
For the implementation, we used the prime field F p , where p is defined as in equation 8. In order to compare the performance with Montgomery curves, we use the following supersingular curve over F p as a base curve.
M : y 2 = x 3 + x The original implementation of Montgomery-CSIDH in [8] does not use the optimization method when evaluating isogenies. Hence, we modified the implementation for a fair comparison with the Huff-CSIDH. The difference in the performance between the algorithms lies purely in the computation of the coefficient of the image curve and coefficient transformation for Huff curves. Table 4 presents the performance of the group action on Montgomery curves and Huff curves. In Table 4, Montgomery-Edwards CSIDH is a method proposed in [21], which implements CSIDH using Montgomery curves but uses Edwards curves for evaluating the coefficient of the image curve. Lastly, Huff-Edwards CSIDH is a method that implements CSIDH using Huff curves, but uses Edwards curves for evaluating the coefficient of the image curve.
As shown in Table 4, Huff-CSIDH is 6% faster than Montgomery-CSIDH. This is because although an extra coefficient transformation is required when Huff curves are used for the implementation, recovering the Montgomery curve's coefficient is costly than on a Huff curve for odd-degree isogenies. For the hybrid implementations, Montgomery-Edwards CSIDH is almost the same as Huff-Edwards CSIDH.  Additionally, for CSIDH, it is important to optimize the odd-degree isogeny formula as isogeny computation contributes to the overall CSIDH performance. Hence we present the CSIDH implementation using the square-root Vélu formula in [11]. Table 5 presents the performance comparison of Montgomery-CSIDH and Huff-CSIDH, when the square-root Vélu formula is used for computing odd-degree isogenies. In Table 5, sqrt-Mont and sqrt-Huff refers to CSIDH implementation when the square-root Vélu formula is used for Montgomery curves and Huff curves, respectively. As the effect of the square-root Vélu formula becomes more conspicuous when isogeny of degree larger than 113 is used, the effect is not immediate for the current parameter setting. However, as the square-root Vélu formula exploits Edwards curves for recovering the coefficient of Montgomery curve, we can see that the performance of sqrt-Mont is similar to Montgomery-Edwards CSIDH in Table 4. As this is also the case for Huff curves, where Edwards curves are used to recover the coefficients of the image curve, the performance of sqrt-Huff is similar to Huff-Edwards CSIDH.

V. CONCLUSION
In this paper, we demonstrated the Huff curves' usage for implementing isogeny-based cryptography. First, we analyzed the computational cost of the lower-level functions when the compression method is used for Huff curves. Then, we proposed additional functions on Huff curves to implement isogeny-based cryptography. We presented the implementation results of SIDH and CSIDH on Huff curves.
For SIDH, we concluded that using w as a compression function on Huff curves is preferred as the computational cost of recovering the coefficient is more efficient. As the computational cost for the lower-level function is the same on Montgomery curves and Huff curves, the performance of Montgomery-SIDH and Huff-SIDH is almost the same. For CSIDH, we presented the birational polynomials on Huff curves in order to exploit the square-root Vélu formula. We further presented the Huff-Edwards hybrid model for optimization. We implemented CSIDH using the classical Vélu formula and the square-root Vélu formula and compared them with Montgomery curves. The performance of sqrt-Mont is almost the same as sqrt-Huff. To summarize, the performance of isogeny-based cryptography on Huff curves is as fast as on Montgomery curves.
Based on our analysis, the Huff curve can be quite practical for implementing isogeny-based cryptography but has limitations. First, as the points of order 2 are all at infinity on Huff curves, it is hard to construct a 2-isogeny formula using w-coordinate so that only e A with an even number can be used to implement SIDH with Huff curves. The second is that a supersingular Huff curve exists on F p , where p ≡ 7 mod 8. This result is contrary to the case where supersingular Montgomery curve exists on F p for both p ≡ 3 mod 8 and p ≡ 7 mod 8.

APPENDIX A 4-ISOGENIES ON HUFF CURVES
Although [24] omits the 4-isogeny formula on Huff curves using w-function, by adapting the idea from [25], we additionally present the 4-isogeny formula on Huff curves using w-function. In this section, we shall briefly state the formula for implementing SIDH using 4-isogeny. To derive equation (9), we adapt the method used in [25]. That is, φ is first derived from the below composition: where ι denotes the transformation from a Huff curve to a general Huff curve, ψ is a 2-isogeny on general Huff curve from [23]. Then φ = ι −1 • ψ • ι. Similarly, we can derive Huff 2-isogenies for the curve of the form H c .
where c =| (c + 1) | / | (1 − c) |. As shown in equation (10), 2-isogeny on H c using w-function is identical to setting b = 1 in equation (9). Also, equation (10) is just reciprocal of the 2-isogeny on H c using w inv function defined in [25]. Lastly, we state the 4-isogeny on Huff curve using w-function, directly derived from the idea presented in [25].
Theorem 6 (4-Isogenies for H c Using w-Function): Let φ : H c → H c be a 4-isogeny with kernel P such that w(P) = w 4 and P has order 4 in H c . Let w(Q) = w = xy for a point Q = (x, y) ∈ H c . Then the evaluation of w under φ is given by where c = (1 + 1 − w 4 4 )/(1 − 1 − w 4 4 ).

APPENDIX B FORMULAS FOR IMPLEMENTING SIDH-BASED CRYPTOGRAPHY
In this section, we present the doubling, tripling, 3-isogeny, and 4-isogeny formula on a Huff curve of the form H c , using w as a compression function. For corresponding formulas on H c using w inv function, please refer to [25].
The tripling formula is the same to the case when w inv is used. The computational cost is 7M + 5S, givenĈ andD. For tripling it efficient to keep the projective curve coefficient as ((C − D) 2 : (C + D) 2 ). where c = C /D andĈ = (C + D ) 2 andD = (C − D ) 2 , to continue with the tripling efficiently. The computational cost for 3-isogeny evaluation is 4M + 2S and the computational cost for computing the coefficient of the image curve is 2M + 3S. whereĉ =Ĉ/D = 1 4 c + 1 c − 2 , to continue with the doubling efficiently. The computational cost for 4-isogeny evaluation is 6M + 2S and the computational cost for computing the coefficient of the image curve is 4S.