Kummer and Hessian Meet in the Field of Characteristic 2

One can compute scalar multiplication on an ordinary short Weierstrass curve defined over a binary field. Also, one can move to the associated binary Kummer line \(\textsf{BKL}_{(1:c)}\) , or isomorphic generalized Hessian curve \(\textsf{H}_{(\gamma ,\delta )}\) from short Weierstrass, and then compute the scalar multiplication. A generalized Hessian curve provides the best performance of scalar multiplication in \(\mathfrak {RT}\) coordinates where \(\mathfrak {R}=R^3+S^3\) and \(\mathfrak {T}=T^3\) for a point \(P=(R: S: T)\) on \(\textsf{H}_{(\gamma ,\delta )}\) . Montgomery scalar multiplication gives us the nP and \((n+1)P\) , again in \(\mathfrak {RT}\) . We propose a method to uniquely obtain the R and S coordinates of nP given \(P=(R:S:T)\) and \(\mathfrak {RT}\) coordinates of nP and \((n+1)P\) . Next, we show that \(\textsf{BKL}_{(1:c)}\) can be linked to an isomorphic \(\textsf{H}_{(\gamma ,\delta )}\) . But small c does not guarantee small \(\gamma \) or \(\delta \) . First, we introduce two isogenies and their duals: one 2-isogeny between two short Weierstrass curves and one 3-isogeny between two generalized Hessian curves to solve the issue. Using the introduced isogenies, we show that there always exists a generalized Hessian curve \(\textsf{H}_{(\gamma ,1)}\) with \(\sqrt{\gamma ^3(\gamma +1)}=c\) associated with a \(\textsf{BKL}_{(1:c)}\) . The obtained \(\textsf{H}_{(\gamma ,1)}\) needs \(5[\textsf{M}]+4[\textsf{S}]+1[\textsf{C}_s]\) field operations for each ladder step of Montgomery scalar multiplication, and the operation count is the smallest one compared to any other curves over a binary field.