Any isogeny between two supersingular elliptic curves can be defined over \(\mathbb {F}_{p^2}\) , however, this does not imply that computing such isogenies can be done with field operations in \(\mathbb {F}_{p^2}\) . In fact, the kernel generators of such isogenies are defined over extension fields of \(\mathbb {F}_{p^2}\) , generically with extension degree linear to the isogeny degree. Most algorithms related to isogeny computations are only efficient when the extension degree is small. This leads to efficient algorithms used in isogeny-based cryptographic constructions, but also limits their parameter choices at the same time. In this paper, we consider three computational subroutines regarding isogenies, focusing on cases with large extension degrees: computing a basis of \(\ell \) -torsion points, computing the kernel polynomial of an isogeny given a kernel generator, and computing the kernel generator of an isogeny given the corresponding quaternion ideal under the Deuring correspondence. We then apply our algorithms to the constructive Deuring correspondence algorithm from [EPSV23] in the case of a generic prime characteristic, achieving around 30% speedup over [EPSV23].

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Faster Algorithms for Isogeny Computations over Extensions of Finite Fields

  • Shiping Cai,
  • Mingjie Chen,
  • Christophe Petit

摘要

Any isogeny between two supersingular elliptic curves can be defined over \(\mathbb {F}_{p^2}\) , however, this does not imply that computing such isogenies can be done with field operations in \(\mathbb {F}_{p^2}\) . In fact, the kernel generators of such isogenies are defined over extension fields of \(\mathbb {F}_{p^2}\) , generically with extension degree linear to the isogeny degree. Most algorithms related to isogeny computations are only efficient when the extension degree is small. This leads to efficient algorithms used in isogeny-based cryptographic constructions, but also limits their parameter choices at the same time. In this paper, we consider three computational subroutines regarding isogenies, focusing on cases with large extension degrees: computing a basis of \(\ell \) -torsion points, computing the kernel polynomial of an isogeny given a kernel generator, and computing the kernel generator of an isogeny given the corresponding quaternion ideal under the Deuring correspondence. We then apply our algorithms to the constructive Deuring correspondence algorithm from [EPSV23] in the case of a generic prime characteristic, achieving around 30% speedup over [EPSV23].