IsogeniesonEdwardsandHucurves.PDFVIP

Isogenies on Edwards and Huff curves Dustin Moody?and Daniel Shumow? August 10, 2011 Abstract Isogenies of elliptic curves over finite fields have been well-studied, in part because there are several cryptographic applications. Using Ve?lu’s formula, isogenies can be constructed explicitly given their kernel. Ve?lu’s formula applies to elliptic curves given by a Weierstrass equation. In this paper we show how to similarly construct isogenies on Edwards curves and Huff curves. Edwards and Huff curves are new normal forms for elliptic curves, different than the traditional Weierstrass form. 1 Introduction Isogenies are the structure preserving mappings between elliptic curves. As such, isogenies are an important mathematical object. Isogenies are also present in many different areas of elliptic curve cryptography. They have been used to analyze the complexity of the elliptic curve discrete logarithm [20], are used in the SEA point counting algorithm [13],[17], [29] and have been proposed as a mathematical primitive in the construction of cryptographic one-way func- tions such as hashes [8] and pseudo-random number generators [9]. Isogenies also play key roles in determining the endomorphism ring of an elliptic curve [4],[23], computing modular and Hilbert class polynomials [7], [31], and in the construction of new public key cryptosystems [26],[30],[32]. Traditionally, elliptic curves have been specified by Weierstrass equations. However, this is merely one possible way to describe an elliptic curve. There are alternate models of elliptic curves which have been proposed for use in cryptog- raphy. Edwards curves, and to a lesser extent Huff curves, have been proposed as such alternative models. Expressing an elliptic curve with these models can lead to more efficient and secure arithmetic. The more efficient arithmetic comes from simpler point addition formulas which require less expensive operations like multiplication and division. These curves can also lead to impro