Optimized method for computing odd-degree isogenies on Edwards curves
International Conference on the Theory and Application of Cryptology and …, 2019•Springer
In this paper, we present an efficient method to compute arbitrary odd-degree isogenies on
Edwards curves. By using the w-coordinate, we optimized the isogeny formula on Edwards
curves by Moody and Shumow. We demonstrate that Edwards curves have an additional
benefit when recovering the coefficient of the image curve during isogeny computation. For ℓ-
degree isogeny where ℓ= 2s+ 1, our isogeny formula on Edwards curves outperforms
Montgomery curves when s ≥ 2. To better represent the performance improvements when w …
Edwards curves. By using the w-coordinate, we optimized the isogeny formula on Edwards
curves by Moody and Shumow. We demonstrate that Edwards curves have an additional
benefit when recovering the coefficient of the image curve during isogeny computation. For ℓ-
degree isogeny where ℓ= 2s+ 1, our isogeny formula on Edwards curves outperforms
Montgomery curves when s ≥ 2. To better represent the performance improvements when w …
Abstract
In this paper, we present an efficient method to compute arbitrary odd-degree isogenies on Edwards curves. By using the w-coordinate, we optimized the isogeny formula on Edwards curves by Moody and Shumow. We demonstrate that Edwards curves have an additional benefit when recovering the coefficient of the image curve during isogeny computation. For -degree isogeny where , our isogeny formula on Edwards curves outperforms Montgomery curves when . To better represent the performance improvements when w-coordinate is used, we implement CSIDH using our isogeny formula. Our implementation is about 20% faster than the previous implementation. The result of our work opens the door for the usage of Edwards curves in isogeny-based cryptography, especially for CSIDH which requires higher degree isogenies.
Springer
Showing the best result for this search. See all results
