Improved Supersingularity Testing of Elliptic Curves Using Legendre Form

Hashimoto, Yuji; Nuida, Koji

doi:10.1007/978-3-030-85165-1_8

Cited by 2 publications

(11 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The main aim of this work is to extend the efficient method of computing 2-isogeny sequence in [7] to the case of CGL hash function. Recall that a Legendre form is an expression of an elliptic curve where the three 2torsion points of the curve are represented as (0, 0), (1, 0) (that are common to all Legendre curves) and (λ, 0) for some λ ̸ = 0, 1 depending on the curve.…”

Section: Contributionmentioning

confidence: 99%

“…Then the three 2-torsion points induce three 2-isogenies, that also define three maps φ 0 , φ 1 , φ λ between Legendre parameters of the source and the target curves. The result in [7] was obtained by studying properties of compositions of those maps (more precisely, their "twisted" versions 1 − φ 0 , 1 − φ 1 , 1 − φ λ ). In order to extend their result, in this work we studied the properties of those maps further.…”

Section: Contributionmentioning

confidence: 99%

“…Then we extend the method in [7] to the case of CGL hash function (see Section 5). In [7], it is shown that among the three maps 1 − φ 0 , 1 − φ 1 , and 1 − φ λ , composition of 1 − φ 1 to any of those maps causes backtracking in a walk on the 2-isogeny graph. Consequently, compositions of two maps cho-sen from 1 − φ 0 and 1 − φ λ in any combination do not cause backtracking.…”

Section: Contributionmentioning

confidence: 99%

“…Recently, Hashimoto and Nuida [7] proposed an improved CGL-type algorithm with less root computations per step, based on relations for the unique non-trivial x-coordinate of 2torsion points in 2-isogenous curves of Legendre form. However, their algorithm was tailored for the "easiestto-compute" direction in the 2-isogeny graph (which is sufficient for their purpose of supersingularity testing for elliptic curves in [7]), while a computation of CGL hash function also requires 2-isogeny sequences in the other directions. Therefore, the method in [7] is not directly applicable to the case of CGL hash function.…”

Section: Introductionmentioning

confidence: 99%

“…However, their algorithm was tailored for the "easiestto-compute" direction in the 2-isogeny graph (which is sufficient for their purpose of supersingularity testing for elliptic curves in [7]), while a computation of CGL hash function also requires 2-isogeny sequences in the other directions. Therefore, the method in [7] is not directly applicable to the case of CGL hash function.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Efficient Construction of CGL Hash Function Using Legendre Curves

Hashimoto

Nuida

2023

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

The CGL hash function is a provably secure hash function using walks on isogeny graphs of supersingular elliptic curves. A dominant cost of its computation comes from iterative computations of power roots over quadratic extension fields. In this paper, we reduce the necessary number of power root computations by almost half, by applying and also extending an existing method of efficient isogeny sequence computation on Legendre curves (Hashimoto and Nuida, CASC 2021). We also point out some relationship between 2-isogenies for Legendre curves and those for Edwards curves, which is of independent interests, and develop a method of efficient computation for 2 e -th roots in quadratic extension fields.

show abstract

Section: Contributionmentioning

confidence: 99%

Section: Contributionmentioning

confidence: 99%

Section: Contributionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Efficient Construction of CGL Hash Function Using Legendre Curves

Hashimoto

Nuida

2023

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

show abstract

Efficient Supersingularity Testing of Elliptic Curves Using Legendre Curves

Hashimoto

Nuida

2023

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

There are two types of elliptic curves, ordinary elliptic curves and supersingular elliptic curves. In 2012, Sutherland proposed an efficient and almost deterministic algorithm for determining whether a given curve is ordinary or supersingular. Sutherland's algorithm is based on sequences of isogenies started from the input curve, and computation of each isogeny requires square root computations, which is the dominant cost of the algorithm. In this paper, we reduce this dominant cost of Sutherland's algorithm to approximately a half of the original. In contrast to Sutherland's algorithm using j-invariants and modular polynomials, our proposed algorithm is based on Legendre form of elliptic curves, which simplifies the expression of each isogeny. Moreover, by carefully selecting the type of isogenies to be computed, we succeeded in gathering square root computations at two consecutive steps of Sutherland's algorithm into just a single fourth root computation (with experimentally almost the same cost as a single square root computation). The results of our experiments using Magma are supporting our argument; for cases of characteristic p of 768-bit to 1024-bit lengths, our proposed algorithm for characteristic p ≡ 1 (mod 4) runs in about 61.5% of the time and for characteristic p ≡ 3 (mod 4) also runs in about 54.9% of the time compared to Sutherland's algorithm.

show abstract

Improved Supersingularity Testing of Elliptic Curves Using Legendre Form

Cited by 2 publications

References 19 publications

Efficient Construction of CGL Hash Function Using Legendre Curves

Efficient Construction of CGL Hash Function Using Legendre Curves

Efficient Supersingularity Testing of Elliptic Curves Using Legendre Curves

Contact Info

Product

Resources

About