Download presentation
1 -

2DMOODYANDDSHUMOW3Giventhekernelofanisogenydeterminetherationalfunctio


4DMOODYANDDSHUMOWThenthel-isogeny30EE0isgivenby30xy xXP2FvPx0xP0uPx0xP2y0XP2F2uPyx0xP3vPy0yP0gxPgyPx0xP2TheequationfortheimagecurveisE0y2x3a05vxb07wDKohelshowedhowtheisogeny30canbealternativelywritten

elena's Recent Documents

FORLIVIIaIGJuly312008K0ChadBurgessSeniorCounselHANDDELIVERYTheHonorabl
FORLIVIIaIGJuly312008K0ChadBurgessSeniorCounselHANDDELIVERYTheHonorabl

TheHonorableCharlesTerreniJuly312008Page2VeryvrulyyoursK0ChadBuaessShannonBowyerHudsonEsquireNanevveS0EdwardsEsquireSeovvElliovvEsquireE0WadeMullinsEsquireDamonE0XenopoulosEsquireJosephWoleiekiMildred

published 0K
20120General EducationMinnesota TransferCurriculumCore Abilities App
20120General EducationMinnesota TransferCurriculumCore Abilities App

Total ProgramCreditsMinimum Requirement MN Transfer CurriculumGenEdMinimumCategory RequirementASDegree30credits6categoriesAASDegree15credits3categoriesMinnesota Transfer Curriculum General Education f

published 0K
HIGHLIGHTS OF PRESCRIBING INFORMATIONThese highlights do not include a
HIGHLIGHTS OF PRESCRIBING INFORMATIONThese highlights do not include a

VITROL naltrexone for extendedrelease injectable suspension for intramuscular useInitial US ApprovalRECENT MAJOR CHANGESDosage and Administration 22 03/2021Warnings and Precautions 51 03/2021INDICATIO

published 0K
UDDEHOLM VIKING6
UDDEHOLM VIKING6

TRANSFORMATION TEMPERATUREF per houraustenite A1 starts forming at approx 800F and ends at approx 850When cooling 100F per hoursaustenite A1 starts transforming at approxF and ends at approx 750HARDNE

published 0K
International Journal of Caring Sciences              MayAugustl   20
International Journal of Caring Sciences MayAugustl 20

wwwinternationaljournalofcaringsciencesorgOriginal Article Financial Crises What is the Impact on Suicidality Rates Christodoulos Charalambous RN MSc Nursing Department Frederick University Cyprus Eva

published 0K
DSCB152 Restricted professional companies only Check the box if the l
DSCB152 Restricted professional companies only Check the box if the l

For additional provisions of the certificate if any attach 8 x 11 sheets IN TESTIMONY WHEREOF the organizers has have executed this Certificate of Organization this day of 20 Signatu

published 0K
CommitmentversusFlexibilitywithCostlyVericationMarinaHalacYaleUniversi
CommitmentversusFlexibilitywithCostlyVericationMarinaHalacYaleUniversi

thepresenceofinformationcostsandmisalignedincentivesInasurveyofmanufacturingrmsRoss1986observesthattopcorporatemanage-mentisoftentoobusyandpreoccupiedwithotherresponsibilitiestohavethetimeandresources

published 0K
CDC quarantine info
CDC quarantine info

https//wwwcdcgov/coronavirus/2019-ncov/if-you-are-sick/quarantinehtmlFor general info abut COVID-19 call 1-800-962-1253 or 211 or go to njcovid19njgovDec11 2020NJ Residents witha PositiveCOVID-19Test

published 0K
Download Section

Download - The PPT/PDF document "" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.






Document on Subject : "2DMOODYANDDSHUMOW3Giventhekernelofanisogenydeterminetherationalfunctio"— Transcript:

1 2D.MOODYANDD.SHUMOW(3)Giventhekernelofan
2D.MOODYANDD.SHUMOW(3)Giventhekernelofanisogeny,determinetherationalfunctionformoftheisogeny(uptoisomorphism).(4)Giventherationalfunctionformofanisogeny,computetheimagethroughtheisogenyongiveninputpoints.(5)GivenaprimelandanellipticcurveE,enumerateallellipticcurvesl-isogenoustoE.Thispaperprimarilyfocusesonproblem3,andalsopartiallyonproblem4.Fromahighlevel,isogeniesofellipticcurvesareanalgebraicconceptindepen-dentofthespeci cmodelchosenforthecurve.However,forcomputationalaspectsthemodelchosenforthecurveisimportant.Velu[36]givesexplicitformulasforisogeniesbetweencurvesspeci edbyWeierstrassequations.ThispaperpresentsexplicitformulasforisogeniesinEdwardsandHu form.Thisisconvenientasitallowsonetoevaluateisogeniesdirectlyonthesealternatemodels,withoutcon-vertingbacktoWeierstrassform.Thisisinterestingfromacomputationalperspective.Velu'sformulasarebasedonpointadditionformulas,andasthesealternatemodelshavemoreecientad-ditionformulasonemayaskiftheisogenyformulasforthesemodelsarealsomoreecient.Thisis,infact,thecase.Themaincontributionofthispaperisasolutiontoproblem3,aslistedabove.Speci

2 ;cally,givenanellipticcurveinEdwardsorHu
;cally,givenanellipticcurveinEdwardsorHu form,anda nitekernelofanisogenyonthiscurve,wegiveexplicitformulasfortheisogeny.TheseisogenyformulasarenotsimplycompositionsofVelu'sfor-mulaswithmappingstoandfromWeierstrassform.Thisallowsformoreecientformulaswithstrictlybetteralgebraiccomplexity.ForpreviousworkontheaspectsofecientcomputationofisogeniesonWeier-strasscurvessee[5],[6],or[10].ForisogeniesofEdwardscurves,theonlypaperintheliteratureis[1],whichcountsthenumberofisogenyclassesofanEdwardscurveovera nite eld.Forsolvingproblem4,Velu'sformulasrunintimelinearinthedegreeoftheisogeny(assumingthekernelpointsareinthebase eld).In[6],theauthorspresentanapproachtoproblem4thatislogarithmicinthedegreeoftheisogeny.However,thisapproachisexponentialinthediscriminantoftheendomorphismringofthecurveandonlyappliestohorizontalisogenies.Assuch,forsomespeci ccurvestheapproachof[6]maybemoreecient,butforthegeneralcaseVelu'sapproachisbetterasithasnorelianceonthediscriminantandisvalidforallisogenies.TheformulasinthispaperareofaVelulikeapproach,andassuchscalelinearlyinthedegreeofthe

3 isogeny.However,theyprovideamoreeci
isogeny.However,theyprovideamoreecientsolutionfortheevaluationofisogniesofellipticcurves(problem4above)thanknownresultsforcomputingVelu'sformulasonWeiestrasscurvesin[5]and[10].Thispaperisorganizedasfollows.Section2reviewsbasicfactsaboutisoge-nies,includingVelu'sformulas.Section3coversEdwardscurvesandHu curves.Sections4and5,givetheanalogueofVelu'sformulaforEdwardsandHu curvesrespectively.Section6presentsabrieflookatthecomputationalcost(problem4)ofcomputingtheformulasfromsections4and5.Wealsoincludesometimingstodemonstratethepracticalityofourresults.Finally,section7concludeswithdirectionsforfuturestudy. 4D.MOODYANDD.SHUMOWThenthel-isogeny:E!E0isgivenby(x;y)! x+XP2F+vP x�xP�uP (x�xP)2;y�XP2F+2uPy (x�xP)3+vPy�yP�gxPgyP (x�xP)2!:TheequationfortheimagecurveisE0:y2=x3+(a�5v)x+(b�7w):D.Kohelshowedhowtheisogenycanbealternativelywrittenintermsofitskernelpolynomial[25].Thekernelpolynomialisde nedasD(x)=YQ2F�f1g(x�xQ)=xl�1�xl�2+2xl�3�3xl�4+::::Then(x;y)= N(x) D(x);yN(x) D(x)0!whereN(x)isrelated

4 toD(x)byN(x) D(x)=lx��(3x2+a)
toD(x)byN(x) D(x)=lx��(3x2+a)D0(x) D(x)�2(x3+ax+b)D0(x) D(x)0:Moregenerally,neitherVelu'spapernorKohel'srequiresthatlbeodd,norEbegivenbyasimpli edWeierstrassequation,althoughtheequationsaresimplerinthiscase.3.EdwardsandHuffcurves3.1.Edwardscurves.In2007,H.Edwardsintroducedanewmodelforellipticcurves[12].Afterasimplechangeofvariables,theseEdwardscurvescanbewrittenintheformEd:x2+y2=1+dx2y2;withd6=0;1.TwistedEdwardscurvesareageneralizationofEdwardscurves,proposedin[2].ThesetwistedEdwardscurvesaregivenbytheequationEa;d:ax2+y2=1+dx2y2;whereaandd6=1aredistinct,non-zeroelementsofK.EdwardscurvesaresimplytwistedEdwardscurveswitha=1.TheadditionlawforpointsonEa;disgivenby:(x1;y1)+(x2;y2)=x1y2+x2y1 1+dx1x2y1y2;y1y2�ax1x2 1�dx1x2y1y2:TheidentityonEa;disthepoint(0;1),andtheinverseofthepoint(x;y)is(�x;y).NotethattheEdwardscurveEdalwayshasacyclicsubgroupoforder4,namelyf(0;1);(0;�1);(1;0);(�1;0)g.TwistedEdwardscurvesalwayshaveapointoforder2,butnotnecessarilyoforder4.ThereisabirationaltransformationfromEa;dtoacurveinWeierstrassform.Themap(1)1:(x;y)!(a�d)1+y 1

5 �y;(a�d)2(1+y) x(1�y)sends
�y;(a�d)2(1+y) x(1�y)sendsthecurveEa;dtothecurveE:y2=x3+2(a+d)x2+(a�d)2x:Theinversetransformationisthemap�11:(x;y)!2x y;x�(a�d) x+(a�d): 6D.MOODYANDD.SHUMOWInthecaser6=0,thenagaincomparingthecoecientsoftheimageofI0withthoseofE^dwe ndthatwemusthaver2+2(1+d)r+(1�d)2=0.Thusr=�1�d2p d,andweareleftwiththeequations2(1+^d)=(�(d+1)6p d)u4;(1�^d)2=4(2d(d+1)p d)u2:Ourconventionforthesymbolsandisthatineachformula,takeallthesignsontop,oralternativelyallthesignsonthebottomofeachsymbol.Thissystemcanbesolvedforuand^d,althoughthedetailsaremoretediousandhenceareomitted.Thesolutiontothissystemofequationsleadstonon-trivialisomorphismsoftheform(x;y)! x(+r)y+�r �u(y+1);(+r�1+^d)y+�r+1�^d (+r+1�^d)y+�r�1+^d!;where=u2(1�d):IsomorphismsofEdwardscurveshavebeendiscussedintheliterature.Forex-ample,[1]includessomeexplicitEdwardsisomorphisms.Also,thequestionofthenumberofEdwardscurveisomorphismclassesover nite eldsisdiscussedin[14],[15],[16].4.2.2-isogeniesinEdwardsForm.Asshownin

6 insection3.1therearebira-tionalmapsfromE
insection3.1therearebira-tionalmapsfromEdwardscurvestoWeierstrasscurves.Themostintuitiveap-proachto ndexplicitisogeniesforEdwardscurvesistocombinethesemapswithVelu'sformula.Let1bethetransformationfromtheEdwardscurveEdtoaWeierstrasscurveEgivenin(1).Let2beanl-isogenyfromEtoanothercurveE0,whoserationalfunctionsareasgivenbyVelu'sformula.TheWeierstrassequationforE0(ascomputedfromVelu'sformula)isnotlikelytobeintheformy2=x3+2(1+^d)x2+(1�^d)2x;forsome^d,soitisnotimmediatelyobvioushowto ndsuchabirationaltransfor-mationtomapthisimagecurvebacktoanEdwardscurve.However,thebirationaltransformationwhichdoesworkisdescribedin[3].LetP=(r2;s2)beapointoforder2ontheimagecurveE0.Thenthechangeofvariables(x;y)!(x�r2;y2)mapsPto(0;0),andthenewcurvehasitsequationoftheformy2=x3+ax2+bx:LetQ=(r1;s1)beapointoforder4onthiscurve,andlet^d=1�4r31=s21.Thusa=21+^d 1�^dr1andb=r21.Themap(2)3:(x;y)! 2r r1 1�^dx y;x�r1 x+r1!mapstotheEdwardscurvex2+y2=1+^dx2y2:Composingthethreemaps1;2;and3givesanexplicitl-isogeny fromEdtoEd0.Applyingthisobservationyieldssimpleexplicitformulasfor2-i

7 sogeniesofEdwardscurves. 8D.MOODYANDD.SH
sogeniesofEdwardscurves. 8D.MOODYANDD.SHUMOWnegation,showsthattherationalfunctionsofthecoordinatemapsofany2-isogenycannothavelowerdegree.4.3.Edwardscurveisogenies.ThissectionpresentsaformulaforisogeniesonEdwardscurvesanalogoustoVelu'sformulas,statedinsection2.Forllargerthan2,theapproachinthelastsubsectionofmappingtoandfromaWeierstrasscurve,whiletheoreticallypossible,leadstofarmorecomplexformulas.Thefollowingformulasaresimplertoexpress,manipulateandimmediatelylendthemselvestoamoreecientimplementation.Asopposedtotheprevioussection,theapproachinthissectionistodirectlyderivetheisogenyformulasfromthepointadditionformulas.ToshowthattheapproachofmappingtoWeierstrassfromEdwardstoapplyVelu'sformulasleadstomorecomplicatedformulas,considertheexampleofl=3.TheWeierstrassequationfortheimageofthe3-isogenyisE0:y2=x3+2(1+d)x2+a4x+a6,witha4=(1�d) (1� )2(79d 2+42d + 2�42 �d�79);a6=�8(1�d) (1� )3(44d2 3+27d2 2�12d 3�d2 �58d 2� 2�58d +27 �12d+44):Here( ; )isapointoforder3ontheEdwardscurveEd.Thepoint(x4;y4)=

8 5d 3�d 2� 3�3 2
5d 3�d 2� 3�3 2�4 +4 2(1� );�2d 3+2d 2� 3+2 2�4 3canbeshowntohaveorder4onE0.Accordingly,theWeierstrasscurveE0canbemappedtotheEdwardscurveE^d,with^d=1�4x34=y24:Byattemptingtocom-posethebirationaltransformationstoandfromtheWeierstrassformwithVelu'sformulas,itquicklybecomesapparentthattheformulasbecomeunwieldyandthisapproachisnotammenabletoformulatingsimpleexplicitformula.Forlargerval-uesofl,thesituationgrowsevenmorecomplex.Incontrast,theresultspresentedbelowaremuchsimpler.TheyalsoshowastrikingsimilarityinappearancetoVelu'sformulas.LetFbethekernelofthedesiredisogeny.Themotivatingideaisthatweareseekingto ndrationalfunctionswhichareinvariantundertranslationbythepointsinF,andmapthepoint(0;1)toitself.Theorem2.SupposeFisasubgroupoftheEdwardscurveEdwithoddorderl=2s+1,andpointsF=f(0;1);( 1; 1);:::;( s; s)g:De ne (P)=0@YQ2FxP+Q yQ;YQ2FyP+Q yQ1A:Then isanl-isogeny,withkernelF,fromthecurveEdtothecurveE^dwhere^d=B8dlandB=Qsi=1 i.Thecoordinatemapsaregivenby:(3) (x;y)= x B2sYi=1 2ix2� 2iy2 1�

9 ;d2 2i 2ix2y2;y B2sYi=1 2iy2
;d2 2i 2ix2y2;y B2sYi=1 2iy2� 2ix2 1�d2 2i 2ix2y2!: 10D.MOODYANDD.SHUMOWSubstitutingtheseintotheequationoftheimageof yieldsG(x;y)=X(x)2+Y(x)2�1�^dX(x)2Y(x)2;=A4 B4x2+(d�1+2sXi=1(d 2i�1 2i))x2�^dA4 B4x2+O(x4);= A4 B4�^dA4 B4+d�1+2sXi=1(d 2i�1 2i)!x2+O(x4):Supposethatthecoecientofx2,intheaboveexpansioniszero,thenGhasazeroofordergreaterthan2atx=0.However,asarguedaboveGhasazerooforder2atx=0.SoGmustbeidenticallyzero.Settingthecoecientofx2tozeroandsolvingthisfor^dyields^d=1+B4 A4 d�1+2sXi=1(d 2i�1 2i)!:Thuswiththischoicefor^d,thefunctionGisidenticallyzero,thusthecodomainofthismapisanotherEdwardscurve.Hence,thetransformationin(4)isarationalmapfromanEdwardscurvetoanotherthatpreservestheidentitypoint.Thisisnecessarilyanisogeny[31,III.4.8].Lookingattheimageofaspeci cpointonthedomaincurvefurthersimpli estheformulafor^d,thecoecientofthecodomaincurve.Particularly,choosethepointP=�1 ;i ;wherei2=�1and4=d.Thispointmaynotbede nedoverK,butratheroveranextensionofK.First,evaluatethevalueonthei

10 nsideoftheproductonthex-coordinatemapatt
nsideoftheproductonthex-coordinatemapatthepointP:1 2 2i+ 2i 1+d 2i 2i:As( i; i)isapointonthedomaincurvex2+y2=1+dx2y2thissimpli esto1 2:Hence,theX-coordinateoftheimagepointis1 B2l:AsimilarcalculationfortheY-coordinateshowsthatY(P)is(�1)si B2l:Then1 B2l;(�1)si B2lisonthecurveX2+Y2=1+^dX2Y2,thus^d=B8dl.NotethattheformulaforisogeniesgiveninTheorem1alsoworksfortwistedEdwardscurvesEa;d.Thisiseasiesttoseebyobservingthatthemap(x;y)!(x=p a;y)mapsEa;dtoE1;d=a.ThenapplyingTheorem2,whichmapstothecurveE1;B8(d=a)l.MappingbacktothetwistedEdwardsformbysending(X;Y)!(p alX;Y)givesanisogenyfromEa;dtoEal;B8dlThisargumentestablishesthefollowingcorollary.Corollary1.SupposeFisasubgroupofthetwistedEdwardscurveEa;dwithoddorderl=2s+1,andpointsF=f(0;1);( 1; 1);:::;( s; s)g:De ne (P)=0@YQ2FxP+Q yQ;YQ2FyP+Q yQ1A: 12D.MOODYANDD.SHUMOWFortherighthandside,note x=(�1)sx A2sYi=1(� 2i+O(x2))=x+O(x3):Consequently,1�dx2 1�^d 2x=(1�dx2)(1+^d 2x+O( 4x))=(1�dx2)(1+^dx2+O(x4))=1+O(x2):Sothecompleterighthandsideis 0

11 x1�dx2 1�^d 2x=(1+O(x2))(1+O(x2))=
x1�dx2 1�^d 2x=(1+O(x2))(1+O(x2))=1+O(x2):Equatingtheconstantcoecientsofthetwoequalpowerseriesgivesc=1.Thus isnormalized.4.4.UniformVariableFormulasForEdwardsIsogenies.ThissectionpresentsformulasforisogeniesonEdwardscurvesthatarewritten(almost)entirelyintermsofonevariable.Letl=2s+1bethedegreeoftheisogeny.Wecanassumetheisogeny satis es (1;0)=(1;0).Ifnot,simplycomposewiththenegationmap.Theorem4.LetEdbeanEdwardscurvewithsubgroupF=f(0;1);( i; i):i=1:::sg.Thenthemap (x;y)! xQsi=1y2� 2i f(y);yQsi=1y2� 2i g(y)!isanisogenywithkernelF.Thepolynomialsf(y)andg(y)aretheuniqueevenpolynomialsofdegree2ssatisfying:(5)f(0)=(�1)ssYi=1 2if( j)= jsYi=1( 2j� 2i);g(1)=sYi=1(1� 2i);g( j)= jsYi=1( 2j� 2i):ThisisogenyisthesameastheisogenygivenbyTheorem2.TheimageisthecurveEB8dl.Proof.Let :Ed!E^dbetheisogenydescribedabove.Write (x;y)=(X(x;y);Y(x;y)),thenbothXandYarerationalfunctionsofxandy.Hitt,Moloney,andMcGuirehaveshown(see[19],[24])thatoverEd,thecoordinatemapscanbeuniquelyex-pressedasX=p(y)+xq(y)andY=r(y)+xs(y);forsomerationalfunction

12 sp(y);q(y);r(y);ands(y).We rstshowth
sp(y);q(y);r(y);ands(y).We rstshowthatp(y)=0ands(y)=0. 14D.MOODYANDD.SHUMOW4.5.EdwardsIsogeniesFromKernelPolynomials.Intheprevioussections,thekernelofanisogenywasassumedtobeexpressedasalistofpointsinthekernel.However,thisismerelyonewayofexpressingthekernel.Analternatemethodisbyakernelpolynomial.Thatis,apolynomialwithrootsatthecoordinatesofthekernelpoints(eachkernelpolynomialisuniformineitherthexorycoordinate).ThisapproachwasoriginallyusedforcomputingtherationalmapsofisogeniesbyD.Kohelinhisthesis,whereheshowedhowthekernelpolynomialofanisogenycanalsobeusedtoexplicitlywritedownanisogeny[25]forWeierstrasscurves.Thiswassummarizedinthesection2.3.WepresentasimilarapproachtodeterminetherationalmapsofanisogenyfromkernelpolynomialsforEdwardscurves.ForWeierstrassform,kernelpolynomialsareusuallyexpressedintermsofthexcoordinates,butthesymmetryofcoordi-natesinEdwardsformadmitsequallysucientkernelpolynomialsinthexandycoordinates.Ifthekernelisf(0;1);( 1; 1);:::;( s; s)g,thenthex-coordinatekernelpolynomialisg(x)=sYi=1(x2� 2i);whichhasasrootsthe i.Alternativelythey-coordinatekerne

13 lpolynomialish(y)=sYi=1(y2� 2i):A
lpolynomialish(y)=sYi=1(y2� 2i):ApplyingTheorem2,theisogeny (x;y)=(X;Y)canbewrittenX=x B2sYi=1x2� 2i 1�d 2ix2orX=x B2sYi=1y2� 2i d 2iy2�1;Y=y B2sYi=1x2� 2i d 2ix2�1orY=y B2sYi=1y2� 2i 1�d 2iy2:NotethatitispossibletocomputeXsolelyintermsofx(andnoty),andlikewiseitispossibletosolelyexpressYintermsofy(andnotx).Writingtheseintermsofthekernelpolynomials,givesX=g(1=p d)xg(x) g(1)x2sg(1=p dx)=xh(y) h(0)(dy2)sh(1=p dy);Y=yh(x) h(0)(dx2)sh(1=p dx)=g(1=p d)yg(y) g(1)y2sg(1=p dy):ThecodomainofthisisogenyisthecurveE^d,where^d=d2s+1Qsi=1 8i=d2s+1h(0)4=dg(1)2=g(1=p d)2:5.IsogeniesonHuffcurves5.1.Isomorphisms.LetHa;bbetheHu curvex(ay2�1)=y(bx2�1);withab(a�b)6=0.Suppose isanisomorphism(overK)fromHa;btosomeotherHu curveH^a;^b.LetbethebirationaltransformationfromthecurveHa;btoaWeierstrasscurveE:y2=x3+(a+b)x2+abxandsimilarlylet^bethebirationaltransformationfromH^a;^btotheWeierstrasscurve^E.ThenitfollowsthatEand 16D.MOODYANDD.SHUMOWwherebothxandyhavesimplezerosat(0;0):Forthepointsatin nity,anecoordinatearenotsucient,sothefor

14 mulasmustbeevalutedinprojectivecoordinat
mulasmustbeevalutedinprojectivecoordinates.Doingsoshowsxhassimplepolesat(1:0:0)and(a:b:0),aswellasasimplezeroat(0:1:0).Inaddition,yhassimplepolesat(0:1:0)and(a:b:0)andasimplezeroat(1:0:0).Thesearetheonlyzeroesandpolesofxandy.Writethemapin(6)as (x;y)=(X;Y).AstraightforwardcalculationleadstoX=1 a�b t�1 (a�b)2 �a+sXi=11�a2 4i 2i!t3+O(t5)!;andsimilarly,Y=1 a�b t�1 (a�b)2 �b+sXi=11�b2 4i 2i!t3+O(t5)!:De neGc;d=X(cY2�1)�Y(dX2�1)=(Y�X)+XY(cY�dX):Acomputationshows(7)Gc;d=1 (a�b)3 b�a+c�d+sXi=11�a2 4i 2i�1�b2 4i 2i!t3+O(t5):TheonlypossiblepolesofGc;dareatthepolesofXandY.WeleaveittothereadertoverifythatthepolesofXareat(1:0:0);(a:b:0);(1=b i;� i);and(�1=b i;�1=a i),allofwhicharesimple.Also,thepolesofYareallsimple,andarelocatedat(0:1:0),(a:b:0),(� i;1=a i);and((�1=b i;�1=a i)).At(1:0:0),Xhasasimplepole,whileYhasasimplezero,soGc;dwillhaveatmostasimplepolethere.Thesameistruefor(0:1:0).At(a:b:0),therewillbeatmostatriplepoleforGc;d.Now,atthepoints(1=b

15 i;� i)thereisatmostasimplepole,an
i;� i)thereisatmostasimplepole,andsimilarlyat(� i;1=a i).Finally,notethatGc;dhasatmostatriplepoleatthepoints(�1=b i;�1=a i).Sothetotalnumberofpoles(countingmultiplicity)isisatmost10s+5=5l.Equation(7)showsthatthecoecientoft3inGc;dislinearincandd.Amoredetailedanalysisalsoshowsthecoecientoft5islinearincanddaswell.Thus,itispossibletosolvethissystemofequationstomakethesecoecientszero.Withthesevaluesofcandd,thenGc;dhasazerooforderatleast7at(0;0),aswellasatthe( i; i).Countingmultiplicities,weobtainthatthereareatleast7+14s=7lzeroes.Thisismorethanthenumberofpossiblepoles,whichisacontradiction,unlessGc;disconstant.WeeasilyseeGc;d(0;0)=0,andhenceGc;disidenticallyzero.Thisshowstheimageof isaHu curve.ThusthereisarationalmapwhichsendsHa;btoanotherHu curveandmaps(0;0)to(0;0).Thisisnecessarilyanisogeny[31,III.4.8].However,whilethisproofshowsthatitispossibleto ndthecodomainofthisisogeny,wedonotpresentexplicitexpressionsforcandd.Thisisbecausethereisasigni cantlyeasierwaytoderivethiscodomainformula,presentedasfollows.Usingprojectivecoordinates,we&

16 #12;ndthepoint(a:b:0)mapstotheprojective
#12;ndthepoint(a:b:0)mapstotheprojectivepoint(alB4(�ab)2s:blA4(�ab)2s:0),whichisequivalenttothepointQ=(alB4:blA4:0): 18D.MOODYANDD.SHUMOW5.4.Hu 2-isogenies.TheHu curveisogeniespresentedintheprevioussubsec-tionsonlyworkforodddegreeisogenies.So,forcompletenessthissectionpresentsformulasfor2-isogeniesonHu curves.Theorem7.Let2 Kbesuchthat2=ab.Thereisa2-isogenyfromtheHu curveHa;btotheHu curveH�(a+2+b);�(a�2+b)givenby(x;y)! (bx�ay) (b�a)2((bx�ay)+(x�y))2 bx2�ay2;(bx�ay) (b�a)2((bx�ay)�(x�y))2 bx2�ay2!:Proof.Thisproofissimilartothemethodusedfor2-isogeniesforEdwardscurves.ItconsistsofcomposingthemapstoandfromHu curvestoWeierstrasscurves(giveninSection3),alongwithaknown2-isogenybetweentherelevantWeierstasscurves.AsthemapstoandfromHu curveswerealreadygiven,weonlyincludetheequationsforthe2-isogeny.Inthisregard,themap2(x;y)=x2+(a+b)x+ab x;yx2�ab x2;isa2-isogenyfromy2=x3+(a+b)x2+abxtoy2=x3�2(a+b)x2+(a�b)2x.Forbrevitythealgebraicdetailsareomitted.6.ComputationAsisogeniesareausefultoolincomput

17 ationalmathematicsandcryptography,thereh
ationalmathematicsandcryptography,therehasbeenmuchinterestandworkintheliteratureonthevariouscomputa-tionalaspectsofisogenies,especiallyeciency,see[5],[6],[10],or[30]forexample.However,untilnowtheassessmentofeciencyoftheevaluationofisogenieshasonlyusedWeierstrasscurves.WiththeEdwardsandHu isogenyformulaspre-sentedinthispaper,wenowhaveanalternativetothispreviouswork.Thissectionbrie yexaminesthecomputationalcost,intermsofalgebraiccomplexity,ofeval-uatingtheformulasforEdwardsandHu isogeniesoninputpoints,andcomparesittoknownresultsforWeierstrassisogenies.ThisinitialassessmentshowsthatforbothEdwardscurvesandHu curvestheisogenyformulas,havestrictlylessmultiplicationoperationsthanVelu'sformulasforWeierstrasscurves.BoththeEdwardsandHu curveformulasrequireapproximatelyhalftheoperationsthattheWeierstrasscurvesdo.Thisisnotintendedtobeanindepthanalysisofthecomplexityoftheseformulas,butratheraquickanalysistoshowthattheformu-laspresentedinthispaperdo,infact,havebetter nitesizescalingthanVelu'sformulas,withoutfurtheroptimization.FirstforthecaseofEdwardscurves,theisogenywithkernelf&#

18 11;i; ig[f(0;1)ghascoordinatemaps (x
11;i; ig[f(0;1)ghascoordinatemaps (x;y)= xsYi=1x2� 2i= 2iy2 1�d2 2i 2ix2y2;ysYi=1y2� 2i= 2ix2 1�d2 2i 2ix2y2!:LetMandSdenotethecostofamultiplicationandsquaringinKrespectively.LetCdenotemultiplicationbyaconstantinK.Ifconstantsarecarefullychosen,thecostofthemultiplicationsdenotedbyCcanbesigni cantlylessthanthoseinM,however,inthegeneralcase,CandMshouldberegardedasequal.Itisstandard 20D.MOODYANDD.SHUMOW Figure1.Isogenycomputationtimebymodel.256bitprimeorder elds.Foreachoddintegerkbetween3and1023,thereisanellipticcurvewithasubgroupoforderk.Notethattheprimemodulivariedforeachcurve,butwerealways256bits.Noneoftheformulasaredependantonspecialformsforthemoduliandtheperformanceoftheunderlying eldarithmeticwasthesameacross elds.ThecurveswereselectedsuchthateachcurveadmitsarepresentationinWeierstrass,EdwardsandHu formsoverthegivenprimemod-ulus.Toperformthethetiming,eachoddordersubgroupwasusedasakernelforanisogenyandevaluatedwiththeformulasfortherespectivemodels.Assuch,thetimingscomparethesameisogenycalcuation,varyingonlytherepresentationofthecurveandcorres

19 pondingisogenyformulae.Thecomputationtim
pondingisogenyformulae.ThecomputationtimewascalculatedbyusingthetimingfunctionalitybuiltintoSAGEandprovidedbythesage timeitclass.Theseperformanceexperimentscon rmthealgebraiccomplexityanalysesoftheisogenyformulaspresentedhere;speci cally,theseexperimentsshowthatstraightforwardimplementationsofisogeniesoncurvesinEdwardsandHu formareconsiderablyfasterthanVelu'sformula'soncurvesinWeierstrassform.7.ConclusionThispaperpresentsisogenyformulasforEdwardsandHu curves,similartoVelu'sformulasforWeierstrasscurves.Itisinterestingtonotethattheseformulasare\multiplicative",comparedtothe\additive"formofVelu'sformulas.Further-more,becausetheadditionlawonthesealternateformsofcurvesissimplerthanWeierstrassform,thesenewisogenyformulasalsoyieldrationalmapsthataresim-plertoexpressthanVelu'sformulas.Inadditiontobeingsimplertoexpress,theseisogenyformulasalsoyieldstrictlybetteralgebraiccomplexityinthegeneralcase,indicatingthattheywillimprovetheperformanceofevaluatingisogenies.Thesenewisogenyformulashavepotentialusesinmanyapplications.AstherearemanyusesforisogeniesofWeierstrasscurvesintheliterature,i

20 tislikelythat ANALOGUESOFVELU'SFORM
tislikelythat ANALOGUESOFVELU'SFORMULASFORISOGENIES21thefasterevaluationofEdwards(orHu )isogeniescouldimproveperformanceoftheseresultsbyswitchingmodels.ThisissimilartohowtheEdwardsadditionlawcanspeeduppointmultiplicationonellipticcurves.SuchpossibilitiesincludetheSEAalgorithm[32],pairings[6],theDoche-Icart-Koheltechnique[11],orinpublickeycryptosystems[21].Thispaperleavesmanydirectionsforfuturework.Thepreliminaryoperationcountsshowtheisogenyformulasareecient,howeverthisanalysisisincompleteanditremainstodoadeepoptimizationofthecomputationsinsection6.Anothersimilarresearchtopicisderivationsofsimilarisogenyformulasforothermodelsofcurves,suchasHessiancurves,JacobiquarticsorJacobiintersections.Yetanotherinterestingdirectionwouldbetoaddresssomeoftheothercomputationalproblemsassociatedwithisogenies(mentionedintheintroduction.)Inparticulartheproblemofcomputinganisogenyofknowndegreesfromthedomainandcodomain.References[1]O.Ahmadi,andR.Granger,OnisogenyclassesofEdwardscurvesover nite elds,J.NumberTheory,132(6),pp.1337-1358,(2011).[2]D.Bernstein,P.Birkner,M.Joye,T.Lange,C.Peters.TwistedEdwardscurves,i

21 n:Progressincryptology|AFRICACRYPT2008,S
n:Progressincryptology|AFRICACRYPT2008,S.Vaudenay(ed.),LectureNotesinComput.Sci.5023,Springer,pp.389{405(2008).[3]D.Bernstein,andT.Lange,Fasteradditionanddoublingonellipticcurves,in:Advancesincryptology|ASIACRYPT2007,K.Kurosawa(ed.),LectureNotesinComput.Sci.4833,Springer,pp.29-50(2007).[4]G.Bisson,andA.Sutherland,ComputingtheEndomorphismRingofanOrdinaryEllipticCurveoveraFiniteField,J.NumberTheory,131(5),pp.815{831,(2011).[5]A.Bostan,F.Morain,B.Salvy,andE.Schost,Fastalgorithmsforcomputingisogeniesbetweenellipticcurves,Math.Comp.77,pp.1755{1778,(2008).[6]R.Broker,D.Charles,andK.Lauter.Evaluatinglargedegreeisogeniesandapplicationstopairingbasedcryptography,in:Pairing08:Proceedingsofthe2ndinternationalconferenceonPairing-BasedCryptography,LectureNotesinComput.Sci.5209,Springer-Verlag,pp.100-112,(2008).[7]R.Broker,K.Lauter,andA.Sutherland,Modularpolynomialsviaisogenyvolcanoes,Math.Comp.81,pp.1201-1231,(2012).[8]D.Charles,E.Goren,andK.Lauter,Cryptographichashfunctionsfromexpandergraphs,J.Cryptology,22(1),pp.93{113,(2009).[9]H.Debiao,C.Jianhua,andH.Jin,ARandomNumberGeneratorBasedonIsogeniesOpera-tions,CryptologyePrin

22 tArchiveReport2010/94,(2010).Availableat
tArchiveReport2010/94,(2010).Availableathttp://eprint.iacr.org/2010/094.[10]L.DeFeo.AlgorithmesRapidespourlesToursdeCorpsFinisetlesIsogenies,PhDthesis.EcolePolytechniqueX,(2010).[11]C.Doche,T.Icart,andD.Kohel,EcientScalarMultiplicationbyIsogenyDecompositions,in:PublicKeyCryptography-PKC2006,LectureNotesinComput.Sci.3958,Springer-Verlag,pp.285{352,(2006).[12]H.Edwards,Anormalformforellipticcurves,Bull.Amer.Math.Soc.44,pp.393{422(2007).[13]N.Elkies,Ellipticandmodularcurvesover nite eldsandrelatedcomputationalissues,In:Computationalperspectivesonnumbertheory:proceedingsofaconferenceinhonorofAOLAtkin,D.A.BuellandJ.T.Teitelbaum(Eds.),pp.21{76(1997).[14]R.Farashahi,OntheNumberofDistinctLegendre,Jacobi,HessianandEdwardsCurves(ExtendedAbstract),in:ProceedingsoftheWorkshoponCodingtheoryandCryptology(WCC2011),pp.37{46,(2011).Availableathal.inria.fr/docs/00/60/72/79/PDF/76.pdf.[15]R.Farashahi,D.Moody,andH.Wu,IsomorphismclassesofEdwardscurvesover nite elds,FiniteFieldsAppl.(18),pp.597{612,(2012).[16]R.Farashahi,I.Shparlinski.Onthenumberofdistinctellipticcurvesinsomefamilies.Des.CodesCryptogr.54(1),pp.