Download presentation
1 -

OnnewVelusformulaeandtheirapplicationstoCSIDHandBSIDHconstanttimeimp


28eldoperationsInthisworkwepresentaconcretecomputationalanal-ysisofthesenovelformulaealongwithseveralalgorithmictricksthathelpedtosigni28cantlyreducetheirpracticalcostFurthermorewere-portaPython-3impl

della's Recent Documents

MEMBERSHIP APPLICATION
MEMBERSHIP APPLICATION

APPLICANT INFORMATION Full nameFirst MI Last Suffix YYYYPreferred name Date application submitted / / Address City State Zip Phone Email address Gender circleMale FemaleHighest educati

published 0K
APPLICATION FOR EXAMINATION  EMPLOYMENT NONREFUNDABLE APPLICATION FIL
APPLICATION FOR EXAMINATION EMPLOYMENT NONREFUNDABLE APPLICATION FIL

WESTCHESTER COUNTY DEPARTMENT OF HUMAN RESOURCES Recruitment and Selection Unit Michaelian Office Building 148 Martine Avenue Suite 100 White Plains New York 10601UNIFORM SERVICES PROMOTIONAL SERIESF

published 0K
PB5BCJNDMNAANNCNLNSx004E006C006CTTUT4TCA5I5D5XBCB6B6BABCBDBERBFBABIA56
PB5BCJNDMNAANNCNLNSx004E006C006CTTUT4TCA5I5D5XBCB6B6BABCBDBERBFBABIA56

UUotx00720069lJUPCx00AB002ECuIRPAUYPNDUCLMCCIMJUA2UNERU66UUTTUIMISENUFHIx0049002D3NUHIIUUIUCCLUCOnUx00490054UDRUSUTD4PUSDCCACEESSECCACLCCERUUACAU1UELDEAECEOPUEAFACDFEFCFUUHRUnUACCACTNUAECNUUNQSPUISTUN

published 0K
al questions
al questions

IllinoisLearning Standardsfor Social Science-5thgradeInquirySkillsDevelopingQuestions andPlanningInquiriesConstructing EssentialQuestionsSSIS13-5Developessentiandexplain theimportance ofthe questions

published 0K
LOGISTICS
LOGISTICS

OCTOBER2017MARKET SNAPSHOT1US MARKETGross Domestic ProductThe US GDP increased at an annual rate of 31in the secondquarter of 2017according to the thirdestimate released by the Bureau of Economic Anal

published 0K
Page 1 of 2
Page 1 of 2

PROFESSIONAL ACTIVITIESMemberMember New York City Bar Association completed Mediation Training Program June 1995 MemberAAA Labor Panel RAB-Local 32BJ SEIU NYC Sma

published 0K
nnrnnnrn r
nnrnnnrn r

nr/-n-00/rr/7-r3/0/rr-Ar3Page 1 of 41nnrnnnrn r /30/rr-A9r37003/DBEB/r30-r-Er3rr33rBrCA/r9-B37/0n30-/-nr/-n-Page 2 of 41nnrnnnrn r /00/rr/7-nnr00Bx0000700nPage 3 of 41nnrnnnrn r /1-0nnr00Bx0000700n

published 0K
TFA.pdf
TFA.pdf

LM06871902

published 0K
Download Section

Download - The PPT/PDF document "" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.






Document on Subject : "OnnewVelusformulaeandtheirapplicationstoCSIDHandBSIDHconstanttimeimp"— Transcript:

1 OnnewVelu'sformulaeandtheirapplicationst
OnnewVelu'sformulaeandtheirapplicationstoCSIDHandB-SIDHconstant-timeimplementationsGoraAdj1,Jesús-JavierChi-Domínguez2,andFranciscoRodríguez-Henríquez31DepartamentdeMatemàtica,UniversitatdeLleida,Spain.gora.adj@udl.cat2TampereUniversity,Tampere,Finland.jesus.chidominguez@tuni.fi3ComputerScienceDepartment,CINVESTAV-IPN,MexicoCity,México.francisco.rodriguez@cinvestav.mxAbstract.Atacombinedcomputationalexpenseofabout6`eldop-erations,Vélu'sformulaeareusedtoconstructandevaluatedegree-`isogeniesinthevastmajorityofisogeny-basedcryptographicimplemen-tations.Recently,Bernstein,deFeo,LerouxandSmithintroducedanewapproachforsolvingthissameproblematareducedcostofjust~O(p `)eldoperations.Inthiswork,wepresentaconcretecomputationalanal-ysisofthesenovelformulae,alongwithseveralalgorithmictricksthathelpedtosignicantlyreducetheirpracticalcost.Furthermore,were-portaPython-3implementationofmultipleinstantiationsofCSIDHandB-SIDHusingacombinationofthenovelformulaeandanadaptationoftheoptimalstrategiescommonlyusedintheSIDH/SIKEprotocols.ComparedtoatraditionalVéluconstant-timeimplementationofCSIDH,ourexperimentalresultsreportasavingof5.357%,13.68%and25.938%baseeldoperationsforCSIDH-512,CSIDH-1024,andCSIDH-1792,re-spectively.Additionally,therstimplementationoftheB-SIDHschemeintheopenliteratureisreportedhere.1IntroductionIsogeny-basedcryptographywasindependentlyintroducedbyCouveignes[15],RostovtsevandStolbunovin[30,32].Sincethen,aneverincreasingnumberofisogeny-basedkey-exchangeprotocolshavebeenproposed.Aselectionofthoseprotocols,especiallyrelevantforthiswork,arebrieysummarizedbelow.WorkingwithsupersingularellipticcurvesdenedovertheniteeldFp2,withpaprime,theSupersingularIsogeny-basedDie-Hellmankeyexchangeprotocol(SIDH)waspresentedbyJaoanddeFeoin[20](seealso[16]).In2017,theSupersingularIsogenyKeyEncapsulation(SIKE)protocol,aSIDHdescen-dent,wassubmittedtotheNISTpost-quantumcryptographystandardizationproject[2].NISTrecentlyannouncedthatSIKEpassedtotheround3ofthiscontestasanalternati

2 vecandidate. In2018,thecommutativeg
vecandidate. In2018,thecommutativegroupactionprotocolCSIDHwasintroducedbyCastryck,Lange,Martindale,PannyandRenesin[8].Operatingwithsupersin-gularellipticcurvesdenedoverFp;CSIDHisasignicantlyfasterversionoftheCouveignes-Rostovtsev-Stolbunovschemevariantasitwaspresentedin[17].Later,in2019,CostelloproposedavariantofSIDHnamedB-SIDH[12].InB-SIDH,Alicecomputesisogeniesfroma(p+1)-torsionsupersingularcurvesubgroup,whereasBobhastooperateonthe(p�1)-torsionsubgroupofthequadratictwistofthatcurve.AremarkablefeatureofB-SIDHisthatitcanachievesimilarclassicalandquantumsecuritylevelsasSIDH,butusingsigni-cantlysmallerpublic/privatekeysizes.Onthedownside,atthetimeofwriting,therehasbeennoreportedimplementationofB-SIDHhighlightinganypotentialbenetofitsshorterkeyoveritspredecessors.Thesinglemostimportantchal-lengeintheimplementationofB-SIDHisthehighcomputationalcostassociatedtothelargedegreeisogeniesinvolvedinitsexecution.Let`beanoddprimenumber,Kaniteeldoflargecharacteristic,andAaMontgomerycoecientofanellipticcurveE:y2=x3+Ax2+x.Givenanorder-`pointP2E(K),theconstructionofanisogeny:E7!E0ofkernelhPianditsevaluationatapointQ2E(K)nhPiconsistofthecomputationoftheMontgomerycoecientA02KofthecodomaincurveE0:y2=x3+A0x2+xandtheimagepoint(Q),respectively.Generallyspeaking,performingisogenymapconstructionsandevaluationsarethemostexpensivecomputationaltasksofanyisogeny-basedprotocol.ThisisespeciallytrueforCSIDHandB-SIDH,where[extremely]largeoddprimedegree-`isogeniescomeintoplay.Fordecadesnow,Vélu'sformulae(cf.[21,Ÿ2.4]and[33,Theorem12.16])hasbeenwidelyusedtoconstructandevaluatedegree-`isogenies.Withtheintroductionofseveralellipticcurvearithmetictricks[25,13,9],itturnsoutthatVélu'sformulaerequireabout6`eldmultiplicationsforthecombinedisogenyconstructionandevaluationprocedures(cf.Ÿ2).Recently,Bernstein,deFeo,LerouxandSmithpresentedin[4]anewap-proachforconstructingandevaluatingdegree-`isogeniesatacombinedcostofjust~O(p `)eldoperations.Thisimprovementwasobtainedbyobservingt

3 hatthepolynomialproductembeddedintheisog
hatthepolynomialproductembeddedintheisogenycomputationscanbespeedupviaababy-stepgiant-stepmethod[4,Algorithm2].Duetoitssquarerootcom-plexityreduction(uptopolylogarithmfactors),intheremainderofthispaper,wewillrefertothisimprovementofVélu'sformulaecomputationaspélu'sfor-mulaeorsimplypélu.Aswewillseeinthispaper,andasitwasalreadyhintedin[4],péluhasahighimpactontheperformanceofCSIDH,andquiteespeciallyonB-SIDH.Bywayofillustration,considerthecombinedcostofconstructingandevaluatingdegree-`isogeniesfor`=587;whichcorrespondstoanexamplehighlightedin[4,AppendixA.3].4Forthatdegree`;theauthorsreportacostofjust22963:898(`+2)eldmultiplicationsandsquaringoperations.Thishasto 4Notethat`=587isthelargestprimefactorofp+1 4;wherepistheprimeusedinthepopularCSIDH-512instantiationoftheCSIDHisogeny-basedprotocol. becomparedwiththecostofaclassicalVéluapproachthatwouldtakesome35446:017(`+2)multiplications.Inspiteofthegroundbreakingresultannouncedin[4],alongwiththehighperformanceachievedbyitscompanionsoftwarelibrary,theauthorsdidnotfocusonprovidingapracticalcostanalysisoftheirapproachbutrather,theycenteredonitsasymptoticalanalysis.Moreover,anapplicationoftheirfastpélureportedarathermodest1%and8%speedupoverthetraditionalVélu'sformulaeappliedtothenonconstant-timeimplementationoftheCSIDHinstan-tiations,CSIDH-512andCSIDH-1024.Furthermore,theauthorsof[4]leftopentheproblemofassessingthepracticalimpactofpéluonCSIDHandB-SIDHconstant-timeimplementations.Contributions.Wepresentaconcreteanalysisofpélu,fromwhichweconcludethatforvirtuallyallpracticalscenarios,thebestapproachforperformingthepolynomialproductsassociatedtotheisogenyarithmeticisachievedbynothingmorethancarefullytailoredKaratsubapolynomialmultiplications.Themainpracticalconsequenceofthisobservationisthatcomputingdegree-`isogenieswithpéluhasaconcretecomputationalcostclosertoO(blog2(3));whereb=p `.Wealsopresentseveraltricksthatpermittosavemultiplicationswhenperform-ingtheproductsinvolvingthepolynomialsEJ0andEJ1(cf.Ÿ4).Additionally,weexploitthefactthatforcomputingxE

4 VAL,thepolynomialsEJ0andEJ1aretherecipro
VAL,thepolynomialsEJ0andEJ1arethereciprocalofeachother.Theseobservationshelpustoconstructandevaluateadegree-587isogenyusingonly2180M3:701(`+2):Thisisabout5.3%cheaperthanthesamecomputationannouncedin[4].Thisimprovementalsopushesto`=89thelimitwherecomputingdegree-`isogenieswithpélubecomesmoreeectivethantraditionalVélu.Inanutshell,ourmainpracticalcontributionscanbesummarizedasfollows:1.Wereporttherstconstant-timeimplementationoftheprotocolB-SIDHintroducedin[12].Usingtheframeworkof[10],optimalstrategiesàlaSIDHareappliedtoB-SIDHwhilealsotakingadvantageofpélu.Asexpected,andhintedin[4],theexperimentalresultsforB-SIDHshowasavingofupto75%comparedwithanimplementationofthisprotocolusingtraditionalVélu'sformulae.2.Weusedtheframeworkpresentedin[10]toapplyoptimalstrategiesàlaSIDHtoCSIDHwhileexploitingpélu.Thisallowsustopresenttherstapplicationofpélutoconstant-timeimplementationsofitsCSIDH-512,CSIDH-1024,andCSIDH-1792instantiations.AcomparisonwithrespecttoCSIDHusingVélu'straditionalformulae,reportssavingsof5.357%,13.68%and25.938%eldFp-operationsforCSIDH-512,CSIDH-1024,andCSIDH-1792,respectively.3.Wedemonstratethatthecomputationalcostofcomputingdegree-`isogeniesinpracticeusingpéluisofO(p `)log23eldoperations.Oursoftwarelibraryisfreelyavailableathttps://github.com/JJChiDguez/velusqrt. Outline.Theremainderofthispaperisorganizedasfollows.InŸ2,traditionalVélu'sformulaearedescribed.AcompactdescriptionoftheB-SIDHandCSIDHprotocolsisalsogiven.InŸ3,webrieydiscusstheapplicationofoptimalstrate-giestoCSIDHandB-SIDH.InŸ4,anexplicitdescriptionofpélu'smainbuildingblocksKPS,xEVAL,andxISOGispresented.Inaddition,wediscussseveralpélu'salgorithmicimprovementsinŸ4.2.TheexperimentalresultsobtainedfromoursoftwarelibraryarereportedanddiscussedinŸ5.WecoverCSIDHandB-SIDHinŸ5.1andŸ5.2,respectively.Finally,ourconcludingremarksaredrawninŸ6.Notation.M,S,andadenotethecostofcomputingasinglemultiplication,squaring,andaddition(orsubtraction)intheprimeeldFp,respectively.2

5 BackgroundThevastmajorityofthefastestiso
BackgroundThevastmajorityofthefastestisogeny-basedconstant-timeprotocolimplemen-tations,haveadoptedMontgomeryandtwistedEdwardscurvemodelsfortheirschemes.AMontgomerycurve[24]isdenedbytheequationEA;B:By2=x3+Ax2+x,suchthatB6=0andA26=4:Forthesakeofsimplicity,wewillwriteEAforEA;1andwillalwaysconsiderB=1:Moreover,itiscustomarytorepresenttheconstantAintheprojectivespaceP1as(A0:C0);suchthatA=A0=C0(see[14]).Letq=pn;wherepisanoddprimenumberandnapositiveinteger.Let`beanoddnumber`=2k+1;withd1:Also,letEandE0betwosupersingularellipticcurvesdenedoverFq;forwhichthereexistsacyclicdegree-`isogeny:E!E0denedoverFq:Thisimpliesthattheremustexistan`-orderpointP2E(Fq)suchthatKer()=hPi:GiventhedomainellipticcurveEandan`-orderpointP2E(Fq);weareinterestedintheproblemofcomputingtheco-domainellipticcurveE0:GivenapointQ2E(Fq)suchthatQ62Ker();wearealsointerestedintheproblemofnding(Q);i.e.,theimageofthepointQoverE0:Inthispaperthesetwotasksarenamedisogenyconstructionandisogenyevaluationcomputations,respectively.Vélu'sformula(see[21,Ÿ2.4]and[33,Theorem12.16]),hasbeengenerallyusedtoconstructandevaluatedegree-`isogeniesbyperformingthreemainbuild-ingblocks,namely,KPS,xISOGandxEVAL.TheblockKPScomputestherstkmultiplesofthepointP,namely,thesetfP;[2]P;:::;[k]Pg:UsingKPSasasortofpre-computationancillarymodule,xISOGndstheconstants(A0:C0)2Fqthatdeterminetheco-domaincurveE0:Also,usingKPSasabuildingblock,xEVALcalculatestheimagepoint(Q)2E0:Afterapplyinganumberofellipticcurvearithmetictricks[25,13,9],thecom-putationalexpensesofKPS,xISOGandxEVALhavebeenfoundtobeabout3`;`and2`multiplications,respectively.Thisgivesanoverallcostofabout6`mul-tiplicationsforthecombinedcostoftheisogenyconstructionandevaluationtasks.InŸ4,specicdetailsofhowthepéluapproachof[4]drasticallyreducesthecostsoftraditionalVélu'sformulaearediscussed.Intheremainderofthissection,webrieydiscussthetwoisogeny-basedprotocolsimplementedinthispaper,namely,CSIDHandB-SIDH. 2.1OverviewingtheC-SIDHHere,wegiveasimpliedde

6 scriptionofCSIDH.Formoretechnicaldetails
scriptionofCSIDH.Formoretechnicaldetails,theinterestedreaderisreferredto[8,9,22,27].CSIDHisanisogeny-basedprotocolthatcanbeusedforkeyexchangeandencapsulation[8],andothermoreadvancedprotocolsandprimitives.Figure1showshowCSIDHcanbeexecutedanalogouslytoDieHellman,toproduceasharedsecretbetweenAliceandBob.Remarkably,theellipticcurvesEbaandEabcomputedbyAliceandBobattheendoftheprotocolareoneandthesame. Fig.1:CSIDHkey-exchangeprotocolCSIDHworksoveraniteeldFp,wherepisaprimeoftheformp=4nYi=1`i�1with`1;:::;`nasetofsmalloddprimes.Forexample,theoriginalCSIDHarticle[8]deneda511-bitpwith`1;:::;`n�1therst73oddprimes,and`n=587.ThisinstantiationiscommonlyknownasCSIDH-512.ThesetofpublickeysinCSIDHisasubsetofallsupersingularellipticcurvesinMontgomeryform,y2=x3+Ax2+x;denedoverFp.SincetheCSIDHbasecurveEissupersingular,itfollowsthat#E(Fp)=(p+1)=4Qni=1`i.Additionally,let:(x;y)7!(xp;yp)betheFrobeniusmapandN2Zbeapositiveinteger.Then,E[N]=fP2E(Fp):[N]P=OgdenotestheN-torsionsubgroupofE=Fp.Similarly,E[�1]=fP2E(Fp):(�1)P=OgandE[+1]=fP2E(Fp2):(+1)P=OgdenotethesubgroupsofFp-rationalandzero-tracepoints,respectively.Inparticular,anypointP2E[+1]isoftheform(x;iy)wherex;y2Fpandi=p �1sothatip=�i:TheinputtotheCSIDHclassgroupactionalgorithmisanellipticcurveE:y2=x3+Ax2+x,representedbyitsA-coecient,andanidealclass a=Qni=1leii;representedbyitslistofexponents(ei;:::;en)2J�m::mKn.Theoutput,forAlice(SeeFigure1),istheA-coecientoftheellipticcurveEAdenedas,EA=aE=le11lennE:(1)Forthesakeofsimplicity,letusassumethatthesecretintegervectore=(e1;:::;en)isdrawnfromtheintervalei2J0::mK.Letn�jbeadegree-`n�jisogenydenedas,n�j:Ej7!E(j+1)modn;forj=0;:::;n�1.Then,theCSIDHgroupactionofEquation1canbecomputedasfollows.Atthebeginningofthegroupactionevaluation,onlythebaseellipticcurveE0=Eandthesecretintegervectore=(e1;:::;en)areknown.WethenproceedbyndingafulltorsionpointT2En[�1](ideally)withorderp+1 4=Qi`i.5There

7 after,forj=0;:::;n�1,asubgroupkernelg
after,forj=0;:::;n�1,asubgroupkernelgeneratorGjiscomputed,andthenthecodomainofthecorrespondingdegree-`n�jisogenyn�jandtheimagepointn�j(T)arefound.ToobtainGj,thepointTmustbedescendedbyperformingascalarmultiplicationwiththerstn�1�jprimefactorsofp+1.Forexample,forj=0;thepointG0=hQn�1i=1`iiTiscomputed.IfG0isnite,thenithastohaveorder`nandcanbeusedtogeneratethekernelofthedegree-`nisogeny`n:Rightafter,thekernelsubgrouphGji KPS(Gj);theimagecurveE0=xISOG(Ej;`n�j;hGji)andtheimagepointT0=n�j(T)=xEVAL(T;hGji)canallthreeofthembecalculated.Itbecomesnowpossibletoupdatethetuple(Ej;T;en�j)as,(E(j+1)modn;T;en�j�1) ((E0;T0;en�j�1)ifen�j6=0;(Ej;[`n�j]T;en�j�1)otherwise,anden�j maxf0;en�j�1g.Oncethatallthensecretexponentsejhavebeenprocessed,theconstantsdeningtheellipticcurveE0areusedtondanewfullorderpointT2E0;restartingtheproceduredescribedaboveuntilexactlymevaluationsareper-formedforallthesecretexponents.ThiscompletestheCSIDHgroupactioncomputation.Aconstant-timeprocedurethatperformsthejustdescribedidealizedstrat-egyforcomputingthegroupactionofEquation1isshowninAlgorithm4ofsectionA.Thecomputationalcostofthegroupactionisdominatedbythecalculationofndegree-`iisogenyevaluationsandconstructionsplusatotalofn(n+1) 2scalarmultiplicationsbytheprimefactors`i;fori=1;:::;n:Asimilarmultiplication-basedapproachforcomputingthegroupactionalgorithmwasproposedintheoriginalCSIDHprotocolof[8].Itwasrststatedin[5,Ÿ8](seealso[19])thatthismultiplication-basedprocedurecouldpossiblybeimprovedbyadaptingto 5Inpracticethecomputationalcostrequiredforndingafull-torsionpointistooexpensive.Therefore,thisconditionisrelaxedtoworkwithpointswhoseorderdoesnotnecessarilyincludealltheprimefactorsofp+1.ThisleadstoextraremedystepsnotshowninAlgorithm4. CSIDH,theSIDHoptimalstrategyapproachintroducedbydeFeo,JaoandPlûtin[16].WebrieydiscussabouttheroleofoptimalstrategiesforlargeinstancesofCSIDHinŸ3,wheretheapproachpresentedin[10]wasadopted.2.2Playingthe

8 B-SIDHIntheB-SIDHprotocolproposedbyCoste
B-SIDHIntheB-SIDHprotocolproposedbyCostelloin[12],AliceandBobworkinthe(p+1)-and(p�1)-torsionofasetofsupersingularcurvesdenedoverFp2andthesetoftheirquadratictwist,respectively.B-SIDHiseectivelytwist-agnosticbecauseoptimizedisogenyandMontgomeryarithmeticonlyrequirethex-coordinateofthepointsalongwiththeAcoecientofthecurve.6ThisfeatureimpliesthatB-SIDHcanbeexecutedentirelyàlaSIDHasshowninFigure2.7Moreconcretely,letE:By2=x3+Ax2+xdenoteasupersingularMont-gomerycurvedenedoverFp2;sothat#E(Fp2)=(p+1)2;andletEt=Fp2de-notethequadratictwistofE=Fp2.Then,Et=Fp2canbemodeledas,( B)y2=x3+Ax2+x,where 2Fp2isanon-squareelementand#E(Fp2)=(p�1)2:Noticethattheisomorphismconnectingthesetwocurvesisdeterminedbythemap:(x;y)7!(x;jy)withj2= (see[12,Ÿ3]).Hence,foranyFp2-rationalpointP=(x;y)onEt=Fp2itfollowsthatQ=(P)=(x;jy)isanFp4-rationalpointonE,suchthatQ+2(Q)=O.Here:(x;y)7!(xp;yp)istheFrobeniusendomorphism.ThisimpliesthatQisazero-traceFp4-rationalpointonE=Fp2.B-SIDHcanthusbeseenasareminiscentoftheCSIDHprotocol[8],wherethequadratictwistisexploitedtoperformthecomputationsusingrationalandzero-tracepointswithcoordinatesinFp2:AlthoughB-SIDHallowstoworkoversmallereldsthaneitherSIDHorCSIDH,itrequiresthecomputationofcon-siderablylargerdegree-`isogenies.AsillustratedinFigure2,B-SIDHcanbeexecutedanalogouslytothemainowoftheSIDHprotocol.B-SIDHpublicparameterscorrespondtoasupersin-gularMontgomerycurveE=Fp2:By2=x3+Ax2+xwith#E(Fp2)=(p+1)2,tworationalpointsPaandQaonE=Fp2,andtwozero-traceFp4-rationalpointsPbandQbonE=Fp2suchthatPaandQaaretwoindependentorder-MpointswithMj(p+1),gcd(M;2)=2,andM 2Qa=(0;0);PbandQbaretwoindependentorder-NpointswithNj(p�1)andgcd(N;2)=1.Inpractice,B-SIDHisimplementedusingprojectivizedx-coordinatepoints,andthusthepointdierencesPQa=Pa�QaandPQb=Pb�Qbmustalsoberecorded.Sincethex-coordinatesofPa;Qa;PQa;Pb;QbandPQb;allbelongto 6Foreciencypurposes,inpracticeboth,thex-coordinateofthepointsandtheconstantAofthecurve,areprojectivizedtotwocoordina

9 tes.7Althoughweomitherethespecicsof
tes.7AlthoughweomitherethespecicsoftheoperationsdepictedinFigure2,theyarecompletelyanalogustotheonescorrespondingtoSIDH,aprotocolthatiscarefullydiscussedinmanypaperssuchas[16,14,1]. Fp2,aB-SIDHimplementationmustperformeldarithmeticonthatquadraticextensioneld. Fig.2:B-SIDHprotocolforaprimepsuchthatMj(p+1)andNj(p�1):AsinthecaseofSIDH,theprotocolowofB-SIDHmustperformtwomainphases,namely,keygenerationandsecretsharing.Inthekeygenerationphase,theevaluationoftheprojectivizedx-coordinatepointsx(P),x(Q)andx(P�Q)isrequired.ThusforB-SIDH,secretsharingissignicantlycheaperthankeygeneration.WebrieydiscusstheroleofoptimalstrategiesforlargeinstancesofB-SIDHinthenextsection.3OptimalstrategiesfortheCSIDHandtheB-SIDHIn[16],optimalstrategieswereintroducedtoecientlycomputedegree-`eiso-geniesatacostofapproximatelye 2log2escalarmultiplicationsby`,e 2log2edegree-`isogenyevaluations,andeconstructionsofdegree-`isogenouscurves.Optimalstrategiescanbeobtainedusingdynamicprogramming(see[2,10]forconcretealgorithms).InthecontextofSIDH,optimalstrategiestendtobalancethenumberofisogenyevaluationsandscalarmultiplicationstoO(elog(e)):However,CSIDHoptimalstrategiesareexpectedtobelargelymultiplicative,i.e.,optimalstrate-gieswilltendtofavorthecomputationofmorescalarmultiplications.Thisisduetothefactthattheseoperationsarecheaperthanlargeprimedegree`isogenyevaluations.LetL=[`1;`2;:::;`74]bethelistofsmalloddprimenumberssuchthatp=4Qni=1`i�1istheprimenumberusedinCSIDH.Inthisworkweadopttheframeworkpresentedin[10],wheretheauthorsheuristicallyassumedthat anarrangementofthesetLfromthesmallesttothelargest`i;isclosetotheglobaloptimal.Forthisxedordering,itwaspresentedin[10]aprocedurethatndsanoptimalstrategywithcubiccomplexitywithrespectton:SimilarlytoSIDH[16],optimalstrategiescanbeusedtoimprovetheperfor-manceofB-SIDH,whichrequirestheconstruction/evaluationofisogenieswhosedegreesarepowersoflargeoddprimes.In[19,10],optimalstrategieswereap-pliedtothecontextofCSIDH.Inthisworkweadoptedtheframeworkproposedin[10],

10 whichpermitsanintuitiveandeasyintegratio
whichpermitsanintuitiveandeasyintegrationofoptimalstrategiestoB-SIDH.Letusassumethatweneedtoconstructadegree-LisogenywithL=`1e1`2e2`nen,andletuswriteL0=[`1;:::;`1| {z }e1;`2;:::;`2| {z }e2;:::;`n;:::;`n| {z }en]:(2)Then,anstrategyforL0canbeusedtoperformthekeygenerationorsecretsharingmainphasesofB-SIDH.Inparticular,anystrategyforB-SIDHcanalsobeencodedasinSIDHandCSIDHprotocols,i.e.,byalistofe�1positiveinte-gerswheree=Pni=1ei:AnysuchstrategycanbeevaluatedfromtheprocedureshowninAlgorithm5.AsinSIDH[16]andCSIDH[10],optimalstrategiesarefoundbymeansofadynamic-programmingprocedure.Theevaluationofstrate-giesforB-SIDHcanbeseenasanhybridbetweenSIDHandCSIDH.Ontheonehand,B-SIDHsharesthesameprotocolowwithSIDH.Ontheotherhand,B-SIDHmustconstruct/evaluatemultipleisogenieswithdegreesofpowersoflargeoddprimesasinCSIDH.4ThenewVéluformulaeThissectionpresentsinmoredetailsthepélualgorithmswhenappliedtoisogeny-basedcryptography.Severalalgorithmictricksthatslightlyimprovetheperformanceofpéluasitwaspresentedin[4]aregiven.LetEA=FqbeanellipticcurvedenedinMontgomeryformbytheequationy2=x3+Ax2+x,withA26=4.LetPbeapointonEAofoddprimeorder`,and:EA!EA0aseparableisogenyofkernelG=hPiandcodomainEA0=Fq:y2=x3+A0x2+x.OurmaintaskhereistocomputeA0andthex-coordinatex( )of(Q),forarationalpointQ=( ; )2EA(Fq)nG.Asmentionedin[4](seealso[13],[23]and[26]),thefollowingformulaeallowtoaccomplishthistask,A0=21+d 1�dandx( )=X`hS(1= )2 hS( )2;whered=A�2 A+2`hS(1) hS(�1)8;S=f1;3;:::;`�2g;andhS(X)=Ys2S(X�x([s]P)): Fromthis,onecanseethattheeciencyofcomputingA0andx( )liesonthatofcomputinghS(X).Thisiswherepélucomesintoplay,withababy-stepgiant-stepstrategypermittingasquarerootspeedupoverthetraditionalVélu'sformulae.4.1ConstructionandevaluationofodddegreeisogeniesAsinsection2,weconsiderthethreebuildingblocksKPS,xISOG,xEVAL,whereKPSconsistsofcomputingalltherequiredx-coordinatesofpointsinthekernelG,xISOGisthecomputationofthecodomaincoecientA0,andxEV

11 ALperformsthecomputationofx( ).
ALperformsthecomputationofx( ).Whilethex-coordinatesof(#S=(`�1)=2)pointsinGarecomputedinKPSinthetraditionalVélualgorithm,withthenewformulaein[4]onlythex-coordinatesofpointsofGwithindicesinthreesubsetsofS,eachofsizeO(p `),arecomputed.DenotebyI,JandKthosesubsetsofS.Then,IandJarechosensuchthatthemapsIJ!Sdenedby(i;j)7!i+jand(i;j)7!i�jareinjectiveandtheirimagesI+J,I�Jaredisjoint.Wecall(I;J)anindexsystemforSandwriteIJfor(I+J)\(I�J).TheremainingindicesofSaregatheredinK=Sn(IJ).Algorithm1statestherequiredKPScomputations. Algorithm1KPS Require:AnellipticcurveEA=Fq;P2EA(Fq)oforderanoddprime`:Ensure:I=fx([i]P)ji2Ig,J=fx([j]P)jj2Jg,andK=fx([k]P)jk2Kgsuchthat(I;J)isanindexsystemforS,andK=Sn(IJ)1:b bp `�1=2c;b0 b(`�1)=4bc2:I f2b(2i+1)j0ib0g3:J f2j+1j0jbg4:K Sn(IJ)5:I fx([i]P)ji2Ig6:J fx([j]P)jj2Jg7:K fx([k]P)jk2Kg8:returnI;J;K FortheexecutionofxISOGandxEVAL,weneedtodenethefollowingbi-quadraticpolynomials:F0(Z;X)=Z2�2XZ+X2;F1(Z;X)=�2(XZ2+(X2+2AX+1)Z+X);F0(Z;X)=X2Z2�2XZ+1:Theexistenceofthesepolynomialsisacornerstoneofthepéluformulae.Indeed,theyprovideawayaroundtothenon-homomorphicityofthex-coordinatemaponellipticcurvepoints.Wereferto[4]and[7,p.132]formoredetails. LetResZ(f(Z);g(Z))denotetheresultantoftwopolynomialsf;g2Fq[Z].WearenowreadytooutlinexISOGandxEVALinAlgorithm2andAlgo-rithm3,respectively.DerivingtheresultantsinAlgorithm2andAlgorithm3mayturnouttobeacumbersometaskifitisnotcarriedoutinanelaboratedway.Forpolynomialsf=aQ0i(Z�xi)andginFq[Z],theirresultantRes(f;g)=anQ0ig(xi)canbecomputedecientlywhenthefactorizationoffisknown,whichisexactlythecaseinthealgorithmsathand.Employingaremaindertreeapproach(anequivalentalternativebeingcontinuedfractions),oneevaluatesthefactorsg(xi)bycomputinggmod(Z�xi),0in,totaketheirproductafterwards.Oneconsiderableadvantageofusingremaindertreeshereisthatthesub-jacentproducttreeofthe(Z�xi)canbesharedamongalltheresultantsinAlgorithm2andAlgorithm3,sincetheselinearpolynomialsdependonlyonthekernelhPi

12 . Algorithm2ComputingxISOG Require:Anell
. Algorithm2ComputingxISOG Require:AnellipticcurveEA=Fq:y2=x3+Ax2+x;P2EA(Fq)oforderanoddprime`;I;J;KfromKPS.Ensure:A02FqsuchthatEA0=Fq:y2=x3+A0x2+xistheimagecurveofaseparableisogenywithkernelhPi.1:hI Qxi2I(Z�xi))2Fq[Z]2:E0;J Qxj2J(F0(Z;xj)+F1(Z;xj)+F2(Z;xj))2Fq[Z]3:E1;J Qxj2J(F0(Z;xj)�F1(Z;xj)+F2(Z;xj))2Fq[Z]4:R0 ResZ(hI;E0;J)2Fq5:R1 ResZ(hI;E1;J)2Fq6:M0 Qxk2K(1�xk)2Fq7:M1 Qxk2K(�1�xk)2Fq8:d A�2 A+2`M0R0 M1R189:return21+d 1�d NoticethatthesinglemostimportanthighleveloperationispolynomialmultiplicationontheringFq[X]:Thus,asdeemedin[4],itisessentialtoutilizefasttailor-madepolynomialmultiplicationalgorithms,becauseinmanyplacesonlyasegmentoftheoutputproductisneeded.CertainlytheresultantResZ(f(Z);g(Z))oftwopolynomialsf;g2Fq[Z]canbecomputedwithanasymptoticruntimecomplexityof~O(n)byusingafastpolynomialmultiplica-tion,whereherefastmeansthatitrequiresO(nlog2(n))eldmultiplications(see[3,p.7,Ÿ3]).Nevertheless,therequireddegreepolynomialsforthecaseofCSIDHandevenB-SIDH,aresucientlysmallforkaratsubapolynomialmultiplication(oranyofitsvariantslikeToom-Cook),emergesasamoreecientsolution.Forexample,accordingtotheimplementationof[4],`=587requirespolynomialsofdegree#I=16and2#J=18(intheB-SIDHcase,#I;#J150).It Algorithm3ComputingxEVAL Require:AnellipticcurveEA=Fq:y2=x3+Ax2+x;P2EA(Fq)oforderanoddprime`;thex-coordinate 6=0ofapointQ2EA(Fq)nhPi;I,J,KfromKPS.Ensure:Thex-coordinateof(Q),whereisaseparableisogenyofkernelhPi.1:hI Qxi2I(Z�xi))2Fq[Z]2:E0;J Qxj2J�F0(Z;xj)= 2+F1(Z;xj)= +F2(Z;xj)2Fq[Z]3:E1;J Qxj2J�F0(Z;xj) 2+F1(Z;xj) +F2(Z;xj)2Fq[Z]4:R0 ResZ(hI;E0;J)2Fq5:R1 ResZ(hI;E1;J)2Fq6:M0 Qxk2K(1= �xk)2Fq7:M1 Qxk2K( �xk)2Fq8:return(M0R0)2=(M1R1)2 canbeeasilyveriedthatKaratsubapolynomialmultiplicationbecomesamoreecientchoice(seeAppendixB).4.2ImplementationspeedupsInthissectionwereportafewalgorithmictechniquesthatareexploitedinourimplementationtoobtainsomemodestbutnoticeablysavingsover[4].Ourrstre

13 ;nementaectsxEVAL,andarisesfromthes
;nementaectsxEVAL,andarisesfromthespecialshapeofthebiquadraticpolynomialsF0,F1,F2.Infact,withrespecttoeithervariable,onecanseethatF1issymmetricandF0issymmetrictoF28,thatis,F1=1=Z2F1(1=Z;X)andF2=1=Z2F0(1=Z;X),consideringtherstvariableforexample.Now,usingaprojectiverepresentationofthex-coordinate =x=zinxEVAL,wecanwriteaquadraticpolynomialfactorinE0;JandaquadraticpolynomialfactorinE1;JrespectivelyasE0;j=1=x2�F0(Z;xj)z2+F1(Z;xj)xz+F2(Z;xj)x2;E1;j=1=z2�F0(Z;xj)x2+F1(Z;xj)xz+F2(Z;xj)z2:Thus,itbecomesclearthatthepolynomialsx2#JE0;Jandz2#JE1;Jaresym-metrictooneanother,allowingtosavethecomputationofoneofthetwoprod-uctsE0;J,E1;J.Thisgivesusanexpectedsavingof#Jlog2(#J)polynomialmultiplicationsviaproducttrees.OurnextimprovementisfocusedonthecomputationofE0;jrequiredinxEVAL.Letuswritexj=Xj=Zj:Then,�F0(Z;xj)z2+F1(Z;xj)xz+F2(Z;xj)x2 8Consequently,allthequadraticfactorsofE0;JandE1;JinxISOGaresymmetric.Bernsteinetal.[4,AppendixA.5]wereawareofthisfactandtookadvantageofittospeedupthecomputationofE0;J,E1;J: (a)Runningtime (b)AsymptoticconstantFig.3:MeasuredandexpectedrunningtimeofKPS+xISOG+xEVALforallthe207smalloddprimes`irequiredinthegroupactionevaluationofCSIDH-1792(see[10]).AllcomputationalcostsaregiveninFp-multiplications.TheexpectedrunningtimecorrespondstoCost(b)withb=p (`�1) 2.canbeexpressedasaZ2+bZ+c;wherea=C(xZj�zXj)2;2b=C(X2+Z2)(�4XjZj)�2(X2j+Z2j)�2[C(XZ)]+�2[A0(XZ)](�4XjZj);c=(C(xXj�zZj)2:Infact,thethreeequationsabove,canbeimplemented(withthehelpofsomeextrapre-computationsrequiredinxISOG)atacostof7M+3S+12aeldoperations.Thiscostshouldbecomparedwiththeimplementationof[4],whichrequires11M+2S+13aeldoperations.AssumingM=S;thisimpliesthatourproposedformulaesaves3eldmultiplicationsperpolynomialE0;j,0j#J.Letusnowillustratetheimprovementsjustdescribedappliedtotheexample`=587:Letusrecallthatintheimplementationof[4],wehave#I=1

14 6and#J=9.Consequently,ourrstimprove
6and#J=9.Consequently,ourrstimprovementsaves9log2(9)28polynomialmultiplicationsviaproducttrees.Ontheotherhand,oursecondimprovementsaves3#J=39=27eldmultiplications. 4.3PracticalcomplexityanalysisInthissection,thecomputationalcostassociatedtothecombinedevaluationoftheKPS,xISOG,andxEVALproceduresisderived.9FirstnotethatKPS(seeAlgorithm1),canbeperformedatacostofabout3bdierentialpointadditions(assuming#I#J#Kb),whichimpliesanexpenseofatmost(18b)Meldmultiplications.Hereb=bp `�1 2casgiveninStep1ofAlgorithm1.ObservealsothatthecomputationofthepolynomialhI(Z)requiredatStep1ofboth,xISOG(Algorithm2)andxEVAL(Algorithm3)procedures,canbesharedandthusmustbecomputedonlyonce.Oneinterestingobservationof[4],isthatthecomputationofthepolynomialsE0;JandE1;JinxISOG(seeSteps2-3ofAlgorithm2),canbeperformedatacostofonlyoneproducttreeproce-dure.Furthermore,asitwasalreadydiscussedinsubsection4.2,thissametrickcanalsobeappliedtoxEVAL,i.e.,Steps2-3ofAlgorithm3canbecalculatedbyexecutingonlyoneproducttree.Hence,eachpolynomialEi;J,i=0;1,re-quiredbyxISOGandxEVALcanbeobtainedatacostof(3b)Mand(10b)Meldoperations,respectively.Additionally,inSteps4-5ofxISOGandxEVAL,thecomputationoftwore-sultantsarerequired,implyingthatfourresultantsmustbecomputedintotal.EachResultantcorrespondstothecomputationofResZ(f(Z);g(Z))suchthatf;g2Fq[Z],degf=b0banddegg=2b.AdetaileddescriptionofthecostofcomputingsucharesultantintermsofbbymeansofcomputingtheleavesofremaindertreesisgiveninAppendixC.InAppendixC,itisshownthatthecomplexityintermsofeldoperationsassociatedtothecomputationofaresultantasdescribedinŸ4.2isgivenas,R(b)=9blog2(3) 1�22 3log2(b)+1!+2blog2(b):(3)TheconstantsM0andM1inSteps6-7ofxISOGandxEVAL,haveacostof(2b)Mand(4b)Meldoperations,respectively.Lastly,thecomputationsofthecoecientdofxISOGandtheoutputofxEVALrequireabout(3log2(b)+16)multiplications.AllinallandinvokingEquation3,theevaluationofKPS,xISOG,andxEVALprocedureshaveacombinedcostofapproximately,Cost(b)=4 9blog2(3) 1�2&

15 #18;2 3log2(b)+1!+2blog2(b)!(4)+3&#
#18;2 3log2(b)+1!+2blog2(b)!(4)+31�1 3log2(b)+1blog2(3)+37b+3log2(b)+16: 9Inthesequel,pélucomputationalcostsarederivedassumingaprojectivecoordinatesystemandM=S. InordertoverifythecorrectnessofthecostpredictedbyEquation4,theexperimentdescribednextwasimplemented.Wecomputeddegree-`isogeniesforalltheoddprimefactors`1;`2;:::;`207ofp+1;wherepistheprimeusedintheCSIDH-1792instantiationproposedin[10].Figure3showsanexcellentapproximationbetweenthetheoreticalcostofEquation4andtheexperimentalresultsobtainedfromourPython3software,whereitwasobservedthat(measuredruntime)0:97(expectedruntime):RecallthatthederivationoftheexpectedcostofEquation4(SeeAp-pendixC),isdrivenbytheassumptionthatM=S,whichisthetypicalcaseforCSIDH.FortheB-SIDHcaseontheotherhand,sinceoneisworkingonthequadraticextensioneldFp2;itholdsthatM=3MFpandS=2MFp,andthusS=2 3M:However,asanupperbound(fortheB-SIDHcase),wecanassumeM=3MFpandM=S,whichgivesanexpectedrunning-timeof3Cost(b)Fp-multiplications.Amemoryanalysisofpélurevealsthatlessthan4bpoints,equivalentto8beldelements,arecomputedandstoredinKPS.Moreover,thecomputationofthetreesdeterminedbythepolynomialhIinStep1ofxISOGandxEVAL,requiresthestorageofnomorethan3blog2beldelements.10Allinall,pélu'smemorycostisofabout8b+3blog2beldelements.Remarkably,pélu'smemoryrequirementisalwaysmoreeconomicalthantheoneassociatedtotraditionalVélu'sformulae,whereitsKPSprocedurestoresatotalof`�1eldelements.AquickinspectionofAlgorithm1-Algorithm3,revealsthatitisstraightfor-wardtoconcurrentlycomputemanyoftheoperationsrequiredbyallthreeofthoseprocedures.Specically,thecalculationofthefourresultantsinSteps4-5ofAlgorithm2-Algorithm3shownodependenciesamongthemandcanthere-forebecomputedinparallelbyamulti-coreprocessor.Sincethefourresultantcalculationsaccountsforabout85%ofthetotalcomputationalcostofpélu,theexpectedsavingsaresubstantial.5ExperimentsanddiscussionInthissectionwepresentaPython3-codeconstant-timeimplementationoftheB-SIDHandCSIDHprotocols,whichmakeextensiveusag

16 eofthepélu'sformu-laeintroducedin[4]boo
eofthepélu'sformu-laeintroducedin[4]boostedwiththecomputationaltrickspresentedinsection4.Furthermore,theoptimalstrategyframeworkpresentedin[10]isalsoexploitedtomaximizetheperformanceofbothprotocols.Oursoftwarelibraryisfreelyavailableathttps://github.com/JJChiDguez/velusqrt.ThemainaimofourPython3-codesoftwareistobenchmarkthetotalnumberofadditions,multiplications,andsquaringsrequiredbytheinstantiationsof 10Forthiscomputationtworemaindertreesareconstructed,requiringthestorageof2blog2beldelements.Inaddition,therecursivityproceduretobuildthetreesmayrequirestoringintheheapspaceanotherblog2beldelements. thetwoaforementionedprotocols.Tothisend,weincludedcountersinsidetheeldarithmeticfunctioncoresforfp_add(),fp_sub(),fp_mul(),andfp_sqr().Hence,alltheperformancegurespresentedinthissectioncorrespondwithourcountofeldoperationsinthebaseeldFp.InthecaseoftheB-SIDHexperiments,usingstandardarithmetictricksthemultiplicationandsquaringoverFp2wereperformedatthecostof3M+5aand2M+3abaseeldoperations,respectively.Alltheexperimentsperformedinthissectionarecenteredoncomparingthefollowingcongurations,whicharebasedontradicionalVélu'sformuale[13,29]andpélu:UsingthetradicionalVélu'sformulae(labeledastvelu);Usingpélu(labeledassvelu);UsingahybridbetweentraditionalVéluandpélu(labeledashvelu).Noticethatbecauseofthenatureofeachprotocol,theB-SIDHexperimentsarerandomness-free,whichimpliesthatthesamecostisreportedforanygiveninstance.Incontrast,theCSIDHexperimentshaveavariablecostdeterminedbytherandomnessintroducedbytheorderofthetorsionpointssampledfromitsElligator-2procedure(foramoredetailedexplanationsee[9]).5.1ExperimentsontheCSIDHOurPython3-codeimplementationoftheCSIDHprotocolincludesaportableversionforthefollowingCSIDHinstantiations,1.Twotorsionpointwithdummyisogenyconstructions(OAYT-style[27])2.Onetorsionpointwithdummyisogenyconstructions(MCR-style[22])3.Twotorsionpointwithoutdummyisogenyconstructions(Dummy-freestyle[9])Oursoftwaresupportsperformingexperimentswithanyprimeeldofp=2

17 e(Qni=1`i)�1elements,foranye
e(Qni=1`i)�1elements,foranye1:OurexperimentswerefocusedontheCSIDH-512primeproposedin[8],theCSIDH-1024primeproposedin[4],andtheCSIDH-1792primeproposedin[10].TherequirednumberofeldoperationsforthoseCSIDHvariantsarereportedinTable1,Table2,andTable3.Inaddition,eachtablepresentsacomparisonbetweentheresultsofthisworkandtheonespresentedin[10].Itisworthmentioningthatoptimalstrategiesandsuitableboundvectorsaccordingto[10,section3.4,4.4and4.5]wereusedandcomputedforeachconguration.WhencomparingwithrespecttoCSIDHconstant-timeimplementationsus-ingtraditionalVélu'sformulae,ourexperimentalresultsreportasavingof5.357%,13.68%and25.938%eldFp-operationsforCSIDH-512,CSIDH-1024,andCSIDH-1792,respectively.Theseresultsaresomewhatmoreencouragingthantheonesreportedin[4],wherespeedupsofabout1%and8%werere-portedforanonconstant-timeimplementationofCSIDH-512andCSIDH-1024. Conguration Groupactionevaluation M S a Cost Saving(%) tvelu OAYT-style 0.641 0.172 0.610 0.813  MCR-style 0.835 0.231 0.785 1.066 dummy-free 1.246 0.323 1.161 1.569 svelu OAYT-style 0.656 0.178 0.988 0.834 �2.583 MCR-style 0.852 0.219 1.295 1.071 �0.469 dummy-free 1.257 0.324 1.888 1.581 �0.765 hvelu OAYT-style 0.624 0.165 0.893 0.789 2.952 MCR-style 0.805 0.204 1.164 1.009 5.347 dummy-free 1.198 0.301 1.696 1.499 4.461 Table1:Numberofeldoperationfortheconstant-timeCSIDH-512groupactionevaluation.Countsaregiveninmillionsofoperations,averagedover1024randomexperiments.ForcomputingtheCostcolumn,itisassumedthatM=Sandalladditioncountsareignored.LastcolumnlabeledSavingcorrespondsto�1�Cost baseline100andbaselineequalstotveluconguration. Conguration Groupactionevaluation M S a Cost Saving(%) tvelu OAYT-style 0.630 0.152 0.576 0.782  MCR-style 0.775 0.190 0.695 0.965 dummy-free 1.152 0.259 1.012 1.411 svelu OAYT-style 0.566 0.138 0.963 0.704 9.974 MCR-style 0.702 0.152 1.191 0.854 11.503 dummy-free 1.046 0.230 1.746 1.276 9.568 hvelu OAYT-style 0.552 0.133 0.924 0.685 12.404 MCR-style 0.687 0.146 1.148

18 0.833 13.679 dummy-free 1.027 0.221 1.67
0.833 13.679 dummy-free 1.027 0.221 1.679 1.248 11.552 Table2:Numberofeldoperationfortheconstant-timeCSIDH-1024groupactionevaluation.Countsaregiveninmillionsofoperations,averagedover1024randomexperiments.ForcomputingtheCostcolumn,itisassumedthatM=Sandalladditioncountsareignored.LastcolumnlabeledSavingcorrespondsto�1�Cost baseline100andbaselineequalstotveluconguration.5.2ExperimentsplayingtheB-SIDHTothebestofourknowledge,wepresentinthissectiontherstimplementationoftheB-SIDHprotocol,whichwasdesignedtobeaconstant-timeone.AsinthecaseofCSIDH,wereportheretherequirednumberofFparithmeticoperations.SimilarlytoCSIDH,theB-SIDHimplementationprovidedinthiswork,allowstoperformexperimentswithanyprimeeldofpelementssuchthatp3mod4.ThemaincontributionprovidedinthissubsectioncorrespondstoacomparisonofB-SIDHinstantiationsusingtheprimesB-SIDHp253,B-SIDHp255,B-SIDHp247,B-SIDHp237andB-SIDHp257,asdescribedinsectionD.Alltheaboveprimeswerechosenconsideringthefollowingfeatures:i)p3mod4,ii)theisogenydegreesareassmallasitwaspossibletond,andiii) Conguration Groupactionevaluation M S a Cost Saving(%) tvelu OAYT-style 1.385 0.263 1.137 1.648  MCR-style 1.041 0.239 0.911 1.280 dummy-free 1.557 0.327 1.336 1.884 svelu OAYT-style 1.063 0.187 2.073 1.250 24.150 MCR-style 0.807 0.154 1.550 0.961 24.922 dummy-free 1.233 0.247 2.314 1.480 21.444 hvelu OAYT-style 1.060 0.185 2.061 1.245 24.454 MCR-style 0.797 0.151 1.522 0.948 25.938 dummy-free 1.220 0.241 2.272 1.461 22.452 Table3:Numberofeldoperationfortheconstant-timeCSIDH-1792groupactionevaluation.Countsaregiveninmillionsofoperations,averagedover1024randomexperiments.ForcomputingtheCostcolumn,itisassumedthatM=Sandalladditioncountsareignored.LastcolumnlabeledSavingcorrespondsto�1�Cost baseline100andbaselineequalstotveluconguration.2210N;M.OurPython3-codeimplementationusesthedegree-4isogenycon-structionandevaluationformulaegivenin[11].Thecorrespondingexperimentalresultsforthekeygenerationandsecretsharingphasesarepresent

19 edinTable4andTable5,respectively.Itcanbe
edinTable4andTable5,respectively.Itcanbeseenthatsignicantsavingsrangingfrom24%upto76%wereobtainedbyB-SIDHcombinedwithpéluwithrespecttothesameimplementationofthisprotocolusingtraditionalVélu'sformulae.NoticethatthebestresultswereobtainedwhenusingtheB-SIDHp253conguration,whichseemstobefasterthananyCSIDHinstantiation,mostlyduetoitssmall256-biteld.5.3DiscussionTable6presentstheclockcyclecountsforseveralisogeny-basedprotocolsre-centlyreportedintheliterature.Ratherthanprovidingadirectcomparison,themainpurposeofincludingthistablehereisthatofprovidingaperspectiveoftherelativetimingcostsofseveralemblematicimplementationsofisogeny-basedkey-exchangeprimitives.Clearly,péluhasadramaticimpactontheperformanceofB-SIDH,somuchsothatonecanclaimcondentlythatB-SIDHoutperformsanyinstantiationofCSIDH.Forexample,usingtheB-SIDHcongurationpresentedinexample2of[12],AliceandBobwillrequireabout1:620220and1:343220baseeldmultiplicationsinFp;wherepisa256-bitprime,respectively.Inparticular,makingtheconservativeassumptionthata256-biteldmultiplicationtakes40clockcycles,thenakeyexchangeusingB-SIDHwouldcostabout118:520220clockcycles.Ontheotherhand,thefastestCISDH-512groupactionevaluation(see[19,10])takesabout230220clockcycles.Therefore,akeyexchangeusingCSIDHwouldtakeabout920220clockcycles(consideringfourgroupaction Conguration Alice'sside Bob'sside M a Saving(%) M a Saving(%) tvelu B-SIDHp253 4.229 8.731  3.444 7.107  B-SIDHp255 4.254 8.774 2.900 5.984 B-SIDHp247 0.910 1.881 2.295 4.735 B-SIDHp237 0.077 0.164 10.449 21.532 B-SIDHp257 4.281 8.828 0.303 0.630 svelu B-SIDHp253 1.176 4.403 72.192 0.972 3.750 71.777 B-SIDHp255 1.225 4.664 71.204 0.879 3.252 69.690 B-SIDHp247 0.452 1.492 50.330 0.997 3.423 56.558 B-SIDHp237 0.106 0.243 �37.663 2.772 10.684 73.471 B-SIDHp257 1.332 4.933 68.886 0.230 0.665 24.092 hvelu B-SIDHp253 1.158 4.355 72.618 0.953 3.699 72.329 B-SIDHp255 1.223 4.659 71.251 0.867 3.221 70.103 B-SIDHp247 0.442 1.461 51.429 0.995 3.420 56.645 B-SIDHp237 0.077 0.

20 164 00.000 2.770 10.676 73.490 B-SIDHp25
164 00.000 2.770 10.676 73.490 B-SIDHp257 1.321 4.905 69.143 0.217 0.633 28.383 Table4:NumberofbaseeldoperationinFpforthepublickeygenerationphaseofBSIDH.Countsaregiveninmillionsofoperations.ColumnslabeledSavingcorrespondto�1�Cost baseline100andbaselineequalstotveluconguration.evaluations).ThisimpliesthatB-SIDHisexpectedtobeabout8xfasterthanthefastestCSIDH-512C-codeimplementation.Costelloproposedin[12]thatB-SIDHcouldbeusefulforkey-exchangesce-nariosexecutedinthecontextofaclient-serversession.Typically,onecouldexpectthattheclienthasmuchmoreconstrainedcomputationalresourcesthantheserver.InthecasethattheprimeB-SIDHp237ischosenforperformingaB-SIDHkeyexchange,AliceandBobwouldrequireabout0:13220and3:953220baseeldmultiplicationsinFp:Assumingonceagainthata256-biteldmultiplicationtakes40clockcycles,thenakeyexchangeusingB-SIDHwouldcostabout5:20220and158:12220clockcyclesforAliceandBob,respectively.Forcomparison,aSIKEp434keyexchangecostsabout10:73220and12:04220clockcyclesforAliceandBob,respectively.Hence,Alice(theclient)willbenetwithaB-SIDHp237computationthatisabouttwiceasfastastheonerequiredinSIKEp434.ThiswillcomeatthepricethatBob'scompu-tation(theserver)wouldbecomethirteentimesmoreexpensive.Ontheotherhand,theB-SIDHp237keysizesarenoticeablysmallerthantheonesrequiredinSIKEp434.Thisfeatureisespeciallyvaluableforhighlyconstrainedclientdevices.WestressthatthequantumsecurityleveloeredbytheCSIDHinstantiationsreportedinthisworkhavebeenrecentlycallintoquestionin[28,6].Intermsofsecurity,theB-SIDHinstantiationsreportedinthispapershouldachievethesameclassicalandquantumsecuritylevelthanaSIDHinstantiations Conguration Alice'sside Bob'sside M a Saving(%) M a Saving(%) tvelu B-SIDHp253 1.831 3.936  1.529 3.277  B-SIDHp255 1.931 4.127 1.305 2.795 B-SIDHp247 0.434 0.928 1.113 2.372 B-SIDHp237 0.053 0.115 4.872 10.377 B-SIDHp257 1.963 4.190 0.156 0.336 svelu B-SIDHp253 0.472 1.769 74.222 0.400 1.546 73.839 B-SIDHp255 0.505 1.945 73.847 0.370 1.357 71.648 B-SIDH

21 p247 0.208 0.668 52.074 0.450 1.543 59.5
p247 0.208 0.668 52.074 0.450 1.543 59.569 B-SIDHp237 0.068 0.157 �28.302 1.184 4.590 75.698 B-SIDHp257 0.562 2.094 71.370 0.116 0.327 25.641 hvelu B-SIDHp253 0.462 1.741 74.768 0.390 1.517 74.493 B-SIDHp255 0.505 1.943 73.847 0.362 1.338 72.261 B-SIDHp247 0.203 0.653 53.226 0.449 1.541 59.659 B-SIDHp237 0.053 0.115 00.000 1.183 4.585 75.718 B-SIDHp257 0.555 2.077 71.727 0.108 0.306 30.769 Table5:NumberofbaseeldoperationinFpforthesecretsharingphaseofBSIDH.Countsaregiveninmillionsofoperations.ColumnslabeledSavingcorrespondto�1�Cost baseline100andbaselineequalstotveluconguration.Implementation ProtocolInstantiation Mcycles SIKE[2] SIKEp434 22 Castrycketal.[8] CSIDH-512unprotected 4155 Bernsteinetal.[4] CSIDH-512unprotected 4153 CSIDH-1024unprotected 4760 Cervantes-Vázquezetal.[9] CSIDH-512MCR-style 4339 CSIDH-512OAYT-style 4238 Hutchinsonetal.[19] CSIDH-512OAYT-style 4229 Chi-Domínguezetal.[10] CSIDH-512MCR-style 4298 CSIDH-512OAYT-style 4230 Thiswork(estimated) CSIDH-512MCR-style 4282 CSIDH-512OAYT-style 4223 B-SIDH-p253 119Table6:SkylakeClockcycletimingsforakeyexchangeprotocolfordierentinstan-tiationsoftheSIDH,CSIDH,andB-SIDHprotocols.usingtheSIKEp434prime.However,B-SIDHissusceptibletotheactiveattackdescribedin[18].Tooerprotectionagainstthiskindofattacks,B-SIDHshouldincorporateakeyencapsulationmechanismsuchastheoneincludedin[2]. ProvidingthisprotectionwillimplyanextraoverheadforB-SIDH,whichwasnotconsideredinthispaper.6ConclusionsAconcreteanalysisofpéluintroducedin[4]waspresentedinthispaper.Fromouranalysisweconcludethatformostpracticalscenarios,thebestapproachforperformingthepolynomialproductsassociatedtopélu,isachievedbyKarat-subapolynomialmultiplications.Themainpracticalconsequenceofthisobserva-tionisthatcomputingdegree-`isogenieswithpéluhasaconcretecomputationalcomplexityessentiallyproportionaltoblog2(3);whereb=p `:Weintroducedseveralalgorithmictricksthatpermittosavemultiplicationswhenperformingthepolynomialproductsinvolvingthecom

22 putationofthere-sultantsincludedinAlgori
putationofthere-sultantsincludedinAlgorithm2-Algorithm3.Thecombinationoftheseim-provementsallowsustoconstructandevaluatedegree-`isogenieswithaslightlylessernumberofarithmeticoperationsthantheonesemployedin[4].WeappliedpéluandoptimalstrategiestoseveralinstantiationsoftheCSIDHandB-SIDHprotocols,producingtheveryrstconstant-timeimplementationofthelatterprotocolforaselectionofprimestakenfrom[12,4].OurfutureworkincludesCconstant-timesingle-coreandmulti-coreimple-mentationsofthetwoprotocolinstantiationsstudiedinthiswork.WewouldalsoliketostudymoreecientselectionsofthesetsI;JandKasdenedinŸ4.1,whichcouldyieldmoreeconomicalcomputationsofpélu.Acknowledgements.Thisworkwaspartiallydonewhilethethirdauthorwasvis-itingtheUniversityofWaterloo.ThethirdauthorreceivedpartialfundsfromtheMexicanSciencecouncilCONACyTproject313572.Thisprojecthasre-ceivedfundingfromtheEuropeanResearchCouncil(ERC)undertheEuropeanUnion'sHorizon2020researchandinnovationprogramme(grantagreementNo804476).ThisworkwaspartiallysupportedbytheSpanishMinisteriodeCiencia,InnovaciónyUniversidades,underthereferenceMTM2017-83271-R. References[1]GoraAdj,DanielCervantes-Vázquez,Jesús-JavierChi-Domínguez,AlfredMenezes,andFranciscoRodríguez-Henríquez.Onthecostofcomputingisogeniesbetweensupersingularellipticcurves.InCarlosCidandMichaelJ.JacobsonJr.,editors,SelectedAreasinCryptography-SAC2018-25thInternationalConference,volume11349ofLectureNotesinComputerSci-ence,pages322343.Springer,2018.[2]RezaAzarderakhsh,MatthewCampagna,CraigCostello,LucaDeFeo,BasilHess,AmirJalali,DavidJao,BrianKoziel,BrianLaMacchia,PatrickLonga,MichaelNaehrig,GeovandroPereira,JoostRenes,VladimirSoukharev,andDavidUrbanik.Supersingularisogenykeyencapsulation.secondroundcandidateofthenist'spost-quantumcryptographystandard-izationprocess,2017.Availableat:https://sike.org/.[3]D.J.Bernstein.Fastmultiplicationanditsapplications.AlgorithmicNum-berTheory,44:325384,2008.[4]DanielJ.Bernstein,LucaDeFeo,AntoninLeroux,andBenjaminSmith.Fastercomputationofisogeniesoflargeprimedegree

23 .IACRCryptol.ePrintArch.,2020:341,2020.[
.IACRCryptol.ePrintArch.,2020:341,2020.[5]DanielJ.Bernstein,TanjaLange,ChloeMartindale,andLorenzPanny.QuantumcircuitsfortheCSIDH:optimizingquantumevaluationofisoge-nies.InYuvalIshaiandVincentRijmen,editors,AdvancesinCryptology-EUROCRYPT2019,PartII,volume11477ofLectureNotesinComputerScience,pages409441.Springer,2019.[6]XavierBonnetainandAndréSchrottenloher.QuantumsecurityanalysisofCSIDH.InAnneCanteautandYuvalIshai,editors,AdvancesinCryptology-EUROCRYPT2020,Proceedings,PartII,volume12106ofLectureNotesinComputerScience,pages493522.Springer,2020.[7]J.W.S.Cassels.LecturesonEllipticCurves.LondonMathematicalSocietyStudentTexts,24edition,2016.[8]WouterCastryck,TanjaLange,ChloeMartindale,LorenzPanny,andJoostRenes.CSIDH:anecientpost-quantumcommutativegroupaction.InThomasPeyrinandStevenD.Galbraith,editors,AdvancesinCryptology-ASIACRYPT2018,PartIII,volume11274ofLectureNotesinComputerScience,pages395427.Springer,2018.[9]DanielCervantes-Vázquez,MathildeChenu,Jesús-JavierChi-Domínguez,LucaDeFeo,FranciscoRodríguez-Henríquez,andBenjaminSmith.Strongerandfasterside-channelprotectionsforCSIDH.InPeterSchwabeandNicolasThériault,editors,ProgressinCryptology-LATINCRYPT2019,volume11774ofLectureNotesinComputerScience,pages173193.Springer,2019.[10]Jesús-JavierChi-DomínguezandFranciscoRodríguez-Henríquez.OptimalstrategiesforCSIDH.IACRCryptol.ePrintArch.,2020:417,2020. [11]DeirdreConnolly.Codeforsidhkeyexchangewithoptionalpublickeycompression.Github,April2017.availableat:https://github.com/dconnolly/msr-sidh/tree/master/SIDH-Magma.[12]CraigCostello.B-SIDH:supersingularisogenydie-hellmanusingtwistedtorsion.IACRCryptol.ePrintArch.,2019:1145,2019.[13]CraigCostelloandHüseyinHisil.AsimpleandcompactalgorithmforSIDHwitharbitrarydegreeisogenies.InTsuyoshiTakagiandThomasPeyrin,editors,AdvancesinCryptology-ASIACRYPT2017,PartII,volume10625ofLectureNotesinComputerScience,pages303329.Springer,2017.[14]CraigCostello,PatrickLonga,andMichaelNaehrig.EcientalgorithmsforsupersingularisogenyDie-Hellman.In

24 MatthewRobshawandJonathanKatz,editors,Ad
MatthewRobshawandJonathanKatz,editors,AdvancesinCryptologyCRYPTO2016,pages572601,Berlin,Heidelberg,2016.SpringerBerlinHeidelberg.[15]Jean-MarcCouveignes.Hardhomogeneousspaces.CryptologyePrintArchive,Report2006/291,2006.http://eprint.iacr.org/2006/291.[16]LucaDeFeo,DavidJao,andJérômePlût.Towardsquantum-resistantcryptosystemsfromsupersingularellipticcurveisogenies.J.Math.Cryptol.,8(3):209247,2014.[17]LucaDeFeo,JeanKieer,andBenjaminSmith.Towardspracticalkeyex-changefromordinaryisogenygraphs.InThomasPeyrinandStevenD.Gal-braith,editors,AdvancesinCryptology-ASIACRYPT2018,PartIII,vol-ume11274ofLectureNotesinComputerScience,pages365394.Springer,2018.[18]StevenD.Galbraith,ChristophePetit,BarakShani,andYanBoTi.Onthesecurityofsupersingularisogenycryptosystems.InJungHeeCheonandTsuyoshiTakagi,editors,AdvancesinCryptology-ASIACRYPT2016,Proceedings,PartI,volume10031ofLectureNotesinComputerScience,pages6391,2016.[19]AaronHutchinson,JasonT.LeGrow,BrianKoziel,andRezaAzarder-akhsh.FurtheroptimizationsofCSIDH:Asystematicapproachtoecientstrategies,permutations,andboundvectors.IACRCryptol.ePrintArch.,2019:1121,2019.[20]DavidJaoandLucaDeFeo.Towardsquantum-resistantcryptosystemsfromsupersingularellipticcurveisogenies.InBo-YinYang,editor,Post-QuantumCryptography-4thInternationalWorkshop,PQCrypto2011,vol-ume7071ofLectureNotesinComputerScience,pages1934.Springer,2011.[21]DavidR.Kohel.Endomorphismringsofellipticcurvesoverniteelds.PhDthesis,UniversityofCaliforniaatBerkeley,Theaddressofthepub-lisher,1996.Availableat:http://iml.univ-mrs.fr/~kohel/pub/thesis.pdf.[22]MichaelMeyer,FabioCampos,andSteenReith.Onlionsandelliga-tors:Anecientconstant-timeimplementationofCSIDH.InJintaiDingandRainerSteinwandt,editors,Post-QuantumCryptography-10thInter-nationalConference,volume11505ofLectureNotesinComputerScience,pages307325.Springer,2019. [23]MichaelMeyerandSteenReith.Afasterwaytothecsidh.InIN-DOCRYPT2018,volume11356ofLectureNotesinComputerScience,pages137152.Springer,2018.[24]

25 PeterLMontgomery.Speedingthepollardandel
PeterLMontgomery.Speedingthepollardandellipticcurvemethodsoffactorization.Mathematicsofcomputation,48(177):243264,1987.[25]DustinMoodyandDanielShumow.Analoguesofvélu'sformulasforisoge-niesonalternatemodelsofellipticcurves.Math.Comput.,85(300):19291951,2016.[26]DustinMoodyandDanielShumow.Analoguesofvélu'sformulasforiso-geniesonalternatemodelsofellipticcurves.Mathematicsofcomputation,85(300):19291951,2016.[27]HiroshiOnuki,YusukeAikawa,TsutomuYamazaki,andTsuyoshiTak-agi.(shortpaper)Afasterconstant-timealgorithmofCSIDHkeepingtwopoints.InNuttapongAttrapadungandTakeshiYagi,editors,14thInterna-tionalWorkshoponSecurity,IWSEC2019,volume11689ofLectureNotesinComputerScience,pages2333.Springer,2019.[28]ChrisPeikert.Hegivesc-sievesontheCSIDH.InAnneCanteautandYuvalIshai,editors,AdvancesinCryptology-EUROCRYPT2020-Proceedings,PartII,volume12106ofLectureNotesinComputerScience,pages463492.Springer,2020.[29]JoostRenes.Computingisogeniesbetweenmontgomerycurvesusingtheac-tionof(0,0).InTanjaLangeandRainerSteinwandt,editors,Post-QuantumCryptography-9thInternationalConference,PQCrypto2018,volume10786ofLectureNotesinComputerScience,pages229247.Springer,2018.[30]AlexanderRostovtsevandAntonStolbunov.Public-keycryptosystembasedonisogenies.IACRCryptologyePrintArchive,2006:145,2006.[31]ArnoldSchönhage.Schnellemultiplikationvonpolynomenüberkörperndercharakteristik2.ActaInformatica,7:395398,1977.[32]AntonStolbunov.Constructingpublic-keycryptographicschemesbasedonclassgroupactiononasetofisogenousellipticcurves.Adv.inMath.ofComm.,4(2):215235,2010.[33]L.Washington.EllipticCurves:NumberTheoryandCryptography,SecondEdition.Chapman&Hall/CRC,2edition,2008.AAlgorithmsBSchönage-FFTvsKaratsubaKaratsubamultiplicationisawell-knownandcompletetoolformultiplyingpolynomialsofdegreenoveracommutativeringatthesubquadraticcostofO(nlog23).However,anasymtoticallyfasterfamilyofalgorithmsbasedonthefastFouriertransform(FFT)exists.Inthissection,weconsiderSchönage'sal-gorithm[31]blendedwiththeFFTmultiplication,asdescribedin[3

26 ],andgive Algorithm4Simpliedconstan
],andgive Algorithm4Simpliedconstant-timeCSIDHclassgroupactionforsupersingularcurvesoverFpp=4Qni=1`i�1.Theidealsli=(`i;�1),wheremapstothep-thpowerFrobeniusmorphism.Thisalgorithmcomputesexactlymisogeniesforeachidealli(Adaptedfrom[10]). Require:AsupersingularcurveEAoverFp,anintegervector(e1;:::;en)2J0::mKn,m�0.Ensure:EB=le11lennEA.1:E0 E//Initializingtothebasecurve2://Outerloop:Each`iisprocessedmtimes3:fori 1tomdo4:T GetFullTorsionPoint(E0)//T2En[�1]5:T [4]T//NowT2EnQi`i6://Innerloop:processingeachprimefactor`ij(p+1)7:forj 0to(n�1)do8:Gj T9:fork 1to(n�1�j)do10:Gj [`k]Gj11:endfor12:ifen�j6=0then13:hGji KPS(Gj)14:E(j+1)modn xISOG(Ej;`n�j;hGji)15:T xEVAL(T;hGji)16:en�j en�j�117:else18:hGji KPS(Gj)19:xISOG(Ej;`n�j;hGji)//Dummyoperations20:T [`n�j]T21:Ej+1modn Ej22:endif23:endfor24:endfor25:returnE0 Algorithm5Largecompositedegreeisogenyconstruction Require:asupersingularMontgomerycurveE=Fp2:By2=x3+Ax2+x,akernelpointgeneratorRonE=Fp2oforderL=`1e1`2e2`nen,andastrategySEnsure:thedegree-LisogenouscurveE=hRi1:SetL0asinEquation2//SmustbedeterminedbyL02:ramifications [R]//listofpointstobeevaluated3:moves [0];k 04:e #L0//emustbeequalto#S+15://Outerloop:Each`iisprocessedeitimes6:fori 0to#S�1do7:prev sum(moves)8://Innerloop:computingthekernelpointgenerator9:whileprev(e�1�i)do10:moves:append(Sk)11:V lastelementoframifications12:forj prevtoprev+Skdo13:V [L0j]V14:endfor15:ramifications:append(V)//Newpointtobeevaluated16:prev prev+Sk;k k+117:endwhile18:G lastelementoframifications19:hGi KPS(G)20:E xISOG(E;`e�1�i;hGi)21://Innerloop:evaluatingpoints22:forj 0to#moves�1do23:ramificationsj xEVAL(ramificationsj;hGi)24:endfor25:moves:pop();ramifications:pop()26:endfor27:G theuniqueelementoframifications28:hGi KPS(G)29:E xISOG(E;`0;hGi)30:returnE anaccurateestimateoftherunningtimeofthisalgorithminordertomakepracticalcomparativeswithKaratsubamultiplication.LetAbecommutativeringwhere2ininvertible.Forn�1apow

27 erof2,casquareinAand2Aasquareof�
erof2,casquareinAand2Aasquareof�1,letf;gbetwopolynomialsinA[x]=(xn+c).Tomultiplyfandg,onecansplittheproblemintotwosmalleronesbyreduc-ingf;gtof�;g�2A[x]=(xn=2�c1=2)andtof+;g+2A[x]=(xn=2+c1=2)g.Then,theproductsf�g�,f+g+arecomputed,andsubsequentlyembeddedintoA[x]=(xn+c)wherein(f�g�+f+g+)and(f�g��f+g+)arecalculatedtonallyrecover2fg.NotethatwhencisannthrootinA,whichinadditioncontainsannthrootof�1,thentheaboveprocedurecanbeappliedrecursivelytocomputetheproductnfgatacostofkmultiplicationsinAand3 2nlog2(n)easymultiplicationsinAbyconstants.ThisisessentiallytheFFTmultiplication.SupposenowthatAdoesnotcontainannthrootof�1,withn=2s�8,thenSchönage'smethodcanbeemployedtomultiplyf=P0ifiandg=P0igiinA[x]=(xn+1).First,denen1=2s1,withs1=bs=2c,B=A[x]=(xn1+1),andconsidertheringB[y]=(y2n=n1+1).ThegoalhereistoreducethecomputationoffgintoonemultiplicationinB[y]=(y2n=n1+1).Notethatxn21=2nisa(2n=n1)throotof�1inB,andhencetheFFTcanbeusedtomultiplypolynomialsinB[y]=(y2n=n1+1).Westartbysendingf;gtoF;G2A[x;y]=(y2n=n1+1),respectively,whereF=X0j2n n1X0in1 2fi+n 2jxiyjandG=X0j2n n1X0in1 2gi+n 2jxiyj;aresuchthat(F)=fand(G)=g,themap:A[x;y]=(y2n=n1+1)!A[x]=(xn+1)beingtheA[x]-algebramorphismthatsendsytoxn1.Thus,sinceFandGhavex-degreen1=2,theirproductcanbecomputedinB[y]=(y2n=n1+1),andthenpassedthroughtorecover(2n=n1)fg.Toestimatethecostofthiscomputation,noticethattransformingf;gtoF;Gand(2n=n1)FGto(2n=n1)fgrequiresnomultiplicationsinA.Moreover,whencomputing(2n=n1)FGinB[y]=(y2n=n1+1)usingtheFFT,themultiplicationsbyconstantscanbeignoredsincethesewillbejustmultiplicationsbypowersofxinB.Therefore,thecostofmultiplyingpolynomialsinA[x]=(xn+1)boilsdowntothe2n=mmultiplicationsinBarisingfromtheFFTapplication.Now,sinceB=A[x]=(xn1+1),theabovestrategycanbeappliedrecursivelyuntilreachingmultiplicationsinA[x]=(x8+1),wheremoreconventionalmethodscanbeused.Hence,thetotalcostofmultiplyingtwopolynomialsinA[x]=(xn+1)willbeC(n)=2n n12n1 n2

28 2nk�1 nkC8=2kn nkC8;w
2nk�1 nkC8=2kn nkC8;whereni=2si,withsi=bsi�1=2cfori2f2;:::;kg,kissuchthatnk=8,andC8isthecostofmultiplyingtwopolynomialsinA[x]=(x8+1).Aneasyanalysisthenshowsthatk=dlog2(s�1)e�1=dlog2(log2(n)�1)e�1.Thus,wehaveC(n)=C8 16enn(log2(n)�1); Fig.4:ComparisonbetweentheSchönage-FFTandKaratsubastylepolynomialmultiplications.Thex-axiscorrespondswiththedegreeofbothpolynomialstobemultiplied,whiley-axisshowstheexpectedcostrequiredinthepolynomialmultiplicationmethod.Inparticular,thekaratsubaandSchönage-FFTcostsaretakenasnlog2(3)and27 8n(blog2(n)c+1),respectively.Schönage-FFTmethodassumesthatEn=1=2,andkaratsubamultiplicationisrequiredinitsbasecase,whichimpliesC8=27.wherelog2(en)=dlog2(log2(n)�1)e�log2(log2(n)�1).Noticethat1en2.Finally,tocomputetheproductofdegree-npolynomialsf;g2A[x](n4),wedeneN=2blog2(n)c+2andcomputefginA[x]=(xN+1)atacostofCost(n)=C8 4Enn(blog2(n)c+1);wherelog2(En)=blog2(n)c�log2(n)+dlog2(blog2(n)c+1)e�log2(blog2(n)c+1).Noticethat1 2En2.InordertoillustratetheperformanceofSchönage-FFTpolynomialmultipli-cation,Figure4comparesitwiththecostofKaratsuba-stylemethod.Anyhow,wedidnotfocusonimprovingSchönage-FFTmethodandourexperimentsarecenteredonasymtopticcosts.Whicheverthecase,itlooksthatKaratsuba-stylepolynomialmultiplicationisthemoresuitableapproachtobeusedinthenewpéluformulaeforbothasCSIDHandB-SIDHimplementations.CComputationalcostofcomputingresultantsviaremaindertreesInthissectionwefocusedonthecomputationalcostassociatedtoaresultantcomputationviaremaindertrees.ResultantsarerequiredbythepéluproceduresxISOGandxEVAL.Formally,eachoneofthetworesultantsrequiredbyAlgorithm2andAlgo-rithm3,correspondstothecomputationofResZ(f(Z);g(Z))suchthatf;g2 Fq[Z],degf=b0banddegg=2b.OurgoalinthisAppendixisthatofderivingthecostoftheresultantcomputationintermsofb.Forthesakeofsimplicity,letusassumedegf=b.Itisimportanttohighlightthatthemodularpolynomialreductionrequiredateachnodeintheremaindertree,canbeperformedviareciprocalcomputa-tions(formoredetailssee[3,p.27,

29 59;17]).Forexample,themodularpolynomialr
59;17]).Forexample,themodularpolynomialreductiongmodfrequirestwodegree-bpolynomialmultiplicationsmoduloxb,oneconstantmultiplicationbyadegree-bpolynomial,andthereciprocalcom-putationmoduloxb(thatis,1=fmodxb).Inturn,thecostofareciprocalcom-putationmoduloxbcanbeestimatedbytheexpensesassociatedtotwodegree-(b=2)polynomialmultiplicationsmoduloxb=2,oneconstantmultiplicationbyadegree-(b=2)polynomial,andanotherreciprocal,butthistimemodulox(b=2).Theaboveimpliesthatareciprocalmoduloxbshouldbecomputedrecursively.Itsassociatedrunningtimecomplexityequationisgivenas,T(b)=Tb 2+2tb 2+b 2;wheret(b)denotesthepolynomialmultiplicationcostoftwodegree-bpolyno-mialsmoduloxb.Now,assumingthataKaratsubapolynomialmultiplicationisused,itfollowsthatT(b)Tb 2+2b 2log2(3)+b 2=Tb 2+2 3blog2(3)+b 2=log2(b)Xi=0 2 3b 2ilog2(3)+b 2i+1!=2 3blog2(3)log2(b)Xi=01 3i+b 2log2(b)Xi=01 2i=1�1 3log2(b)+1blog2(3)+1�1 2log2(b)+1b:Hence,thepolynomialreductiongmodfisexpectedtohavearunningtimeof��3�1 3log2(b)+1blog2(3)+�2�1 2log2(b)+1beldmultiplications.Now,theremaindertreeoffandgisconstructedgoingfromitsrootallthewaytoitsleaves.Todothis,atthei-thleveloftheremaindertree2imodularreductionsoftheformgmodfsuchthatdegfb 2ianddegg2degf;mustbeperformed.Theircombinedcostisgivenas, R(b;i)=�2i 3�1 3log2(b=2i)+1b 2ilog2(3)+2�1 2log2(b=2i)+1b 2i!=�2i3�1 3log2(b)�i+1blog2(3) 3i+2�1 2log2(b)�i+1b 2i=3blog2(3) 2 3i�2i 3log2(b)!+2�2i 2log2(b)+1b:Furthermore,thecostoftheremaindertreeconstructioncanbedonewithaboutR(b)=Plog2(b)i=0R(b;i)eldmultiplications.Inparticular,R(b)=9blog2(3) 1�2 3log2(b)+1�2log2(b)+1 3log2(b)+1!+2log2(b)�2log2(b)+1 2log2(b)+1b=9blog2(3) 1�22 3log2(b)+1!+�2log2(b)�1b:Finally,oncetheremaind

30 ertreehasbeenconstructed,thenextstepisto
ertreehasbeenconstructed,thenextstepistomultiplyallitsleaves,whichhasanextracostofbeldmultiplications,andproducesthattheResultantResZ(f(Z);g(Z))computationrequiresatotalof 9blog2(3) 1�22 3log2(b)+1!+2blog2(b)!M:Ontheotherhand,thepolynomialsrequiredintherootoftheremaindertreecanbeobtainedviaproducttreesatacostof��1�1 3log2(b)+1blog2(3)eldmultiplications.DB-SIDHprimes1.Example2.of[12,section5.2],wenameditasB-SIDHp253:p=0x1935BECE108DC6C0AAD0712181BB1A414E6A8AAA6B510FC29826190FE7EDA80F;M=423716179318311571132151196011142072847776667;N=1118192313477983891513347174493346151193:2.Example3.of[12,section5.2],wenameditasB-SIDHp255:p=0x76042798BBFB78AEBD02490BD2635DEC131ABFFFFFFFFFFFFFFFFFFFFFFFFFFFM=455572672234229978713399215213225747353;N=3341117192293753297107109131137197199227251551990913399738201: 3.Example5.of[12,section5.3],wenameditasB-SIDHp247:p=0x46B27D6FAE96ED4A639E045B7D2C3CA33F476892ADAFF87B9B6EAE5EE1FFFFM=�4252723791073072129479012;N=311172413494216139831327166729693769448146494801487755276673710375377621:4.Example6.of[12,section5.3],wenameditasB-SIDHp237:p=0x1B40F93CE52A207249237A4FF37425A798E914A74949FA343E8EA487FFFFM=43�434171931375326;N=71343731032694398818831321547991811254115803201612404334843484376275372577:5.Luckyproposalof[4,appendixA],wenameditasB-SIDHp257:p=0x1E409D8D53CF3BEB65B5F41FB53B25EBEAF37761CD8BA996684150A40FFFFFFFFM=41652171116311812389523383531013911939220032539141843;N=356314359271311353461593607647691743769877&