[PDF] Top 20 Computing supersingular isogenies on Kummer surfaces

... – In 2014, Bernstein and Lange [6] revived Scholten’s work when they proposed using his con- struction in the context of (hyper)elliptic curve cryptography (H)ECC to convert keys back and forth between elliptic and ... See full document

... puting isogenies between ordinary elliptic ...compute isogenies between ordinary curves in subexponential ...of computing isogenies between supersin- gular elliptic curves, which does not have ... See full document

... message where the hash fails than it is to find a preimage with a square-root algorithm. The former requires O(p) work, the latter O(p 3/2 ). In this, as we will see, the simplified CDS hash function contains the seeds ... See full document

... random supersingular curve with a large prime as the group order, and an isogeny be- tween this curve and a curve with a known distortion map as a ...dom supersingular elliptic curve, and the hardness of ... See full document

... proposed supersingular isogeny Diffie– Hellman (SIDH) as a key exchange protocol offering post-quantum ...on computing explicit isogenies on Montgomery curves is more ... See full document

... It can be seen that, in general, sign-and-MAC variants appear to o ff er a wider variety of security features at a lower computing cost. Nevertheless, in some settings implicitly authenticated protocols can o ff ... See full document

... Section 6 shows that constructing paths in the `-isogeny graph reduces to a different type of endomorphism ring computation. However, instead of just re- quiring an algorithm for computing the maximal order, one ... See full document

... cryptography, supersingular elliptic curve isogeny is one of the most attractive candidates for post-quantum ...Feo’s supersingular isogeny Diffie-Hellman key exchange (SIDH) [JD14] based on the hard ... See full document

... their Kummer surfaces via Rosenhain invariants and related Kummer ...so computing them requires less precision, and in addition, the Rosenhain model for the curve can be written down directly ... See full document

... Because of its simplicity, the Diffie-Hellman key exchange has served as a basis for several oblivious transfer methods, most notably by Bellare and Micali, Naor and Pinkas, and more recently Chou and Orlandi [4,11,25]. ... See full document

... of supersingular elliptic curves over finite fields. Supersingular isogeny graphs are excellent expander graphs with asymptotically optimal expansion con- stant ...of computing isogenies of ... See full document

... The Supersingular Isogeny Diffie-Hellman (SIDH) key agreement scheme was proposed by Jao and De Feo [12] (see also ...Computational Supersingular Isogeny (CSSI) problem, which was first defined by Charles, ... See full document

... (SIDH). Computing a sequence of isogenies of elliptic curves is a new cryptographic basic operation in some ...of computing an isogeny sequence, which is based on the hardness of constructing an ... See full document

... Abstract. The discrete logarithm over finite fields of small character- istic can be solved much more efficiently than previously thought. This algorithmic breakthrough is based on pinpointing relations among the factor ... See full document

... are isogenies of degree ...however, isogenies do not have an inverse that behaves like this; instead, every isogeny has a unique dual isogeny [12, Theorem ...dual isogenies lands us back on the same ... See full document

... the Kummer varieties. In fact most models of Kummer varieties have dedicated faster formulae for the doubling and differential additions than for the schematic ... See full document

... In Chapter 3 we give a method called the “Division polynomial factor- ization method” for computing kernel polynomials for `-isogenies of E. The main advantage of this method is that it works for any prime ... See full document

... of Kummer type I transformation (2) obtained by Paris [7], recently Rathie and Pogany [12] have given the following interesting extension of Kummer type II transformation in the ... See full document

... In the following theorem, we will prove a local Hyers-Ulam stability of the Kummer’s equation under some additional conditions. More precisely, if an analytic function satisfies some conditions given in the following ... See full document

... [15] Sabyasachi Karati and Palash Sarkar. Kummer for genus one over prime order fields. In Tsuyoshi Takagi and Thomas Peyrin, editors, Advances in Cryptology - ASIACRYPT 2017 - 23rd International Conference on the ... See full document