Efficient scalar multiplication by isogeny decompositions

  • Authors:
  • Christophe Doche;Thomas Icart;David R. Kohel

  • Affiliations:
  • Department of Computing, Macquarie University, Australia;Laboratoire d'Informatique de l'École Polytechnique, France;School of Mathematics and Statistics, University of Sydney, Australia

  • Venue:
  • PKC'06 Proceedings of the 9th international conference on Theory and Practice of Public-Key Cryptography
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

On an elliptic curve, the degree of an isogeny corresponds essentially to the degrees of the polynomial expressions involved in its application. The multiplication–by–ℓ map [ℓ] has degree ℓ2, therefore the complexity to directly evaluate [ℓ](p) is O(ℓ2). For a small prime ℓ (= 2, 3) such that the additive binary representation provides no better performance, this represents the true cost of application of scalar multiplication. If an elliptic curve admits an isogeny ϕ of degree ℓ then the costs of computing ϕ(P) should in contrast be O(ℓ) field operations. Since we then have a product expression [ℓ]=$\hat{\varphi}\varphi$, the existence of an ℓ-isogeny ϕ on an elliptic curve yields a theoretical improvement from O(ℓ2) to O(ℓ) field operations for the evaluation of [ℓ](p) by naïve application of the defining polynomials. In this work we investigate actual improvements for small ℓ of this asymptotic complexity. For this purpose, we describe the general construction of families of curves with a suitable decomposition [ℓ]=$\hat{\varphi}\varphi$, and provide explicit examples of such a family of curves with simple decomposition for [3]. Finally we derive a new tripling algorithm to find complexity improvements to triplication on a curve in certain projective coordinate systems, then combine this new operation to non-adjacent forms for ℓ-adic expansions in order to obtain an improved strategy for scalar multiplication on elliptic curves.