## Cryptology ePrint Archive: Report 2018/850

Computing supersingular isogenies on Kummer surfaces

Craig Costello

Abstract: We apply Scholten's construction to give explicit isogenies between the Weil restriction of supersingular Montgomery curves with full rational 2-torsion over $GF(p^2)$ and corresponding abelian surfaces over $GF(p)$. Subsequently, we show that isogeny-based public key cryptography can exploit the fast Kummer surface arithmetic that arises from the theory of theta functions. In particular, we show that chains of 2-isogenies between elliptic curves can instead be computed as chains of Richelot (2,2)-isogenies between Kummer surfaces. This gives rise to new possibilities for efficient supersingular isogeny-based cryptography.

Category / Keywords: Supersingular isogenies, SIDH, Kummer surface, Richelot isogeny, Scholten's construction

Original Publication (in the same form): IACR-ASIACRYPT-2018

Date: received 7 Sep 2018, last revised 9 Oct 2018

Contact author: craigco at microsoft com

Available format(s): PDF | BibTeX Citation

Short URL: ia.cr/2018/850

[ Cryptology ePrint archive ]