**Radical Isogenies on Montgomery Curves**

*Hiroshi Onuki and Tomoki Moriya*

**Abstract: **We work on some open problems in radical isogenies. Radical isogenies are formulas to compute chains of $N$-isogenies for small $N$ and proposed by Castryck, Decru, and Vercauteren in Asisacrypt 2020. These formulas do not need to generate a point of order $N$ generating the kernel and accelerate some isogeny-based cryptosystems like CSIDH. On the other hand, since these formulas use Tate normal forms, these need to transform Tate normal forms to curves with efficient arithmetic, e.g., Montgomery curves. In this paper, we propose radical-isogeny formulas of degrees 3 and 4 on Montgomery curves. Our formulas have simple formulas to recover Montgomery coefficients and are more efficient for some cryptosystems than the original radical isogenies. In addition, we prove a conjecture left open by Castryck et al. that relates to radical isogenies of degree 4.

**Category / Keywords: **public-key cryptography / Post-quantum cryptography, radical isogenies, Montgomery curves, CSIDH

**Date: **received 27 May 2021

**Contact author: **onuki at mist i u-tokyo ac jp

**Available format(s): **PDF | BibTeX Citation

**Version: **20210528:091520 (All versions of this report)

**Short URL: **ia.cr/2021/699

[ Cryptology ePrint archive ]