Implementation of the CSIDH Algorithm Model on Supersingular Twisted and Quadratic Edwards Curves

Abstract

The properties of twisted and quadratic supersingular Edwards curves forming pairs of quadratic torsion with the order p + 1 over the simple field Fp are considered. A modification of the CSIDH algorithm using the isogenies of these curves in replacement of the extended arithmetic's of the isogenies of curves in the Montgomery form is presented. The isogeny parameters of the CSIDH algorithm model are calculated and tabulated on the basis of the theorems proved in the previous work. The example of Alice's and Bob's calculations according to the non-interactive Diffy-Hellman circuit, illustrating the separation of their secrets, is considered. The use of the known projective (W:Z)-coordinates for the given classes of curves provides the fastest execution of the CSIDH algorithm to-date.

Keywords

• 1 Generalized Edwards form curve
• complete Edwards curve
• twisted Edwards curve
• quadratic Edwards curve
• curve order
• point order
• isomorphism
• isogeny
• w-coordinates
• quadratic residue
• quadratic non-residue

1. Introduction

This article is a continuation of the previous work [ 1 ]. Problems of post-quantum cryptography (PQC) today are successfully solved by various algorithms, among which the most promising, in particular, are algorithms based on isogenies of supersingular elliptic curves (SEC) [ 2, 3 ]. An efficient alternative to the SIDH [ 2 ] (Supersingular Isogeny Diffi-Hellman) protocol is the CSIDH [ 3 ] (Commutative SIDH) algorithm with the minimum known key length. Instead of the extended field 2 in the SIDH, operations in the CSIDH are performed over a simple field Fp, which for the given Fp halves the length of field elements and key sizes.

The implementations of the SIDH and CSIDH algorithms were mainly based on the fast arithmetic of isogenies of curves in the Montgomery form. In [ 4 ] (2019), a new efficient method for calculating isogenies of odd degrees for Edwards curves based on the Farashahi-Hosseini w-coordinates [ 5 ] is proposed. This work, in turn, is based on Montgomery's method of differential addition of points and adapts it to Edwards curves. The optimization of the arithmetic of isogenies on Edwards curves in projective coordinates (W:Z) in [ 4 ] significantly accelerated the algorithms of their previous work [ 6 ] and allowed the authors to obtain a 20% gain in the speed of operations compared to the implementation of the algorithm on the Montgomery curves.

Formulas for calculating isogenies of odd degrees of Edwards curves [ 7 ] also contain components of differential addition of points, which served as the basis for the method proposed in [ 4 ]. Calculations in classical projective coordinates, as our analysis showed for isogeny of small degrees [ 8 ], become much more complicated with increasing degree of isogeny and lose in cost to (W:Z)-coordinates.

Complete Edwards curves Ed with one parameter (χ(d) = –1), defined in [ 9 ], have well-known advantages: maximum speed of exponentiation of a point, universality of the law of addition of points, affine coordinates of a neutral element of a group of points. The introduction of the 2nd parameter a of the curve Ea,d in [ 10 ] expanded the class of curves in the Edwards form and gave rise, according to the classification adopted in [ 11, 12 ], to two new classes: twisted and quadratic Edwards curves. They form quadratic torsion pairs that are used in this article to implement the CSIDH algorithm.

The calculation of isogenies of odd degrees for complete and quadratic Edwards curves Ed is carried out by the formulas defined by Theorems 2–4 in [ 7 ]. In our previous work [ 1 ], we generalized theorems [ 7 ] to curves in the generalized Edwards form with two parameters a and d, which allowed us to apply in this article twisted and quadratic Edwards curves over the field for the implementation of the CSIDH model.

Our analysis in this paper is based on the properties of twisted and quadratic Edwards curves connected as pairs of quadratic torsion [ 13, 14 ]. Supersingular curves of these classes with the same order NE = p + 1 = 2mn, m ≥ 3 (n is odd) exist only at p ≡ 3mod4. The minimum even cofactor of the order of such curves is eight; then, for the CSIDH algorithm with odd n=∏ =1 , the modulus of the field Fp should be chosen as p = 8n – 1. In order to adapt the definitions for the arithmetic of isogenies of Edwards curves and curves in the Weierstrass form, we use a modified law of addition of points [ 11,12 ].

Section 1 gives a brief overview of the properties of twisted and quadratic supersingular Edwards curves [ 13–15 ]. Section 2 discusses specific aspects of the implementation of the CSIDH algorithm model on twisted and quadratic Edwards curves, provides a modification of the algorithm [ 3 ], calculates and tabulates the parameters of isogenous curves of the model, gives an example of Alice’s and Bob’s calculations in the Diffie-Hellman secret sharing scheme. Aspects of the performance of model using (W:Z)-coordinates [ 4,1 ] are summarized.

2. Properties of Twisted and Quadratic Supersingular Edwards Curves

A number of general properties of Edwards curves were considered in the previous work [ 1 ]. Here we turn to the specific properties of the supersingular Edwards curves (SEC) [ 13, 14 ]. The elliptic curve in the generalized Edwards form [ 11 ] is determined by the equation (1) (3)

Ea,d : x2  ay 2  1 dx2 y 2 , a, d  Fp*, a  d, d  1.

With the quadratic character χ(ad) = –1, the curve (1) is isomorphic to the complete Edwards curve [ 9 ] with one parameter d

Ed : x2  y 2  1  dx2 y 2 ,  (d )  1. (2) In case of χ(ad) = 1, χ(a) = χ(d) = 1 the curve (1) is isomorphic to the Edwards quadratic curve [ 11 ]

Ed : x2  y 2  1  dx2 y 2 ,  (d )  1, , d  1.

Having, in contrast to (2), the parameter d, defined as the square. For both curves (2) and (3) usually take a = 1. In the work [ 10 ] the curve (3) together with the curve (2) are called the Edwards curves. The difference in the quadratic characters of these curves leads to their radically different properties [ 11, 12 ].

The twisted Edwards curve was defined in [ 11 ] as a special case of the curve (1) for χ(ad) = 1, χ(a) = χ(d) = –1.

We define a pair of twisted and quadratic Edwards curves [ 11 ] as a pair of quadratic torsion with parameters χ(ad) = 1, aʹ = ca, dʹ = cd, χ(c) = –1. As the SEC exists only at p ≡ 3mod4 [ 11 ], then we can accept c = –1, aʹ = –a =–1, dʹ = –d, where a and d are quadratic curve parameters and, respectively, aʹ,dʹ-twisted curve parameters. In other words, the transition from a quadratic to a twisted torsion curve and vice versa can be defined as Ed = E1,d ↔ E–1,–d. So the equation of the twisted SEC at p ≡ 3mod4 from (1) can be written as

E1,d : x 2  y 2  1  dx 2 y 2 , d  Fp* , d  1.,  (d )  1. (4) The order NE of the elliptic curve over the simple field is defined based on the trace t of the characteristic Frobenius equation tφ2 + tϕ + p =0 as NE = p + 1 – t. For the curve of the quadratic torsion Et the respective order will be equal to NʹE = p + 1+ t. An elliptic curve is supersingular if and only if over any extension of a simple field the trace of Frobenius equation is t ≡ 0modp, where in 2 = − , = ±√− [ 14,15 ]. In other words, in the algebraic closure ̅ a supersingular curve doesnot contain the points of the order p. Over a simple field such curve always has the order NE = p + 1, and over any extension of this field NE ≡ 1modp.

So, twisted and quadratic SEC as a pair of quadratic torsion have the same order NE = p + 1, but a different structure. Except two points (0,±1) all their points do not coincide; therefore, isogenies of the same degrees have different kernels and are calculated independently. Both curves are non-cyclic with respect to the points of even order (they contain three points of the 2nd order, two of which are singular √ points. Both curves are 1,2 = (±√

, ∞) [ 11 ]). Besides, the quadratic SEC contains two singular points of the 4th order ± 1 = (∞, ± 1 ). The presence of three points of the 2nd order limits to eight the minimum cofactor of the order NE = 8n (n is odd) of twisted and quadratic Edwards curves [ 11 ]. The maximum order of the points of these curves is NE / 2. Points of even orders are not involved in the calculations of the CSIDH algorithm.

For the curve (1) J-invariant equals [ 13,15 ]

J (a, d )  16(a 2  d 2  14ad )3 ad (a  d )4 , ad (a  d )  0 (5)

This parameter distinguishes between isogenous (with different J-invariants) and isomorphic (with equal J-invariants) curves. Since the J-invariant retains its value for all isomorphic curves and pairs of quadratic torsion [ 15 ], it is the same for a pair of twisted and quadratic SEC (a = ±1), therefore, in what follows we will use J-invariant J(d). It is a useful tool both for finding supersingular curves and for constructing graphs of isogenous chains. One of the properties of the J-invariant J(d) is J (d )  J (d 1 ) .

For the classes of SEC under consideration, the replacement d → d–1 gives an isomorphism, and for complete Edwards curves—quadratic torsion [ 16 ].

3. Modification of the CSIDH Algorithm on Twisted and Quadratic Edwards

Curves

[ 11 ]. p ≡ –1mod8.

The PQC CSIDH (Commutative SIDH) algorithm was proposed by the authors [ 3 ] to solve the same key exchange problem (SIDH [ 2 ]), but on the basis of isogenous mappings of elliptic curves, on the whole, as additive Abelian groups. This mapping over a simple field Fp is defined as the class of group action and is commutative. In comparison with the well-known original CRS scheme (Couveignes (1997), Rostovtsev, Stolbunov (2004) on nonsupersingular curves, the use of isogenies of supersingular curves made it possible to dramatically speed up the algorithm and obtain the smallest known key size (512 bits in [ 3 ]).

Let the curve E of the order NE contain points of small odd orders li, i = 1,2,…,K. Then there is an isogenous curve Eʹ of the same order NE as the mapping of the degree li: E → Eʹ = [li]*E. The repetition of this operation ei times will denote [

] ∗ . The exponents of isogenies ei ∈ Z determine the length of the chain of isogenies of li degree. In the work [ 3 ] an interval of exponential values–m ≤ ei ≤ m, m = 5, K = 74 is adopted, which provides a security level of 128 bits when attacking a quantum computer. Negative values of the exponent ei indicate a transition to a quadratic torsion curve.

The implementation of the CSIDH algorithm mainly uses Montgomery’s fast arithmetic of elliptic curves y2 = x3 + Cx2 + x, C ≠ ±2, containing two points of the 4th order and, respectively, having the order NE = 4n (n is odd) [ 9 ]. In the work [ 4 ] the algorithm is built on complete SEC of the same order. In this work, for the first time, we propose to use in the CSIDH algorithm twisted and quadratic SEC, which have the same record-breaking speed performance indicators as the complete Edwards curves

This possibility arises on the basis of the theorems we proved in [ 1 ]. With a minimum cofactor of eight, the order of twisted and quadratic SEC is NE = 8n. Thus, for these classes of SEC with the order = 8 = + 1, = ∏ =1 the field modulus in the CSIDH algorithm should be chosen as Diffie-Hellman non-interactive key exchange scheme includes the following stages [ 3 ]: secret.

The choice of parameters. For small simple odd li. = ∏ =1 is calculated, where the value K is determined by the safety level and the appropriate modulus of the field = 2 3 and starting elliptical curve E0 are selected.

Calculation of public keys. Alice with her private key = ( 1,, 2, 3,, … , ,) constructs an isogenous function = [ 11, ] and calculates an isogenous curve public key. Bob, with the secret key ΩB and function b, performs the same calculations and gets his = ∗ 0 as her public key В = ∗ 0. These curves are determined by their parameters up to isomorphism.

Key exchange. Here the protocol is similar to item two with the replacement E0⟶EB for Alice and E0⟶EA for Bob. Knowing Bob’s public key, Alice calculates = ∗ = ∗ 0.

Similar actions of Bob give the result EAB = b * EA = ba * E0, which coincides with the first due to the commutativity of the group operation. The J-invariant of the curve (EBA) is taken as the shared ∏ =1 − 1 , ≥

Below we present a modification of Alice’s computation algorithm according to item 2 [ 3 ] using isogenies of twisted and quadratic SEC.

Algorithm 1: Evaluating the class-group action on twisted and quadratic SEC. Input: dA ∈ EA, χ(d) = 1 and a list of integers ΩA = (e1,e2,…,eK).

Output: dB such that [l1e1 , l2e2 ,...lK eK ]* E

A  EB , where EA,B : x 2  y 2  1  d А,В x y , 2 2 1. While some ei ≠ 0 do 2. Sample a random x ∈ F. 7. For each i ∈ S do

8. Compute Q ← [k/li]R. 3. Set s ← 1, EA: x2 – y2 = 1 – dAx2y2, if (x2 – 1)/(1 – dx2) is a square in Fp. 4. Else s ← –1, EAt: x2 + y2 = 1 + dAx2y2. 5. Let S = {i | sei > 0}. If S = ∅ then start over to line 2 while s ← –s. 6. Let = ∏ ∈ and compute R ← [(p + 1)/2k]P, P = (x,y).

9. If Q ≠ (1,0), compute an isogeny φ: EA → EB with ker φ = Q.

10. Set dA ← dB, R ← φ(R), k ← k/li, and finally ei ← ei – s. 11. Return dA.

In comparison with Algorithm 2 in the work [ 3 ] in our algorithm 1, adapted to twisted and quadratic SEC, modifications were made: 1.

The repeated selection of a random point (Item 5) is performed until it falls after the original curve EA into the curve (EtA) of quadratic torsion (y2 → –y2). The check of quadraticity y2 in Item 3 is performed for the twisted Edwards curve equation (4).

The set S of indices of positive and negative exponentials {ei} is formed twice according to For twisted Edwards curve order NE = 8n = p + 1 with the maximum order of the point NE / 2 = 4n to get the point of the order n it is enough to double a random point P twice. In item 6 this property is taken into account by decreasing one doubling in the point product. According to Item 10 for each li exactly ei of isogenies is calculated until the exponent ei is zeroed. Depending on its sign, isogenies are calculated in the twisted class (ei > 0) or quadratic SEC class (ei < 0).

The construction of isogenies of odd simple degrees for quadratic Edwards curves is based on the Theorem 2 [ 7 ], for the twisted Edwards curves—on the Theorem 1 [ 1 ]. In the last work, the formulas of mapping ϕ(P) for the curve (1), depending on two parameters a and d, are presented for the first time. They are formulated below.

Theorem 1 [ 1 ]. Let us G = {(1,0),±Q1,±Q2,…,±QS,} is subgroup of odd simple order l = 2s + 1 of the points ±Q1 = (αi,±βi) of the curve Ed over the field Fp.

We define  (P)   x, y      QG x

Qi xPQi xPQi ,  xQi

QG x

Qi

 yPQi yPQi  xQi 

 aʹ = al, dʹ = A8dl, = ∏ =1 , and the mapping function

Then ϕ(x,y) is an l-isogeny with the kernel G from the curve Ea,d into the curve Eaʹ,dʹ with parameters or  (x, y)   2   x  A s (i x)2  a2 (i y)2 y i1 1 (dii xy)2 , A2  s (i y)2  (i x)2  i1 1 (dii xy)2   (x, y)   2   x  A s x2  ai2 ,  y2  i11 di x2 A is1 ax2 daiix22  (6) (7) Its proof is given in [ 1 ].

Let’s consider a simple model for the implementation of the CSIDH algorithm on twisted and quadratic SEC that form pairs of quadratic torsion with the same order. Such curves exist only at p≡ –1mod8 and have the order NE = NtE = p + 1 = cn(n – odd), c ≡ 0mod8. Let such pair of curves contain the kernels of the 3rd and 5th order at the minimum value n = 15, then the minimal simple is p = 239 and the order of these curves is NE = 16n =240. The parameter d of the whole family of 118 quadratic Edwards curves can be taken as squares d = r2modp, r=2..119. Of these, 30 pairs of quadratic and twisted SEC were found with parameters a = ±1 and ad. Let us denote a quadratic SEC as Ed and a twisted SEC (4) as E–1,–d. Table 1 shows the values of parameters for pairs of quadratic and twisted SCEs. They are written as squares in ascending order d = r2modp, r=5..119. twisted SEC can be fixed as quadratic non-deduction a = –1, because, according to theorem 1, a(i+1) = (a(i))l= –1 for all odd degrees l. constructing the function [ 11,

The curve E–1,–25 contains the point of the 3rd order Q1 = (149,64), then, according to Theorem 3 [ 7 ] = ∏ 3-isogenous curves with the start value d = 25 are given in the first half of Table 2. The period of the =1 = 149, 8 = 8, (1) = 8( (0))3 = 3. Calculated parameters d(i), J(d(i)) of the chain of chain π = 5 divides the number of all twisted SEC, equal to 30. By setting a different start value d = 2 from Table 1, we can get another sequence of parameters d(i) ∈ {2,61,62,193,5,2} with period 5 with values from Table1. Parameters of the 2nd chain are given in the second half of Table 2. For 3-isogenies it is possible to calculate 3 tables similar to Table 2 with non-overlapping values d(i) of Table 1. The data in Table 2 are used for twisted SEC when constructing the function[ 11, 22], 1 = 3, 1 > 0.

With negative values of exponents 1 < 0 the results of similar calculations for quadratic SEC with other kernels Q of the 3rd order are given in Table 3. We emphasize that in comparison with Table 2, the same values of the parameters d(i) on the period of the chain are run in reverse order here.

The kernel of the 5-isogeny on the curve E–1,–25 is the subgroup of points of the 5th order Q1 = (α1,β1) = (–95,28), 2Q1 = Q2 = (α2,β2) = (–72,–119), 3Q1 = –2Q1 = (α2,–β2), 4Q1 = –Q1 = (α1,–β1), 5Q1 = O = (1,0). It is unequivocally determined by the coordinates α1,α2 of two points and the equation (4). For each 5-isogenous curve we calculate A(i) = α1(i)α2(i), d(i+1) = (A(i))8(d(i))5, i = 0,1,… The results of calculating the parameters of the chain of 5-isogenic twisted SCEs are given in Table 4.The period of this chain is π = 15 and we can construct one more similar table (up to cyclic shift) with the other half of parameters of Table 1. For quadratic SEC, the results of similar calculations are summarized in We will accept private keys of exponential isogeny {ei} of Alice and Bob ΩA = (1,–2), ΩA = (–4,3), their isogenous functions, respectively, = [31, 5−2], = [ 3−4, 53 ]. Let`s calculate their public keys dA,dB. As a start curve of the chain of isogenies we accept the curve E(0) = E–1,–25. Alice calculates the parameters of 3-isogenous curves E(i): one 3- isogenous twisted SEC, two 5-isogenous quadratic SECs at random.

1. Calculation from left to right. From Table 2 at the first step we immediately get d(0) = 25 → d(1) = 3 ⟹ E(1) = E–1,–3. For calculation of 5-isogenous curves we pass to the class of quadratic torsion—to the quadratic curve E(1) = E1,3 = E3. According to Table 5 we get d(1) = 3 → d(2) = 187 → d(3) = 193 ⟹ E3 → E187 → E193 ⟹ E(3) = E193. Returning to the class of twisted SECs gives E(3) = E–1,–193. So Alice’s public key is dA = 193. The default for the twisted SEC class is aA = –1.

2. Calculation from right to left. For this case, at first in the class of quadratic curves, Alice calculates two 5-isogenous quadratic curves from Table 5 E25 → E201 → E62 ⟹ E(2) = E62. Then she goes to the twisted curve E–1,–62 and calculates one 3-isogenous curve. From Table 2 we get the final result E(2) = E–1,–62 → E(3) = E–1,–193 ⟹ dA = 193. This example illustrates the commutability of isogenous mappings in the CSIDH algorithm.

Bob’s public key is calculated in the same way. At e1 = –4 the first isogenous curve is the quadratic curve E(4) = E3 from Table 3. Calculation of the next three 5-isogenous twisted curves (e2 = 3) in accordance with Table 4 gives the curve E(7) = EB = E–1,–110 and the value of Bob’s public key dʹ = d(3) = dB = 110. Calculations from right to left give the same result.

Further, in the secret sharing scheme, Alice knowing Bob’s public key calculates the isogenous curve EBA = [31,5–2)*E–1,–110. From Table 2 for twisted SECs we get d(0) = 110 → d(1) = 25, then from Table 5 for quadratic SECs is d(1) = 25 → d(2) = 201 → d(3) = 62. As a result, EBA = E–1,–62 ⟹ dBA = 62.

Calculations of Bob in the secret sharing EAB = [3–4,53)*E–1,–193. From Table 3 for quadratic SEC we get d(0) = 193 → d(1) = 62 → d(2) = 61 → d(3) = 2 → d(4) = 5, then from Table 4 for twisted SECs is d(4) = 5 → d(5) = 121 → d(6) = 10 → d(7) = 62. As a result, EAB = EBA = E–1,–62 ⟹ dAB = 62. Alice’s and Bob’s results are identical.

According to Algorithm 1, isogenous functions (7) with kernels of degrees li along with dot products of points can be effectively used to calculate points of corresponding simple orders in chains of isogenous curves.

The mapping (7) of the points P = (x,y) of the curve EA = E–1,–25 with the kernel of 3-isogeny G = {(1,0),±Q = (149,±64)} has the form 3(x, y)  x x2  a 2 y x2  2  x x2  642 y x2 1492  A2 1 d 2x2  A2 1 d 2x2      ,

 1492 1 252642 x2 1492 1 2521492 x2 

The point of maximum odd 15th order P = (–44,–12) of the curve E–1,–25 is mapped to the point Pʹ = (221,125) of the 5thorder of the curve E–1,–3, the point of the 5th order P = (144,28) is mapped to the point Pʹ = (25,183) of the 5th order, and the point of the 3rd order P = (149,64) is mapped to the neutral element of the group—the point Pʹ = (1,0) = O. As we see, the function ϕ3(x,y) reduces the orders of points of the preimage that are multiples of three and does not change the orders of other points.

For the same curve E–1,–25 with the kernel of the 5th order G = {(1,0),±Q1 = (–95,±28),±Q2 = (–72,– 119)} of the 5th isogeny in the form (7) is written as The point of the 15th order P = (–44,–12) of the curve E–1,–25 is mapped into the point Pʹ = (–18,7) of the 3rd order of the curve Eʹ–1,–2. The point of the 3rd order P = (149,64) is mapped into the point Pʹ = (–18,–7) of the 3rd order of isogenous curve, the point of the 5th order P = (–95,28) is mapped into the point Pʹ = (1,0) = O. Here the function ϕ3(x,y) reduces the orders of the preimage points, which are multiples of 5, by 5 times, without changing the orders of other points.

Calculations of the isogenies of twisted and quadratic SEC in projective Farashahi-Hosseini coordinates [ 6 ] (W:Z) with replacement w(x,y) = dx2y2 based on the method proposed in [ 4 ] were considered in the previous paper [ 1 ] using Theorems 1 and 2 proved there.

The results of the implementation of the Edwards-CSIDH model [ 4 ] in projective coordinates claim that it is faster than the Montgomery-CSIDH model in coordinates (X:Z) by 20%.

We note that the Edwards-CSIDH model [ 4 ] is built on complete Edwards curves with the order NE = p + 1 = 4n (n is odd). On the basis of Theorems 1 and 2 [ 1 ] in this paper we have shown how to implement such a model on twisted and quadratic SEC forming pairs of quadratic torsion.

The advantage of these classes of curves over the complete Edwards curves is the absence of the laborious inversion of the parameter d → d–1, which is necessary in the transition to the complete curve of quadratic torsion. This only speeds up the execution of the algorithm. However, with the same maximum order of the point 4n, the order of these curves NE = 8n is twice as large as compared to the complete ones, which is hardly significant.

4. Conclusions

It can be concluded that the method for calculating isogenies of odd degrees in coordinates (W:Z), proposed in [ 4 ], using full and twisted supersingular Edwards curves, allows us to implement the fastest computations for today when constructing the PQC CSIDH protocol and the like. The theorems proved in [ 1 ] open up classes of twisted and quadratic Edwards curves for their implementation. This article is the first to show such an implementation for a simple model of the CSIDH algorithm. 5. References

References

[1] Bessalov , A. , Sokolov , V. , Skladannyi , P. , Zhyltsov , O. Computing of odd degree isogenies on supersingular twisted edwards curves . CEUR Workshop Proceedings , 2021 , 2923 , pp. 1 - 11 .

[2] D. Jao , and L. de Feo, Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies , Post-Quantum Cryptography pp. 19 - 34 ( 2011 ).

[3] Castryck , W. , Lange , T. , Martindale , C. , Panny , L. , Renes , J.: CSIDH : An efficient post-quantum commutative group action . In: Peyrin, T. , Galbraith , S. (eds.) Advances in Cryptology { ASIACRYPT 2018 . pp. 395 - 427 . Springer International Publishing, Cham ( 2018 ).

[4] Suhri Kim , Kisoon Yoon, Young-Ho Park , and Seokhie Hong . Optimized Method for Computing Odd-Degree Isogenies on Edwards Curves . Security and Communication Networks , 2019 ( 2019 ).

[5] Farashahi , R.R. , Hosseini , S.G. : Differential addition on twisted Edwards curves . In: Pieprzyk, J. , Suriadi , S. (eds.) Information Security and Privacy . pp. 366 { 378 . Springer International Publishing, Cham ( 2017 ).

[6] Suhri Kim , Kisoon Yoon, Jihoon Kwon, Seokhie Hong, and Young-Ho Park Efficient Isogeny Computations on Twisted Edwards Curves Hindawi Security and Communication NetworksVolume .

[7] Moody D , Shumow D. Analogues of Velus formulas for isogenies on alternate models of elliptic curves . Mathematics of Computation , vol. 85 , no. 300 , pp. 1929 - 1951 , 2016 .

[8] A. Bessalov , V. Sokolov , P. Skladannyi . Modeling of 3- and 5-Isogenies of Supersingular Edwards Curves // Proceedings of the 2nd International Workshop on Modern Machine Learning Technologies and Data Science (MoMLeT&DS' 2020 ), June 2-3, 2020 : abstracts. - No. I, vol. 2631 . - Aachen : CEUR, 2020 . - P. 30 - 39 .

[9] Bernstein D.J. , Lange T. Faster Addition and Doubling on Elliptic Curves // Advances in Cryptology-ASIACRYPT' 2007 (Proc. 13th Int. Conf. on the Theory and Application of Cryptology and Information Security. Kuching, Malaysia. December 2-6 , 2007 . Lect. Notes Comp. Sci. V. 4833 . Berlin: Springer, 2007 . P. 29 - 50 .

[10] Bernstein Daniel J. , Birkner Peter , Joye Marc , Lange Tanja, Peters Christiane . Twisted Edwards Curves.// IST Programme under Contract IST-2002 -507932 ECRYPT , and in part by the National Science Foundation under grant ITR-0716498 , 2008 .

[11] Bessalov A.V. Elliptic curves in Edwards form and cryptography . Monograph. Polytechnic, Kyiv, 2017 . 272p.

[12] Bessalov A.V. , Tsygankova O.V. Number of curves in the generalized Edwards form with minimal even cofactor of the curve order . Problems of Information Transmission , Volume 53 , Issue 1 ( 2017 ), p. 92 - 101 . doi: 10 .1134/S0032946017010082

[13] Bessalov , A.V. , Kovalchuk , L.V. Supersingular Twisted Edwards Curves Over Prime Fields. I. Supersingular Twisted Edwards Curves with j-Invariants Equal to Zero and 123 . Cybernetics and Systems Analysist, 2019 , 55 ( 3 ), стр. 347 - 353 .

[14] Bessalov , A.V. , Kovalchuk , L.V. Supersingular Twisted Edwards Curves over Prime Fields. II. Supersingular Twisted Edwards Curves with the j-Invariant Equal to 663. Cybernetics and Systems Analysist, 2019 , 55 ( 5 ), стр. 731 - 741 .

[15] Washington , L.C. Elliptic Curvres . Number Theory and Cryptography . Second Edition . CRC Press, 2008 .

[16] A. Bessalov , et al., Analysis of 2-isogeny properties of generalized form Edwards curves , in: Proceedings of the Workshop on Cybersecurity Providing in Information and Telecommunication Systems, July 7 , 2020 , vol. 2746 , pp. 1 - 13 .