Finding a kernel generator of the dual isogeny

710 Views Asked by At

Let's say we have an isogeny $\phi:E\to E/\ker\phi$ between two elliptic curves over some finite field. Let's also assume we know $\ker\phi$ explicitly, or at least a generator of it, e.g. $\langle A\rangle=\ker\phi$. Let $\hat\phi$ be the dual of $\phi$, is there an easy way to find a generator of $\ker\hat\phi$? Or are there certain conditions under which it would be easy?

Any help would be really appreciated!

1

There are 1 best solutions below

1
On BEST ANSWER

This answer is for a typical case appearing in isogeny-based cryptography (schemes like SIDH/SIKE).

Assuming a separable and cyclic isogeny $\phi : E \rightarrow E / \ker \phi$ of degree $n$, you can obtain a generator $G$ of its dual, $\hat \phi$, by evaluating $\phi$ at a point $P$ of order $n$ that is not in the kernel of $\phi$. The desired generator will be $G = \phi(P)$.

Proof sketch. Note that $\phi(P)$ is a full order point in the image curve (this has a simple proof). Moreover, by evaluating the dual at $\phi(P)$, one gets $\hat \phi (\phi (P)) = \hat \phi \circ \phi (P) = [deg \phi] P = [n]P = O_E$, thus $\phi(P)$ is in the kernel of $\hat \phi$. Since $G = \phi(P)$ is a full order point and is in the kernel of the dual, it must be a generator of the whole kernel.