Isogenies on twisted Hessian curves

Elliptic curves are typically defined by Weierstrass equations. Given a kernel, the well-known Vélu’s formula shows how to explicitly write down an isogeny between Weierstrass curves. However, it is not clear how to do the same on other forms of elliptic curves without isomorphisms mapping to and from the Weierstrass form. Previous papers have shown some isogeny formulas for (twisted) Edwards, Huff, and Montgomery forms of elliptic curves. Continuing this line of work, this paper derives explicit formulas for isogenies between elliptic curves in (twisted) Hessian form. In addition, we examine the numbers of operations in the base field to compute the formulas. In comparison *This author is supported by the PREMA project in Subsaharan Africa sponsoserd by The Simons Foundation

with other isogeny formulas, we note that our formulas for twisted Hessian curves have the lowest costs for processing the kernel and our X-affine formula has the lowest cost for processing an input point in affine coordinates.

Introduction
An elliptic curve is defined as a nonsingular irreducible projective curve of genus one, with a specified point as additive identity on the curve. An elliptic curve is said to be defined over a field k if the curve is defined over k and the specified point additive identity is k-rational.
Let E be an elliptic curve defined over k with the specified point additive identity O. It is well known that there exist functions x, y ∈ k(E) such that the rational map φ defined over k by φ = (x : y : 1) is an isomorphism from E to an elliptic curve in Weierstrass form: and φ(O) = (0 : 1 : 0), where a 1 , a 2 , . . . , a 6 ∈ k (see [31,III.3.1]). Therefore, elliptic curves are typically identified with curves defined by such a Weierstrass equation with the specified point additive identity (0 : 1 : 0).
Let E and E be elliptic curves with specified point additive identities O and O respectively. An isogeny from E to E is defined as a morphism φ : E → E such that φ(O) = O . It is a theorem (see [31,III.4.8]) that an isogeny is also a group homomorphism. As a corollary, the kernel of an isogeny is a finite subgroup of the domain. Conversely, if F is a finite subgroup of E, there exists an elliptic curve E and a separable isogeny φ : E → E such that the kernel of φ is F (see [31,III.4.12]). Given E and F , Vélu's formula in [34] shows an explicit expression for φ and E , where E and E are both in Weierstrass form.
However, the Weierstrass equation is only one way to represent an elliptic curve. Other forms of elliptic curves are possible and have been proposed, some with applications in cryptography. Examples include Montgomery curves in [25,29], (twisted) Edwards curves in [9,3,1], Huff curves in [20,36], and (twisted) Hessian curves in [2]. The first formulas for isogenies defined directly for non-Weierstrass curves was for (twisted) Edwards curves and Huff curves [27]. Shortly thereafter, similar work, [6] and [30], showed formulas for computing isogenies on Montgomery curves. In this paper, we derive a formula for isogenies on twisted Hessian curves and consider the computational cost of computing image points. Furthermore, in our main proof, we make explicit and rigorous the techniques and justifications that are required but omitted in proving isogeny formulas in previous works. Compared to other isogeny formulas, we note that our formulas for twisted Hessian curves have the lowest costs for preprocessing the kernel points to determine the rational map prior to input evaluation, and our X-affine formula has the lowest cost for processing an input point in affine coordinates.
Isogenies have found applications in counting the number of points on an elliptic curve over a finite field (e.g. see [17,23]), analyzing the complexity of elliptic-curve discrete logarithms in [18], and cryptographic constructions (e.g. [33,5,7]). More efficient isogeny formulas could lead to performance benefits in the above applications.
The organization of the paper is as follows. Section 2 introduces Hessian curves and their generalization called twisted Hessian curves. A summary of the point addition formulas on twisted Hessian curves is included. Section 3 derives formulas for 3-isogenies. Section 4 states and proves the main result for isogenies with a kernel of size ≡ 0 (mod 3). Finally, Section 5 examines the main formula's computational cost of computing image points. Some open problems and directions for future work are given in Section 6.

Twisted Hessian Curves
A Hessian curve in projective coordinates is defined by the equation The Hessian form of elliptic curves has been studied, for example, in [32,15,16,12], to optimize point addition and scalar multiplication formulas, as well as to optimize pairing computations. In addition, as a step towards resistance against side-channel attacks, the Sylvester addition formula (described below) on Hessian curves can also be used for point doubling and subtraction after a permutation of input coordinates [19]. A generalization of Hessian curves, called twisted Hessian curves, is defined by the equation Twisted Hessian curves were used in [2] to provide a complete unified addition formula and improve efficiency for point dou-bling and tripling over fields of arbitrary characteristic. Other works that optimized arithmetic on (twisted) Hessian curves include [10,11,22]. Definition 1. A twisted Hessian curve over a field k is a projective curve H(a, d) defined by the polynomial aX 3 +Y 3 +Z 3 = dXY Z with the specified point (0 : −1 : 1) as additive identity in the projective space P(k) 2 , with a, d ∈ k and a(27a − d 3 ) = 0. If a = 1, the curve is called a Hessian curve.
As an elliptic curve, each twisted Hessian curve must be isomorphic over k to a curve given by a Weierstrass equation. Over a finite field of characteristic not equal to 3, we can find an explicit isomorphism from any twisted Hessian curve to a Weierstrass curve, and conversely, from any Weierstrass curve with a k-rational point of order 3 to a twisted Hessian curve. Such isomorphisms are given in [2, Theorem 5.3 and 5.4] and [28].

3-isogenies
In this section, we show how to compute 3-isogenies on twisted Hessian curves, and in the next section, we provide a formula for -isogenies with ≡ 0 (mod 3). To compute an isogeny with kernel of size divisible by 3, we can write the kernel as an internal product of a subgroup of size not divisible by 3 and one or more subgroups of size 3, and compose the formulas for each factor. Together, these formulas are sufficient for kernels of any size. In particular, to obtain an isogeny with kernel of size 3 r where ≡ 0 (mod 3), we can compose an -isogeny with r isogenies of degree 3.
To derive the result for 3-isogenies, we begin by characterizing all points of order 3 on a twisted Hessian curve. Let c be a cubic root of a. It can be easily verified that the point (1 : 0 : −c) and its inverse (1 : −c : 0) both have order 3. In addition, if ω 3 = 1 and ω = 1, then (0 : −ω : 1) and its inverse (0 : 1 : −ω) have order 3. The verification has been done in [2,Theorem 5.1]. In fact, based on the cardinality of the 3-torsion on elliptic curves (e.g. see [35,Theorem 3.2]), these are the only points of order 3 on a twisted Hessian curve. Moreover, using the defining equation of H(a, d), it can be easily verified that the 3-torsion is the precisely the set of points (X : Y : Z) such that XY Z = 0.
We now turn to formulas for 3-isogenies of twisted Hessian curves. As seen in the preceding paragraph, a kernel of size 3 is either generated by (0 : −ω : 1) with ω 3 = 1 and ω = 1 or by (1 : −c : 0) with c 3 = a. First, we consider 3-isogenies with their kernel generated by (0 : −ω : 1). Such a map can be obtained by composing the 3-isogeny given in [2, Theorem 5.4] from a twisted Hessian curve to a Weierstrass curve of the form Y 2 Z+a 1 XY Z+a 3 Y Z 2 = X 3 with the isomorphism given in [2,Theorem 5.4] between such a Weierstrass curve and a twisted Hessian curve. The result of such composition is stated in Theorem 1. Proof. We leave the straightforward verification to the reader.
Next, we consider 3-isogenies with kernel generated by the point (1 : −c : 0) with c 3 = a. The only formula for such isogenies that we are aware of is given in [14,Proposition 4] for Hessian curves over characteristic 3. We restate the result here.
We generalize Theorem 2 to 3-isogenies on twisted Hessian curves H(a, d) over any characteristic with kernel (1 : −c : 0) , where c 3 = a. Proof. Let f = xy, g = c 2 x 2 + cxy 2 + y, and h = c 2 x 2 y + cx + y 2 be the dehomogenized coordinate maps of φ. Also let A and D be as given in the theorem statement. Then, This shows that the range of the rational map φ is indeed H(A, D). It remains to check that the kernel is as claimed. Let P = (X : Y : Z) and suppose φ(P ) = (0 : −1 : 1), then XY Z = 0.

Isogenies of degree ≡ 0 (mod 3)
In this section, we look at the -isogeny formulas, where ≡ 0 (mod 3). One approach for obtaining such an -isogeny between twisted Hessian curves is to compose the isogeny given by Vélu's formula with isomorphisms to and from Weierstrass curves. This approach, however, doesn't lead to a simple formula. Moreover, the resulting codomain twisted Hessian curve is dependent on the choice of point of order 3 on the codomain Weierstrass curve produced by Vélu's formula. We prove our main twisted Hessian isogeny result as follows.
Note that in the equation for φ, for each point P + R, the choice of representative of P + R in projective coordinates does not affect the result φ(P ). Moreover, s i t i = 0 for each i ∈ {1, 2, . . . , n}.
Proof. Without loss of generality, let k be algebraically closed. We start by writing down a rational form of the map φ given in the theorem, which is derived from the standard addition formula. Let That is, φ(x : y : where A, D ∈ k are to be determined. Our goal is show that G = 0 for A, D ∈ k as stated in the theorem. To this end, by Proposition [31, II.1.2], it suffices to show that G has no poles and G(Q) = 0 for some Q on H. By the definitions of φ Y and φ Z , if P is a pole of G, then X(φ(P )) = 0, which is equivalent to X(P + R) = 0 for some R ∈ F . Let Q = P + R. From the formula of φ, it can be seen that φ is invariant under translation by any point in F . So φ(P ) = φ(Q) and X(Q) = 0. Therefore, if G has a pole at some point P , then G also has a pole at some point Q with X(Q) = 0. By subsituting X = 0 into the defining equation of H, we find that the only points Q with X(Q) = 0 are Let P = (0 : −ω : 1) with ω 3 = 1. We'll show that P is not a pole of G for some A and D in k and hence by the arguments in the preceding paragraph, G has no pole at all and thus is constant.
First, we assume that the characteristic of k is not 3. We need the following facts: We can conclude that the function that maps each element in k(H) to its Laurent series expansion in k((x)) is a one-to-one ring homomorphism [13,Problem 2.32]. We write f = r i=m c i x i where m ∈ Z and r ∈ Z ∪ {∞} to mean that f has the Laurent series expansion r i=m c i x i . We also denote by O(x n ) any unspecified series of order at least n.
Next, we find the series expansion of y in terms of x. The order of y at P is ord P (y) = 0, since y is defined and is nonzero at P . Thus y has a power series expansion y = ∞ i=0 c i x i . As ax 3 + y 3 + 1 − dxy is zero in k(H) and the function that maps each element in k(H) to its Laurent series expansion is a one-to-one ring homomorphism, Since y − c 0 vanishes at P , we have c 0 = −ω. Then, solving for c 1 and c 2 gives Then, Note that by the characterization of the 3-torsion in the preceding section, that the kernel does not contain a point of order 3 is equivalent to s i t i = 0. In the remainder of the proof, we use the definition S := n i=1 s i , and since −(s i : t i : 1) = (s i /t i : 1/t i : 1), we have Moreover, we also use the following formula for the product of power series: Moreover, Substitution into G, with some additional simplifying using (1), yields i.e. G has no pole and thus is constant. Finally, we consider the case when k has characteristic 3. In particular, x is not a uniformizer for k[H] P . Instead, ω = 1, and u = y + 1 is a uniformizer for k[H] P . Since x is defined and vanishes at P , i.e. ord P (x) ≥ 1, x has a power series expansion Solving for b 1 , b 2 , . . . , we get Note that in characteristic 3, by the definition of twisted Hessian curves, d = 0. Then, Using the identities in (1) we obtain the simplified expression Substitution into the definition of G, with additional simplification in characteristic 3, yields Therefore, if D = (1 − 2n)d/S, G = O(1) and thus is constant. We have proved that for the value of D stated in theorem, G is constant. So if G(Q) = 0 for some Q, then G = 0. Next, we find A ∈ k such that G

Rational-map representations
In this section, we derive efficient rational-map representations of the isogeny in Theorem 4 and examine their computational complexity by counting the number of multiplications, squarings, and inversions. We denote by S, M, M a , and I the cost of squaring, multiplication, multiplication by a, and inversion respectively.
In general, the computational cost depends on many factors, for examples, how the points are represented: projective, affine, or both (mixed), how much we want to avoid inversions, how the coordinate maps are represented (e.g. polynomials or rational functions), and the particular applications and their amortized running time. In our analysis, we will work with purely affine coordinates or purely projective coordinates, and allow up to one inversion operation. Furthermore, we separate the computation into two parts: one that involves only the kernel and one that requires the input point.

Affine coordinates
Due to the symmetry between the Z and Y coordinates, we have a choice whether to work with the X-affine and Z-affine patch. We will analyze both cases.
In counting the number of operations, we separate the computation into two parts: one that involves only the kernel and one that requires the input point. First, we look at (5).
To process the kernel, we compute the following values: . This step takes sS + (2s + r)M a + rM .
The products A final step takes 2M + 1I.
. H(a, d) and |F | ≡ 0 (mod 3), where (β i , γ i ) has order greater than 2 and (β i ,β i ) has order 2. Let φ be the isogeny in Theorem 4 with kernel F . Then, Moreover, using the notation of Theorem 4, Note that the expression for D doesn't involve any inversion.
Proof. Equation (10) follows from Theorem 4, the rotated addition formula, and simplification using equations (7) and (8) in Lemma 2. Equation (11) follows from Theorem 4, the standard addition formula, and simplification using equations (8) and (9) in Lemma 2. The expression for D follows because, using the notation in Theorem 4, By rewriting (10) and (11) as and straightforward counting as before, the costs of (12) and (13) are given in Table 1.

Projective coordinates
be a subgroup of H(a, d) and |F | ≡ 0 (mod 3), where (α i : β i : γ i ) has order greater than 2 and (α i :β i :β i ) has order 2. Let φ be the isogeny in Theorem 4 with kernel F . Then, Proof. The corollary follows by projectivizing the expressions in previous corollaries.
By straightforward counting, (15) takes (2r + s)S + (r + s)M + sM a to process the kernel and (9s + 9r + 3)M + 3S for the input point, and (14) takes additional 2rM a for processing the kernel. The results are summarized in Table 1.

Comparison with other formulas
For comparison, consider the isogeny formula from [27] for Edwards curves, which is the most efficient to our knowledge so far. We note that the authors reported the cost of (6s+1)M +2S +I in affine coordinates or (6s+3)M +4S in mixed coordinates (the kernel is in affine coordinates and the input point is in projective coordinates), for computing an image point. However, in each case, up to sI were required for preprocessing the kernel points. Here, we consider a different approach that avoids inversions entirely in the projective case and uses only 1 inversion in the affine case. First, we consider the projective case. Suppose the kernel is The isogeny is For processing the kernel, one can compute β 2 i γ 4 i , α 2 i γ 4 i , and d 2 α 2 i β 4 i , for all i, with (5s + 1)S + 4sM . For computing the image point, x 2 z 2 , y 2 z 2 , x 2 y 2 , and z 4 , take 3M and 4S. If the characteristic is not 2, By the definition of (twisted) Edwards curves, the characteristic is not 2, and we can compute each pair of 2(β 2 i γ 4 i x 2 z 2 − α 2 i γ 4 i y 2 z 2 ) and 2(β 2 i γ 4 i y 2 z 2 − α 2 i γ 4 i x 2 z 2 ) for the x and y coordinates with only 2M using the identities: 2(ax − by) = (a − b)(x + y) + (a + b)(x − y) and 2(ay − bx) = (a − b)(x + y) − (a + b)(x − y).
Each factor β 2 i γ 4 i z 4 − d 2 α 2 i β 4 i x 2 y 2 in the z coordinate takes 2M , and let cost(2 s ) be the cost of computing 2 s . Multiplication of all the factors in the x and y coordinates takes 2sM , and multiplication of the factors in the z coordinate including 2 s takes (s+1)M . Therefore, the total cost of computing an image point is 4S + (7s + 4)M + cost(2 s ).
Similarly, in affine coordinates, we can compute the Edwards isogeny map using (3s+1)S+2sM for processing the kernel and (6s+1)M +2S+I+cost(2 s ) for the input point. The comparison is summarized in Table 2, where we assume the kernel size is odd and 1S = 0.8M . We note that our formulas for twisted Hessian curves have the lowest costs for processing the kernel and our X-affine formula has the lowest cost for processing an input point in affine coordinates.  [27] (3.6s + 1.6)M (6s − 0.4)M + 2I Vélu's [34] 9.8M (13s + 1.8)M + 1I