Hacker News Reader

> That random point defines Alice's secret isogeny through the isogeny formulas I talked about above.

I don't think the author actually described how a point defines an isogeny...

As far as I can find out you do it by forcing the point you find to be in the kernel of the isogeny, apparently this is enough information to construct the codomain.

So basically if you've constructed point R you then simply require:

phi(P + R) = phi(P)

and see what kind of space you end up with. Apparently it'll still be an elliptic curve.

Yep! In this case, I think you end up constructing, slightly more specifically, the isogeny whose kernel is exactly the cyclic subgroup generated by the point R (i.e., phi(S) is 0 iff S is a power of R). There are explicit formulas ("Vélu's formulas") that let you compute an isogeny from its kernel. Looks like the paper goes into some depth about how to do that computation efficiently, and how to ensure that you choose a cryptographically suitable point R.

Reply on news.ycombinator.com