Skip to content

Back to the catalog

Radical isogenies on every model
eprint.iacr.orgpaper

Radical isogenies on every model

Radical isogenies on every model is an IACR ePrint paper by Thomas Decru (October 2026). It gives radical isogeny steps of every odd degree N directly on short Weierstrass, Montgomery, twisted Edwards, Huff, Jacobi quartic, twisted Hessian, Legendre and Jacobi intersection curves, plus Kummer lines. In Tate normal form a step drops from 12.5N to 10N multiplications. Montgomery and twisted Edwards curves cost 10.5N+O(1) per step and 2N to push a point. All algorithms are inversion-free, with exact operation counts.

TL;DR Extends radical isogeny formulas from Tate normal form to most elliptic curve models, with cheaper inversion-free steps for CSIDH-style chains.
Open original ↗
Document

What it is

"Radical isogenies on every model" is a preprint by Thomas Decru (KU Leuven), received 27 October 2026 and approved on ePrint on 28 October 2026. Radical isogeny formulae compute a cyclic chain of N-isogenies with one Nth root per step and no torsion point sampling. Before this paper, general N was only known in Tate normal form. The paper gives steps for every odd N directly on other curve models, so a chain no longer needs conversion to Tate normal form.

How it works

The approach is model-independent. The Tate normal form data comes from the x-coordinate of the kernel generator by a shifted recursion. The codomain is then recovered in the original model by locating the image of a distinguished torsion point, without square roots. The abstract also lists curves with a rational point of order 2 as covered, which the catalog summary does not mention.

Costs the abstract states

  • Tate normal form: 10N multiplications plus one exponentiation per step, down from 12.5N.
  • Short Weierstrass: 10N+35.
  • Montgomery and twisted Edwards: 10.5N+O(1) per step.
  • Huff, extended Jacobi quartic, twisted Hessian, Legendre and Jacobi intersection: between 11.5N+O(log N) and 15.5N+O(log N).
  • Pushing a point: 2N multiplications on Montgomery and twisted Edwards with no precomputation. Tate normal form needs 2N+16 plus a shared 2N-7.

What to do

The choice of model depends on whether the chain carries points. If it only walks the chain, Tate normal form (10N) or short Weierstrass (10N+35) is cheapest per step. If it transports torsion points, the abstract names Montgomery and twisted Edwards as cheapest, for example for all N ≥ 19 when two points are pushed. That threshold is the page's own figure. The paper lists CSIDH among its keywords, but the abstract gives no CSIDH-specific numbers.

Caveats

This is an unrefereed preprint. The abstract gives operation counts only, with no implementation or timings. All algorithms are inversion-free. The constants for the four non-Montgomery models are given only as a range.

Organisations named here

  • radical isogenies
  • Tate normal form
  • Thomas Decru
  • Vélu's formulae

Technologies named here

  • CSIDH

Techniques named here

  • Model-independent radical isogeny steps
  • Inversion-free algorithms with exact operation counts

Related in other