<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Jan 29, 2014, at 6:52 AM, Robert Ransom <<a href="mailto:rransom.8774@gmail.com">rransom.8774@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">While counting points on Edwards curves, I've found two obvious,<br>useful patterns of isogenies. I haven't seen them documented<br>anywhere, so I'll list them here. (At the very least, they're useful<br>to anyone searching for a new curve.)<br><br>For lack of a better ASCII-friendly notation, I'll use Ed(foo, bar) to<br>denote the Edwards curve a*x^2 + y^2 = 1 + d*x^2*y^2 with a=foo,<br>d=bar; and Mont(foo, bar) to denote the Montgomery curve B*y^2 = x^3 +<br>A*x^2 + x with B=foo, A=bar.<br><br>The first pattern is that Ed(1, d) is isogenous to Ed(-1, d-1) for<br>every d that I have tested.</blockquote><br><div>I noticed this too, and I wrote up pretty much exactly what you're thinking. See <a href="http://eprint.iacr.org/2014/027.pdf">http://eprint.iacr.org/2014/027.pdf</a> :-)</div><div><br></div><blockquote type="cite">The second pattern is that Mont(1, 4*d + 2) is isogenous to Ed(-1,<br>d). For example:<br><br>I noticed this pattern while looking for a twist-secure<br>small-parameter Edwards curve over the Curve25519 coordinate field:<br>the first winning curve had a value of d suspiciously similar to<br>(A+2)/4 for one of the curves that Dr. Bernstein considered in the<br>Curve25519 paper. Further experiments showed that the pattern held<br>for the other two curves considered there, including Curve25519<br>itself.</blockquote><br></div><div>This is neat, and I didn't know it before you mentioned it on the Montgomery thread. Do you know what the isogeny is? Is it simple, and does it interact nicely with point compression? Is it a 2-isogeny or a 4-isogeny?</div><div><br></div><div>Cheers,</div><div>-- Mike</div></body></html>