AAN ATLAS OF THE RICHELOT ISOGENY GRAPH
ENRIC FLORIT AND BENJAMIN SMITH
Abstract.
We describe and illustrate the local neighbourhoods of verticesand edges in the (2 , Introduction
This article is an illustrated guide to the Richelot isogeny graph. Following Kat-sura and Takashima [14], we present diagrams of the neighbourhoods of generalvertices of each type. Going further, we also compute diagrams of neighbourhoodsof general edges, which can be used to glue the vertex neighbourhoods together. Ouraim is to build intuition on the various combinatorial structures in the graph, pro-viding concrete examples for some of the more pathological cases. The authors haveused the results presented here to verify computations and form conjectures wheninvestigating the behaviour of random walks in superspecial isogeny graphs [8].We work over a ground field k of characteristic not 2, 3, or 5. In our applicationto superspecial PPASes, k = F p , though our computations were mostly done overfunction fields over cyclotomic fields.Let A / k be a principally polarized abelian surface (PPAS). A (2 , -isogeny , or Richelot isogeny , is an isogeny φ : A → A (cid:48) of PPASes whose kernel is a maximal2-Weil isotropic subgroup of A [2]. Such a φ has kernel isomorphic to ( Z / Z ) ; itrespects the principal polarizations λ and λ (cid:48) on A and A (cid:48) , respectively, in the sensethat φ ∗ ( λ (cid:48) ) = 2 λ ; and its (Rosati) dual isogeny φ † : A (cid:48) → A satisfies φ † ◦ φ = [2] A .The (2 , -isogeny or Richelot isogeny graph is the directed weighted multigraphdefined as follows. The vertices are isomorphism classes of PPASes over k . If A isa PPAS, then (cid:2) A (cid:3) denotes the corresponding vertex. The edges are isomorphismclasses of (2 , φ : A → A (cid:48) and φ : A → A (cid:48) are isomorphic if thereare isomorphisms of PPASes α : A → A and β : A (cid:48) → A (cid:48) such that φ ◦ α = β ◦ φ ).The edges are weighted by the number of distinct kernels yielding isogenies intheir class. The weight of an edge (cid:2) φ (cid:3) is denoted by w ( (cid:2) φ (cid:3) ). If (cid:2) φ (cid:3) : (cid:2) A (cid:3) → (cid:2) A (cid:48) (cid:3) isan edge, then w ( (cid:2) φ (cid:3) ) = n if and only if there are n kernel subgroups K ⊂ A [2] suchthat A (cid:48) ∼ = A /K (this is independent of the choice of representative isogeny φ ).There are fifteen maximal 2-Weil-istropic subgroups in A [2], though some (orall) might not be defined over k . The sum of the weights of the edges leaving anyvertex is therefore at most 15.The isogeny graph breaks up into connected components within isogeny classes.We are particularly interested in the superspecial isogeny class. Recall that a PPAS Date : December 2020.The second author was supported by ANR CIAO. a r X i v : . [ m a t h . N T ] J a n ENRIC FLORIT AND BENJAMIN SMITH A / F p is superspecial if its Hasse–Witt matrix vanishes identically. Equivalently, A is superspecial if it is isomorphic as an unpolarized abelian variety to a productof supersingular elliptic curves. For background on superspecial and supersingularabelian varieties in low dimension, we refer to Ibuyiyama, Katsura, and Oort [12]and Brock’s thesis [4]. For more general results, we refer to Li and Oort [15]. Definition 1.
The superspecial Richelot isogeny graph is the subgraph Γ SS (2; p ) ofthe Richelot isogeny graph over F p supported on the superspecial vertices. Recall that Γ SS (2; p ) has p / O ( p ) vertices (see § A / F p represents a vertex in Γ SS (2; p ), thenthe invariants corresponding to (cid:2) A (cid:3) are defined over F p , as are all 15 of the (2 , SS (2; p ) is a 15-regular graph. It has interesting number-theoretic properties and applications (such as Mestre’s m´ethode des graphes [16]),and potential cryptographic applications (including [6, 19, 9, 5, 7]). All of these ap-plications depend on a clear understanding of the structure of Γ SS (2; p ): for exam-ple, the local neighbourhoods of vertices with extra automorphisms (and their inter-relations) affect the expansion properties and random-walk behaviour of Γ SS (2; p ),as we see in [8]. 2. Richelot isogenies and isogeny graphs
There are two kinds of PPASes: products of elliptic curves (with the productpolarization) and Jacobians of genus-2 curves. The algorithmic construction ofisogenies depends fundamentally on whether the PPASes are Jacobians or ellipticproducts. We recall the Jacobian case in § § Richelot isogenies.
Let C : y = F ( x ) be a genus-2 curve, with F squarefreeof degree 5 or 6. The kernels of (2 , J ( C ) correspond to factoriza-tions of F into quadratics (of which one may be linear, if deg( F ) = 5): C : y = F ( x ) = F ( x ) F ( x ) F ( x ) , up to permutation of the F i and constant multiples. We call such factorizations quadratic splittings . The kernel (and isogeny) is defined over k if the splitting is.Fix one such quadratic splitting { F , F , F } ; then the corresponding subgroup K ⊂ J ( C )[2] is the kernel of a (2 , φ : J ( C ) → J ( C ) /K . For each1 ≤ i ≤
3, we write F i ( x ) = F i, x + F i, x + F i, . Now let δ = δ ( F , F , F ) := (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) F , F , F , F , F , F , F , F , F , (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) . If δ ( F , F , F ) (cid:54) = 0, then J ( C ) /K is isomorphic to a Jacobian J ( C (cid:48) ), which wecan compute using Richelot’s algorithm (see [3] and [18, § C (cid:48) is defined by C (cid:48) : y = G ( x ) G ( x ) G ( x ) where G i ( x ) := 1 δ ( F (cid:48) j ( x ) F k ( x ) − F (cid:48) k ( x ) F j ( x ))for each cyclic permutation ( i, j, k ) of (1 , , { G , G , G } corresponds to the kernel of the dual isogeny φ † : J ( C (cid:48) ) → J ( C ).If δ ( F , F , F ) = 0, then J ( C ) /K is isomorphic to an elliptic product E × E (cid:48) .which we can compute as follows. There exist linear polynomials U and V such that F = α U + β V and F = α U + β V for some α , β , α , and β ; and since in N ATLAS OF THE RICHELOT ISOGENY GRAPH 3 this case F is a linear combination of F and F , we must have F = α U + β V for some α and β . The elliptic factors are defined by E : y = (cid:89) i =1 ( α i x + β i ) and E (cid:48) : y = (cid:89) i =1 ( β i x + α i ) , and the isogeny φ : J ( C ) → E × E (cid:48) is induced by the product of the double covers π : C → E resp. π (cid:48) : C → E (cid:48) mapping ( x, y ) to ( U /V , y/V ) resp. ( V /U , y/U ).2.2. Isogenies from elliptic products.
Consider a generic pair of elliptic curves E : y = ( x − s )( x − s )( x − s ) , E (cid:48) : y = ( x − s (cid:48) )( x − s (cid:48) )( x − s (cid:48) ) . We have E [2] = { E , P , P , P } and E (cid:48) [2] = { E (cid:48) , P (cid:48) , P (cid:48) , P (cid:48) } where P i := ( s i ,
0) and P (cid:48) i := ( s (cid:48) i , ≤ i ≤
3, we let ψ i : E −→ E i := E / (cid:104) P i (cid:105) and ψ (cid:48) i : E (cid:48) → E (cid:48) i := E (cid:48) / (cid:104) P (cid:48) i (cid:105) be the quotient 2-isogenies. These can be computed using V´elu’s formulæ [21].Nine of the fifteen kernel subgroups of ( E × E (cid:48) )[2] correspond to products ofelliptic 2-isogeny kernels. Namely, for each 1 ≤ i, j ≤ K i,j := (cid:104) ( P i , E (cid:48) ) , (0 E , P (cid:48) i ) (cid:105) ⊂ ( E × E (cid:48) )[2]of the product isogeny φ i,j := ψ i × ψ j : E × E (cid:48) −→ E i × E (cid:48) j ∼ = ( E × E (cid:48) ) /K i,j . The other six kernels correspond to 2-Weil anti-isometries E [2] ∼ = E (cid:48) [2]: they are K π := { (0 E , E (cid:48) ) , ( P , P (cid:48) π (1) ) , ( P , P (cid:48) π (2) ) , ( P , P (cid:48) π (3) ) } for π ∈ Sym( { , , } ) , with quotient isogenies φ π : E × E (cid:48) −→ A π := ( E × E (cid:48) ) /K π . If the anti-isometry P i (cid:55)→ P (cid:48) π ( i ) is induced by an isomorphism E ∼ = E (cid:48) , then A π ∼ = E × E (cid:48) . Otherwise, following [11, Prop. 4], A π is the Jacobian of a genus-2 curve C π : y = − F ( x ) F ( x ) F ( x )where F i ( x ) := A ( s j − s i )( s i − s k ) x + B ( s (cid:48) j − s (cid:48) i )( s (cid:48) i − s (cid:48) k )for each cyclic permutation ( i, j, k ) of (1 , , A := a a (cid:89) ( s (cid:48) i − s (cid:48) j ) where a := (cid:88) ( s j − s i ) s (cid:48) j − s (cid:48) i and a := (cid:88) s i ( s (cid:48) k − s (cid:48) j ) ,B := b b (cid:89) ( s i − s j ) where b := (cid:88) ( s (cid:48) j − s (cid:48) i ) s j − s i and b := (cid:88) s (cid:48) i ( s k − s j ) , where the sums and products are over cyclic permutations ( i, j, k ) of (1 , , φ † π : J ( C π ) → E × E (cid:48) corresponds to the splitting { F , F , F } . ENRIC FLORIT AND BENJAMIN SMITH Automorphism groups of abelian surfaces
We now consider the impact of automorphisms on edge weights in the isogenygraph, following Katsura and Takashima [14], and recall the explicit classificationof reduced automorphism groups of PPASes. In contrast with elliptic curves, where(up to isomorphism) only two curves have nontrivial reduced automorphism group,with PPASes we see much richer structures involving many more vertices. Proofsfor all of the results in this section can be found in [12], [14], and [8].3.1.
Automorphisms and isogenies.
Let φ : A → A /K be a (2 , K . Let α be an automorphism of A , and let φ (cid:48) : A → A /α ( K ) be thequotient isogeny; then α induces an isomorphism α ∗ : A /K → A /α ( K ) such that α ∗ ◦ φ = φ (cid:48) ◦ α .If α ( K ) = K , then A /K = A /α ( K ), so α ∗ is an automorphism of A /K . Goingfurther, if S is the stabiliser of K in Aut( A ), then S induces an isomorphic subgroup S (cid:48) of Aut( A /K ), and in fact S (cid:48) is the stabiliser of ker( φ † ) in Aut( A /K ).If α ( K ) (cid:54) = K then the quotients A /K and A /α ( K ) are different, so α ∗ is anisomorphism but not an automorphism. The isogenies φ and φ α := α − ∗ ◦ φ (cid:48) haveidentical domains and codomains, but distinct kernels; thus, they both representthe same edge in the isogeny graph, and w ( (cid:2) φ (cid:3) ) > −
1] in its automorphism group, but [ −
1] fixes every kerneland commutes with every isogeny—so it has no impact on edges or weights in theisogeny graph. We can therefore simplify by quotienting [ −
1] out of the picture.
Definition 2. If A is a PPAS, then its reduced automorphism group is RA( A ) := Aut( A ) / (cid:104) [ − (cid:105) . Since (cid:104) [ − (cid:105) is contained in the centre of Aut( A ), the quotient RA( A ) acts onthe set of kernel subgroups of A [2]. We have two useful results for (2 , φ : A → A /K . First, if O K is the orbit of K under RA( A ), then there are O K distinct kernels of isogenies representing (cid:2) φ (cid:3) : that is, w ( (cid:2) φ (cid:3) ) = O K . Second, we have the “ratio principle” from [8, Lemma 1]:(1) A ) · w ( (cid:2) φ † (cid:3) ) = A (cid:48) ) · w ( (cid:2) φ (cid:3) ) . Reduced automorphism groups of Jacobians.
There are seven possiblereduced automorphism groups for Jacobian surfaces (provided p >
5; see [1]). Fig-ure 1 gives the taxonomy of Jacobian surfaces by reduced automorphism group,using Bolza’s names (“types”) for the classes of Jacobian surfaces with each ofthe reduced automorphism groups (we add
Type-A for the Jacobians with trivialreduced automorphism group). We will give normal forms for each type in § (cid:2) J ( C ) (cid:3) ←→ ( A : B : C : D ) ∈ P (2 , , , k ) , where A , B , C , and D are homogeneous polynomials of degree 2, 4, 6, and 10in the coefficients of the sextic defining C (see [17, § P (2 , , , A : B : C : D ) = ( λ A : λ B : λ C : λ D ) for all λ (cid:54) = 0 ∈ k . N ATLAS OF THE RICHELOT ISOGENY GRAPH 5
Type-A : 1
Type-II : C Type-I : C Type-III : C Type-IV : S Type-V : D × Type-VI : S dim = 0dim = 1dim = 2dim = 3 Figure 1.
Reduced automorphism groups for genus-2 Jacobians.Dimensions are of the corresponding loci in the 3-dimensional mod-uli space of PPASes. Lines connect sub- and super-types.We will not define ( A : B : C : D ) explicitly here; in practice, we compute themusing (e.g.) ClebschInvariants in Magma [2] or clebsch invariants in Sage [20].To determine RA( J ( C )) for a given C , we use Bolza’s criteria on Clebsch invari-ants given in Table 1. We will need some derived invariants (see [17]): let A = 2 C + 13 AB , A = 23 ( B + AC ) , A = 12 B · A + 13 C · A ,A = D , A = D , A = 12 B · A + 13 C · A , and let R be defined by 2 R = det( A ij ) (we will only need to know whether R = 0).Type Conditions on Clebsch invariants Type-A R (cid:54) = 0, ( A : B : C : D ) (cid:54) = (0 : 0 : 0 : 1) Type-I R = 0, A A (cid:54) = A Type-II ( A : B : C : D ) = (0 : 0 : 0 : 1) Type-III BA − AA = − D , CA + 2 BA = AD , 6 C (cid:54) = B , D (cid:54) = 0 Type-IV C = B , 3 D = 2 BA , 2 AB (cid:54) = 15 C , D (cid:54) = 0 Type-V B = A , D = 0, A = 0, A (cid:54) = 0 Type-VI ( A : B : C : D ) = (1 : 0 : 0 : 0) Table 1.
Determining the RA-type of J ( C ) from its Clebsch invariants.3.3. Reduced automorphism groups of elliptic products.
There are sevenpossible reduced automorphism groups for elliptic product surfaces [8, Prop. 3].Figure 2 shows the taxonomy of elliptic product surfaces by reduced automorphismgroup. The names (“types”) for the classes of surfaces are taken from [8].Every elliptic product
E × E (cid:48) has an involution σ = [1] × [ −
1] in RA(
E × E (cid:48) ). If
E ∼ = E (cid:48) then there is also the involution τ exchanging the factors of the product.The situation is more complicated if either or both factors are isomorphic to one of E : y = x − E ) = (cid:104) ζ : ( x, y ) (cid:55)→ ( ζ x, − y ) (cid:105) ∼ = C where ζ is a primitive 3rd root of unity, or E : y = x − x with Aut( E ) = (cid:104) ι : ( x, y ) (cid:55)→ ( − x, √− y ) (cid:105) ∼ = C . ENRIC FLORIT AND BENJAMIN SMITH
Type- Π: C Type- Σ: C Type- Π : C Type- Π : C Type- Σ : C × S Type- Π , : C Type- Σ : C (cid:111) C dim = 0dim = 1dim = 2 Figure 2.
Reduced automorphism groups of elliptic products. Di-mensions are of the corresponding loci in the 3-dimensional modulispace of PPASes. Lines connect sub- and super-types.When constructing isogenies, we label the 2-torsion of E and E as follows: E [2] = { , P = (1 , , P = ( ζ , , P = ( ζ , } , E [2] = { , P = (1 , , P = ( − , , P = (0 , } . When navigating isogeny graphs, we can identify the isomorphism class of anelliptic product using the pair of j -invariants of the factors: (cid:2) E × E (cid:3) ←→ { j ( E ) , j ( E ) } . To determine RA( E × E ), we can use the criteria on j -invariants given in Table 2.Type Conditions Type Conditions Type- Π { j ( E ) , j ( E ) } ∩ { , } = ∅ Type- Σ j ( E ) = j ( E ), Type- Π j ( E ) = 0 or j ( E ) = 0 j ( E i ) (cid:54)∈ { , } Type- Π j ( E ) = 1728 or j ( E ) = 1728 Type- Σ j ( E ) = j ( E ) = 0 Type- Π , { j ( E ) , j ( E ) } = { , } Type- Σ j ( E ) = j ( E ) = 1728 Table 2.
Determining the RA-type of an elliptic product E × E .3.4. Superspecial vertices.
Ibukiyama, Katsura, and Oort have computed theprecise number of superspecial genus-2 Jacobians (up to isomorphism) of each re-duced automorphism type [12, Theorem 3.3]. We reproduce their results for p > F p ) in Table 3. Definition 3.
For each prime p > , we define the following quantities: • (cid:15) ,p = 1 if p ≡ , 0 otherwise; • (cid:15) ,p = 1 if p ≡ , , 0 otherwise; • (cid:15) ,p = 1 if p ≡ , 0 otherwise; • (cid:15) ,p = 1 if p ≡ , 0 otherwise; • N p = ( p − / − (cid:15) ,p / − (cid:15) ,p / .Note that N p , (cid:15) ,p , and (cid:15) ,p count the isomorphism classes of supersingular ellipticcurves over F p with reduced automorphism group of order , , and , respectively. If the reader chooses suitable values of p and computes Γ SS (2; p ), then they willfind graphs built from overlapping copies of the neighbourhoods described in § SS (2; p ) is much more complicated than the elliptic 2-isogenygraph. N ATLAS OF THE RICHELOT ISOGENY GRAPH 7
Type Vertices in Γ SS (2; p ) Type Vertices in Γ SS (2; p ) Type-I ( p − p − Type- Π N p ( N p − (cid:15) ,p + (cid:15) ,p + (cid:15) ,p Type- Π (cid:15) ,p N p Type-II (cid:15) ,p Type- Π (cid:15) ,p N p Type-III N p + (cid:15) ,p − (cid:15) ,p − (cid:15) ,p Type- Π , (cid:15) ,p · (cid:15) ,p Type-IV N p + (cid:15) ,p − (cid:15) ,p Type- Σ N p Type-V (cid:15) ,p Type- Σ (cid:15) ,p Type-VI (cid:15) ,p Type- Σ (cid:15) ,p Type-A ( p − p − p + 346) − (cid:15) ,p − (cid:15) ,p − (cid:15) ,p − (cid:15) ,p Table 3.
The number of superspecial vertices of each RA-type.4.
An atlas of the Richelot isogeny graph
We are now ready to compute the neighbourhoods of each type of vertex andedge in the Richelot isogeny graph. We begin with general (
Type-A ) vertices, beforeconsidering each type with an involution, in order of increasing speciality, andending with
Type-II (which has no involution).4.1.
The algorithm.
We compute each vertex neighbourhood in the same way:(1) Take the generic curve or product for the RA-type. We use Bolza’s nor-mal forms for the curves with special reduced automorphism groups fromBolza [1], reparametrizing to force full rational 2-torsion in the Jacobians.(2) Enumerate the (2 , § § Diagram notation.
In all of our diagrams, solid vertices have definitetypes, and solid edges have definite weights. The dotted vertices have anindicative type, but may change type under specialization, acquiring more auto-morphisms, with the weight of dotted edges increasing proportionally accordingto Eq. (1). For example: in Figure 3, if one of the dotted neighbours specializes toa
Type-I vertex, then the returning dotted arrow will become a weight-2 arrow. Alledges from solid vertices are shown; some edges from dotted vertices, especially tovertices outside the diagram, are omitted for clarity.4.3.
General vertices and edges.
Figure 3 shows the neighbourhood of a
Type-A vertex: there are weight-1 edges to fifteen neighbouring vertices, generally all
Type-A , and a weight-1 dual edge returning from each of them.The Richelot isogeny graph is 15-regular (counting weights), and it is temptingto imagine that locally, the graph looks like an assembly of copies of the star inFigure 3, with each outer vertex becoming the centre of its own star. However, thereality is more complicated. If we look at a pair of neighbouring
Type-A vertices,then six of the neighbours of one are connected to neighbours of the other. Figure 4shows this configuration.
ENRIC FLORIT AND BENJAMIN SMITH
AAAAAAA A A A A AAAAA
Figure 3.
The neighbourhood of a
Type-A vertex.
A AAAA AAAA AAAA AAAAAA A A A A A A AAAAA
Figure 4.
The neighbourhood of a general edge and its dual.The interconnections in Figure 4 are explained as follows. For each (2 , φ : A → A , there are twelve (4 , , , , A to A ; composing any of these with φ † defines a cycle oflength 4 in the graph, which is isomorphic to multiplication-by-4 on A . Thesecycles of length 4 are the “small cycles” exploited by Flynn and Ti in [9, § , , General elliptic products:
Type- Π vertices. The general
Type-
Π vertexis an elliptic product vertex (cid:2)
E × E (cid:48) (cid:3) where E (cid:48) (cid:54)∼ = E , and neither E nor E (cid:48) has special N ATLAS OF THE RICHELOT ISOGENY GRAPH 9 automorphisms. In this case RA(
E ×E (cid:48) ) = (cid:104) σ (cid:105) ∼ = C , which fixes every (2 , C in the reduced automorphism groupof every (2 , Type-
Π; the six Jacobian neighbours are generally
Type-I , the most general type witha reduced involution. The situation is illustrated at the left of Figure 5.ΠΠΠΠΠ Π Π ΠΠΠ
II I I II I Π III IIIA A A A Figure 5.
Neighbourhoods of the general
Type-
Π and
Type-I vertices.
Remark . Looking at Figure 5, we see that
Type-
Π vertices cannot have
Type-A or Type-II neighbours: any walk in the graph from a
Type-A vertex to an ellipticproduct must have already passed through a vertex with an involution in its reducedautomorphism group. We will see below that the same applies to any ellipticproduct or square vertex, as well as to
Type-IV , Type-V , and
Type-VI vertices.4.5.
Type-I vertices.
The generic
Type-I vertex is (cid:2) J ( C I ) (cid:3) , where C I is defined by C I : y = F I ( x ) := ( x − x − s )( x − t )with parameters s and t . Any Jacobian A with C ⊆ RA( A ) (that is, Type-I , Type-III , Type-IV , Type-V , or
Type-VI ) is isomorphic to the Jacobian of J ( C I ) forsome ( s, t ) such that st ( s − t − s − t ) (cid:54) = 0.There are maximal 2-Weil isotropic subgroups K , . . . , K of J ( C I )[2]; eachis the kernel of a (2 , J ( C I ) = A → A i = A /K i . The kernels K i correspond to the following quadratic splittings. First: K ↔ { x − , x − s , x − t } . These three quadratics are linearly dependent, so A ∼ = E × E (cid:48) with factors E : y =( x − x − s )( x − t ) and E (cid:48) : y = ( x − x − /s )( x − /t ).Six of the kernels share a nontrivial element with K , namely K ↔ { x − , x ± ( s + t ) x + st } , K ↔ { x − , x ± ( s − t ) x − st } ,K ↔ { x − s , x ± ( t + 1) x + t } , K ↔ { x − s , x ± ( t − x − t } ,K ↔ { x − t , x ± ( s + 1) x + s } , K ↔ { x − t , x ± ( s − x − s } . The last eight kernels do not share any nontrivial elements with K , namely K ↔ { x + ( s − x − s, x − ( t − x − t, x − ( s − t ) x − st } ,K ↔ { x − ( s − x − s, x + ( t − x − t, x + ( s − t ) x − st } ,K ↔ { x − ( s − x − s, x − ( t + 1) x + t, x + ( s + t ) x + st } ,K ↔ { x + ( s − x − s, x + ( t + 1) x + t, x − ( s + t ) x + st } ,K ↔ { x + ( s + 1) x + s, x + ( t − x − t, x − ( s + t ) x + st } ,K ↔ { x − ( s + 1) x + s, x − ( t − x − t, x + ( s + t ) x + st } ,K ↔ { x + ( s + 1) x + s, x − ( t + 1) x + t, x − ( s − t ) x − st } ,K ↔ { x − ( s + 1) x + s, x + ( t + 1) x + t, x + ( s − t ) x − st } . The reduced automorphism group is RA( C I ) = (cid:104) σ (cid:105) ∼ = C , where σ acts as σ ∗ : x ←→ − x on x -coordinates, and on (the indices of) the set of kernels { K , . . . , K } via σ ∗ = (1)(2)(3)(4)(5)(6)(7)(8 , , , , . The orbits of the kernel subgroups under σ and the types of the correspondingneighbours are listed in Table 4. The situation is illustrated on the right of Figure 5.Kernel orbit Stabilizer Codomain Kernel orbit Stabilizer Codomain { K } (cid:104) σ (cid:105) Type- Π { K } (cid:104) σ (cid:105) Type-I { K } (cid:104) σ (cid:105) Type-I { K , } Type-A { K } (cid:104) σ (cid:105) Type-I { K , } Type-A { K } (cid:104) σ (cid:105) Type-I { K , } Type-A { K } (cid:104) σ (cid:105) Type-I { K , } Type-A { K } (cid:104) σ (cid:105) Type-I
Table 4.
Edge data for the generic
Type-I vertex.Computing one isogeny step beyond each
Type-I neighbour of (cid:2) J ( C I ) (cid:3) , we find sixneighbours of (cid:2) E × E (cid:48) (cid:3) ; thus we complete Figure 6, which shows the neighbourhoodof the edge (cid:2) φ (cid:3) and its dual, (cid:2) φ † (cid:3) = (cid:2) φ Id (cid:3) . This should be compared with Figure 4.Note that φ i ◦ φ † is a (4 , , , ≤ i ≤ ≤ i ≤ General elliptic squares:
Type- Σ vertices. The general
Type-
Σ vertex is (cid:2)
E × E (cid:3) where E has no special automorphisms, so RA( E ) = (cid:104) σ, τ (cid:105) ∼ = C . Theorbits of the kernel subgroups under RA( E ) (with respect to an arbitrary labellingof E [2]) and the types of the corresponding neighbours are described by Table 5,and the neighbourhood of the generic Type-
Σ vertex is shown on the left of Figure 7.4.7.
Type-III vertices.
The generic
Type-III vertex is (cid:2) J ( C III ) (cid:3) , where C III : y = ( x − x − u )( x − /u )with u a free parameter; note that C III ( u ) = C I ( s, t ) with ( s, t ) = ( u, u − ). Wehave RA( J ( C ) III ) = (cid:104) σ, τ (cid:105) ∼ = C , where σ is inherited from Type-I and τ acts on x -coordinates via τ ∗ : x (cid:55)−→ /x . N ATLAS OF THE RICHELOT ISOGENY GRAPH 11 I ΠΠ II I Π II I Π II IA A A A II Π ΠΠΠΠΠ
Figure 6.
The neighbourhood of a general
Type-I vertex and its
Type-
Π neighbour.Kernel orbit Stab. Codomain Kernel orbit Stab. Codomain { K , } (cid:104) σ, τ (cid:105) Type- Σ { K Id } (cid:104) σ, τ (cid:105) (loop) { K , } (cid:104) σ, τ (cid:105) Type- Σ { K (1 , } (cid:104) σ, τ (cid:105) Type-III { K , } (cid:104) σ, τ (cid:105) Type- Σ { K (1 , } (cid:104) σ, τ (cid:105) Type-III { K , , K , } (cid:104) σ (cid:105) Type- Π { K (2 , } (cid:104) σ, τ (cid:105) Type-III { K , , K , } (cid:104) σ (cid:105) Type- Π { K (1 , , , K (1 , , } (cid:104) σ (cid:105) Type-I { K , , K , } (cid:104) σ (cid:105) Type- Π Table 5.
Edge data for the generic
Type-
Σ vertex.ΣΠ2Π 2 Π2ΣΣ Σ
III III IIII III ΣΣ A I I I I Figure 7.
Neighbourhoods of the general
Type-
Σ and
Type-III vertices.Specializing the kernels and quadratic splittings of § s, t ) = ( u, u − ), we seethat RA( J ( C III )) acts on the kernel indices by σ ∗ = (1)(2)(3)(4)(5)(6)(7)(8 , , , , ,τ ∗ = (1)(2)(3)(4 , , , , . The kernel orbits and the edges leaving (cid:2) J ( C III ) (cid:3) are described in Table 6.Orbit Stab. Codomain Orbit Stab. Codomain { K } (cid:104) σ, τ (cid:105) Type- Σ { K , K } (cid:104) σ (cid:105) Type-I { K } (cid:104) σ, τ (cid:105) (loop) { K , K } (cid:104) τ (cid:105) Type-I { K } (cid:104) σ, τ (cid:105) Type- Σ { K i : 10 ≤ i ≤ } Type-A { K , K } (cid:104) σ (cid:105) Type-I { K , K } (cid:104) τ (cid:105) Type-I
Table 6.
Edge data for the generic
Type-III vertex.We observe that J ( C III ) /K ∼ = J ( C III ): that is, φ is a (2 , J ( C III ), so (cid:2) φ (cid:3) is a weight-1 loop. The kernels K and K are stabilised byRA( J ( C III )) and δ ( K ) = δ ( K ) = 0, so (cid:2) φ (cid:3) and (cid:2) φ (cid:3) are weight-1 edges to Type-
Σ vertices (cid:2) E (cid:3) and (cid:2) ( E (cid:48) ) (cid:3) , respectively, where E and E (cid:48) are the elliptic curves E : y = ( x − x − u )( x − /u ) , E (cid:48) : y = − x − (cid:16) x + 2 u − u + 1( u + 1) x + 1 (cid:17) . There is a 2-isogeny ϕ : E → E (cid:48) , as predicted in [10, §
4] (in fact ker ϕ = (cid:104) (1 , (cid:105) and ker ϕ † = (cid:104) (1 , (cid:105) ), so there are edges (cid:2) ϕ × ϕ (cid:3) and (cid:2) ϕ † × ϕ † (cid:3) between (cid:2) E (cid:3) and (cid:2) ( E (cid:48) ) (cid:3) . The neighbourhood of the general Type-III vertex is shown on the rightof Figure 7. Combining with the
Type-
Σ neighbourhood and extending to includeshared adjacent vertices yields Figure 8.4.8.
Elliptic 3-isogenies:
Type-IV vertices.
The generic
Type-IV vertex is rep-resented by J ( C IV ( v )), where C IV ( v ) := C I ( s IV ( v ) , t IV ( v )) with s IV ( v ) := ( v + 1)( v − ζ )( v − v + ζ ) and t IV ( v ) := ( v + 1)( v − ζ )( v − v + ζ )where ζ is a primitive third root of unity and v is a free parameter. We haveRA( C IV ( v )) = (cid:104) σ, ρ (cid:105) ∼ = S , where σ is inherited from Type-I and ρ is the order-3automorphism acting on x -coordinates via ρ ∗ : x (cid:55)−→ (cid:0) (2 ζ + 1)( v − x + 3( v + 1) (cid:1) / (cid:0) v − x + (2 ζ + 1)( v − (cid:1) . Specializing the kernels and quadratic splittings from § J ( C IV )) on (the indices of) the K i is given by ρ ∗ = (1 , , , , , , , , ,σ ∗ = (1)(2)(3)(4)(5)(6)(7)(8 , , , , . The kernel orbits and the edges leaving (cid:2) J ( C ) IV (cid:3) described in Table 7, and illus-trated in Figure 9. We find that (cid:2) A (cid:3) = (cid:2) A (cid:3) = (cid:2) A (cid:3) = (cid:2) E × E (cid:48) (cid:3) , where E : y = ( x − x − s IV ( v ) )( x − t IV ( v ) )and E (cid:48) : y = ( x − x − /s IV ( v ) )( x − /t IV ( v ) ) . There is a 3-isogeny Φ :
E → E (cid:48) , as predicted in [10, § x − ( v + 1) / ( v − , and the kernel of Φ † is cut out by x − ( v − / ( v + 1) .Elliptic products with a 3-isogeny between the factors therefore play a special rolein the Richelot isogeny graph; we will represent these special Type-
Π vertices using
N ATLAS OF THE RICHELOT ISOGENY GRAPH 13 Σ I III
Π Σ
III
Π Σ
III Π I I I I A I I I I A I I I I A
42 Π2
Figure 8.
The neighbourhood of a generic
Type-
Σ vertex and its
Type-III neighbours. IV Φ3 I I I IV IV IV
Figure 9.
The neighbourhood of the general
Type-IV vertex.the symbol Φ. We remark that the presence of the 3-isogeny severely constrainsthe possible specializations of a Φ-vertex.Figure 10 shows the neighbourhood of the edges between a general
Type-IV vertexand its Φ-neighbour; it should be compared with Figures 4 and 6.
Type-IV verticescorrespond to Φ-vertices, and edges between
Type-IV vertices correspond to edgesbetween Φ-vertices.
Kernel orbit Stabilizer Codomain Kernel orbit Stabilizer Codomain { K , K , K } (cid:104) σ (cid:105) Type-
Π (Φ) { K } (cid:104) σ, ρ (cid:105) Type-IV { K , K , K } (cid:104) σ (cid:105) Type-I { K } (cid:104) σ, ρ (cid:105) Type-IV { K , K , K } (cid:104) σ (cid:105) Type-I { K } (cid:104) σ, ρ (cid:105) Type-IV { K , K , K } (cid:104) σ (cid:105) Type-I
Table 7.
Edge data for the generic
Type-IV vertex. IV Φ3 Φ
IVI I
333 Φ
IVI I
333 Φ
IVI I II Π ΠΠΠΠΠ
Figure 10.
The neighbourhood of a
Type-IV vertex and its
Type-
Π neighbour.4.9.
The
Type- Π family. The
Type- Π vertices are (cid:2) E × E (cid:3) for elliptic curves E (cid:54)∼ = E . We have RA( E × E ) = (cid:104) σ, [1] × ζ (cid:105) ∼ = C . The automorphism ζ of E cyclesthe points of order 2 on E , so [1] × ζ fixes no (2 , E × E [2] form orbits of three, and so we see the five neighbourswith weight-3 edges in Figure 11 (which should be compared with Figure 5).Π Π3Π 3Π 3 I I Figure 11.
The neighbourhood of a generic
Type- Π vertex. N ATLAS OF THE RICHELOT ISOGENY GRAPH 15
The
Type- Π family. The
Type- Π vertices are (cid:2) E × E (cid:3) for ellipticcurves E (cid:54)∼ = E . The curve E has an order-4 automorphism ι which fixes onepoint P of order 2, and exchanges P and P . We therefore have an order-4 element α = [1] × ι generating RA( E × E ) ∼ = C , and α = [1] × [ −
1] = σ (which fixesall the kernels). Hence, with respect to (cid:104) α (cid:105) , the isometries form three orbits of sizetwo, as do the six product kernels not involving P ; on the other hand, the kernels (cid:104) P (cid:105) × (cid:104) P (cid:105) are fixed by α , and since E / (cid:104) P (cid:105) ∼ = E we get three weight-1 edgesto Type- Π vertices. The situation is illustrated in Figure 12 (which should becompared with Figure 5). Π Π Π Π Π 2Π2 Π2 I I I Figure 12.
The neighbourhoods of the generic
Type- Π vertex.4.11. The
Type- Π , vertex. The unique
Type- Π , vertex is (cid:2) E × E (cid:3) . Itsreduced automorphism group is RA( E × E ) = (cid:104) ζ × [1] , [1] × ι (cid:105) ∼ = C . Thekernel orbits and edges can be derived using a combination of the analyses in § § Type- Π , vertex, illustrated in Figure 13, is a combination of the Type- Π and Type- Π neighbourhoods of Figures 11 and 12.Kernel orbit Stabilizer Codomain type(conjugate) General p p = 7 p = 11 { K , , K , , K , } (cid:104) [1] × ι (cid:105) Type- Π Type- Π Type- Σ { K i,j : 1 ≤ i ≤ , ≤ j ≤ } (cid:104) σ (cid:105) Type- Π Type- Π (loops) { K π : π ∈ S } (cid:104) σ (cid:105) Type-I Type-I Type-IV
Table 8.
Edge data for the unique
Type- Π , vertex.4.12. The
Type- Σ vertex. The unique
Type- Σ vertex is (cid:2) E (cid:3) . We haveRA( E ) = (cid:104) σ, τ, [1] × ι (cid:105) ∼ = C (cid:111) C . The kernel orbits and edges are described inTable 9. Figure 14, illustrating the neighbourhood of (cid:2) E (cid:3) , should be comparedwith Figure 7. Π , Π
3Π 6 I Figure 13.
The neighbourhood of the
Type- Π , vertex.Σ
2Σ 4
III Figure 14.
The neighbourhood of the
Type- Σ vertex. Thedotted neighbour types change for p = 7 and 11 (see Table 9).Kernel orbit Stabilizer Codomain type(conjugate) General p p = 7 p = 11 { K , , K , , K , , K , } (cid:104) σ, τ (cid:105) Type-
Σ (loops)
Type- Σ { K , , K , , K , , K , } (cid:104) [1] × ι (cid:105) Type- Π (loops) Type- Π , { K , } RA( E ) (loop) (loop) (loop) { K Id , K (1 , } (cid:104) τ, ι × ι (cid:105) (loops) (loops) (loops) (cid:26) K (1 , , , K (1 , , ,K (1 , , K (1)(2 , (cid:27) (cid:104) σ, τ (cid:105) Type-III Type-III Type-V
Table 9.
Edge data for the unique
Type- Σ vertex.Kernel orbit Stabilizer Codomain type(conjugate) General p p = 11 { K i,j : 1 ≤ i, j ≤ } (cid:104) σ, τ (cid:105) Type- Σ Type- Σ { K Id , K (1 , , , K (1 , , } (cid:104) τ, ζ × ( − ζ ) (cid:105) (loop) (loop) { K (1 , , K (1 , , K (2 , } (cid:104) τ, ζ × ζ (cid:105) Type-V Type-V
Table 10.
Edge data for the unique
Type- Σ vertex.4.13. The
Type-V and
Type- Σ vertices. The
Type-V and
Type- Σ vertices arealways neighbours, so we treat them simultaneously.The unique Type- Σ vertex is (cid:2) E (cid:3) , and RA( E ) = (cid:104) τ, [1] × ζ, ζ × [1] (cid:105) / (cid:104)− (cid:105) ∼ = C × S . The kernel orbits and edges are described in Table 10.The unique Type-V vertex is (cid:2) J ( C V ) (cid:3) , where C V : y = x + 1; note that C V = C III ( ζ ) = C I ( ζ , /ζ ), where ζ is a primitive sixth root of unity. We N ATLAS OF THE RICHELOT ISOGENY GRAPH 17 have RA( C V ) = (cid:104) σ, τ, ζ (cid:105) , where σ and τ are inherited from C III , and ζ is a newautomorphism of order 6 such that ζ = σ . Specializing the kernels and quadraticsplittings from § K i via τ ∗ = (1)(2)(3)(4 , , , , , , ,ζ ∗ = (1)(2 , , , , , , , , , , ,σ ∗ = ζ ∗ = (1)(2)(3)(4)(5)(6)(7)(8 , , , , . The kernel orbits and edges are described in Table 11.Figure 15 illustrates the shared neighbourhood of the
Type-V and
Type- Σ ver-tices for general p ; it should be compared with Figure 7. The Type-I neighbourof the
Type-V vertex always has four (2 , Type-I and
Type-
Π neighbours of the
Type-IV vertex, since these are also connected to the
Type-
Σ and
Type-I neighbours. Dashedneighbour types may change for p = 11, 17, 29, and 41 (see Table 11). V Σ I Σ IV Φ I
33 33 2 6 49 2 33 3
Figure 15.
The neighbourhood of the
Type-V and
Type- Σ vertices.Kernel orbit Stabilizer Codomain type(conj.) General p p = 11 p = 17 p = 29 p = 41 { K } (cid:104) τ, ζ (cid:105) Type- Σ Type- Σ Type- Σ Type- Σ Type- Σ { K , K , K } (cid:104) σ, τ (cid:105) (loops) (loops) (loops) (loops) (loops) { K , K , K } (cid:104) σ, τ (cid:105) Type- Σ Type- Σ Type- Σ Type- Σ Type- Σ { K , K } (cid:104) τ ζ, ζ (cid:105) Type-IV Type-IV Type-IV Type-VI Type-IV { K i : 10 ≤ i ≤ } (cid:104) στ (cid:105) Type-I Type-IV (loops)
Type-I Type-III
Table 11.
Edge data for the
Type-V vertex
Remark . To see the
Type-V neighbourhood in Figure 15 as a specialization of the
Type-IV diagram (Figure 9): • the Type-
Π neighbour specializes to (cid:2) E (cid:3) , where E has j -invariant 54000and an endomorphism of degree 3; • one of the Type-IV neighbours degenerates to
Type- Σ ; • the other two Type-IV neighbours merge, yielding a weight-2 edge; • one of the Type-I neighbours specializes to
Type-V , yielding a loop; • the other two Type-I neighbours merge, yielding a weight-6 edge.
The
Type-VI vertex.
The unique
Type-VI vertex is (cid:2) J ( C V I ) (cid:3) , where C V I = C IV ( v V I ) with v V I = ( ζ + ζ +1) / √ ζ = ζ . This curve is isomorphic toBolza’s Type-VI normal form y = x ( x +1). We have RA( J ( C V I )) = (cid:104) σ, ρ, ω (cid:105) ∼ = S ,where σ and ρ are inherited from C III and ω is an order-4 automorphism acting as ω ∗ : x (cid:55)−→ ( x − ( √ / (( √ − x + 1)on x -coordinates. Specializing the splittings of § s = s IV ( v V I ) = − ζ √ − ζ and t = t IV ( v V I ) = 2 √ J ( C V I )) acts as σ ∗ = (1)(2)(3)(4)(5)(6)(7)(8 , , , , ,ρ ∗ = (1 , , , , , , , , ,ω ∗ = (1 , , , , , , , , , , Type-
Σ neighbour is special: it is (cid:2) E (cid:3) where E is an elliptic curveof j -invariant 8000; it is Φ, because E has a degree-3 endomorphism. Pushing onestep beyond the Type-IV neighbours, we find new
Type-I and Φ vertices connectedto (cid:2) E (cid:3) , and we thus complete the neighbourhood shown in Figure 16.Kernel orbit Stabilizer Codomain type(conjugate) General p p = 7 p = 13 , { K , K , K , K , K , K } (cid:104) σ, ω (cid:105) Type- Σ Type- Σ Type- Σ { K , K , K , K } (cid:104) σ, ρ (cid:105) Type-IV (loops)
Type-IV / V { K , K , K , K } (cid:104) σ, ρ (cid:105) Type-IV (loops)
Type-V / IV { K } RA( J ( C V I )) (loop) (loop) (loop)
Table 12.
Edge data for the
Type-VI vertex. For p = 13 and p = 29, one of the two Type-IV neighbours specializes to
Type-V ,depending on the choice of ζ . V I ΣΦ IVIV I
Φ44 33 3 3 226
Figure 16.
The neighbourhood of the
Type-VI vertex. The dottedneighbours change type for p = 7, 13, and 29 (see Table 12). N ATLAS OF THE RICHELOT ISOGENY GRAPH 19
The
Type-II vertex.
The unique
Type-II vertex is (cid:2) J ( C II ) (cid:3) where C II isdefined by y = x −
1; we have RA( J ( C II )) = (cid:104) ζ (cid:105) ∼ = C , where ζ acts as ζ ∗ : x (cid:55)−→ ζ x . The 15 kernel subgroups of J ( C II )[2] form three orbits of five under the action of ζ . We fix orbit representatives K = { x − , ( x − ζ )( x − ζ ) , ( x − ζ )( x − ζ ) } ,K = { x − , ( x − ζ )( x − ζ ) , ( x − ζ )( x − ζ ) } ,K = { x − , ( x − ζ )( x − ζ ) , ( x − ζ )( x − ζ ) } , and let φ i : J ( C II ) → A i := J ( C II ) /K i be the quotient isogenies for 1 ≤ i ≤ w ( (cid:2) φ i (cid:3) ) = 5 for each i .The neighbourhood of (cid:2) J ( C II ) (cid:3) is shown in Figure 17. Generally, the (cid:2) A i (cid:3) are Type-A (because the stabilizer of each orbit is trivial), but for p = 19, 29, 59, 79, and89 the codomain types change (see Table 13). Note that at p = 19, the codomain A becomes isomorphic to A , so (cid:2) φ (cid:3) becomes a weight-5 loop. IIA A A Figure 17.
The neighbourhood of the (unique)
Type-II vertex.Characteristic p
19 29 59 79 89 OtherType of (cid:2) A (cid:3) Type-I Type-I Type-I Type-I Type-A Type-A
Type of (cid:2) A (cid:3) Type-II Type-I Type-A Type-A Type-I Type-A
Type of (cid:2) A (cid:3) Type-III Type-A Type-I Type-A Type-A Type-A
Table 13.
Types of neighbours of the
Type-II vertex.
References [1] Oskar Bolza. On binary sextics with linear transformations into themselves.
American Journalof Mathematics , 10(1):47–70, 1887.[2] Wieb Bosma, John J. Cannon, Claus Fieker, and Allan Steel.
Handboook of Magma functions ,2.25 edition, January 2020.[3] Jean-Benoˆıt Bost and Jean-Fran¸cois Mestre. Moyenne arithm´etico-g´eom´etrique et p´eriodesdes courbes de genre 1 et 2.
Gaz. Math. Soc. France , 38:36–64, 1988.[4] Bradley W. Brock.
Superspecial curves of genera two and three . PhD thesis, Princeton Uni-versity, 1993.[5] Wouter Castryck, Thomas Decru, and Benjamin Smith. Hash functions from superspecialgenus-2 curves using Richelot isogenies.
Journal of Mathematical Cryptology , 14(1):268–292,2020. Proceedings of NuTMiC 2019. [6] Denis X. Charles, Eyal Z. Goren, and Kristin E. Lauter. Families of Ramanujan graphs andquaternion algebras.
Groups and symmetries: from Neolithic Scots to John McKay , 47:53–63,2009.[7] Craig Costello and Benjamin Smith. The supersingular isogeny problem in genus 2 and be-yond. In Jintai Ding and Jean-Pierre Tillich, editors,
Post-Quantum Cryptography - 11thInternational Conference, PQCrypto 2020, Paris, France, April 15-17, 2020, Proceedings ,volume 12100 of
Lecture Notes in Computer Science , pages 151–168. Springer, 2020.[8] Enric Florit and Benjamin Smith. Automorphisms and isogeny graphs of abelianvarieties, with applications to the superspecial Richelot isogeny graph. Preprint:https://hal.inria.fr/hal-03094375, 2020.[9] E. Victor Flynn and Yan Bo Ti. Genus two isogeny cryptography. In Jintai Ding andRainer Steinwandt, editors,
Post-Quantum Cryptography - 10th International Conference,PQCrypto 2019, Chongqing, China, May 8-10, 2019 Revised Selected Papers , volume 11505of
Lecture Notes in Computer Science , pages 286–306. Springer, 2019.[10] Pierrick Gaudry and ´Eric Schost. On the invariants of the quotients of the Jacobian of acurve of genus 2. In
International Symposium on Applied Algebra, Algebraic Algorithms, andError-Correcting Codes , pages 373–386. Springer, 2001.[11] Everett W. Howe, Franck Lepr´evost, and Bjorn Poonen. Large torsion subgroups of splitJacobians of curves of genus two or three.
Forum Mathematicum , 12(3):315–364, 2000.[12] Tomoyoshi Ibukiyama, Toshiyuki Katsura, and Frans Oort. Supersingular curves of genustwo and class numbers.
Compositio Mathematica , 57(2):127–152, 1986.[13] Bruce W. Jordan and Yevgeny Zaytman. Isogeny graphs of superspecial abelian varieties andgeneralized Brandt matrices, 2020.[14] Toshiyuki Katsura and Katsuyuki Takashima. Counting richelot isogenies between super-special abelian surfaces. In Steven D. Galbraith, editor,
Proceedings of the Fourteenth Al-gorithmic Number Theory Symposium , volume 4 of
The Open Book Series , pages 283–300.Mathematical Sciences Publishers, 2020.[15] Ke-Zheng Li and Frans Oort.
Moduli of supersingular abelian varieties , volume 1680 of
LectureNotes in Mathematics . Springer-Verlag, Berlin, 1998.[16] Jean-Fran¸cois Mestre. La m´ethode des graphes. Exemples et applications. In
Proceedings ofthe international conference on class numbers and fundamental units of algebraic numberfields (Katata) , pages 217–242, 1986.[17] Jean-Fran¸cois Mestre. Construction de courbes de genre 2 `a partir de leurs modules. In
Effective methods in algebraic geometry , pages 313–334. Springer, 1991.[18] Benjamin Smith.
Explicit endomorphisms and correspondences . PhD thesis, University ofSydney, 2005.[19] Katsuyuki Takashima. Efficient algorithms for isogeny sequences and their cryptographicapplications. In T. Takagi et al., editor,
Mathematical Modelling for Next-Generation Cryp-tography. Mathematics for Industry , volume 29, pages 97–114, Singapore, 2018. Springer.[20] The Sage Developers.
SageMath, the Sage Mathematics Software System (Version 9.1) , 2020. .[21] Jacques V´elu. Isog´enies entre courbes elliptiques.
Comptes Rendus Hebdomadaires desS´eances de l’Acad´emie des Sciences, S´erie A , 273:238–241, juillet 1971. https://gallica.bnf.fr/ark:/12148/cb34416987n/date . IMUB - Universitat de Barcelona, Gran Via de les Corts Catalanes 585, 08007Barcelona, Spain
Email address : [email protected] Inria and Laboratoire d’Informatique de l’´Ecole polytechnique (LIX), Institut Poly-technique de Paris, 1 rue Honor´e d’Estienne d’Orves, 91120 Palaiseau, France
Email address ::