Computing 2-isogenies between Kummer lines

. We use theta groups to study 2-isogenies between Kummer lines, with a particular focus on the Montgomery model. This allows us to recover known formulas, along with more efficient forms for translated isogenies, which require only 2 S + 2 m 0 for evaluation. We leverage these translated isogenies to build a hybrid ladder for scalar multiplication on Montgomery curves with rational 2-torsion, which cost 3 M +6 S +2 m 0 per bit, compared to 5 M +4 S +1 m 0 for the standard Montgomery ladder.


Motivation
Elliptic curve cryptography is widely used in the TLS layer, and its speed is determined by the scalar multiplication.Its efficiency relies on the chosen model.On a Montgomery model, Montgomery [Mon87] provided an efficient algorithm known as the Montgomery ladder to compute x(n • P ) with only the datum of x(P ).This allows protocols like the Diffie-Hellman key exchange protocol to only send the coordinate x(n • P ), thus gaining in bandwidth.
Furthermore, the equation of the elliptic curve helps to recover y(n • P ) from x(n • P ), up to a sign.The sign can also be determined with x((n + 1) • P ), which is also computed by the ladder, at a negligible cost.To sum up, one efficient way to do a scalar multiplication on an elliptic curve is to do it only with the x-coordinate x(P ), and recover y(n • P ) at the very end.
The mathematical object on which we only keep the x-coordinate is a Kummer line, which is described by a morphism (x(P ), y(P )) → x(P ) from the elliptic curve to the projective line.It is a degree-2 map and its ramification points are the four 2-torsion points.An interesting fact about Kummer lines is that they are entirely described by this ramification, made of 4 points.This gives a very convenient and flexible approach to build models of Kummer lines as we will see throughout the paper.Apart from scalar multiplication, Kummer lines are also used a lot for isogeny based cryptography, as in [FJP14;CLN16].
The main goal of this paper is to provide a general method to study 2-isogenies between different models of Kummer lines, and to find old and new formulas for these isogenies, and notably to also study translated isogenies.Our main objective was to better understand the isogeny formulas from isogeny based cryptography, and in particular why the Montgomery model has fast 2-isogenies, in the hope to extend these formulas to higher dimension.For dimension 1, as we will see in Appendix C, although our translated 2-isogeny formula is faster than the usual one, in practice, as shown in [CH17], it is faster to decompose a 2 n -isogeny as a product of 4-isogenies rather than a product of 2-isogenies.
Our second application is to speed up the multiplication law on the Kummer line of an elliptic curve.Indeed, composing a 2-isogeny with its dual gives the multiplication by 2 map.This approach, pioneered by [DIK06], allows writing the doubling as a composition of two polynomials of degree 2 rather than a polynomial of degree 4. Such a decomposition is already used in the fast doubling formula of the Montgomery model [Mon87] or the theta model [GL09].

Results
On the Montgomery model with full rational 2-torsion, we can evaluate a 2-isogeny, translated by a suitable 2-torsion point in 2S + 1m 0 , compared to 2M + 1m 0 for the non translated image.Composing with the translated dual isogeny, we obtain a translated doubling formula in 4S + 2m 0 , compared to 2M + 2S + 1m 0 for a standard doubling.
Using the translated doubling in the Montgomery ladder, and keeping track of the translation by the 2-torsion point, we obtain a hybrid ladder arithmetic which costs 3M + 6S + 2m 0 per bit, compared to 5M + 4S + 1m 0 for the standard ladder for the Montgomery model.Thus, if m 0 is sufficiently small, we obtain a more efficient scalar multiplication (while retaining the standard side channel protection of the Montgomery ladder).We remark also that the ladder for the theta model costs 3M + 6S + 3m 0 , hence our hybrid ladder is always faster than the theta ladder.

Method
We proceed to a systematic study of 2-isogenies between Kummer lines by combining two tools: 1. First, we use that a Kummer model is completely determined by its four ramification points.Keeping track of the ramification along the isogeny allows us to keep track of the model, without resorting to formal groups as in Vélu's formulas; 2. Secondly we make a systematic use of theta groups and their action on sections to find invariant sections.
As explained in Remark 2 below (Section 2), the usual Vélu formulas [Vél71] can be seen as a special case of the above strategy, applied to the theta group of a divisor D invariant by translation and where the canonical action by the symmetric elements is trivial.In this paper we rather use the action of the theta group G(2(O E1 )) associated to the divisor 2(O E1 ), which is not invariant by translation, hence whose associated action is not trivial.
This will allow us in future work to extend this strategy to higher dimension.Notably, we will explain in an upcoming article how to study differential additions in dimension one on Kummer lines, using the fact that differential additions can be described by a 2-isogeny in dimension two, on a product of two Kummer lines.Extending our framework to a systematic study of 2-isogenies formulas between arbitrary models of Kummer surfaces is more challenging though, because the combinatorial description of the Kummer surface is given by a (16, 6, 2)-design in P 3 rather than by simply 4 points in P 1 , so is harder to keep track off.
Our paper is exhaustive as we can apply this algorithm to several known models such as Legendre curves, Montgomery curves, but also theta functions of level 2. We give several examples, along with examples when we start from one type of model and obtain a new type of model for the codomain.This allows us to recover the efficient 2-isogenies formulas already in the literature in a unified manner, showing the flexibility of the framework.
A particularity of our framework is that we do not impose the neutral point O E1 to be the point at infinity ∞ = (1 : 0) on the Kummer line.This extra flexibility allows us to naturally find new efficient formulas for translated isogeny images.
In particular, we study the Montgomery models of Kummer lines in more detail.Such a model exists whenever there is a point T ′ 1 of 4-torsion which is rational on the Kummer model (so the set {T ′ 1 , −T ′ 1 } is rational on the elliptic curve).Let R 1 be a 2-torsion point, and E 2 the codomain of the isogeny with kernel R 1 .The curve E 2 admits a Montgomery 1 , or when T 1 = R 1 and there exists a 8-torsion point T 1 on E above T ′ 1 .We give explicit formulas via our framework for these isogenies and their duals in both cases, recovering well known formulas in the literature [FJP14;CH17;Ren18].Furthermore, we also obtain the efficient translated isogeny formula on a Montgomery model mentioned above.
We mainly focus in this paper on the study of 2-isogenies between models of Kummer lines which have a specific Galois action on their 2 n -torsion (like the Legendre model, the Montgomery model and the theta model).This is indeed the most interesting situation: the isogeny interacts with the Galois action.So either we lose some of the Galois information on the codomain, which means that we can only describe another type of model on the codomain (like Theta to Montgomery, Montgomery to Legendre, or Legendre to Montgomery), or we need to assume that we are given a supplementary input.For instance, for 2-isogeny formulas from theta to theta, we need a 8-torsion point above the kernel to find a theta model of the codomain.
By contrast, a model requiring, say, a rational 3-torsion point T would not have this problem with a 2-isogeny formula, since the image of T by the isogeny would immediately give a model of the codomain.In a similar vein, handling the case of odd degree isogenies in the models mentioned above (Montgomery, Legendre, Theta), is in some sense easier since the Galois structure on the 2 n -torsion is respected through the isogeny, see Appendix E for formulas.

Notations
We work with elliptic curves and Kummer lines defined over a field of characteristic different from 2, and with separable isogenies.When the kernel of an isogeny between elliptic curves has order n, we call it an n-isogeny.An n-isogeny between Kummer lines is then the projection of an n-isogeny between elliptic curves.
We will use the following complexity notations throughout the article: • M is a generic multiplication, • S is a generic squaring, • m 0 is a multiplication by a curve constant, • c is a multiplication by a small constant (i.e. less than a computer word), • a is an addition / subtraction.

Similar work
In [Mor+22], the authors introduce the generalized Montgomery coordinate h on an elliptic curve E 1 , which can be seen as the composition h = x • f of an isogeny f : E 1 → E 2 to an elliptic curve in Montgomery form, with the x-coordinate on E 2 [Mor+22, Thm.13].They then give formulas for isogenies and scalar multiplication in the generalized Montgomery coordinate.
Our work is in an orthogonal direction.If the isogeny f is of degree n, a generalized Montgomery coordinate h = x • f is a section of a divisor of degree 2n on E 1 .The work of [Mor+22] may thus be seen as specifying a special model associated to a section of 2n(O E1 ) and developing the arithmetic and isogenies on this model.By contrast, we focus only on sections of 2(O E1 ) to describe models of the Kummer line, but we don't impose conditions on the model; our framework allows us to derive efficient isogeny formulas between different Kummer models, including models where the neutral point is not at infinity.
In [KS20], the authors use the theta squared coordinates on the Kummer line.One can see that their doubling formulas in their Table 2 are indeed the one we recover up to a translation by a 2-torsion point in Algorithm 1.Our ladder is however slightly faster because we are using Montgomery differential addition instead of the theta squared one, a comparison is available in Table 2 in Section 5.

Roadmap
In Section 2 we recall Kummer models and the theory of theta groups and their action on sections, which allow us to develop our isogeny framework.We apply it in Section 4 to study 2-isogenies between Montgomery models, and we apply those in Section 5 where we introduce the hybrid ladder.We briefly discuss applications to fast evaluations of 2 n -isogenies in Appendix C. In Appendix B, we provide more examples of our technique with different ramification structure to show its flexibility.Finally, in Appendix E, we explain how to deal with odd degree isogenies.

2-isogenies between Kummer lines
In this whole article, k is a perfect field of characteristic different from 2.

Weierstrass coordinates
Let E/k be an elliptic curve given by an affine short Weierstrass equation y 2 = x 3 + a 2 x 2 + a 4 x + a 6 .If D is a divisor on E, we recall that a global section is a function f ∈ k(E) from the function field k(E) of E such that div f + D ≥ 0. The set of all global sections associated to D is denoted by Γ(D).
For instance, if x, y⟩.The Weierstrass coordinates x, y give an embedding of E into P 2 k ; however, since x is even (x(−P ) = x(P )), the application It is often convenient to work with projective coordinates to avoid divisions; the elliptic curve has a projective equation Y 2 Z = X 3 + a 2 X 2 Z + a 4 XZ 2 + a 6 Z 3 in P 2 .Working in projective coordinates means we pass from the divisor point of view to the line bundle point of view.We denote by O E (D) the line bundle associated to D; this is the sheaf given by the local sections of D, i.e., such that on a Zariski open U of E, we have Since we are only interested in models of Kummer lines in this paper, we will change notations and denote Γ(O E (2D)) = ⟨X, Z⟩, where Z = Z 2 0 .With this notation, the full projective Weierstrass coordinates are XZ 0 , Y, ZZ 0 .
As explained in the introduction, it will be convenient to have models of Kummer lines where the neutral point is not at infinity.If x ∈ Γ(2(O E )) is an affine Weierstrass coordinate (resp.(X : Z) are projective Weierstrass coordinates) this amounts to allow working with the affine coordinate x ′ = ax+b cx+d with c ̸ = 0 (resp.(X ′ : Z ′ ) = (aX + bZ : cX + dZ)).Notice that the divisor of poles of x ′ is not equal to 2(O E ) when c ̸ = 0, but to a linearly equivalent divisor, so x ′ is not a section of 2(O E ), while X ′ , Z ′ are still sections of O E (2(O E )).

Kummer lines
Let E be an elliptic curve defined over k.We have seen that E/ ± 1 ≃ P 1 .However, the curve P 1 by itself is not enough to recover E, so we'll reserve the term Kummer line to include slightly more information: Definition 1.A Kummer line is the datum of a degree 2 covering of P 1 by E with 4 distinct ramification points, one of which is rational and marked: A way to reinterpret this is that the involution quotient E → E/ ± 1 ≃ P 1 is a degree-2 cover ramified at 4 points.Conversely, for such a degree-2 cover of P 1 , the curve on the domain is of genus 1 by the Riemann-Hurwitz formula, and marking an explicit rational point makes it an elliptic curve E. The cover gives an embedding k(P 1 ) → k(E), hence a Galois involution, which on the level of E has to be given by P → −P because the neutral point is one of the ramified points of this involution.In particular, the fibres are π −1 (π(P )) = {−P, P }.We will give more details in a future work on the geometry of Kummer lines.
Example 1.The marked point is denoted with a * .If the ramification on the Kummer line is given by (1 : 0) * , (α 1 : 1), (α 2 : 1), (α 3 : 1), (with the α i potentially defined over an extension of k) then the corresponding elliptic curve has equation, with some β ∈ k: Conversely, starting from Eq. (2), if the point at infinity is denoted O, then the following map is a degree 2-covering with 4 ramification points which correspond to the 2-torsion: We remark that a Kummer line cannot distinguish between an elliptic curve E and its quadratic twist E ′ which amount in the previous example to a choice of β ∈ k * /k * ,2 .Denote π ′ : E ′ → P 1 a Kummer line associated to the quadratic twist.If p ∈ P 1 is not a ramification point of π and π ′ , then there are two points P ∈ E and P ′ ∈ E ′ of order n > 2 such that π(P ) = π ′ (P ′ ) = p, and either P ∈ E(k) or P ′ ∈ E ′ (k).Thus pushing the rational point along a 2-isogeny allows keeping track of the twist on the codomain even while working on the Kummer lines.
We will describe Kummer lines only via their ramification, like in Eq. (1), and denote them by K, where K ≃ P 1 .We will also forget about the π notation when it is not ambiguous and write [P ] = π(P ).
The addition law is not well-defined any more on the Kummer line π, as if one knows π(P ) and π(Q), one retrieves ±P and ±Q on the elliptic curve and won't be able to distinguish π(P + Q) from π(P − Q).However, with the knowledge of π(P ), π(Q) and π(P −Q), it is possible to reconstruct π(P +Q), this is differential addition and is enough to build a scalar multiplication on the Kummer line, see for instance Montgomery arithmetic in Appendix A.
Consider a Kummer line π, and since we are interested in 2-isogenies, assume there is a rational 2-torsion point T ∈ E(k).This is a particular case of where we can define the translation by T on the line, as T = −T , so π(P − T ) = π(P + T ).

Main Example 1.
By taking an automorphism of P 1 , i.e a homography, we can always send T to the point (0 : 1) and the marked point to (1 : 0).This amounts to working on the following curve, according to Eq. ( 2): The complete ramification on the Kummer line K associated to E is then where α ∈ k satisfies the equation A = −α − γ α , with A, γ ∈ k.

2-isogenies between Kummer lines via an analogue of Vélu's formulas
Let E 1 /k be an elliptic curve, Starting from a Kummer model of E 1 , with affine coordinate x 1 ̸ = 1, we want to build a Kummer model of E 2 with affine coordinate x 2 ̸ = 1.For simplicity here, we will take x 1 , x 2 to be Weierstrass coordinates.
Our goal is to express x 2 as a rational function of x 1 .The coordinate x 2 is a section of the divisor 2(O 2 ), its pullback by f is f * (2(O 2 )) = 2(O 1 ) + 2(T 1 ).In particular, the coordinate x 2 • f on E 1 is a section of 2(O 1 ) + 2(T 1 ) which is invariant by translation by T 1 .Conversely, any coordinate u ∈ Γ(2(O 1 ) + 2(T 1 )) which is invariant by translation by T 1 is of the form x 2 • f for some x 2 ∈ Γ(2(O 2 )), by the universal property of the quotient.
In particular, since ) and is certainly invariant by translation, so is of the form x 2 • f .This is exactly like the first step of Vélu's formulas (where Vélu takes traces under the kernel of the isogeny of the coordinates x and y respectively, because he works with sections of 3(O 1 )).In the second step of Vélu's formulas, Vélu then uses the formal group of E 1 to recover equations for E 2 .
In our case, we only need to recover a model of the Kummer line E 2 / ± 1; by Section 2.2 it is completely determined by the image by u of the four ramifications points of the Kummer line E 1 / ± 1. Since we are working with Weierstrass coordinates in our example, one of these ramification points is at infinity and is sent to infinity.
In the rest of this article, rather than working with the affine coordinates x 1 , x 2 , we will work directly with the projective coordinates X 1 , Z 1 , X 2 , Z 2 (in other words, their numerators and denominators).

A general framework for 2-isogenies on a Kummer line
In this section, we will redo Section 2.3 but with projective coordinates directly.Although conceptually more abstract (we need to introduce Mumford's theory of the theta group), the same techniques apply to higher dimensional abelian varieties, by contrast to Vélu's method, as explained in Remark 2 below.

Theta group and isogenies
We reuse the notations of Section 2.3.We have the two projective coordinates X 1 , Z 1 associated to the divisor 2(O E1 ), which is a shortcut to say they are sections of the line bundle ), and we would like to find, like in Section 2.3, a basis of linear combinations only surjects onto even global sections: all global sections of D 2 are even, so their products have to be even.
In particular, since Γ(4(O E1 )) is of dimension 4, there is a fourth linearly independent projective coordinate, which is generated by an odd coordinate, because the space of even coordinates is of dimension 3.
On the other hand, the sections s we want to construct on E 2 are sections of 2(O E2 ), so are even, and their pullbacks f * s are even.Hence, it is enough to look at the even sections ) is very convenient to use to get a nice basis of the even sections subspace, it is not invariant by translation by T 1 , so it does not descend to a divisor on E 2 .
We first need to find a divisor D ′′ 4 linearly equivalent to D 4 which is invariant by translation by T 1 .Then sections of D ′′ 4 invariant by translation descends to coordinates on E 2 ; we then need to express this translation invariance for the sections of D ′′ 4 in terms of the sections of D 4 .
Mumford's theory of the theta group answers these questions, in the general case of an abelian variety.For simplicity, we only describe the case of a divisor D on an elliptic curve E here.
Let D be a divisor.The divisor D induces the polarization Φ D : E → Ê, which is the map defined by The theta group G(D) associated to the divisor D is the group of functions g P on k(E) such that P ∈ E[n] = ker(Φ D ), and div g P = t * −P D − D. The addition law of G(D) is given by (g Theorem 1 (Mumford).Mumford's theorem says that the functions g ′′ P , when they are induced by such a function g form a group under the theta group law (that's the easy part).
Conversely, if for each P ∈ K we pick up a g P with divisor t * −P D − D, and these g P form a group in G(D), then they are induced by a function g ∈ k(E), and D ′′ = D + div g is invariant.This is the hard part, which is a corollary of Grothendieck's general flat descent theory.
Let K be a lift of K in the theta group, and g the function induced by the g P ∈ K.If s ′′ ∈ Γ(D ′′ ) is invariant by K, then s ′′ = s/g is a function in Γ(D), and since g P = g (•)  g(•−P ) , the action of g P on s is given by g We apply this theory to 2-isogenies, and let K = {O 1 , T 1 } be a kernel generated by a 2-torsion point First we look at the possible descents of D 2 to E 2 , this amounts to finding an element ), and we even have δ −1 g T1 = g T1 by [Mum66, Prop. 2 p.307 and Prop. 3 p.309].So g T1 is symmetric if and only if g T1 is of order 2, and we see that a lift K of K to G(D 2 ) corresponds to a symmetric lift g T1 above T 1 , and the possible descents of D 2 have to be symmetric.
Take an arbitrary lift g T1 ∈ G(D 2 ), then since 2 , which live possibly over a degree-2 extension of k.Since taking another lift g T1 changes λ T1 by a square, we see that λ T1 is well-defined in k * /k * ,2 .It is not hard to show that it is given by the non-reduced self Tate pairing e T,2 (T 1 , T 1 ): g T1 is a function with divisor 2(T 1 ) − 2(O 1 ), and g T1 (R)g T1 (R − P ) = λ T1 by definition of the group law.So the class of λ T1 ∈ k * /k * ,2 is given by g T1 (R + P )/g T1 (R), which is the self Tate pairing.
Definition 2. The element [λ T1 ] ∈ k * /k * ,2 defined above is the type of T 1 .We say that T 1 is of Montgomery type if λ T1 is already a square over k.
From the discussion above, by Mumford's theorem, D 2 descends over k to a symmetric divisor on E 2 if and only if λ T1 is a square in k, if and only if T 1 is of Montgomery type.
We can check this directly.First we remark that ) is not linearly equivalent to D 2 , so D 2 cannot directly descend to (O 2 ).The other symmetric degree-1 divisors on E 2 are given by (T 2 ), (R 2 ), (S 2 ) where T 2 , R 2 , S 2 are the three Weierstrass points on E 2 .Set R 1 and S 1 to be the other Weierstrass points of E 1 in addition to T 1 , we may assume that f (R 1 ) = f (S 1 ) = T 2 .We let T ′ 1 be a 4-torsion point above T 1 , and Only the last two are linearly equivalent to D 2 , they give the two possible symmetric descents of D 2 to E 2 .
We remark that these divisors are rational if and only if

if and only if the cyclic degree-4 subgroup generated by T ′
1 is rational, if and only if e T,2 (T 1 , T 1 ) is a square.This explains why in general a symmetric lift g T1 only lives in a degree two extension, and explains the terminology of Montgomery type: T 1 is of Montgomery type if and only if T 1 can be sent to the point (0, 0) on a Montgomery model.In particular, there can be an asymmetry: D 2 may descend to a symmetric divisor on E 2 via f , while 2(O 2 ) may not descend to a symmetric divisor on E 1 via the dual isogeny f .The situation becomes much simpler when looking at the possible descents of D 4 = 4(O 1 ) to a degree-2 divisor on E 2 , which is all we need to construct a Kummer model for E 2 .The tensor product gives a morphism is symmetric in G(D 4 ) and always rational.An important remark is that while the symmetric divisor ± g T1 above T 1 in G(D 2 ) is only defined up to a sign, there is a canonical symmetric divisor in G(D 4 ) given by g ⊗2 T1 , which does not depend on this sign.
By Theorem 1, we get that the global sections Γ(D ′ 2 ) are precisely the global sections in Γ(D 4 ) invariant under the action by g ⊗2 T1 .We can now sketch our algorithm to compute 2-isogenies between Kummer lines: 1. Compute the action of the symmetric element g ⊗2 T1 on X 2 , XZ, Z 2 2. Find a basis X ′ , Z ′ of invariant functions 3. Recover the Kummer model of E ′ embedded by X ′ , Z ′ .
We detail these steps in the next sections.
Remark 2 (Vélu's formula).By Section 2.3, we certainly do not need Theorem 1 to find a divisor linearly equivalent to D 4 and invariant by T 1 : simply take D ′′ 4 = 2(O E1 ) + 2(T 1 ).The link with Vélu's formula and the theta group is as follows: since D ′′ 4 is invariant by translation by T 1 , the constant function 1 provides a canonical symmetric element h ′′ T1 above T 1 in G(D ′′ 4 ), which corresponds to the canonical descent of D ′′ 4 to 2(O 2 ).Sections of D ′′ 4 invariant by T 1 thus corresponds by Theorem 1 to sections of 2(O 2 ) on E 2 .We will see below in Main Example 3 that as expected, on E 2 these sections are exactly the same as the ones we obtain through sections of D 4 invariant by h T1 = g T1 ⊗2 .In fact, if g is any function with divisor D ′′ 4 − D 4 = 2(T 1 ) − 2(O 1 ), then one can check that the function h T1 = g(•)/g(• − T 1 ) defined in the proof of Theorem 1 is precisely g T1 ⊗2 .
So Vélu's formula can be seen as a special case of the more general framework of descending sections and divisors through theta groups actions.The reason we work directly with theta groups is that it provides a more flexible framework to study isogenies.In particular, it is slightly more convenient to work with the divisor D 2 = 2(O 1 ) than with (O 1 ) + (T 1 ).
More importantly, in higher dimensions, we don't have analogues of Vélu's formula for an ℓ-isogeny.Namely, if we start with an ample divisor Θ of degree 1 associated to a principal polarization, then the traces of Θ under the points of K, a maximal isotropic subgroup of A[ℓ] will be an invariant divisor of degree ℓ g 2 , hence descends to a divisor on B = A/K of degree ℓ g(g−1) , so is associated to a principal polarization if and only if g = 1.So taking traces of principal polarization does not work to build invariant divisors of the correct degree on A, and we need the full power of the theta group framework as developed by Mumford.In this paper, we study 2-isogenies between Kummer lines, from which we can deduce doubling formulas (by composing with the dual isogeny).In a sequel to this paper we will extend this to differential addition formulas.This amounts to studying the dimension 2 isogeny given by E × E → E × E, (P, Q) → (P + Q, P − Q).The action of the theta group G(D 2 ) on the global sections (X, Z) that we study in this paper will be crucial to extend the doubling formulas to differential additions.

Computing 2-isogenies
We reuse the notations from Section 2.2, we want to compute a 2-isogeny generated by a 2-torsion point T .We will describe in this section how to build degree 2 maps which are invariant under a translation by T on Kummer lines, and how to recover 2-isogenies from that.
Remark 3. The automorphism τ T : P → P + T on the elliptic curve can be pushed to P 1 via π because T is of 2-torsion.It is an involutive map, therefore it is an automorphism of P 1 , i.e. it is a homography.So τ T (X : Z) = (bZ : cX) = (γZ : X) and the associated matrix in PGL 2 (k) is: This lift is associated to an explicit element g T in the theta group G(D 2 ).Indeed, we have a projective action of E[2] on Γ(D 2 ) ≃ k 2 given by translation by a 2-torsion point on projective coordinates.The canonical action defined in Section 3.1 lifts this to an affine group action of G(D 2 ) on Γ(D 2 ).Since this group action is faithful, we can represent an element g ∈ G(D 2 ) by the corresponding action matrix.In particular, the element λ T associated to M T is the same as the one we associated to g T in Section 3.1.As mentioned there, because of the lift, λ T is well-defined up to a square.In particular: is the type of T , as defined in Definition 2. λ T depends on the chosen lift M T , however 1 √ λ T M T does not (up to a sign).This is the invariant matrix of interest, corresponding to the action of a symmetric lift g T of Section 3.1.
We want to build quadratic forms in (X, Z) invariant by 1 √ λ M T , which will be said to be T -invariants.(Note that 1 √ λ M T is canonical and does not depend on the sign.)We will look at the action of this matrix on X 2 , Z 2 and XZ.Remark 4. If q is a quadratic form and M = a b c d , the action of M over q is given by: Here, √ λ T may be in some quadratic extension of k, but we can work around that, if

Main Example 3. Following up with Main Example 2, we choose
We then compute the action of M T on X 2 , Z 2 and XZ, and then divide by γ: We notice that XZ is already invariant, to build another one we can consider a trace for the matrix action on quadratic forms, for instance: It appears that we retrieve the same invariant projective sections using Vélu's formula.By Remark 2, Vélu's formula build the invariant affine section: x ′ (P ) = x(P ) + x(P + T ) = x(P ) + γ x(P ) = X(P ) Z(P ) + γZ(P ) X(P ) = X 2 (P ) + γZ 2 (P ) X(P )Z(P ) .
The numerator and denominators of this function are precisely the above invariant sections.
Say we have two linearly independent quadratic forms q and q ′ which are T 1 -invariant where T 1 is a 2-torsion point on the Kummer line K 1 , and consider a basis u, v ∈ Span(q, q ′ ).Set M T1 = a b c d the matrix of τ T1 and [λ T1 ] the type of T 1 .
Set the following degree 2 map, which is well-defined by the properties of quadratic forms: Since u and v are T 1 -invariant, we get f (P + T 1 ) = f (τ T1 (P )) = f (P ).What remains to do is determining the codomain K 2 using the extra 2-torsion points we have.

Main Example 4.
We add a 1 in index of notations from Main Example 1.We found earlier in Main Example 3 that q(X, Z) = X 2 + γZ 2 and q ′ (X, Z) = XZ are T 1 -invariant.Consider for instance u = q and v = q ′ (or any linear combination of q and q ′ ), then f : (X : Z) → (X 2 + γZ 2 : XZ) can be computed in 1M + 2S + 1m 0 .We have by construction of f that f (O 1 ) = f (T 1 ), and since S 1 = R 1 + T 1 , we also have f (R 1 ) = f (S 1 ).A quick computation yields: We are trying to build an isogeny with kernel T 1 , so f (O 1 ) is sent to O 2 , and f (R 1 ) is a 2-torsion point on K 2 .Note that here f (R 1 ) is rational even if R 1 may not be, this is a more general fact proven in the following lemma: Proof.Let σ be a Galois element on the field k.If R 1 is invariant by σ, so is S 1 (because S 1 = R 1 + T 1 ) and the image by f is obviously invariant by σ too.However, if R 1 is not invariant by σ, then σ(R 1 ) ̸ = R 1 , so we must have σ(R 1 ) = S 1 because T 1 is rational.But then, since σ commutes with f : To grab the final information of 2-torsion, consider a 4-torsion point T ′ 1 above T 1 which may not be rational.Such a point can be found by solving T ′ 1 + T 1 = T ′ 1 on the Kummer line (remember that −T ′ 1 = T ′ 1 in this situation).If T ′ 1 = (X : Z), using the translation τ T1 , this leads to: Then T ′ 1 = ( √ γ : 1) and T ′′ 1 = (− √ γ : 1) are the 4-torsion points above T 1 , and f (T ′ 1 ), f (T ′′ 1 ) are the remaining 2-torsion points on K 2 .An optional step is to put K 2 in a nice shape by a homography, but this is not mandatory and can gain some operations.We will give more details in the next section.

2-isogenies on Montgomery curves
We will focus on Montgomery curves in this section, which corresponds to the case γ = 1 in Main Example 1. Recall from Definition 2: Definition 3. A 2-torsion point T is said to be of Montgomery type if its type λ T is a square.Sending T to (0, 0) and O to infinity, we thus obtain a Montgomery model The Montgomery Kummer line is denoted K 1 over k with constant A 1 ∈ k.The ramification of our Kummer line is then:

A1B1
and: (3) The constant d 1 is the important one instead of A 1 because it is also sufficient to recover the elliptic curve up to a twist, but it is more importantly used in doubling formulas on Montgomery curves, see Algorithm 5. When the codomain of an isogeny is a Montgomery curve, we want to compute d 1 efficiently to get all the necessary information about the codomain.
We computed in Main Example 3 the type of T 1 which is 1 up to a square (T 1 is then of Montgomery type), and two T 1 -invariant quadratic forms: We also have the translation by T 1 denoted τ T1 : We will need the translation by R 1 later too, which is given by: Remark 5. When the curve E is fixed (as for scalar multiplication), we will count multiplication by d or (A 1 : B 1 ) as one m 0 , since we can assume that B 1 = 1.For the computation of a 2 n -isogeny chain, they will be given as quotients, in which case we will count them as two multiplications, either small or generic depending on the context.See Section 5 and Appendix C.

Isogeny with kernel T 1
Assume in this section that A1 B1 ∈ k, so we have the full 2-torsion on our curve.Recall we have these independent 4-torsion points above T 1 : We will use the following invariant quadratic forms from Remark 6, using the notations of Main Example 3: . By construction, f 0 (P + T 1 ) = f 0 (P ).Set , the image of the ramification is the following: To get a Montgomery shaped ramification, we will multiply by C : (X : Up to a translation by S 2 we recover the 2-isogeny with kernel T 1 and the image is Montgomery shaped. Theorem 2 (Translated 2-isogeny with kernel T 1 ).Let g : K 1 → K 2 be the 2-isogeny with kernel T 1 on the Montgomery Kummer line K 1 with extra 2-torsion (A 1 : B 1 ), and assume f can be computed in 2S + 1m 0 + 2a, the codomain K 2 is a Montgomery Kummer line and the curve constant d 2 can be computed in 2S + 1a with: Proof.The fact that g is the 2-isogeny with kernel T 1 and that the image is a Montgomery Kummer line is straight-forward from the reasoning above.The curve constant d 2 comes from the computation in Eq. (3) and that (A 2 : B 2 ) = (A 1 + B 1 : A 1 − B 1 ): Proposition 1 (Translated dual isogeny).Using notation of Theorem 2, the dual isogeny of g is given by ĝ = f + S 1 where: Then f • f (P ) = 2 • P + R 1 where P ∈ K 1 can be computed in 4S + 2m 0 + 4a as in Algorithm 1.
Proof.Because the Hadamard transform is an involution, the codomain of f is K 1 .We can then set g 0 = f + S 1 , which is the 2-isogeny with kernel T 2 thanks to Theorem 2. Let's check that g 0 • g = [2], the multiplication by 2, on the Kummer line.We will use the following formula: We then study g 0 • g on the 2-torsion: . By uniqueness, g 0 = ĝ.The first formula then yields f (f (P )) = 2 • P + R 1 .

Algorithm 1: Doubling in Montgomery coordinates up to a 2-torsion point
Input: 6 return (X : Z); We will be using the translated doubling of Proposition 1 in Section 5 to build a "hybrid ladder".
Remark 7. In ECC, if one always works on the same curve, it is possible to control the associated constants and make them small.That way, a multiplication by a curve constant costs way less than a multiplication by a generic number.The hybrid ladder will rely on this fact a lot.Because the translated point is S 2 and not T 2 in Theorem 2, it is not convenient to use these formulas to chain isogenies.
Remark 8.The translated doubling formula of Algorithm 1 uses exactly the same formula as the standard doubling formula in squared theta coordinates 1 .This is not a coincidence, as remarked in [HR19], the Montgomery Kummer line and the squared theta Kummer line differ by translation by a 2-torsion point (one way to directly recover this result, using Section 2, is to look at the associated ramification points), so using the squared theta doubling formula in Montgomery coordinates gives a translated doubling.We will come back to this in an upcoming article where we explore the Galois properties of various models of Kummer lines in more details.

Isogeny with kernel R 1
Assume once again that A1 B1 ∈ k, so we have full 2-torsion on our curve.Recall that we have the following ramification on our Kummer line: In this section, we further assume that there is a 4-torsion point . A useful relation that we will be using is the following: This comes for instance from the doubling formulas in Proposition 1, because 2 ).We will now apply the algorithm to find invariant maps by R 1 .A matrix associated to τ R1 is: , we will be looking at the action of M on the following basis of quadratic forms: (X + Z) 2 , (X − Z) 2 and (X − Z)(X + Z): The invariant quadratic forms we will be using are then: By doing linear combination of q 1 and q 2 , we end up with the following formulas: . Finally, set f to be the following map: Then the ramification on the image of f is: • h(1 : 0) = (1 : 0), then c = 0.

Algorithm 2: Alternative doubling in Montgomery coordinates up to a 2-torsion point
Input: 10 return (X : Z);

Additional 8-torsion: another formula for the isogeny with kernel T 1
In this last section, we assume A1 B1 / ∈ k, so we don't know about the full 2-torsion, but we add a hypothesis about a 8-torsion point T 1 = (r : s) above T ′ 1 = (1 : 1) (which itself is above T 1 = (0 : 1)).That way, we ensure that there will still be a rational 4-torsion point on the Kummer line, so it will be Montgomery shaped.
Proof.We have that ker ĝ = ⟨R 2 ⟩, we can't apply results from Theorem 3 since we don't know the 4-torsion above R 2 .We have already computed the matrix M associated to τ R2 and the type λ = δ 2 − γ 2 : Furthermore, we have seen that , so we are looking for one other invariant: Hence, the two invariant quadratic forms we will consider are: We then set g 0 (X : Z) = (au(X, Z)+bv(X, Z) : cu(X, Z)+dv(X, Z)), which by construction verifies g 0 (• + R 2 ) = g 0 .Since we want it to be the dual of g, we are looking for the following equations: We factor by a in g 0 and get the following expression: We then check that it behaves correctly on the remaining 2-torsion: Finally, g 0 = ĝ.

Hybrid ladder
Let π : E → P 1 ≃ K be a Montgomery Kummer line.Recall that if one knows π(P ), π(Q) and π(P − Q), then it is possible to recover π(P + Q) using differential addition formulas which are given in Appendix A, Algorithms 4 and 5. Special formulas for doubling are necessary because the general formula do not work when P = Q, unlike for the theta model which uses the same formulas for doublings and differential additions.We will also use the notation [P ] = π(P ) in the algorithms.
Using these formulas, one can compute π(n • P ) on the Kummer line using the Montgomery ladder (Algorithm 6).The key of the ladder is that, at each step, we have π(U − V ) = π(P ), where U and V are the two points we keep track of.It is clear that the cost of a scalar multiplication depends linearly on the cost of one differential addition and one doubling.In this paper, we focus on the doubling part.If we look at the computational cost of the doubling in Algorithm 5, we get 2M + 2S + 1m 0 , where m 0 is a multiplication by a curve constant.
On the other hand, the computational cost of a doubling up to a 2-torsion point in Proposition 1 and Algorithm 1 is 4S + 2m 0 .Depending on the context, a square tends to be faster than a multiplication.For instance, 3S = 2M in F p 2 = F p [i] when p ≡ 3 mod 4. The comparison is given in Table 1.
For parameters where the multiplication by a curve constant is way faster than a generic multiplication, then our translated doubling is faster.This can be achieved for instance by having small constants, i.e. less than a computer word.By adapting the Montgomery ladder to take into account the additional 2-torsion point, we can build a new hybrid ladder in Algorithm 3. The major change is that, instead of having π(U − V ) = π(P ), we allow π(U − V ) ∈ {π(P ), π(P + R 1 )}.The correctness of our scalar multiplication is  explained in Appendix D, the formula for the correction step that may occur is given by Eq. ( 5).Now, in the context of ECC, if we are working on a set curve like in ECDSA, we can choose a convenient one such that the associated constants are less than a computer word, and that way one can get m 0 way smaller than M.
Remark 10.Since we work on a set curve, some constants can be saved.Implementationwise, constants are given as a numerator r and a denominator s, and because everything lives in a projective space a multiplication by r s can be put into two multiplications by r and by s.We will denote by c the cost of a multiplication by a small constant.
• In the doubling Algorithm 5, we directly choose d to be small, so 1m 0 = 1c for this one.
• With the additional 2-torsion point in Algorithm 1, the curve constants are A1 B1 and A2 B2 .We can choose B 1 = 1, and that's it because the others are tied, we end up with three constants then: A 1 , A 2 and B 2 .In this algorithm, 2m 0 = 3c.
Instead of dealing with the low level libraries' implementation of multiplication to take into account the small constants, we provide a proof of concept as well as verification scripts on GitLab 2 .The context is the following: • We work over F p 10 = F p 5 [i] where i 2 = −1 and F p 5 = F p [u] where u 5 = 2.The extension F p 10 /F p 5 is to ensure that 3S = 2M, and the extension F p 5 /F p is to have a large extension with trivial multiplication by u and i.A small constant corresponds to an element of F p .The construction obviously puts some constraints on p (p ≡ 3 mod 4 and p ≡ 1 mod 5).• We choose A 1 = 1 + µi and d = ν + i for some µ, ν ∈ F p , that way A 2 = 2 + µi and B 2 = µi.Multiplication by these constants are faster to deal with than multiplication by generic number over F p 10 .• We repeated 100 times 100 random scalar multiplications.The chosen parameters are the following: The results are in Table 2 and show that we achieve a 6.2% gain over the Montgomery ladder.For completeness, we also add a comparison with the theta ladder over which we achieve a 4.4%, the doubling formulas correspond to the ones from Algorithm 1, and the differential addition can be found in [KS20, Table 2].Remark 11.In the differential addition Algorithm 4, since in our application π(U − V ) is also a constant, it is possible to add a constraint for this one to be small too and that improves the whole time saved.However, this is not necessary for our comparison as the differential addition is the same in both ladders.

A Montgomery arithmetic on a Kummer line
We work on a Kummer line K associated to a Montgomery curve with constant A. Arithmetic in Algorithms 4 and 5 was introduced by Montgomery in [Mon87].They are used in the Montgomery ladder (Algorithm 6).
Algorithm 4: Differential addition in Montgomery xz-coordinates Input: B More examples of 2-isogenies: Legendre and theta models In this section, we will look at two other classical Kummer lines models.

B.1 Legendre model
An elliptic curve is said to be in Legendre form if it has full rational 2-torsion and is then put in the following shape: In terms of Kummer lines, this is a particular case of Main Example 1.The ramification is as follows: O = (1 : 0) * , T = (0 : 1), R = (1 : 1), S = (γ : 1).
We will focus on two isogenies with kernel T .Our goal is to recover the Montgomery to Legendre and Legendre to Montgomery isogeny formulas from [Ber+08, Theorem 5.1].
We also have f (R ′ 1 ) = (1 : 1) and f (S ′ 1 ) = (−1 : 1), the 4-torsion above (1 : 0).The ramification is Montgomery shaped up to a translation, the 2-isogeny is then g f can be computed in 2S, the codomain in 2S too.This can be used to find doubling formulas on the theta model.If ĝ is the dual of g, we have that ker ĝ = ⟨T 2 ⟩.We use the same invariants as in Theorem 2 because we start on a Montgomery model, and we set ĝ0 : ( • ĝ0 (T ′′ 2 ) = (0 : 1).
The 4-torsion is g 0 ( T 1 ) = (r 2 + s 2 : r 2 − s 2 ) := (u : v), g 0 (R ′ 1 ) = (1 : 0) and g 0 (S ′ 1 ) = (0 : 1).By setting h : (X : Z) → (BX : AZ), the ramification is put in the correct shape.It remains to check is that (A : B) is indeed rational in this context.To do so, we will look at the 4-torsion on the intermediate model, set: We also denoted earlier (a ′ i : b ′ i ) the 4-torsion point above R i and (a i : b ).We will focus on the case where P 0 is above the 2-torsion point R 0 , as we want to compare it to Renes formulas provided in [Ren18, Prop.4.2], and for simplicity we neglect the cost of the additions.Recall from Section 4 that for the isogeny with kernel R i , the translated by is represented by R i+1 and can be computed in 2S, and the translated image costs 2M + 2S.Since R i+1 = f i (R ′ i ) is the kernel of the next isogeny f i+1 , computing translated images by R i+1 does not matter, except at the very last step where we can use the standard non translated formula instead.Thus, similarly to what was done in Section 5, we can build a hybrid algorithm which combines Montgomery doubling (standard or translated by R i ) and our translated image formula.
Remark 12.As we can see, our image formula only involves the 4-torsion point R ′ i above R i (we can also recover from it the constant d i ), so the leaves in our strategy tree will be the 4-torsion points instead of the 2-torsion ones.This also implies that if we want to compute a 2 n -isogeny, we have to assume we are given a 2 n+1 -torsion point, or we do the last step with Renes formulas which doesn't have this constraint.
What matters now is to compare the standard costs operations from [Ren18, Prop.4.2] with the ones provided in Section 4, this is done in Table 3. Unlike in Section 5, after the first 2-isogeny, we don't have control on curve constants any more, so m 0 must be counted as two generic multiplications because of the numerator and the denominator.We see that our formulas for images should be faster than the ones by Renes.The cost of the codomain is more tricky: Renes formulas directly give d i+1 in 2S.Our formulas give R i+1 in 2S; but from R i+1 we can only use our translated doubling formulas, which are in this context more expensive than the standard doubling formulas.Thus, we need to compute d i+1 from R i+1 which costs 2S by the formula for a total codomain cost of 4S.Asymptotically, since there are exactly n codomains to compute, they are negligible compared to images and doublings which are in O(n log n).An implementation to compute a 2 n -isogeny using this hybrid method with SIKEp434 parameters is available in the same GitLab repository and shows that we do end on the same curve as the one with Renes formulas.For these parameters, our implementation shows that our hybrid method is slower, because the n considered is not large enough that the faster images compensate the slower codomains.
Another reason why this would not be viable anyway is that there exists efficient 4-isogeny formulas [CH17, § A], which saves half of the steps while having competitive costs for multiplication by 4 and images, hence are much faster.Indeed, the 4-isogeny codomain costs 4S (computing d i+2 from d i and R ′ i ), and a 4-isogeny image costs 6M + 2S.We remark that this is the same cost as combining our translated 2-isogeny image with the standard 2-isogeny image.In particular, by composing our translated 2-isogeny image twice, there is also a translated (by a 2-torsion point) 4-isogeny image in only 4M + 4S.However, to be able to use these translated images, our codomain formula would be slower.
Only in some hypothetical context where we would need to compute a lot of images, assuming we already know the codomains, then the hybrid approach would be faster.

D Correctness of the hybrid ladder
Fig. 3 shows two steps of Algorithm 3 and explains why we are cycling between 1 and 2 translated points.We want to compute n • P , with n an ℓ-bits integer, its bits are denoted b i .Set also Q = P + R where R is the extra 2-torsion point and assume the input is U 0 = m • P and V 0 = (m + 1) • P + R, this corresponds to the initialization of our algorithm.According to Fig. 3, the correction to the end result is as follows: • If we have an odd number of steps, i.e. ℓ is even, we get U = n • P + R, so we always need to correct U .
• On the other hand, if ℓ is odd, we get V = n • P + R if and only if the last bit is 0, otherwise we have U = n • P .

E Odd degree isogenies on Kummer lines
In this section, we extend the work of [Ren18] to build isogenies of odd degrees on any model of a Kummer line.
Let E be an elliptic curve, and K be a cyclic kernel of odd degree ℓ, and f : E → E ′ the corresponding isogeny.To build a model of the Kummer line associated to E ′ = E/K, we need to build sections of 2(O E ′ ), hence invariant sections of f * (2(O E ′ )) = T ∈K 2(T ) on E.
If s is an invariant section, its associated divisor div s is invariant.The converse is not true, there is an obstruction coming from the Weil-Cartier pairing.
Lemma 3. Let D = i a i T ∈K (P i + T ) = div s D a principal divisor and P 0 := a i P i .Then s D is invariant by translation if and only if P 0 ∈ K.
Proof.Since div s D is invariant by K, if T ∈ K, the function s D (P + T ) has the same divisor as s D , hence differ by a constant.By definition of the Weil-Cartier pairing e f , this constant is precisely equal to e f (T, f (P 0 )).So s D is invariant by K if and only if P 0 ∈ E[ℓ] is orthogonal to K, if and only if P 0 ∈ K, if and only if f Another equivalent proof is to remark that s D is invariant by translation if and only if D descends to a divisor D ′ = i a i T ∈K f (P i ) on E ′ which is linearly equivalent to 0, which is the case if and only if P 0 ∈ K.
x−x(Q2+T ) (we use the convention that x − x(O E ) := 1).Its associated divisor is Then s D is invariant by translation and descends to x−f (Q1) x−f (Q2) on E/K, x a Weierstrass coordinate.When Q 2 = O E , we recover a formula from [CH17;Ren18].
As illustrated by Example 6, we can use Lemma 3 to construct divisors associated to an invariant section.From such a divisor we can use Miller's algorithm to construct the associated section s.Since the isogeny is of odd degree, it preserves the 2-torsion, so by evaluating s on the ramification point of the Kummer model of E we can efficiently recover the Kummer model of E ′ given by s.
where t * −P is the pullback of the translation by −P .We stress that Φ D (P ) is in Pic 0 (E), which means that we consider the divisor t * −P D − D up to linear equivalence.(The correct polarization should be the map −Φ D , but to match with the usual sign conventions on elliptic curves, we will use Φ D in this article.)We say that two divisors D 1 , D 2 are algebraically equivalent if the associated polarizations are the same: Φ D1 = Φ D2 .On an elliptic curve, this is equivalent to deg D 1 = deg D 2 .In particular, if deg D = n, to study Φ D we may take D = D n , and Φ D subgroup, and E ′ = E/K the image of the isogeny f with kernel K.There is a bijection between descents of the divisor D to a divisor D ′ on E ′ = E/K (meaning that f * D ′ ≃ D) and lifts K of K ⊂ ker Φ D to the theta group G(D).Furthermore, D ′ is symmetric if and only if K consists of symmetric elements.Finally, there is a canonical isomorphism between Γ(D ′ ) and Γ(D) K .Proof.Let us give an idea of the proof.A descent of D to a divisor D ′ on E ′ is the same as finding a divisor D ′′ on E, linearly equivalent to D, which is invariant by translation by the points of the kernel: to D ′ we associate its pullback D ′′ = f * D ′ by the isogeny.Since K ⊂ E[n] = ker Φ D , by definition for any P ∈ K, we have that t * −P D ≃ D. Assume we have such a D ′′ .Let g be a function with divisor D ′′ − D. Then the function g(• − P ) has for divisor D ′′ − t * −P D since D ′′ is invariant, hence g ′′ P := g(•) g(•−P ) is a function with divisor t * −P D − D: g ′′ P ∈ G(D).

Table 3 :
Comparison of operations on Kummer lines to compute 2 n -isogenies :B i ), (A i+1 : B i+1 ) (A i : B i ) (a i : b i ) i