In “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies” by DeFeo, Jao and Plut (PDF), the public parameters are defined as:

  1. Supersingular curve $E$, and
  2. bases $P, Q$ generating the torsion subgroup $E[l]$ respectively for Alice and Bob.

The parameters for the key exchange generated by Alice would be:

  • Random elements $m, n$.
  • The isogeny with kernel $K := \langle[m]P + [n]P\rangle$.
  • Some other stuff beyond this question…

So the question is:

Why does it not suffice to generate the torsion subgroup (respectively the isogeny, defined by kernel) with just one point $P$? Taken the subgroup $\langle P\rangle = E[x]$ i could also generate an isogeny. Also the final isogeny could be generated by Bob using only $\mathit{Alice}'$ resulting curve $E_{\mathit{Alice}}$ and the image of the the point $P_{\mathit{Alice}}$ as well as Bobs secret parameters.


1 Answer 1


Found the answer:

The $l$-torsion subgroup is isomorphic to a direct sum of two quotient groups: $E[l] \simeq \mathbb{Z}_n \oplus \mathbb{Z}_n$, hence the basis requires two points and the elements of $E[l]$ are represented by linear combinations of such a basis. [Reference: Elliptic Curves, Washington, section 3.1]

  • $\begingroup$ You should be able to accept your own answer once enough time has passed; see here. $\endgroup$
    – yyyyyyy
    Commented Jul 12, 2015 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.