# How to find kernel of isogeny from the dual isogeny

Let $$E$$ be a supersingular elliptic curve over $$\mathbb{F}_{p^2}$$, where $$p = \ell_A^{e_A} \ell_B^{e_B} f \pm 1$$ for some primes $$\ell_A, \ell_B$$. Let $$R \in E[\ell_A^{e_A}]$$ be a point of order $$\ell_A^{e_A}$$ and suppose $$\phi:E \to E' = E/\langle R \rangle$$ is an isogeny with kernel $$\langle R \rangle$$. Let $$\widehat{\phi}:E' \to E$$ be the dual isogeny.

My question is: suppose we know the kernel of $$\widehat{\phi}$$, say $$\langle S \rangle$$. How can we recover $$\langle R \rangle$$?

• It looks similar to some kind of homework, can you provide some a bit of background on where you encounter this problem? Also, can you explain why you feel this is more cryptography than purely mathematics? – DannyNiu Oct 30 '19 at 8:10
• @DannyNiu This kind of questions shows up in isogeny-based cryptography, specifically SIDH/SIKE. – yyyyyyy Oct 30 '19 at 9:05
• Hint: Consider another point $Q\in E'$ such that $\{S,Q\}$ is a basis of the $\ell_A^{e_A}$-torsion of $E'$ and look how $\phi\circ\widehat\phi$ acts on these points. – yyyyyyy Oct 30 '19 at 9:11
• my guess (cmiiw) is that $\ker(\phi) = \langle \widehat{\phi}(Q) \rangle$ because $\phi(\widehat{\phi}(Q)) = [\ell_A^{e_A}]Q =$ identity. However, it is still unclear to me why should $\langle \widehat{\phi}(Q) \rangle = \langle R \rangle$. – tfp Oct 30 '19 at 9:24
• @tfp You are right that $\ker(\phi)=\langle\widehat\phi(Q)\rangle$, but your argument only shows the $\supseteq$ inclusion. Re: "why should $\langle\widehat\phi(Q)\rangle=\langle R\rangle$", note that you've assumed $\ker(\phi)=\langle R\rangle$. – yyyyyyy Oct 31 '19 at 12:29