Abstract: In some aspects, a key establishment protocol is executed to generate a shared secret. A first entity calculates a first image curve EB representing an image of an elliptic curve E under a first isogeny ?B; calculates the shared secret based on the first image curve EB; receives a second image curve EA and a first pair of elliptic curve points {?A(PB), ?A(QB)} and from a second entity; obtains a basis {R, S}; calculates a third image curve EBA representing an image of the second image curve EA under a second isogeny ?B; calculates a third pair of elliptic curve points {?B(R), ?B(S)}; and sends the third image curve EBA and the third pair of elliptic curve points {?B(R), ?B(S)} to the second entity, wherein the third image curve EBA and the third pair of elliptic curve points {?B(R), ?B(S)} enable the second entity to compute the shared secret.

Abstract: In a general aspect, a supersingular isogeny-based cryptography process is performed. In some aspects, a cryptographic element is generated by executing a supersingular isogeny-based cryptography protocol. A generator of a first isogeny kernel is computed. A pre-determined tree topology is traversed. The tree topology includes nodes coupled by edges. The edges of the pre-determined tree topology include a first set of edges representing scalar multiplications and a second set of edges representing point evaluations. A plurality of isogeny kernels corresponding to respective nodes in the tree topology and having a lower order than the first isogeny kernel is computed by executing batches of operations using a plurality of cryptographic co-processors. At least one of the batches includes two or more of the scalar multiplications represented in the tree topology.

Abstract: In a general aspect, a supersingular isogeny-based cryptography process is performed. In some aspects, a cryptographic element is generated by executing a supersingular isogeny-based cryptography protocol. A generator of a first isogeny kernel is computed. A pre-determined tree topology is traversed. The tree topology includes nodes coupled by edges. The edges of the pre-determined tree topology include a first set of edges representing scalar multiplications and a second set of edges representing point evaluations. A plurality of isogeny kernels corresponding to respective nodes in the tree topology and having a lower order than the first isogeny kernel is computed by traversing a zigzag path through the tree topology. The zigzag path includes a series of scalar multiplications or a series of the point evaluations (or both) that terminates at a node above a leaf node in the tree topology.

Abstract: In a general aspect, a supersingular isogeny-based cryptography process is performed. In some aspects, a cryptographic element is generated by executing a supersingular isogeny-based cryptography protocol. A generator of a first isogeny kernel is computed. A pre-determined tree topology is traversed. The tree topology includes nodes coupled by edges. A first set of edges represent scalar multiplications, and a second set of edges represent point evaluations. A plurality of isogeny kernels corresponding to respective nodes in the tree topology are computed by executing batches of operations. At least one of the batches includes a first point evaluation represented in the tree topology having a first domain and a first range, and a second point evaluation represented in the tree topology having a second domain and a second range. The first domain, the first range, the second domain and the second range are non-isomorphic elliptic curves.

Abstract: In some aspects, a key establishment protocol is executed to generate a shared secret. A first entity calculates a first image curve EA representing an image of an elliptic curve E under a first isogeny ?A; calculates a first pair of elliptic curve points {?A(PB), ?A(QB)}; calculates secret integers {c, d}; sends the first image curve EA and the first pair of elliptic curve points {?A(PB), ?A(QB)} to a second entity; receives a second image curve EBA and a third pair of elliptic curve points {?B(R), ?B(S)} from the second entity; calculates a third image curve EÃBA representing an image of the second image curve EBA under a second isogeny {tilde over (?)}A, wherein the second isogeny {tilde over (?)}A is identified based on the secret integers {c, d} and the third pair of elliptic curve points {?B(R), ?B(S)}; and calculates the shared secret based on the third image curve EÃBA.

Abstract: In a general aspect, a cryptography process performs modular operations, where the modulus is a non-Mersenne prime. In some aspects, an integer is obtained during execution of a cryptography protocol defined by a cryptosystem. A prime modulus is defined by the cryptosystem in terms of a set of constants. The set of constants includes at least a first constant and a second, distinct constant. A set of block coefficients is computed to represent the integer in a block form. The plurality of block coefficients includes a first block coefficient obtained by a first modular reduction modulo the first constant, and a second block coefficient obtained by a second modular reduction modulo the second constant. A reduced representation of the integer is computed based on the plurality of block coefficients, such that the reduced representation is less than the prime modulus.