Cost of Projective Radical Isogenies per Degree Clause Samples

Cost of Projective Radical Isogenies per Degree. In Table 1, we compare the cost of affine radical isogenies to projective radical isogenies. In Table 2, we compare the cost in switching between the different curve models for affine and projective coordinates. In summary, fully projective radical isogenies are almost twice as fast as the original affine radical isogenies for constant-time implementations. Nevertheless, as we will see in the analysis of Sect. 4.1, the radical isogenies of degree 5, 7, 11 and 13 still perform worse than ‘traditional’ V´elu isogenies in realistic scenarios. Table 1. Comparison between affine radical isogenies from [8] and the projective radical isogenies in this work. The letters E, M, S, A and I denote exponentiation, multiplica- tion, squaring, addition and inversion respectively. The last column expresses the ratio projective/affine in terms of finite field multiplications over Fp for a prime of 512 bits, using close-to-optimal addition chains for exponentiation and inversion, assuming S = M and ignoring A.