Fast and simple constant-time hashing to the BLS12-381 elliptic - PowerPoint PPT Presentation

Attempt #2: hash and check HashToCurve H&C (msg): ✗ ctr ← 0 y ← ⊥ while y = ⊥ : x ← H p (ctr || msg) ctr ← ctr + 1 ySq ← x 3 + ax + b y ← sqrt( ySq ) // ⊥ if ySq is non-square P ← ( x , y ) return [ h ] P // map to G via cofactor mul Not constant time; “bad” inputs are common.

Attempt #2: hash and check HashToCurve H&C (msg): ✗ ctr ← 0 y ← ⊥ while y = ⊥ : x ← H p (ctr || msg) ctr ← ctr + 1 ySq ← x 3 + ax + b y ← sqrt( ySq ) // ⊥ if ySq is non-square P ← ( x , y ) return [ h ] P // map to G via cofactor mul Not constant time; “bad” inputs are common. Loop a fixed number of times?

Attempt #2: hash and check HashToCurve H&C (msg): ✗ ctr ← 0 y ← ⊥ while y = ⊥ : x ← H p (ctr || msg) ctr ← ctr + 1 ySq ← x 3 + ax + b y ← sqrt( ySq ) // ⊥ if ySq is non-square P ← ( x , y ) return [ h ] P // map to G via cofactor mul Not constant time; “bad” inputs are common. ✗ Loop a fixed number of times? Slow; well-meaning “optimization” breaks CT.

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5:

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] p ≡ 2 mod 3, a = 0 1 exp

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] p ≡ 2 mod 3, a = 0 1 exp y 2 = x 3 + b y 2 − b � 3 = ⇒ x =

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] p ≡ 2 mod 3, a = 0 1 exp [SW06] none 3 exp

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] p ≡ 2 mod 3, a = 0 1 exp [SW06] none 3 exp SWU [Ulas07] p ≡ 3 mod 4, ab � = 0 3 exp

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] p ≡ 2 mod 3, a = 0 1 exp [SW06] none 3 exp SWU [Ulas07] p ≡ 3 mod 4, ab � = 0 3 exp [Icart09] p ≡ 2 mod 3 1 exp

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] p ≡ 2 mod 3, a = 0 1 exp [SW06] none 3 exp SWU [Ulas07] p ≡ 3 mod 4, ab � = 0 3 exp [Icart09] p ≡ 2 mod 3 1 exp S-SWU [BCIMRT10] p ≡ 3 mod 4, ab � = 0 2 exp

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] p ≡ 2 mod 3, a = 0 1 exp [SW06] none 3 exp SWU [Ulas07] p ≡ 3 mod 4, ab � = 0 3 exp [Icart09] p ≡ 2 mod 3 1 exp S-SWU [BCIMRT10] p ≡ 3 mod 4, ab � = 0 2 exp Elligator [BHKL13] b � = 0, 2 | # E ( F p ) 1 exp

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] p ≡ 2 mod 3, a = 0 1 exp [SW06] none 3 exp SWU [Ulas07] p ≡ 3 mod 4, ab � = 0 3 exp [Icart09] p ≡ 2 mod 3 1 exp S-SWU [BCIMRT10] p ≡ 3 mod 4, ab � = 0 2 exp Elligator [BHKL13] b � = 0, 2 | # E ( F p ) 1 exp [SS04,Ska05,FSV09,FT10a,FT10b,KLR10,CK11,Far11,FT12,FJT13,BLMP19. . . ]

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] p ≡ 2 mod 3, a = 0 1 exp [SW06] none 3 exp SWU [Ulas07] p ≡ 3 mod 4, ab � = 0 3 exp [Icart09] p ≡ 2 mod 3 1 exp S-SWU [BCIMRT10] p ≡ 3 mod 4, ab � = 0 2 exp Elligator [BHKL13] b � = 0, 2 | # E ( F p ) 1 exp This work ab � = 0 1 exp + exp none 1 [SS04,Ska05,FSV09,FT10a,FT10b,KLR10,CK11,Far11,FT12,FJT13,BLMP19. . . ]

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] p ≡ 2 mod 3, a = 0 1 exp [SW06] none 3 exp SWU [Ulas07] p ≡ 3 mod 4, ab � = 0 3 exp [Icart09] p ≡ 2 mod 3 1 exp S-SWU [BCIMRT10] p ≡ 3 mod 4, ab � = 0 2 exp Elligator [BHKL13] b � = 0, 2 | # E ( F p ) 1 exp This work ab � = 0 1 exp + exp none 1 BLS12-381: p ≡ 1 mod 3, a = 0, 2 ∤ # E ( F p ) [SS04,Ska05,FSV09,FT10a,FT10b,KLR10,CK11,Far11,FT12,FJT13,BLMP19. . . ]

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] ✗ p ≡ 2 mod 3, a = 0 1 exp [SW06] none 3 exp SWU [Ulas07] p ≡ 3 mod 4, ab � = 0 3 exp [Icart09] ✗ p ≡ 2 mod 3 1 exp S-SWU [BCIMRT10] p ≡ 3 mod 4, ab � = 0 2 exp Elligator [BHKL13] b � = 0, 2 | # E ( F p ) 1 exp This work ab � = 0 1 exp + exp none 1 BLS12-381: p ≡ 1 mod 3, a = 0, 2 ∤ # E ( F p ) [SS04,Ska05,FSV09,FT10a,FT10b,KLR10,CK11,Far11,FT12,FJT13,BLMP19. . . ]

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] ✗ p ≡ 2 mod 3, a = 0 1 exp [SW06] none 3 exp SWU [Ulas07] ✗ p ≡ 3 mod 4, ab � = 0 3 exp [Icart09] ✗ p ≡ 2 mod 3 1 exp S-SWU [BCIMRT10] ✗ p ≡ 3 mod 4, ab � = 0 2 exp Elligator [BHKL13] b � = 0, 2 | # E ( F p ) 1 exp This work ab � = 0 1 exp + exp none 1 BLS12-381: p ≡ 1 mod 3, a = 0, 2 ∤ # E ( F p ) [SS04,Ska05,FSV09,FT10a,FT10b,KLR10,CK11,Far11,FT12,FJT13,BLMP19. . . ]

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] ✗ p ≡ 2 mod 3, a = 0 1 exp [SW06] none 3 exp SWU [Ulas07] ✗ p ≡ 3 mod 4, ab � = 0 3 exp [Icart09] ✗ p ≡ 2 mod 3 1 exp S-SWU [BCIMRT10] ✗ p ≡ 3 mod 4, ab � = 0 2 exp Elligator [BHKL13] ✗ b � = 0, 2 | # E ( F p ) 1 exp This work ab � = 0 1 exp + exp none 1 BLS12-381: p ≡ 1 mod 3, a = 0, 2 ∤ # E ( F p ) [SS04,Ska05,FSV09,FT10a,FT10b,KLR10,CK11,Far11,FT12,FJT13,BLMP19. . . ]

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] ✗ p ≡ 2 mod 3, a = 0 1 exp [SW06] ✓ none 3 exp SWU [Ulas07] ✗ p ≡ 3 mod 4, ab � = 0 3 exp [Icart09] ✗ p ≡ 2 mod 3 1 exp S-SWU [BCIMRT10] ✗ p ≡ 3 mod 4, ab � = 0 2 exp Elligator [BHKL13] ✗ b � = 0, 2 | # E ( F p ) 1 exp This work ab � = 0 1 exp + exp none 1 BLS12-381: p ≡ 1 mod 3, a = 0, 2 ∤ # E ( F p ) [SS04,Ska05,FSV09,FT10a,FT10b,KLR10,CK11,Far11,FT12,FJT13,BLMP19. . . ]

Deterministic maps to elliptic curves M : F p → E ( F p ), where E : y 2 = x 3 + ax + b and p > 5: Map M Restrictions Cost [BF01] ✗ p ≡ 2 mod 3, a = 0 1 exp [SW06] ✓ none 3 exp SWU [Ulas07] ✗ p ≡ 3 mod 4, ab � = 0 3 exp [Icart09] ✗ p ≡ 2 mod 3 1 exp S-SWU [BCIMRT10] ✗ p ≡ 3 mod 4, ab � = 0 2 exp Elligator [BHKL13] ✗ b � = 0, 2 | # E ( F p ) 1 exp This work ✗ ab � = 0 1 exp + exp ✓ none 1 BLS12-381: p ≡ 1 mod 3, a = 0, 2 ∤ # E ( F p ) [SS04,Ska05,FSV09,FT10a,FT10b,KLR10,CK11,Far11,FT12,FJT13,BLMP19. . . ]

The Shallue–van de Woestijne map [SW06] (high level) E : y 2 = f ( x ) = x 3 + ax + b Idea #1 (Ska� lba): For X 1 , X 2 , X 3 , X 4 � = 0, let V ( F p ) : f ( X 1 ) · f ( X 2 ) · f ( X 3 ) = X 2 4

The Shallue–van de Woestijne map [SW06] (high level) E : y 2 = f ( x ) = x 3 + ax + b Idea #1 (Ska� lba): For X 1 , X 2 , X 3 , X 4 � = 0, let V ( F p ) : f ( X 1 ) · f ( X 2 ) · f ( X 3 ) = X 2 4 � One of f ( X i ), i ∈ { 1, 2, 3 } must be square ⇒ that X i must be an x-coordinate on E ( F p )

The Shallue–van de Woestijne map [SW06] (high level) E : y 2 = f ( x ) = x 3 + ax + b Idea #1 (Ska� lba): For X 1 , X 2 , X 3 , X 4 � = 0, let V ( F p ) : f ( X 1 ) · f ( X 2 ) · f ( X 3 ) = X 2 4 Idea #2: Construct a map F p �→ V ( F p ), yielding polynomials X 1 ( t ), X 2 ( t ), X 3 ( t ).

The Shallue–van de Woestijne map [SW06] (high level) E : y 2 = f ( x ) = x 3 + ax + b Idea #1 (Ska� lba): For X 1 , X 2 , X 3 , X 4 � = 0, let V ( F p ) : f ( X 1 ) · f ( X 2 ) · f ( X 3 ) = X 2 4 Idea #2: Construct a map F p �→ V ( F p ), yielding polynomials X 1 ( t ), X 2 ( t ), X 3 ( t ).  � ( X 1 ( t ), f ( X 1 ( t ))) if f ( X 1 ( t )) is square, else   SW( t ) � � ( X 2 ( t ), f ( X 2 ( t ))) if f ( X 2 ( t )) is square, else  � ( X 3 ( t ), f ( X 3 ( t ))) 

The Shallue–van de Woestijne map [SW06] (high level) E : y 2 = f ( x ) = x 3 + ax + b Idea #1 (Ska� lba): For X 1 , X 2 , X 3 , X 4 � = 0, let V ( F p ) : f ( X 1 ) · f ( X 2 ) · f ( X 3 ) = X 2 4 Idea #2: Construct a map F p �→ V ( F p ), yielding polynomials X 1 ( t ), X 2 ( t ), X 3 ( t ).  � ( X 1 ( t ), f ( X 1 ( t ))) if f ( X 1 ( t )) is square, else   SW( t ) � � ( X 2 ( t ), f ( X 2 ( t ))) if f ( X 2 ( t )) is square, else  � ( X 3 ( t ), f ( X 3 ( t )))  � constant-time cost dominated by 3 exps (recall: Legendre symbol in F p ops is 1 exp)

Hash functions from deterministic maps Compose H p and M in a natural way: HashToCurve NU (msg) : // { 0, 1 } ⋆ �→ F p t ← H p (msg) P ← M ( t ) // F p �→ E ( F p ) return [ h ] P // E ( F p ) �→ G

Hash functions from deterministic maps Compose H p and M in a natural way: HashToCurve NU (msg) : // { 0, 1 } ⋆ �→ F p t ← H p (msg) P ← M ( t ) // F p �→ E ( F p ) return [ h ] P // E ( F p ) �→ G

Hash functions from deterministic maps Compose H p and M in a natural way: HashToCurve NU (msg) : // { 0, 1 } ⋆ �→ F p t ← H p (msg) P ← M ( t ) // F p �→ E ( F p ) return [ h ] P // E ( F p ) �→ G

Hash functions from deterministic maps Compose H p and M in a natural way: HashToCurve NU (msg) : // { 0, 1 } ⋆ �→ F p t ← H p (msg) P ← M ( t ) // F p �→ E ( F p ) return [ h ] P // E ( F p ) �→ G

Hash functions from deterministic maps Compose H p and M in a natural way: HashToCurve NU (msg) : // { 0, 1 } ⋆ �→ F p t ← H p (msg) P ← M ( t ) // F p �→ E ( F p ) return [ h ] P // E ( F p ) �→ G � Can use a faster method for cofactor clearing: • via endomorphisms [GLV01,SBCDK09,FKR11,BP18] • via subgroup structure [S19 (see WB19, § 5)]

Hash functions from deterministic maps Compose H p and M in a natural way: HashToCurve NU (msg) : // { 0, 1 } ⋆ �→ F p t ← H p (msg) P ← M ( t ) // F p �→ E ( F p ) return [ h ] P // E ( F p ) �→ G Possible issue: M is not a bijection: # E ( F p ) � = p � output distribution is nonuniform

Hash functions from deterministic maps Compose H p and M in a natural way: HashToCurve NU (msg) : // { 0, 1 } ⋆ �→ F p t ← H p (msg) P ← M ( t ) // F p �→ E ( F p ) return [ h ] P // E ( F p ) �→ G Possible issue: M is not a bijection: # E ( F p ) � = p � output distribution is nonuniform This could be OK—but what if we need uniformity?

Uniform hashing from deterministic maps [BCIMRT10] For some distinguished point ˆ P ∈ G : HashToCurve OTP (msg) : P 1 ← M ( H p (msg)) x ← H q (msg) P 2 ← [ x ]ˆ P P ← P 1 + P 2 return [ h ] P

Uniform hashing from deterministic maps [BCIMRT10] For some distinguished point ˆ P ∈ G : HashToCurve OTP (msg) : P 1 ← M ( H p (msg)) x ← H q (msg) P 2 ← [ x ]ˆ P P ← P 1 + P 2 return [ h ] P

Uniform hashing from deterministic maps [BCIMRT10] For some distinguished point ˆ P ∈ G : HashToCurve OTP (msg) : P 1 ← M ( H p (msg)) x ← H q (msg) P 2 ← [ x ]ˆ P P ← P 1 + P 2 return [ h ] P

Uniform hashing from deterministic maps [BCIMRT10] For some distinguished point ˆ P ∈ G : HashToCurve OTP (msg) : P 1 ← M ( H p (msg)) x ← H q (msg) P 2 ← [ x ]ˆ P P ← P 1 + P 2 return [ h ] P

Uniform hashing from deterministic maps [BCIMRT10] For some distinguished point ˆ P ∈ G : HashToCurve OTP (msg) : P 1 ← M ( H p (msg)) x ← H q (msg) P 2 ← [ x ]ˆ P P ← P 1 + P 2 return [ h ] P � [ x ]ˆ P acts as a “one-time pad”

Uniform hashing from deterministic maps [BCIMRT10] For some distinguished point ˆ P ∈ G : HashToCurve OTP (msg) : P 1 ← M ( H p (msg)) x ← H q (msg) P 2 ← [ x ]ˆ P P ← P 1 + P 2 return [ h ] P � [ x ]ˆ P acts as a “one-time pad” � HashToCurve OTP is indifferentiable from RO [MRH05]

Uniform hashing from deterministic maps [BCIMRT10] For some distinguished point ˆ P ∈ G : HashToCurve OTP (msg) : P 1 ← M ( H p (msg)) x ← H q (msg) P 2 ← [ x ]ˆ P // ✗ expensive P ← P 1 + P 2 return [ h ] P � [ x ]ˆ P acts as a “one-time pad” � HashToCurve OTP is indifferentiable from RO [MRH05]

Faster uniform hashing from deterministic maps Problem: point multiplication is usually much more expensive than evaluating M .

Faster uniform hashing from deterministic maps Problem: point multiplication is usually much more expensive than evaluating M . Idea [BCIMRT10,FFSTV13]: HashToCurve(msg) : P 1 ← M ( H p (0 || msg)) P 2 ← M ( H p (1 || msg)) P ← P 1 + P 2 return [ h ] P

Faster uniform hashing from deterministic maps Problem: point multiplication is usually much more expensive than evaluating M . Idea [BCIMRT10,FFSTV13]: HashToCurve(msg) : P 1 ← M ( H p (0 || msg)) P 2 ← M ( H p (1 || msg)) P ← P 1 + P 2 return [ h ] P

Faster uniform hashing from deterministic maps Problem: point multiplication is usually much more expensive than evaluating M . Idea [BCIMRT10,FFSTV13]: HashToCurve(msg) : P 1 ← M ( H p (0 || msg)) P 2 ← M ( H p (1 || msg)) P ← P 1 + P 2 return [ h ] P � Indifferentiable from RO if M is well distributed ✓ All of the M we’ve seen are well distributed.

Roadmap 1. Hash functions to elliptic curves 2. Optimizing the map of [BCIMRT10] 3. Evaluation results 4. IETF standardization efforts

The Simplified SWU map [BCIMRT10] E : y 2 = f ( x ) = x 3 + ax + b , ab � = 0 Idea: pick x s.t. f ( ux ) = u 3 f ( x ). � For u non-square ∈ F p , f ( x ) or f ( ux ) is square.

The Simplified SWU map [BCIMRT10] E : y 2 = f ( x ) = x 3 + ax + b , ab � = 0 Idea: pick x s.t. f ( ux ) = u 3 f ( x ). � For u non-square ∈ F p , f ( x ) or f ( ux ) is square. u 3 x 3 + aux + b = u 3 ( x 3 + ax + b ) � � x = − b 1 ∴ 1 + u 2 + u a

The Simplified SWU map [BCIMRT10] E : y 2 = f ( x ) = x 3 + ax + b , ab � = 0 Idea: pick x s.t. f ( ux ) = u 3 f ( x ). � For u non-square ∈ F p , f ( x ) or f ( ux ) is square. u 3 x 3 + aux + b = u 3 ( x 3 + ax + b ) � � x = − b 1 ∴ 1 + u 2 + u a � If p ≡ 3 mod 4, u = − t 2 is non-square

The Simplified SWU map [BCIMRT10] E : y 2 = f ( x ) = x 3 + ax + b , ab � = 0 Idea: pick x s.t. f ( ux ) = u 3 f ( x ). � For u non-square ∈ F p , f ( x ) or f ( ux ) is square. u 3 x 3 + aux + b = u 3 ( x 3 + ax + b ) � � x = − b 1 ∴ 1 + u 2 + u a � If p ≡ 3 mod 4, u = − t 2 is non-square, so: � � X 0 ( t ) � − b 1 X 1 ( t ) � − t 2 X 0 ( t ) 1 + t 4 − t 2 a

Evaluating the S-SWU map � � ( X 0 ( t ), f ( X 0 ( t ))) if f ( X 0 ( t )) is square S-SWU( t ) � � ( X 1 ( t ), f ( X 1 ( t ))) otherwise

Evaluating the S-SWU map � � ( X 0 ( t ), f ( X 0 ( t ))) if f ( X 0 ( t )) is square S-SWU( t ) � � ( X 1 ( t ), f ( X 1 ( t ))) otherwise Attempt #1 (assume p ≡ 3 mod 4): x 0 ← X 0 ( t ) p +1 y 0 ← f ( x 0 ) // ✗ expensive 4 x 1 ← − t 2 x 0 // a.k.a. X 1 ( t ) p +1 y 1 ← f ( x 1 ) // ✗ expensive 4 if y 2 0 = f ( x 0 ): return ( x 0 , y 0 ) else: return ( x 1 , y 1 )

Evaluating the S-SWU map � � ( X 0 ( t ), f ( X 0 ( t ))) if f ( X 0 ( t )) is square S-SWU( t ) � � ( X 1 ( t ), f ( X 1 ( t ))) otherwise Attempt #1 (assume p ≡ 3 mod 4): x 0 ← X 0 ( t ) p +1 y 0 ← f ( x 0 ) // ✗ expensive 4 x 1 ← − t 2 x 0 // a.k.a. X 1 ( t ) p +1 y 1 ← f ( x 1 ) // ✗ expensive 4 if y 2 0 = f ( x 0 ): return ( x 0 , y 0 ) else: return ( x 1 , y 1 )

Evaluating the S-SWU map � � ( X 0 ( t ), f ( X 0 ( t ))) if f ( X 0 ( t )) is square S-SWU( t ) � � ( X 1 ( t ), f ( X 1 ( t ))) otherwise Attempt #1 (assume p ≡ 3 mod 4): x 0 ← X 0 ( t ) p +1 y 0 ← f ( x 0 ) // ✗ expensive 4 x 1 ← − t 2 x 0 // a.k.a. X 1 ( t ) p +1 y 1 ← f ( x 1 ) // ✗ expensive 4 if y 2 0 = f ( x 0 ): return ( x 0 , y 0 ) else: return ( x 1 , y 1 )

Evaluating the S-SWU map � � ( X 0 ( t ), f ( X 0 ( t ))) if f ( X 0 ( t )) is square S-SWU( t ) � � ( X 1 ( t ), f ( X 1 ( t ))) otherwise Attempt #1 (assume p ≡ 3 mod 4): x 0 ← X 0 ( t ) p +1 y 0 ← f ( x 0 ) // ✗ expensive 4 x 1 ← − t 2 x 0 // a.k.a. X 1 ( t ) p +1 y 1 ← f ( x 1 ) // ✗ expensive 4 if y 2 0 = f ( x 0 ): return ( x 0 , y 0 ) else: return ( x 1 , y 1 ) Requires two exponentiations! Can we do better?

Eliminating an exponentiation Recall: f ( x 1 ) = − t 6 f ( x 0 ). So: � p +1 p +1 4 = − t 6 f ( x 0 ) � f ( x 1 ) 4

Eliminating an exponentiation Recall: f ( x 1 ) = − t 6 f ( x 0 ). So: � p +1 p +1 4 = − t 6 f ( x 0 ) � f ( x 1 ) 4 = t 3 ( − f ( x 0 )) p +1 4 = t 3 � − f ( x 0 )

Eliminating an exponentiation Recall: f ( x 1 ) = − t 6 f ( x 0 ). So: � p +1 p +1 4 = − t 6 f ( x 0 ) � f ( x 1 ) 4 = t 3 ( − f ( x 0 )) p +1 4 = t 3 � − f ( x 0 ) p +1 4 . Can we use this? � We have f ( x 0 )

Eliminating an exponentiation Recall: f ( x 1 ) = − t 6 f ( x 0 ). So: � p +1 p +1 4 = − t 6 f ( x 0 ) � f ( x 1 ) 4 = t 3 ( − f ( x 0 )) p +1 4 = t 3 � − f ( x 0 ) p +1 4 . Can we use this? � We have f ( x 0 ) � 2 � p +1 p +1 p − 1 2 = f ( x 0 ) · f ( x 0 ) f ( x 0 ) = f ( x 0 ) 4 2

Eliminating an exponentiation Recall: f ( x 1 ) = − t 6 f ( x 0 ). So: � p +1 p +1 4 = − t 6 f ( x 0 ) � f ( x 1 ) 4 = t 3 ( − f ( x 0 )) p +1 4 = t 3 � − f ( x 0 ) p +1 4 . Can we use this? � We have f ( x 0 ) � 2 � p +1 p +1 p − 1 2 = f ( x 0 ) · f ( x 0 ) f ( x 0 ) = f ( x 0 ) 4 2 Legendre symbol!

Eliminating an exponentiation Recall: f ( x 1 ) = − t 6 f ( x 0 ). So: � p +1 p +1 4 = − t 6 f ( x 0 ) � f ( x 1 ) 4 = t 3 ( − f ( x 0 )) p +1 4 = t 3 � − f ( x 0 ) p +1 4 . Can we use this? � We have f ( x 0 ) � 2 � p +1 p +1 p − 1 2 = f ( x 0 ) · f ( x 0 ) f ( x 0 ) = f ( x 0 ) 4 2 = − f ( x 0 ) if f ( x 0 ) is non-square p +1 4 is � ✓ f ( x 0 ) − f ( x 0 ) when f ( x 0 ) is non-square!

Evaluating the S-SWU map—faster! Attempt #2 (assume p ≡ 3 mod 4): x 0 ← X 0 ( t ) y 0 ← f ( x 0 ) ( p +1) / 4 // ✗ expensive x 1 ← − t 2 x 0 // a.k.a. X 1 ( t ) y 1 ← t 3 y 0 // ✓ cheap! if y 2 0 = f ( x 0 ): return ( x 0 , y 0 ) else: return ( x 1 , y 1 )

Evaluating the S-SWU map—faster! Attempt #2 (assume p ≡ 3 mod 4): x 0 ← X 0 ( t ) y 0 ← f ( x 0 ) ( p +1) / 4 // ✗ expensive x 1 ← − t 2 x 0 // a.k.a. X 1 ( t ) y 1 ← t 3 y 0 // ✓ cheap! if y 2 0 = f ( x 0 ): return ( x 0 , y 0 ) else: return ( x 1 , y 1 ) ✓ Prior work [BDLSY12] lets us avoid inversions.

Evaluating the S-SWU map—faster! Attempt #2 (assume p ≡ 3 mod 4): x 0 ← X 0 ( t ) y 0 ← f ( x 0 ) ( p +1) / 4 // ✗ expensive x 1 ← − t 2 x 0 // a.k.a. X 1 ( t ) y 1 ← t 3 y 0 // ✓ cheap! if y 2 0 = f ( x 0 ): return ( x 0 , y 0 ) else: return ( x 1 , y 1 ) ✓ Prior work [BDLSY12] lets us avoid inversions. ✓ Straightforward to generalize to p ≡ 1 mod 4.

Generalizing: the p ≡ 5 mod 8 case -1 is square in F p ⇒ need u = ξ t 2 for ξ nonsquare.

Generalizing: the p ≡ 5 mod 8 case -1 is square in F p ⇒ need u = ξ t 2 for ξ nonsquare. Recall Atkin’s square-root trick: � 1 � 2 � � p +3 p − 1 2 z = z · z 8 2

Generalizing: the p ≡ 5 mod 8 case -1 is square in F p ⇒ need u = ξ t 2 for ξ nonsquare. Recall Atkin’s square-root trick: � 1 � 2 � � p +3 p − 1 2 z = z · z 8 2 Legendre symbol!

Generalizing: the p ≡ 5 mod 8 case -1 is square in F p ⇒ need u = ξ t 2 for ξ nonsquare. Recall Atkin’s square-root trick: � 1 � 2 � � p +3 p − 1 2 z = z · z 8 2 4 = √ z p +3 8 · 1 − 1 z

Generalizing: the p ≡ 5 mod 8 case -1 is square in F p ⇒ need u = ξ t 2 for ξ nonsquare. Recall Atkin’s square-root trick: � 1 � 2 � � p +3 p − 1 2 z = z · z 8 2 4 = √ z p +3 8 · 1 − 1 z So we want: � � ξ 3 t 6 f ( x 0 ) f ( x 1 ) = � p +3 8 · 1 − 1 = t 3 � ξ 3 f ( x 0 ) 4

Generalizing: the p ≡ 5 mod 8 case -1 is square in F p ⇒ need u = ξ t 2 for ξ nonsquare. Recall Atkin’s square-root trick: � 1 � 2 � � p +3 p − 1 2 z = z · z 8 2 4 = √ z p +3 8 · 1 − 1 z So we want: � � ξ 3 t 6 f ( x 0 ) f ( x 1 ) = � p +3 8 · 1 − 1 = t 3 � ξ 3 f ( x 0 ) 4 ξ 3 � p +3 � � ξ is fixed, so we can preompute 8