The cr.yp.to microblog: 2022.01.20 07:45:07

2022.01.20 07:45:07 (1484054366038360066) from Daniel J. Bernstein:

Just to spell out one way to apply https://eprint.iacr.org/2022/037 to Curve25519: take point on curve (not twist); check x squareness to see if point is 2*P; compute such a P (exercise: use generic P to avoid roots); do order-4 pairing with (1,...) and 4th-power test to see if P is 4*Q.

2022.01.20 08:37:21 (1484067508713758724) from Daniel J. Bernstein:

The generic computer-algebra view of this is that finding a curve point Q given 8*Q is solving a low-degree system of equations in two variables. That's already ok speed (done either directly or as three halvings). Everything else is about optimizing detection of soluble cases.