# How to find kernel of isogeny from the dual isogeny

Let $$E$$ be a supersingular elliptic curve over $$\mathbb{F}_{p^2}$$, where $$p = \ell_A^{e_A} \ell_B^{e_B} f \pm 1$$ for some primes $$\ell_A, \ell_B$$. Let $$R \in E[\ell_A^{e_A}]$$ be a point of order $$\ell_A^{e_A}$$ and suppose $$\phi:E \to E' = E/\langle R \rangle$$ is an isogeny with kernel $$\langle R \rangle$$. Let $$\widehat{\phi}:E' \to E$$ be the dual isogeny.

My question is: suppose we know the kernel of $$\widehat{\phi}$$, say $$\langle S \rangle$$. How can we recover $$\langle R \rangle$$?

• It looks similar to some kind of homework, can you provide some a bit of background on where you encounter this problem? Also, can you explain why you feel this is more cryptography than purely mathematics? – DannyNiu Oct 30 '19 at 8:10
• @DannyNiu This kind of questions shows up in isogeny-based cryptography, specifically SIDH/SIKE. – yyyyyyy Oct 30 '19 at 9:05
• Hint: Consider another point $Q\in E'$ such that $\{S,Q\}$ is a basis of the $\ell_A^{e_A}$-torsion of $E'$ and look how $\phi\circ\widehat\phi$ acts on these points. – yyyyyyy Oct 30 '19 at 9:11
• my guess (cmiiw) is that $\ker(\phi) = \langle \widehat{\phi}(Q) \rangle$ because $\phi(\widehat{\phi}(Q)) = [\ell_A^{e_A}]Q =$ identity. However, it is still unclear to me why should $\langle \widehat{\phi}(Q) \rangle = \langle R \rangle$. – tfp Oct 30 '19 at 9:24
• @tfp You are right that $\ker(\phi)=\langle\widehat\phi(Q)\rangle$, but your argument only shows the $\supseteq$ inclusion. Re: "why should $\langle\widehat\phi(Q)\rangle=\langle R\rangle$", note that you've assumed $\ker(\phi)=\langle R\rangle$. – yyyyyyy Oct 31 '19 at 12:29
{"ft_lang_label":"__label__en","ft_lang_prob":0.60930806,"math_prob":0.9996748,"size":486,"snap":"2020-34-2020-40","text_gpt3_token_len":169,"char_repetition_ratio":0.15145229,"word_repetition_ratio":0.0,"special_character_ratio":0.36419752,"punctuation_ratio":0.10891089,"nsfw_num_words":0,"has_unicode_error":false,"math_prob_llama3":0.99999094,"pos_list":[0],"im_url_duplicate_count":[null],"WARC_HEADER":"{\"WARC-Type\":\"response\",\"WARC-Date\":\"2020-09-24T09:32:14Z\",\"WARC-Record-ID\":\"<urn:uuid:55865718-48db-4b4b-852d-14328b6b71b9>\",\"Content-Length\":\"147642\",\"Content-Type\":\"application/http; msgtype=response\",\"WARC-Warcinfo-ID\":\"<urn:uuid:56b76004-1eee-4c64-8d6a-ad3337488228>\",\"WARC-Concurrent-To\":\"<urn:uuid:142ee71a-f2cf-4981-8067-22af69899f99>\",\"WARC-IP-Address\":\"151.101.1.69\",\"WARC-Target-URI\":\"https://crypto.stackexchange.com/questions/75403/how-to-find-kernel-of-isogeny-from-the-dual-isogeny\",\"WARC-Payload-Digest\":\"sha1:KMUGUS4EDUXGJTFCN7MG3TLND6BPDWTN\",\"WARC-Block-Digest\":\"sha1:VCB2ITWK74334VKRI73N2HRTAD3KCE55\",\"WARC-Identified-Payload-Type\":\"text/html\",\"warc_filename\":\"/cc_download/warc_2020/CC-MAIN-2020-40/CC-MAIN-2020-40_segments_1600400214347.17_warc_CC-MAIN-20200924065412-20200924095412-00306.warc.gz\"}"}