ISOGENY FORMULAS FOR JACOBI INTERSECTION AND TWISTED HESSIAN CURVES

. The security of public-key systems is based on the diﬃculty of solv-ing certain mathematical problems. With the possible emergence of large-scale quantum computers several of these problems, such as factoring and computing discrete logarithms, would be eﬃciently solved. Research on quantum-resistant public-key cryptography, also called post-quantum cryptography (PQC), has been productive in recent years. Public-key cryptosystems based on the prob- lem of computing isogenies between supersingular elliptic curves appear to be good candidates for the next generation of public-key cryptography stan- dards in the PQC scenario. In this work, motivated by a previous work by D. Moody and D. Shumow [17], we derived maps for elliptic curves represented in Jacobi Intersection and Twisted Hessian models. Our derivation follows a multiplicative strategy that contrasts with the additive idea presented in the V´elu formula. Finally, we present a comparison of computational cost to generate maps for isogenies of degree l , where l = 2 k + 1. In aﬃne coordinates, our formulas require 46 . 8% less computation than the Huﬀ model and 48% less computation than the formulas given for the Extended Jacobi Quartic model when computing isogenies of degree 3. Considering higher degree isogenies as 101, our formulas require 23 . 4% less computation than the Huﬀ model and 24 . 7% less computation than the formula for the Extended Jacobi Quartic model.

1. Introduction 1.1. Isogenies in cryptography. One of the first appearances of the concept of isogenies in the field of cryptography was the need to improve the complexity of the polynomial time algorithm proposed by Schoof [19] in order to compute the number of points on an elliptic curve defined over a finite field. This algorithm was later renamed SEA [11] (in honor of the improvements made by N. Elkies and A. Atkin).
For the supersingular elliptic curve scenario, there are three main problems that have emerged as potential hardness assumptions related to isogenies computation. The first is the problem of computing isogenies between supersingular elliptic curves. The second consist of computing the endomorphism ring of a supersingular elliptic curve, and the third one is to compute a maximal order isomorphic to End(E), where E is a supersingular elliptic curve. For a long time, these problems were believed to be interrelated and polynomial-time equivalent. Nevertheless, the first reduction between them was presented only in a recent paper due to K. Eisenträger, S. Hallgren, and T. Morrison [10].
1.2. Constructions based on isogenies and applications. Due to the fact that the most commonly used cryptosystems (e.g., RSA and ECDSA) are vulnerable to Shor's quantum algorithm [3], it is necessary to search for new options. More recently, Cryptography based on Isogenies was proposed. Couveignes [8] mentioned about isogenies in cryptography but only published in 2006; In 2009 Charles, Goren and Lauter [5] introduced an isogeny-based hash function and showed that it is collision resistant based on hardness of computing isogenies between supersingular elliptic curves. In 2010, Stolbunov [18] presented the first published isogenybased public-key cryptosystem based on isogenies between ordinary curves, and Childs et al. [7] showed a quantum subexponential attack on Stolbunov's publickey cryptosystem based on a reduction to a hidden shift problem, together with a subexponential-time algorithm for evaluating isogenies from kernel ideals assuming the Generalized Riemann Hypothesis. The authors in [13] presented a Diffie-Hellman-like key exchange algorithm for supersingular elliptic curves (SIDH) and an encryption algorithm that can be easily derived from it. The problems on which these authors based the difficulty of their proposals, and related to the problems presented in subsection 1.1, can be defined as • Computational Supersingular Isogeny (CSSI) Problem: Let φ A : , and not both divisible by l A , respectively l B . Then, given supersingular elliptic curves E A , E B and points φ A (P B ), φ A (Q B ), φ B (P A ), φ B (Q A ), find the j-invariant of In [4] the authors presented a non-interactive key exchange protocol named CSIDH (commutative-Supersingular Isogeny Diffie-Hellman) with even shorter keys than the SIDH protocol. A construction named SIKE [14] is the representative of isogeny-based algorithms among 69 candidates submitted to the first round of NIST's Post-Quantum Cryptography Standardization process [6]. In January 2019, the SIKE protocol was moved to the second round of NIST PQC standardization process. In addition, the SIDH was included in an experiment for a quantumresistant version of TLS 1.3. So, there are important real applications for isogenies in cryptography.
1.3. Our contributions. One of the main problems in isogeny-based algorithms is the computation of rational functions that make up the isogeny map. Vélu's formula [21] does this for curves in the Weierstrass model, but there are several other models for elliptic curves. Addition formulas for alternative models can present good features for cryptography purposes as symmetry and possibility of using for point doubling. Finding efficient formulas for curve operations on different models can improve the computation and evaluation of isogenies. In this work, we present formulas for evaluating isogenies given a specification of the kernel for some models of elliptic curves. In particular, we derived explicit formulas for isogeny computation in Jacobi Intersection and Twisted Hessian models when a kernel representation of the isogeny is given. For the Twisted Hessian curves mentioned before, we only claim the application of the multiplication-based derivation technique as well as the computational cost analysis of such formulas. All these formulas are a multiplication version of Vélu's, constructed over the addition law of these alternative representation models for elliptic curves.
1.4. Organization of this document. This paper is organized as follows: Section 2 presents the elliptic curve models treated in this work, named Jacobi Intersection and Twisted Hessian, as the models of related work used for comparison, namely Edwards, Huff, and Extended Jacobi Quartic; Section 3 introduces concepts related to isogenies and how to construct them via Vélu's formula in the Weierstrass model; in Section 4 we present the explicit formulas for degree l isogeny computation and evaluation in Jacobi Intersection model; in Section 5 we present the explicit formulas for degree l isogeny computation and evaluation in Twisted Hessian model and our advances on construct a formal proof; in Section 6, we analyze the complexity of the formulas for both models and compare them with related formulas obtained from related works; finally, in Section 7 we put forward conclusions and directions for future work.

Elliptic curve models
Although elliptic curves are more commonly specified by the reduced and generalized Weierstrass equations, in this section we will present alternative models for representing elliptic curves, discuss some aspects about them and show how they are related to the Weierstrass model.

2.1.
Edwards' model. Introduced by H. Edwards [9] in 2007, the named Edwards' model for an elliptic curve can be expressed by the equation E d : x 2 +y 2 = 1+dx 2 y 2 , with d = 0, 1. Given points on E d , P 1 = (x 1 , y 1 ) and P 2 = (x 2 , y 2 ), the addition formula for P 1 + P 2 is given by The point (0, 1), whose order is 2, is the identity element of E d . Moreover, given a point P = (x, y), −P = (−x, y) is the inverse element of P under point addition. Generalizations of such curves, known as Twisted Edwards Curves, were proposed [1] in 2008. Such curves are given by the equation E a,d : ax 2 + y 2 = 1 + dx 2 y 2 , where a and d = 1 are distinct and non-zero elements of a field K over which the elliptic curve is defined. Given points P 1 = (x 1 , y 1 ) and P 2 = (x 2 , y 2 ) on E a,d , the point addition formula for P 1 + P 2 is P 1 + P 2 = (x 1 , y 1 ) + (x 2 , y 2 ) = x 1 y 2 + x 2 y 1 1 + dx 1 x 2 y 1 y 2 , y 1 y 2 − ax 1 x 2 1 − dx 1 x 2 y 1 y 2 .
The point (0, 1) is the identity element of E a,d . Moreover, given the point P = (x, y), −P = (x, −y) is the inverse element of P . A birational map between an elliptic curve given by E a,d [17] and another curve E, given in the Weierstrass model, is given by which sends the points on curve E a,d onto points on curve E : The inverse transformation is given by the map ψ −1 ,

2.2.
Huff's model. The Huff curves were reintroduced in [16] and defined, as presented here, in [23]. The Huff curves can be expressed by H a,b : x(ay 2 − 1) = y(bx 2 − 1), with ab(a − b) = 0. The point (0, 0) is the identity element of H a,b and, given the point P = (x, y), −P = (−x, −y) is the inverse element of P . Given two points in the Huff's model, P 1 = (x 1 , y 1 ) and P 2 = (x 2 , y 2 ), the formula for point addition is given by The addition formula given above works for every point on H a,b except for the points at infinity (1 : 0 : 0), (0 : 1 : 0) and (a : b : 0), expressed in projective coordinates. In [16] the authors present a birational map between a Huff curve H a,b and a curve E in the Weierstrass form. This map is given as and sends the points on H a,b onto the points on E : y 2 = x 3 + (a + b)x 2 + abx. The inverse transformation is given by the map ψ −1 as x + b y .

2.3.
Hessian and twisted Hessian's models. Another parameterization of elliptic curves is given by curves in the Hessian model [15]. We can express such curves by the equation H d : u 3 + v 3 + 1 = 3duv or, in projectives coordinates, where K is the underlying field and d 3 = 1. The identity point, in projective coordinates is (1 : −1 : 0) and, for a given point P = (u, v), −P = (v, u) is the inverse element of P . For the addition law, let P 1 = (u 1 , v 1 ) and P 2 = (u 2 , v 2 ) be points on H d with P 1 = P 2 ; then, the coordinates of the resulting point P 3 = (u 3 , v 3 ) = P 1 + P 2 are given by For point doubling, the coordinates of P 3 = (u 3 , v 3 ) = [2]P 1 are given by There are some interesting properties of the addition law for a curve in the Hessian form. For example, taking a point P 1 = (U 1 : where the operation is the operand for Hessian's addition law in projective coordinates. This fact enables us to use the addition formula for point doubling. In this sense, one can obtain a unified formula for point addition as a tool to improve the resistance of the point multiplication algorithm against side-channel attacks. In [15] the authors present a birational map between an elliptic curve given by H d and one E in Weierstrass form. The coordinate map is given by The inverse map is given by 3 . An extension of the Hessian model for covering a greater range of elliptic curves was introduced by D. Bernstein, C. Chuengsatiansup, D. Kohel and T. Lange [2]. This model is given by H a,d : au 3 + v 3 + 1 = duv, and one can see that it is isomorphic to the Hessian curve H a,d :û 3 +v 3 + 1 = (d/a 1/3 )ûv over an extension field L. For this, just takeû = a 1/3 ,v = v with a 1/3 a cubic root of a in the extension L. For completeness, the Hessian curve is a special case of the Twisted Hessian curve where a = 1. Let P 1 = (u 1 , v 1 ) and P 2 = (u 2 , v 2 ) be points on H a,d with P 1 = P 2 ; then, the coordinates of the resulting point P 3 = (u 3 , v 3 ) = P 1 + P 2 are given by For point doubling, the coordinates of P 3 = (u 3 , v 3 ) = [2]P 1 are given by The curve H a,d is birationally equivalent over a field K to the Weierstrass curve E W : The map ψ is regular on every point of H a,d , except the point (0, −1). The map φ is regular on every point of E W , except the points (x, y) where d 3 − 12dx − 108a + 24y = 0.
2.4. Jacobi Intersection's Model. The last model presented in this paper is named Jacobi Intersection Model [12]. Each curve in this model is given by the intersection of two quadratic surfaces in three dimensional space over a base field. Jacobi Intersection curves, defined over a field K, can be expressed by with a ∈ K, a(1 − a) = 0 and a = 0, 1. The point (0, 1, 1) is the identity element of J a and, given the point P = (s, c, d), −P = (−s, c, d) is the inverse element of P . Given two points in the Jacobi Intersection model, e.g. P 1 = (s 1 , c 1 , d 1 ) and P 2 = (s 2 , c 2 , d 2 ), the expression for the result point P 3 = P 1 + P 2 = (s 3 , c 3 , d 3 ) via point addition is given by For point doubling, the coordinates of P 3 = (s 3 , c 3 , d 3 ) = [2]P 1 are given by

Isogenies
For our purposes, we will define and work with isogenies between elliptic curves over finite fields, but this definition is not limited to these fields. A more general and abstract approach can be found in [20]. Fix a prime p and a power q = p k , with k ∈ N, and let E 1 and E 2 be elliptic curves over K = F q . An isogeny φ : where + is the elliptic curve point addition. The degree of an isogeny is its degree as a rational map and, for separable isogenies, it is the size of its kernel. Theorem 3.1 from [22,Section 12.5] gives us a necessary and sufficient condition for two elliptic curves to be isogenous. In order to explicitly compute the polynomials that make up the isogeny of the form defined above, we can use a formula due to Vélu [21] which is given in Theorem 3.2.
Theorem 3.1 (Tate). Let E 1 and E 2 be elliptic curves defined over F q , where q = p k and k ∈ N. E 1 is isogenous to E 2 if, and only if, Theorem 3.2 (Vélu's Formula). Consider the underlying field K such that char(K) is not equal to 2 or 3. Let E : y 2 = x 3 + Ax + B be an elliptic curve in Short Weierstrass form. Let G be a subgroup of E(K) with order l, l prime. Let S be the set of representatives of G/ ∼, where ∼ is such that P ∼ Q ⇐⇒ P = ±Q. Then, there exists an isogeny φ : The application of Vélu's formula gives us the coefficients of E :y 2 =x 3 + (A−5t)x+(B−7w) and a normalized isogeny whose kernel is S.
A straight observation of the above formula shows that in order to compute an isogeny we need O(|G|) operations in the underlying field K.

Jacobi intersection curve isogenies
We initiate this section with the purpose of presenting an approach for isogeny evaluation and computation for curves given in the Jacobi Intersection model. Instead of Vélu's addition version for the isogeny formula, our multiplicative version is compact and is derived mainly from exploring a simple point negation formula in this model. Theorem 4.1 states our approach in full.
Theorem 4.1. Suppose F is a subgroup of the Jacobi Intersection curve J a with odd order l = 2k + 1, and points Then ψ is an l-isogeny, with kernel F , from the curve J a to the curve Jâ wherê . When P / ∈ F , the coordinate maps are given by ψ (S(s, c, d), C(s, c, d), D(s, c, d)) as It is easy to see that F is the kernel of the isogeny ψ and ψ(0, 1, 1) = (0, 1, 1). Now, we need to deriveâ in the image curve Jâ : are functions of the coordinate maps. To accomplish this, we consider the functions and solve them forâ. We can use the fact that if 5 is identically zero, the codomain curve will be a Jacobi Intersection curve. One more step is to notice that the maps 2,3, and 4 preserve the points (0, 1, 1), (0, −1, 1), (0, 1, four zeros at s = 0. Now, we will analyze if either theses points are singular or not and then classify the zeros of 5 as simple zeros or not. We start by computing the partial derivatives of 5: For the point (0, 1, 1) we have 6, 7, and 8 as be the coordinate maps of 2, 3, and 4, respectively. We have that where (β 2 i + α 2 i ) 2 = 1 by the curve equation. Next, by applying the chain rule for partial derivatives related to s, c, and d of 2, 3 and 4 we obtain In order to compute the partial derivatives given above at (0, 1, 1), we need to compute S is (0, 1, 1), S ic (0, 1, 1), and S i d (0, 1, 1). 0, 1, 1) = 0. From 9, 10, and 11, we have C s (0, 1, 1) = 0, C c (0, 1, 1) = 1+2k, and C d (0, 1, 1) = 0. Similar computation can be done to obtain D s (0, 1, 1), D c (0, 1, 1), and D d (0, 1, 1) as follows: From 12, 13, and 14, we have D s (0, 1, 1) = 0, D c (0, 1, 1) = 0, and D d (0, 1, 1) = 1 + 2k. Therefore, we conclude that 6, 7, and 8 are not simultaneously zero when evaluated at (0, 1, 1), consequently, they have simple zeros at (0, 1, 1). Similar computation can be done for the other points with s-coordinate equal to zero. Now, with the purpose of derivingâ in the codomain curve equation, we will work with the power series of 2, 3, and 4 at s = 0. First, we replace c 2 = 1−s 2 and d 2 = 1−as 2 and then obtain S(s), C(s), and D(s) as univariate rational functions. Then, Our next step is to replace 15, 16, and 17 into 5, name it G (s) H (s) and obtain If we suppose that the coefficient of s 2 is equal to zero in H (s), then H (s) has a zero of order greater than two in s = 0. Consequently, H (s) must be identically zero. Now, we can set the coefficient of s 2 to zero in H (s) and solve forâ which yields toâ Thus, by choosingâ of this form, the functions G and H are identically zero and the codomain of this map is another valid Jacobi Intersection curve. Hence, the transformations in 2, 3, and 4 form rational maps from a Jacobi Intersection curve to another one that preserves the identity point.

Twisted Hessian curve isogenies
In this section, we present a similar isogeny map construction given for Jacobi Intersection curves presented in Section 4. Here, we just present the maps used as isogeny evaluation for Twisted Hessian curves. Our goal in this section is to highlight how efficient isogenies formulas in the Twisted Hessian model could be produced using the same technique as applied for Jacobi Intersection curves. So, it is an open problem to know if these proposed maps send points on an initial Twisted Hessian curve to points on an isogenous curve with specified coefficientsâ andd in the base field K. Following, we present analogous construction for isogenies in the Twisted Hessian model. We start supposing F is a subgroup of the Twisted Hessian curve H a,d with odd order l = 2k + 1, and points Then ψ is suppose to be an l-isogeny, with kernel F , from curve H a,d to a curve Hâ ,d . When P / ∈ F , the coordinate maps are given by ψ(U (u, v), V (u, v)) as We present below the idea that should be used to show that the above maps are, indeed, an isogenie between Twisted Hessian elliptic curves. The first step is to notice that F is the kernel of the map ψ and ψ(0, −1) = (0, −1). Next step is to deriveâ andd in the image curve Hâ ,d :âU 3 − V 3 + 1 =dU V , where U, V are functions of the coordinate maps. For accomplish this, we consider the function and solve them forâ andd. We can assume that 21 is identically zero and the codomain curve will be a Twisted Hessian curve. One more step is to notice that the maps 19 and 20 preserve the point (0, −1) which is the point with u-coordinate equal to zero. Looking at the codomain curve, this point is the unique point with u-coordinate equal to zero. Following this, we can observe that G(u, v) has one zero at u = 0. Following, we analyze if theses points are singular or not and then classify the zeros of 21 as simple zeros or not. We start by computing the partial derivatives of 21: Now, evaluating the point (0, −1) at 22 and 23 we have G u (0, −1) = 3V u +dU u and G v (0, −1) = 3V v +dU v . Let be the coordinate maps of 19 and 20, respectively. We have that Next, applying the chain rule for partial derivatives related to u and v of 19 and 20 we obtain The computation of partial derivatives given above at the point (0, −1) depends of the values S iu (0, −1) and S iv (0, −1). Firstly, we need to compute the partial derivatives of S i and then evaluate the result at (0, −1): S iv (0, −1) = 2 β i .

From 24 and 25, we have
So, we see that the points of coordinate u = 0 are simple zeros of the coordinate maps. After showing this, it is necessary to derive the coefficients of the isogenous curve. Following the exact procedure as did for Jacobi Intersection could not allows to construct the coefficients of the isogenous curve.
A way to get around this situation and, at least, generate the coefficient of the isogenous curve (but we would not be properly demonstrating that they are, in fact, isogenous) would be to find a particular point in the curve. Such a point would probably be defined over some extension of the base field. The choice of this point should be such that by replacing it in G(u, v) =âU 3 (u, v) + V 3 (u, v) + 1 − dU (u, v)V (u, v) would obtain a simple expression for the coefficientsâ andd.

Analysis of operation count
In this section we will analyze the cost of computing isogenies from a kernel points in Jacobi Intersection and Twisted Hessian models. We do not intend to give an exhaustive analysis of the computational complexity, but just an operation count to allow us to be able to compare it with other formulas. Following convention in open literature, M stands for a field multiplication, S for a field squaring, C for a multiplication by a curve constant, and I for a field inversion. We avoid to count additions and subtractions since their cost is much less than the cost of squarings and multiplications in the field. We initially analyze the functions derived for isogeny between Jacobi Intersection curves in affine coordinates: We start computing s 2 , s 4 , c 2 = 1−s 2 , d 2 = 1−as 2 , d 2 c 2 = (d 2 −s 2 +as 4 ), d 2 s 2 = s 2 −as 4 and c 2 s 2 = s 2 −s 4 at the cost of 2S+1C. Next, for each i we need to compute In order to complete the calculation of the isogeny, we need to compute the inverse of k i=1 (β 2 i + d 2 α 2 i ) 2 and perform 3 more multiplications M. Thus, the total cost (in affine coordinates) is given by (4k + 2)M + (k + 2)S + (4k + 1)C + I. Among the operations obtained so far to evaluate a point through isogeny is an inversion. Such an operation is very costly (about 100 times more costly than a multiplication one). To avoid it, we can work with projective coordinates. For we compute s 2 , c 2 , d 2 , z 2 , z 3 , z 4 , s 4 , d 4 d 2 s 2 , d 2 c 2 , c 2 s 2 , s 2 z 2 , c 2 z 2 , d 2 z 2 and, following similar computation made for the affine case, we obtain a total cost of (4k + 7)M + 5S + (6k + 2)C. Following this analysis, we estimate the cost of isogeny evaluation for curves given in Twisted Hessian model, based on coordinate maps 19 and 20: First, we need to compute u 2 , v 2 and uv which cost 1M + 2S. For each value of i we need to compute at the cost of (2 + 3(k − 1))M. To complete the evaluation of isogenies, we need to compute the inverse element of k i=1 (aα 2 i uv − β 2 i ) 2 and two more multiplications M with cost 2M + I. Finally, adding all the above costs to evaluate isogenies between curves in Twisted Hessian model we get the total cost of (5k + 2)M + (k + 2)S + (8k)C + I. Just as it was done for isogenies between curves in the Jacobi Intersection model, we will avoid inverse computations by working with projective coordinates. For we compute, in addition to the previous case, z 2 , uz, vz e u 2 v 2 at the cost of 3M + 1S. The total cost will be (5k + 2)M + 3S + (9k)C. In 2011, the paper of D. Moody and D. Shumow [17] presented isogeny formulas for Edwards and Huff curves and compared with Vélu formula for Weierstrass curves using a SAGE implementation. The results showed that isogenies on Edwards and Huff curves are faster than Vélu's formula. Another work by X. Xu et al. [24] presents isogeny formulas for Extended Jacobi Quartic curves. They showed that isogeny evaluation in this model can achieve performance comparable to that obtained for the Huff model if the constants are chosen carefully. Table 1 summarizes the operation cost for models presented in previous works as well as the cost obtained in our work. Table 2 seeks to present the results so that they can more easily be compared. In this case, the cost of operations is taken concerning the multiplication cost in the base field. Taking into account the values of the table, we can observe that the isogeny formula obtained for the Jacobi Intersection model is more efficient than the formulas obtained for the Huff and Extended Jacobi Quartic models. It is noteworthy that the efficiency difference varies according to the values of k (i.e., the degree of isogeny we are computing). For example, for S = 0.8M and I = 100M , our formula requires 46.8% less computation than the Huff model and 48% less computation than the given formula for the Extended Model Jacobi Quartic when computing isogenies of 3 degree. For the case in which one needs to compute isogenies of degree 101, our formula requires 23.4% less computation than the Huff model and 24.7% less computation than the formula for the Extended Jacobi Quartic model. Finally, Table 3 brings the comparison of the models of the literature to represent the isogenies formulas in projective coordinates. In Table 4, the total cost of each formula is compared after the conversion of the cost of operations to the cost of multiplying elements in the field on which the elliptic curve is defined.

Conclusion
This work presents isogeny formulas for isogenies between curves in Jacobi Intersection and Twisted Hessian models, which complement the works of [17] and [24] for other elliptic curve models. These formulas are multiplicative and based on the addition law of each model in question. To the best of our knowledge, this is the first work to present this kind of formulas for both models. Our formulas achieve the cost of (4k + 2)M + 3S + (5k + 1)C + I operations for Jacobi Intersection model and (5k+2)M +3S +(9k)C +I for Twisted Hessian model, in affine coordinates. For projective coordinates, our formulas require (4k + 7)M + 5S + (6k + 2)C operations for Jacobi Intersection model and (5k+2)M +3S+(9k)C for Twisted Hessian model. We showed that our formula, for Jacobi Intersection isogenies, requires 46.8% less Table 4. Operations Counting for Isogeny Evaluation on Alternative Models, using projective coordinates, as a function of the number of multiplications in the base field.

MODEL
OPERATION COST S = 1M , * const = 0M S = 0, 8M , * const = 0M S = 0, 67M , * const = 0M Edwards [17] (3k + 7)M (3k + 6.2)M (3k + 5.68)M Huff [17] (4k + 6)M (4k + 5.4)M (4k + 5.01)M Ext. Jacobi Quartic [24] ---Weierstrass [17] ---Jacobi Intersection computation than the Huff model and 48% less computation than the given formula for the Extended Model Jacobi Quartic when computing isogenies of 3 degree. In addition, when computing isogenies of degree 101, our formula requires 23.4% less computation than the Huff model and 24.7% less computation than the formula for the Extended Jacobi Quartic model. These costs are result of a brief analysis of the formulas obtained. Thus, the cost can be better estimated with a deeper analysis. We point out that as theses formulas are constructed using the addition law; future improvements on formulas for adding points in these models may improve the isogeny formulas. As a future work, we plan to demonstrate that the formulas given for the Twisted Hessian model are, in fact, isogenies between curves in this model. Another research direction is to improve these formulas through the search for new addition formulas and evaluate using the composition of l-isogeny maps as point multiplication to speed up elliptic curve applications.