1: \begin{abstract}

2:     Consider the problem of efficiently evaluating 

3:     isogenies $\phi: \EC \to \EC/H$

4:     of elliptic curves over a finite field $\FF_q$,

5:     where the kernel \(H = \subgrp{G}\)

6:     is a cyclic group of odd (prime) order:

7:     given \(\EC\), \(G\), and a point (or several points) $P$ on $\EC$,

8:     we want to compute $\phi(P)$. 

9:     This problem is at the heart of efficient implementations of

10:     group-action- and isogeny-based post-quantum cryptosystems such as CSIDH.  % and Couveignes--Rostovtsev--Stolbunov key exchange.

11:     Algorithms based on Vélu's formul\ae{} give an efficient solution to this problem

12:     when the kernel generator $G$ is defined over $\FF_q$.

13:     However, for general isogenies,

14:     \(G\) is only defined over some extension $\FF_{q^k}$,

15:     even though $\subgrp{G}$ as a whole (and thus \(\phi\))

16:     is defined over the base field $\FF_q$;

17:     and the performance of Vélu-style algorithms degrades rapidly as $k$ grows.

18:     In this article we revisit the isogeny-evaluation problem

19:     with a special focus on the case where $1 \le k \le 12$.

20:     We improve Vélu-style isogeny evaluation

21:     for many cases where \(k = 1\)

22:     using special addition chains,

23:     and combine this with the action of Galois 

24:     to give greater improvements when \(k > 1\).

25: \end{abstract}

26: