 Hello everyone! I'd like to talk to you a little bit about radical isogenes, which is a topic in isogeny-based cryptography that has applications to a lot of different schemes that use group actions. So one of these schemes that uses group actions is called seaside, which is a certain post-quantum key exchange protocol. So we have a starting public elliptic curve E0 and Alice and Pop both have a secret element of a certain group that acts on elliptic curves. So what they do is they both act on the starting curve and then they send the result to each other and then they act on what they receive from the other person. And as long as the group action is commutative, which it is in this case because the sea and seaside stands for commutative, the result they get in the end is going to be the same. Now what's really cool about seaside is that it has very small keys. So compared to all the other post-quantum key exchange protocols, it has the smallest keys, but it's relatively slow. And the reason it's slow is because computing the group action is slow. So the secrets of Alice and Pop correspond to maps between elliptic curves. There we call isogenes and these maps typically have a very large degree. But they decompose into lots of smaller maps of smaller degrees. So essentially computing the group action boils down to computing chains of isogenes of small degree. So how do you do that? So for example, how do you compute a chain of 5 isogenes? One way to do it is to sample on each of the curves in your sequence a point of order 5 and then to set the next curve to be the quotient by this point. And that works. But it kind of sucks because first of all generating this random point, it can fail with a certain probability and then you have to try again. And this is not super good for for example constant time implementations. And also, as mentioned, it's quite slow. So the dream would be that instead of having to sample a random point every time for there to just be maybe some kind of formula depending on the coefficients of the curve that just always gives me the next curve in the sequence. And that's exactly what radical isogenes does. So for example, this is radical 5 isogenes. So let's say that we have an elliptic curve that is of this special form for some value of the parameter B. Then the radical 5 isogenic formula tells me what the next curve in the sequence of 5 isogenes is going to be in terms of this parameter B. So it's this very simple expression that depends on the fifth root of B. And this is much faster. So compared to sampling random points, this is much better. And this is currently the fastest way to compute long chains of 5 isogenes. And you can infect truth so you can show that for every degree n there exists a radical isogenes formula. But the question is how do you find them? Like how do you find this magic expression? So that's not super obvious, but that's basically what we did. So we found a new method to obtain the formulas which is based on the theory of modular curves that extends the range for the n for which we know the formulas. And then for the formulas that we have, we also rewrote them a little bit so that they are more efficient to evaluate. And we show that this leads to significant speed-ups for particles such as seaside.