e_2=250; e_3=159; p=2^e_2*3^e_3-1; isprime(p) a=ffgen([p,2],'a); P=(X^2+1)*Mod(1,p); a=ffgen(P,'a); E=ellinit([1,0],a); x_0=Mod(1,p); issquare(x_0^3+x_0) issquare(x_0^3+x_0,&y_0) ellisoncurve(E,[x_0,y_0]) P1=[x_0,y_0]; ellorder(E,P1) x_0=Mod(14,p); issquare(x_0^3+x_0,&y_0) P_2=ellmul(E,[x_0,y_0],3^(e_3)); factor(ellorder(E,P_2)) x_0=a+4; issquare(x_0^3+x_0) issquare(x_0^3+x_0,&y_0); Q_2=ellmul(E,[x_0,y_0],3^(e_3)); factor(ellorder(E,Q_2)) t= ellweilpairing(E,P_2,Q_2,2^(e_2)) t^{2^(e_2-1)} sk2=random(2^{e_2}); R_2=ellmul(E,Q_2,sk2); S_2=elladd(E,P_2,R_2); S_int=ellmul(E,S_2,2^(e_2-1)); iso=ellisogeny(E,S_int) Q_3x=0x1e7d6ebceec9cfc47779affd696a88a971cdf3ec61e009df55caf4b6e01903b2cd1a12089c2ece106bdf745894c14d7e39b6997f70023e0a23b4b3787ef08f Q_3y=0x2ec0aaef9fbbdd75fbda11da19725f79e842fbc355071fd631c1cdf90e08e601929faec5daeb0d96bbb4ad50fc7c8ad47064f05c06dc5d4aae61ccceff1f26 Q_3=[Q_3x,Q_3y] P_3x1=0x21b7098b640a01d88708b729837e870cff9df6d4df86d86a7409f41156cb5f7b8514822730940c9b51e0d9821b0a67dd7ed98b9793685fa2e22d6d89d66a4e P_3x2=0x2f37f575bebbc33851f75b7ab5d89fc3f07e4df3cc52349804b8d17a17000a42fc6c5734b9fcfde669730f3e8569ceb53821d3e8012f7f391f57364f402909 P_3y1=0x78f8a30ab36b301bdf672d9e3518af741f8227cc95a9f351b99623a826de3f8d90dd6ed42ff298e394e77b7aefee6010cdf34a7de9f9e239b103e7b3eee P_3y2=0x37f3c600488ebb6b11462c4cafc41cd5dc611a9b0c804e3bf50d6d8f75c4e7a136e29e00d80eb8653ca830f2aed61d04f9f3a8317f7916e016f2733b828ac0 P_3x=P_3x1+a*P_3x2 P_3y=P_3y1+a*P_3y2 P_3=[P_3x,P_3y] P_3b=ellisogenyapply(iso[2],P_3) Q_3b=ellisogenyapply(iso[2],Q_3) S_2b=ellisogenyapply(iso[2],S_2) Eb=ellinit(iso[1]); factor(ellorder(Eb,P_3b)) factor(ellorder(Eb,Q_3b)) factor(ellorder(Eb,S_2b)) R_2 = ellsub(E, P_2, Q_2); R_3 = ellsub(E, P_3, Q_2); sk3=random(3^{e_3}); pk2 = isogen_ell(E, P_2, Q_2, sk2, P_3, Q_3, R_3, e_2, 2); pk3 = isogen_ell(E, P_3, Q_3, sk3, P_2, Q_2, R_2, e_3, 3); j_ech1 = isoex_ell( pk2[4], sk3, pk2[1], pk2[2], pk2[3], e_3, 3) j_ech2 = isoex_ell( pk3[4], sk2, pk3[1], pk3[2], pk3[3], e_2, 2)