Compute Kernel Polynomial Given Isogeneous Curve? So I was trying to implement a CRS key exchange using modular polynomial. I start with a curve $E_1$, for Elkies prime $\ell$, I solve for the roots of classical modular polynomial $\Phi_\ell(X,j(E_1))$. Then I could obtain the j-invariant $j(E_2)$ of an isogeneous curve. However, I should be distinguishing two possible isogeny with different Frobenius eigenvalues $\lambda,\mu$. Therefore I have to somehow restore the isogeny polynomial to do this, which is suggested in [1], page 12.
Problem. Suppose $E_1,E_2$ of the same characteristic are isogeneous given by $\phi:E_1\to E_2$ where $\ker\phi$ is small. Is it possible to compute its kernel polynomial $\chi\in\mathbb F_p[X]$ that collects $\ker\phi$ as its zeros? In particular, I was using SageMath 9.0, is there anything I can use in it?
[1]"CSIDH: An Efficient Post-QuantumCommutative Group Action," Castryck et al.
 A: The whole point of CSIDH is that by concocting a suitable elliptic curve in which all the necessary kernel points are defined over the base field, it is possible to compute isogenies without resorting to modular polynomials at all. Since you are implementing CRS, not CSIDH, you need modular polynomials. For that reason, the CSIDH paper is not the best place to go looking for hints on how to do your computation.
The precise algorithms for computing the kernel polynomial are quite complicated -- much too involved for me to provide here. The canonical source is Schoof, R.: Counting points on elliptic curves over finite fields. J. Théor. Nombres Bordeaux 7, 219–254 (1995), specifically Section 8 "The kernel of the isogeny." Unfortunately this paper is not super clear from an algorithmic point of view. I am not aware of any place where the entire algorithm is written out in explicit detail.
The best overview of modular polynomial isogeny computation is Broker, R., Charles, D., Lauter, K.: Evaluating large degree isogenies and applications to pairing-based cryptography, Pairing 2008, Lecture Notes in Computer Science 5209, 100-112 (2008). This article contains fairly explicit descriptions of algorithms for almost everything, including how to distinguish the two possible isogenies (end of Section 3.1) -- everything, that is, except the kernel polynomial computation!
