Look at optimizations.md file.

Use "shared secret" instead of "key agreement" to point out that there's no hashing, key derivation, etc. going on.

Measure the keypair generation (including random sampling) in the "fast" benchmarks.

A later revision of the CLN paper uses the Montgomery relation to recover the a
value from the three x-coordinates in the public key, saving its transmission.
This patch improves slightly over the description in the paper, by
projectivizing the computation of the first four-isogeny; this means that it's
not necessary to perform an inversion to get the affine a value.

Currently these aren't tested; Sage gets unhappy working with isogenies of
large elliptic curves.  (Also, the previous test vectors were generated just to
test curve arithmetic, so they're not in the correct isogeny class and should
be changed...)

This contains Montgomery (pseudo)addition, doubling, and tripling.

The formulas are slightly amended from the usual Montgomery arithmetic to allow
projective curve coefficients.