Computing endomorphism rings of Jacobians of genus 2 curves over finite fields
David Freeman, Kristin Lauter
备注：
Revised version, with minor corrections and incorporating reader comments. Proposition 3.7 and Lemma 6.5 are new. To appear in Proceedings of SAGA 2007, Tahiti
We present algorithms which, given a genus 2 curve $C$ defined over a finite field and a quartic CM field $K$, determine whether the endomorphism ring of the Jacobian $J$ of $C$ is the full ring of integers in $K$. In particular, we present probabilistic algorithms for computing the field of definition of, and the action of Frobenius on, the subgroups $J[\ell^d]$ for prime powers $\ell^d$. We use these algorithms to create the first implementation of Eisenträger and Lauter's algorithm for computing Igusa class polynomials via the Chinese Remainder Theorem \cite{el}, and we demonstrate the algorithm for a few small examples. We observe that in practice the running time of the CRT algorithm is dominated not by the endomorphism ring computation but rather by the need to compute $p^3$ curves for many small primes $p$.
We classify the endomorphism algebras of factors of the Jacobian of certain hypergeometric curves over a field of characteristic zero. Other than a few exceptional cases, the endomorphism algebras turn out to be either a cyclotomic field $E=\mathbb{Q}(ζ_q)$, or a quadratic extension of $E$, or $E\oplus E$. This result may be viewed as a generalization of the well known results of the classification of endomorphism algebras of elliptic curves over $\mathbb{C}$.
The main result of [FG20] classifies the 92 geometric endomorphism algebras of geometrically split abelian surfaces defined over Q. We show that 54 of them arise as geometric endomorphism algebras of Jacobians of genus 2 curves defined over Q, and that the remaining 38 do not. In particular, we exhibit 38 examples of Qbar-isogeny classes of abelian surfaces defined over Q that do not contain any Jacobian of a genus 2 curve defined over Q, and for each of the 54 algebras that do arise we exhibit a curve realizing them.
We describe several improvements to algorithms for the rigorous computation of the endomorphism ring of the Jacobian of a curve defined over a number field.
Let $p$ be a prime, and $q$ a power of $p$. Using Galois theory, we show that over a field $K$ of characteristic zero, the endomorphism algebras of the jacobians of certain superelliptic curves $y^q=f(x)$ are products of cyclotomic fields.
Using Galois cohomology, Schmoyer characterizes cryptographic non-trivial self-pairings of the $\ell$-Tate pairing in terms of the action of the Frobenius on the $\ell$-torsion of the Jacobian of a genus 2 curve. We apply similar techniques to study the non-degeneracy of the $\ell$-Tate pairing restrained to subgroups of the $\ell$-torsion which are maximal isotropic with respect to the Weil pairing. First, we deduce a criterion to verify whether the jacobian of a genus 2 curve has maximal endomorphism ring. Secondly, we derive a method to construct horizontal $(\ell,\ell)$-isogenies starting …
We prove that the jacobian of a hyperelliptic curve y^2=f(x) is absolutely simple if deg(f)=q+1 where q is a power prime congruent to 5 modulo 8, the polynomial f(x) is irreducible over the ground field of characteristic zero and its Galois group is L_2(q).
This is (mostly) a survey article. We use an information about Galois properties of points of small order on an abelian variety in order to describe its endomorphism algebra over an algebraic closure of the ground field. We discuss in detail applications to jacobians of cyclic covers of the projective line.
We present a method for computing the Mordell-Weil rank of the jacobian of a curve of genus 2 with multiplication by a square root of 2, based on descent via isogenies of degree 2, and apply it to a family of curves.
We describe an algorithm, based on the properties of the characteristic polynomials of Frobenius, to compute $\operatorname{End}_{\overline{K}}(A)$ when $A$ is the Jacobian of a nice genus-2 curve over a number field $K$. We use this algorithm to confirm that the description of the structure of the geometric endomorphism ring of $\operatorname{Jac}(C)$ given in the LMFDB ($L$-functions and modular forms database) is correct for all the genus 2 curves $C$ currently listed in it. We also discuss the determination of the field of definition of the endomorphisms in some special cases.
Suppose that $K$ is a field of characteristic 0, $K_a$ is its algebraic closure, $p$ is a prime, $q=p^r$ is a power prime. Suppose that $f(x) \in K[x]$ is a polynomial of degree $n > 4$ without multiple roots. Let us consider the superelliptic curve $C: y^q=f(x)$ and its jacobian $J(C)$. We study the endomorphism algebra $End^0(J(C))$ of all $K_a$-endomorphisms of $J(C)$. We prove that $End^0(J(C))$ is "as small as possible" if the Galois group of $f$ over $K$ is either the full symmetric group $S_n$ or the alternating group $A_n$.
We give parametrisation of curves C of genus 2 with a maximal isotropic (ZZ/3)^2 in J[3], where J is the Jacobian variety of C, and develop the theory required to perform descent via (3,3)-isogeny. We apply this to several examples, where it can shown that non-reducible Jacobians have nontrivial 3-part of the Tate-Shafarevich group.
Let K be a field of characteristic zero, n>4 an integer, f(x) an irreducible polynomial over K of degree n, whose Galois group is doubly transitive simple non-abelian group. Let p be an odd prime, Z[ζ_p] the ring of integers in the p-th cyclotomic field, C_{f,p}:y^p=f(x) the corresponding superelliptic curve and J(C_{f,p}) its jacobian. Assuming that either n=p+1 or p does not divide n(n-1), we prove that the ring of all endomorphisms of J(C_{f,p}) coincides with Z[ζ_p].
We construct examples of families of curves of genus 2 or 3 over Q whose Jacobians split completely and have various large rational torsion subgroups. For example, the rational points on a certain elliptic surface over P^1 of positive rank parameterize a family of genus-2 curves over Q whose Jacobians each have 128 rational torsion points. Also, we find the genus-3 curve 15625(X^4 + Y^4 + Z^4) - 96914(X^2 Y^2 + X^2 Z^2 + Y^2 Z^2) = 0, whose Jacobian has 864 rational torsion points. This paper has appeared in Forum Math. 12 (2000) 315-364.
Consider the jacobian of a hyperelliptic genus two curve defined over a finite field. Under certain restrictions on the endomorphism ring of the jacobian we give an explicit description all non-degenerate, bilinear, anti-symmetric and Galois-invariant pairings on the jacobian. From this description it follows that no such pairing can be computed more efficiently than the Weil pairing. To establish this result, we need an explicit description of the representation of the Frobenius endomorphism on the l-torsion subgroup of the jacobian. This description is given. In particular, we show that if t…
We consider the problem of efficient computation in the Jacobian of a hyperelliptic curve of genus 3 defined over a field whose characteristic is not 2. For curves with a rational Weierstrass point, fast explicit formulas are well known and widely available. Here we address the general case, in which we do not assume the existence of a rational Weierstrass point, using a balanced divisor approach.
We extend the formulae of classical invariant theory for the Jacobian of a genus one curve of degree $n \le 4$ to curves of arbitrary degree. To do this, we associate to each genus one normal curve of degree $n$, an $n \times n$ alternating matrix of quadratic forms in $n$ variables, that represents the invariant differential. We then exhibit the invariants we need as homogeneous polynomials of degrees $4$ and $6$ in the coefficients of the entries of this matrix.
In this paper, we give a universal family of curves of genus 2 whose jacobians have $\sqrt2$ multiplication fixed by the Rosati involution, and several results based on it, including isogenies between jacobians of curves, and jacobians of curves with quaternionic multiplication.
We describe the use of explicit isogenies to translate instances of the Discrete Logarithm Problem (DLP) from Jacobians of hyperelliptic genus 3 curves to Jacobians of non-hyperelliptic genus 3 curves, where they are vulnerable to faster index calculus attacks. We provide explicit formulae for isogenies with kernel isomorphic to $(\ZZ/2\ZZ)^3$ (over an algebraic closure of the base field) for any hyperelliptic genus 3 curve over a field of characteristic not 2 or 3. These isogenies are rational for a positive fraction of all hyperelliptic genus 3 curves defined over a finite field of character…
Suppose K is a field of characteristic 0, $K_a$ is its algebraic closure, p is an odd prime. Suppose, $f(x) \in K[x]$ is a polynomial of degree $n \ge 5$ without multiple roots. Let us consider a curve $C: y^p=f(x)$ and its jacobian J(C). It is known that the ring End(J(C)) of all $K_a$-endomorphisms of J(C) contains the ring $Z[ζ_p]$ of integers in the pth cyclotomic field (generated by obvious automorphisms of C). We prove that $End(J(C))=Z[ζ_p]$ if the Galois group of f over K is either the symmetric group $S_n$ or the alternating group $A_n$.
In 2000, Galbraith and McKee heuristically derived a formula that estimates the probability that a randomly chosen elliptic curve over a fixed finite prime field has a prime number of rational points. We show how their heuristics can be generalized to Jacobians of curves of higher genus. We then elaborate this in genus 2 and study various related issues, such as the probability of cyclicity and the probability of primality of the number of points on the curve itself. Finally, we discuss the asymptotic behavior as the genus tends to infinity.
We study the endomorphism ring $End(J(C))$ of the complex jacobian $J(C)$ of a curve $y^p=f(x)$ where $p$ is an odd prime and $f(x)$ is a polynomial with complex coefficiens of degree $n>4$ and without multiple roots. Assume that all the coefficients of $f$ lie in a (sub)field $K$ and the Galois group of $f$ over $K$ is either the full symmetric group $S_n$ or the alternating group $A_n$. Then we prove that $End(J(C))$ is the ring of integers in the in the $p$th cyclotomic field, if $p$ is a Fermat prime (e.g., $p=3,5,17,257$). Similar results for $p=2$ (the case of hyperelliptic curves) were …
In this paper, we give an explicit formula as well as a practical algorithm for computing the Cassels-Tate pairing on $\text{Sel}^{2}(J) \times \text{Sel}^{2}(J)$ where $J$ is the Jacobian variety of a genus two curve under the assumption that all points in $J[2]$ are $K$-rational. We also give an explicit formula for the Obstruction map $\text{Ob}: H^1(G_K, J[2]) \rightarrow \text{Br}(K)$ under the same assumption. Finally, we include a worked example demonstrating we can indeed improve the rank bound given by a 2-descent via computing the Cassels-Tate pairing.
Given a prime number l greater than or equal to 5, we construct an infinite family of three-dimensional abelian varieties over Q such that, for any A/Q in the family, the Galois representation ρ_{A, l}: Gal_Q -> GSp(6, l) attached to the l-torsion of A is surjective. Any such variety A will be the Jacobian of a genus 3 curve over Q whose respective reductions at two auxiliary primes we prescribe to provide us with generators of Sp(6, l).
We show that a genus $2$ curve over a number field whose jacobian has complex multiplication will usually have stable bad reduction at some prime. We prove this by computing the Faltings height of the jacobian in two different ways. First, we use a formula by Colmez and Obus specific to the CM case and valid when the CM field is an abelian extension of the rationals. This formula links the height and the logarithmic derivatives of an $L$-function. The second formula involves a decomposition of the height into local terms based on a hyperelliptic model. We use results of Igusa, Liu, and Saito t…
We construct three-dimensional families of hyperelliptic curves of genus 6, 12, and 14, two-dimensional families of hyperelliptic curves of genus 3, 6, 7, 10, 20, and 30, and one-dimensional families of hyperelliptic curves of genus 5, 10 and 15, all of which are equipped with an an explicit isogeny from their Jacobian to another hyperelliptic Jacobian. We show that the Jacobians are generically absolutely simple, and describe the kernels of the isogenies. The families are derived from Cassou--Noguès and Couveignes' explicit classification of pairs $(f,g)$ of polynomials such that $f(x_1) - g(…
We give a closed formula for recovering a non-hyperelliptic genus three curve from its period matrix, and derive some identities between Jacobian Nullwerte in dimension three.
Let $p$ be an odd prime number and be an integer coprime to $p$. We survey an algorithm for computing explicit rational representations of $(\ell,...,\ell)$-isogenies between Jacobians of hyperelliptic curves of arbitrary genus over an extension $K$ of the field of $p$-adic numbers $\mathbb{Q}\_p$. The algorithm has a quasi-linear complexity in $\ell$ as well as in the genus of the curves.
Let $C$ be a smooth projective curve of genus $g \ge 1$ over a finite field $\F$ of cardinality $q$. In this paper, we first study $\#\J_C$, the size of the Jacobian of $C$ over $\F$ in case that $\F(C)/\F(X)$ is a geometric Galois extension. This improves results of Shparlinski \cite{shp}. Then we study fluctuations of the quantity $\log \#\J_C-g \log q$ as the curve $C$ varies over a large family of hyperelliptic curves of genus $g$. For fixed genus and growing $q$, Katz and Sarnak showed that $\sqrt{q}\left(\log \# \J_C-g \log q\right)$ is distributed as the trace of a random $2g \times 2g$…
For distinct odd primes $p$ and $q$, we define the Catalan curve $C_{p,q}$ by the affine equation $y^q=x^p-1$. In this article we construct the Sato-Tate groups of the Jacobians in order to study the limiting distributions of coefficients of their normalized L-polynomials.Catalan Jacobians are nondegenerate and simple with noncyclic Galois groups (of the endomorphism fields over $\mathbb Q$), thus making them interesting varieties to study in the context of Sato-Tate groups. We compute both statistical and numerical moments for the limiting distributions. Lastly, we determine the Galois endomo…
We present an accelerated Schoof-type point-counting algorithm for curves of genus 2 equipped with an efficiently computable real multiplication endomorphism. Our new algorithm reduces the complexity of genus 2 point counting over a finite field (\F_{q}) of large characteristic from (\widetilde{O}(\log^8 q)) to (\widetilde{O}(\log^5 q)). Using our algorithm we compute a 256-bit prime-order Jacobian, suitable for cryptographic applications, and also the order of a 1024-bit Jacobian.
In this note, an analogous statement to the Nagell-Lutz theorem does not hold for the Jacobian of a certain curve of genus 2 over $\mathbb{C}(t)$. As a by-product, we give a (2, 3, 6) quasi-torus decomposition for the dual curve of a smooth cubic.
We give a criterion to distinguish between a genus three Jacobian and its [-1] twist in terms of the product of the 36 even theta nulls. We also express the product of the 36 theta nulls in terms of the discriminant of a genus three curve. The results are arithmetic in nature and thus add to previous work over C on the product of the even theta nulls. They generalize previous work of Ritzenthaler and Lachaud for Abelian threefolds which are (2,2,2) isogenous to a product of elliptic curves. This answers a 2003 of letter of Jean-Pierre Serre to Jaap Top.
Let $C$ be a genus $2$ hyperelliptic curve over a number field $K$, with a Weierstrass point $\infty$ at infinity, let $J$ be its Jacobian, let $Θ$ be the theta divisor with respect to $\infty$, and let $p$ be any prime number. We give an explicit construction of a $p$-adic height $h_p\colon J(\overline{\mathbb{Q}})\to \mathbb{Q}_p$ by means of $p$-adic analogues of Néron functions of divisor $2Θ$. We define such Néron functions using division polynomials and a generalisation of Blakestad's $p$-adic sigma function on the formal group of $J$. We prove that our $p$-adic Néron function $λ_v$ at a…
In this paper we study genus 2 curves whose Jacobians admit a polarized (4,4)-isogeny to a product of elliptic curves. We consider base fields of characteristic different from 2 and 3, which we do not assume to be algebraically closed. We obtain a full classification of all principally polarized abelian surfaces that can arise from gluing two elliptic curves along their 4-torsion and we derive the relation their absolute invariants satisfy. As an intermediate step, we give a general description of Richelot isogenies between Jacobians of genus 2 curves, where previously only Richelot isogenies …
Mazur proved that any element xi of order three in the Shafarevich-Tate group of an elliptic curve E over a number field k can be made visible in an abelian surface A in the sense that xi lies in the kernel of the natural homomorphism between the cohomology groups H^1(k,E) -> H^1(k,A). However, the abelian surface in Mazur's construction is almost never a jacobian of a genus 2 curve. In this paper we show that any element of order three in the Shafarevich-Tate group of an elliptic curve over a number field can be visualized in the jacobians of a genus 2 curve. Moreover, we describe how to get …
Given a sextic CM field $K$, we give an explicit method for finding all genus 3 hyperelliptic curves defined over $\mathbb{C}$ whose Jacobians are simple and have complex multiplication by the maximal order of this field, via an approximation of their Rosenhain invariants. Building on the work of Weng, we give an algorithm which works in complete generality, for any CM sextic field $K$, and computes minimal polynomials of the Rosenhain invariants for any period matrix of the Jacobian. This algorithm can be used to generate genus 3 hyperelliptic curves over a finite field $\mathbb{F}_p$ with a …
We prove that the jacobian of a hyperelliptic curve y^2=f(x) has no nontrivial endomorphisms over an algebraic closure of the ground field of characteristic zero if the Galois group of the polynomial f is ``very big''.
We describe a method to determine all the isomorphism classes of principal polarizations of the modular abelian surfaces $A_f$ with quaternionic multiplication attached to a normalized newform $f$ without complex multiplication. We include an example of $A_f$ with quaternionic multiplication for which we find numerically a curve $C$ whose Jacobian is $A_f$ up to numerical approximation, and we prove that it has quaternionic multiplication and is isogenous to $A_f$.
We introduce an algorithm to compute the rational torsion subgroup of the Jacobian of a hyperelliptic curve of genus 3 over the rationals. We apply a Magma implementation of our algorithm to a database of curves with low discriminant due to Sutherland as well as a list of curves with small coefficients. In the process, we find several torsion structures not previously described in the literature. The algorithm is a generalisation of an algorithm for genus 2 due to Stoll, which we extend to abelian varieties satisfying certain conditions. The idea is to compute p-adic torsion lifts of points ov…
We gives an explicit genus 3 curve over Q such that the Galois action on the torsion points of its Jacobian is a large as possible. That such curves exist is a consequence of a theorem of D. Zureick-Brown and the author; however, those methods do not produce explicit examples. We shall apply the general strategies of Hall and Serre in their open image theorems. We also make use of Serre's conjecture to show that the modulo ell Galois actions are irreducible. While we computationally focus on a single curve, the methods of this paper can be applied to a large family of genus 3 curves.
We study the problem of efficiently constructing a curve C of genus 2 over a finite field F for which either the curve C itself or its Jacobian has a prescribed number N of F-rational points. In the case of the Jacobian, we show that any `CM-construction' to produce the required genus-2 curves necessarily takes time exponential in the size of its input. On the other hand, we provide an algorithm for producing a genus-2 curve with a given number of points that, heuristically, takes polynomial time for most input values. We illustrate the practical applicability of this algorithm by constructing…
We consider the problem of finding cryptographically suitable Jacobians. By applying a probabilistic generic algorithm to compute the zeta functions of low genus curves drawn from an arbitrary family, we can search for Jacobians containing a large subgroup of prime order. For a suitable distribution of curves, the complexity is subexponential in genus 2, and O(N^{1/12}) in genus 3. We give examples of genus 2 and genus 3 hyperelliptic curves over prime fields with group orders over 180 bits in size, improving previous results. Our approach is particularly effective over low-degree extension fi…
Let $\C$ be a genus 2 curve defined over $k$, $char (k) =0$. If $\C$ has a $(3,3)$-split Jacobian then we show that the automorphism group $Aut(\C)$ is isomorphic to one of the following: $\bZ_2, V_4, D_8$, or $D_{12}$. There are exactly six $\bC$-isomorphism classes of genus two curves $\C$ with $Aut(\C)$ isomorphic to $D_8$ (resp., $D_{12}$). %We compute their absolute invariants $i_1, i_2, i_3$. We show that exactly four (resp., three) of these classes with group $D_8$ (resp., $D_{12}$) have representatives defined over $\bQ$. We discuss some of these curves in detail and find their rationa…
Up to isomorphism over C, every simple principally polarized abelian variety of dimension 3 is the Jacobian of a smooth projective curve of genus 3. Furthermore, this curve is either a hyperelliptic curve or a plane quartic. Given a sextic CM field K, we show that if there exists a hyperelliptic Jacobian with CM by K, then all principally polarized abelian varieties that are Galois conjugated to it are hyperelliptic. Using Shimura's reciprocity law, we give an algorithm for computing approximations of the invariants of the initial curve, as well as their Galois conjugates. This allows us ton d…
We revisit and generalize some geometric techniques behind deterministic primality testing for some integer sequences using curves of genus 1 over finite rings. Subsequently we develop a similar primality test using the Jacobian of a genus 2 curve.
A curve over the field of two elements with completely decomposable Jacobian is shown to have at most six rational points and genus at most 26. The bounds are sharp. The previous upper bound for the genus was 145. We also show that a curve over the field of $q$ elements with more than $q^{m/2}+1$ rational points has at least one Frobenius angle in the open interval $(π/m,3π/m)$. The proofs make use of the explicit formula method.
We discuss the structure of the endomorphism algebras of the jacobians of superelliptic curves y^q=f(x) where q is a prime power and f(x) is an irreducible cubic or quartic polynomial over the field of rational functions k(t) in characteristic zero, whose Galois group is the full symmetric group.
We give a general framework for uniform, constant-time one-and two-dimensional scalar multiplication algorithms for elliptic curves and Jacobians of genus 2 curves that operate by projecting to the x-line or Kummer surface, where we can exploit faster and more uniform pseudomultiplication, before recovering the proper "signed" output back on the curve or Jacobian. This extends the work of L{ó}pez and Dahab, Okeya and Sakurai, and Brier and Joye to genus 2, and also to two-dimensional scalar multiplication. Our results show that many existing fast pseudomultiplication implementations (hitherto …
