Abelian varieties with prescribed embedding and full embedding degrees

TL;DR

This paper demonstrates the existence of abelian varieties with specific embedding and full embedding degrees over finite fields, crucial for cryptography, by constructing varieties with prescribed CM fields and endomorphism properties.

Contribution

It provides a method to construct abelian varieties with predetermined embedding degrees and endomorphism algebras, advancing cryptographic applications.

Findings

Existence of abelian varieties with prescribed embedding degrees

Construction over finite fields with specific CM fields

Analysis of simple higher dimensional abelian varieties

Abstract

We study the problem of the embedding degree of an abelian variety over a finite field which is vital in pairing-based cryptography. In particular, we show that for a prescribed CM field $L$ of degree $\geq 4$, prescribed integers $m$, $n$ and any prime $\ell\equiv 1 \mod{mn}$ that splits completely in $L$, there exists an ordinary abelian variety over a prime finite field with endomorphism algebra $L$, embedding degree $n$ with respect to $\ell$ and the field extension generated by the $\ell$-torsion points of degree $mn$ over the field of definition. We also study a class of absolutely simple higher dimensional abelian varieties whose endomorphism algebras are central over imaginary quadratic fields.

Equations

$$A[\ell ]\times A[\ell ]⟶{\mu }_{\ell }$$

$$A[\ell ]({\mathbb{F}}_q)\times A({\mathbb{F}}_q)/\ell A({\mathbb{F}}_q)⟶{\mathbb{F}}_q^{\ast }/({\mathbb{F}}_q^{\ast }{)}^{\ell }.$$

$$\{\text{Simple abelian varieties over }{\mathbb{F}}_q\text{ up to isogeny}\}⟷\{\text{Weil }q\text{-integers up to }{\mathrm{Gal}}_{\mathbb{Q}}\text{-conjugacy}\}$$

$$2\dim B=[\mathbb{Q}(\pi ):\mathbb{Q}]\cdot [{\mathrm{End}}^0(B_{\pi }):\mathbb{Q}(\pi ){]}^{1/2}.$$

$$P_{B_{\pi }}(X):=\prod _{\sigma \in {\mathrm{Gal}}_{\mathbb{Q}}}(X-\sigma (\pi ){)}^{m_{\pi }}$$

$${\Phi }_N(X):=\prod _{\begin{array}{c}1\le j\le N\\ \gcd (j,N)=1\end{array}}(X-{\zeta }_{{}_N}^j)\in \mathbb{Z}[X]$$

$$B{\times }_{{\mathbb{F}}_q}{\overline{\mathbb{F}}}_q{=}_{\mathrm{isog}}{\tilde{B}}^{(\dim B)/N}.$$

$${\mathrm{inv}}_v(D_{\pi })=\{\begin{array}{ll}0& \text{ if }v\nmid q.\\ \frac{1}{2}& \text{ if }v\text{ is real.}\\ [\mathbb{Q}(\pi {)}_v:{\mathbb{Q}}_p]\cdot \frac{v(\pi )}{v(q)}& \text{ if }v|q.\end{array}$$

$$\big{|}B_{\pi}(\mathbb{F}_{q})\big{|}=P_{B_{\pi}}(1)=\operatorname{Nm}(1-\pi)^{m_{\pi}}\vspace{-1mm}$$

$$[{\mathbb{F}}_q(B_{\pi }[n]):{\mathbb{F}}_q]=\inf \{d\ge 1:{\pi }^d\equiv 1(\mathrm{mod}n)\text{ in }\mathrm{End}(A)\}.$$

$${\mathbb{F}}_q\subseteq {\mathbb{F}}_{q^n}\subseteq {\mathbb{F}}_q(B_{\pi }[\ell ])\subseteq {\mathbb{F}}_{q^{\ell -1}}.$$

$$[\mathbb{Q}(\pi ):\mathbb{Q}]=\{\begin{array}{ll}\varphi (N)& \text{if }\sqrt{q}\in \mathbb{Q}({\zeta }_{{}_N})\\ 2\varphi (N)& \text{if }\sqrt{q}\notin \mathbb{Q}({\zeta }_{{}_N}).\end{array}$$

$$P_B(1)=\prod _{\sigma \in \mathrm{Gal}(\mathbb{Q}({\mathcal{W}}_{B_{\pi }})/\mathbb{Q})}(1-\sigma (\pi ))$$

$$=\prod _{\gcd (i,2N)=1}(1-\sqrt{q}{\zeta }_{{}_{2N}}^i)$$

$$=\prod _{\gcd (i,2N)=1}({\zeta }_{{}_{2N}}^{-i}-\sqrt{q})$$

$$={\Phi }_{2N}(\sqrt{q}).$$

$$2g=[\mathbb{Q}(\pi ):\mathbb{Q}]\cdot [D_{\pi }:\mathbb{Q}(\pi ){]}^{1/2}=\varphi (N)\cdot [D_{\pi }:\mathbb{Q}(\pi )].$$

$${\pi }^{\frac{\ell -1}{m\cdot n}}\equiv 1(\mathrm{mod}\mathfrak{l}),{\overline{\pi }}^{\frac{\ell -1}{m\cdot n}}\equiv {\zeta }_{mn}^{m\cdot i}(\mathrm{mod}\mathfrak{l}),{\pi }_{{}_1}^{\frac{\ell -1}{m\cdot n}}\equiv {\zeta }_{mn}^j(\mathrm{mod}\mathfrak{l})$$

$$\tilde{\pi }:={\pi }^{{}^{\frac{\ell -1}{m\cdot n}}},\tilde{q}:=q^{{}^{\frac{\ell -1}{m\cdot n}}}\text{vspace}-1mm$$

$$\inf \{d\ge 1:\sigma (\tilde{\pi }{)}^d\equiv 1(\mathrm{mod}\mathfrak{l})\forall \sigma \in {\mathrm{Gal}}_{\mathbb{Q}}\}.\text{vspace}-1mm$$

$${\sigma }^j(\pi )={\pi }^{k_1^j}\cdot q^{k(k_1^j-1)/(k_1-1)}.$$

$${\mathcal{W}}_{B_{\pi }}=\{\pi \cdot {\zeta }_3^i,\overline{\pi }\cdot {\zeta }_3^i:i=0,1,2\}$$

$$3\times \frac{1}{3},3\times \frac{2}{3}$$

$${\mathcal{W}}_{B_{{\pi }^3}}=\{{\pi }_1^2\cdot {\overline{\pi }}_1,{\pi }_1\cdot {\overline{\pi }}_1^2\},{\Phi }_{B_{{\pi }^3}}=⟨{\pi }_1,{\overline{\pi }}_1⟩$$

$$\pi {\mathcal{O}}_L=\prod _{i=1}^g{\mathfrak{p}}_i,\overline{\pi }{\mathcal{O}}_L=\prod _{i=1}^g{\overline{\mathfrak{p}}}_i$$

$${\mathrm{Nm}}_{\Phi }:L⟶\tilde{L},x\mapsto \prod _{\varphi \in \Phi }\varphi (x)$$

$${\mathrm{Nm}}_{\Phi }(x)\cdot {\mathrm{Nm}}_{\overline{\Phi }}(x)={\mathrm{Nm}}_{L/\mathbb{Q}}(x).$$

$${\mathrm{Nm}}_{\Psi }:\tilde{L}⟶\tilde{L},x\mapsto \prod _{\psi \in \Psi }\psi (x)$$

$${\mathrm{Nm}}_{\Phi }:\tilde{L}⟶\tilde{L}\text{vspace}-1mm$$

$$\ell {\mathcal{O}}_{\tilde{L}}=\prod _{\varphi \in \Phi }\varphi (\mathfrak{l})\overline{\varphi }(\mathfrak{l}).\text{vspace}-2mm$$

$$\mathrm{Gal}({\tilde{L}}^{\ell {\mathcal{O}}_{\tilde{L}}}/\tilde{L})\cong \prod _{\sigma \in \mathrm{Gal}(\tilde{L}/\mathbb{Q})}\mathrm{Gal}({\tilde{L}}^{\sigma (\mathfrak{l})}/\tilde{L})$$

$$\#B_{\pi }({\mathbb{F}}_p)=\frac{(\#C({\mathbb{F}}_p){)}^2+\#C({\mathbb{F}}_{p^2})}{2}-p.$$

Full text

1 Introduction

For a principally polarized abelian variety $A$ over a finite field $\mathbb{F}_{q}$ and a prime $\ell$ prime to $q$, the embedding degree is the degree of the field extension $\mathbb{F}_{q}(\zeta_{\ell})$ obtained by attaching the $\ell$-th roots of unity. The full embedding degree is the degree of the field extension $\mathbb{F}_{q}(A[\ell])$ obtained by attaching all $\ell$-torsion points of $A$.

The embedding and full embedding degrees for varieties that are Jacobians of curves are natural notions in pairing-based cryptography. Such an abelian variety is principally polarized and is endowed with the non-degenerate Weil pairing

[TABLE]

from the subgroup scheme of $\ell$-torsion points to the $\ell$-th roots of unity in $\overline{\mathbb{F}}_{q}$. If $\mathbb{F}_{q}$ contains $\mu_{\ell}$, we also have the non-degenerate Tate pairing

[TABLE]

In pairing-based cryptography, one typically chooses the prime $\ell$ and the embedding degree such that the discrete logarithm problems in the groups $A(\mathbb{F}_{q})[\ell]$ (the $\ell$-torsion subgroup of the group of $\mathbb{F}_{q}$-valued points of $A$) and $\mathbb{F}_{q}(\mu_{\ell})^{*}$ are roughly of the same difficulty. This entails a large $\ell$ and a substantially smaller embedding degree. Abelian varieties with these properties are called pairing friendly. Curves whose Jacobians allow for this are relatively rare and are also said to be pairing friendly curves.

The full embedding degree is an integer sandwiched in between the embedding degree and the prime $\ell$ and hence, one of the ways to look for suitable pairing-friendly abelian varieties is to look for abelian varieties with a prescribed embedding and full embedding degree. The crux of this short paper is some existence theorems related to this question.

We only consider simple abelian varieties, i.e. those not isogenous to a product of two lower dimensional ableian varieties, since we can always reduce to this case. By Honda-Tate theory, the isogeny classes of simple abelian varieties over a finite field are in bijection with the Galois conjugacy classes of Weil numbers. Hence, the existence of abelian varieties with cetain properties is equivalent to the existence of suitable Weil numbers.

1.1 Structure of the paper

In section 1, we introduce some notations and background. We also state and prove a few lemmas that we will need repeatedly in the subsequent sections.

In section 2, we explore simple (albeit not absolutely simple) supersingular abelian varieties as candidate for pairing friendly curves.

In section 3, we discuss Koblitz’s theorem on embedding degrees generalized to higher dimensional abelian varieties. We show that it fails to generalize to all but one class of absolutely simple abelian varieties of dimension two or higher.

In section 4, we study ordinary abelian varieties. In particular, we show that for a prescribed CM field $L$, prescribed integers $m$, $n$ and prescribed prime $\ell$ that splits completely in $L(\zeta_{mn})$, there exists an ordinary abelian variety over a prime finite field with endomorphism algebra $L$ and with embeddng and full embedding degrees $n$ and $m\cdot n$ respectively with respect to the prime $\ell$.

In section 5, we study a class of absolutely simple abelian varieties with endomorphism algebra that are central over imaginary quadratic fields. This is the only class of higher dimensional abelian varieties where the notions of the embedding and the full embedding degrees coincide.

1.2 Notations and background

Throughout, $q$ denotes the size of a finite field which is the field of definition of an abelian variety under discussion. We denote the prime charactersitic of this field by $p$. Thus, $q$ is a $p$-power.

For an abelian variety $A$ over a field $F$, $\operatorname{End}^{0}(A)$ denotes the endomorphism algebra of $A$ over the field of definition. By Honda-Tate theory, we have the well-known bijection

[TABLE]

induced by the map sending an abelian variety to its Frobenius. For a Weil number $\pi$, we write $B_{\pi}$ for the corresponding simple abelian variety (up to isogeny) over $\mathbb{F}_{q}$. The dimension of $B_{\pi}$ is given by

[TABLE]

Note that $\operatorname{End}^{0}(B_{\pi})$ is a central division algebra over $\mathbb{Q}(\pi)$ and hence, $[\operatorname{End}^{0}(B_{\pi}):\mathbb{Q}(\pi)]^{1/2}$ is an integer. The characteristic polynomial of $B_{\pi}$ on the Tate representation $V_{\ell}(A):=T_{\ell}(A)\otimes_{\mathbb{Z}_{\ell}}\mathbb{Q}_{l}$ (for any prime ${\ell}\neq p$) is independent of ${\ell}$ and is given by

[TABLE]

where $m_{\pi}=[\operatorname{End}^{0}(B_{\pi}):\mathbb{Q}(\pi)]^{1/2}.$ We denote by $\mathcal{W}_{B_{\pi}}$ the set of Galois conjugates of $\pi$. Hence, $\mathbb{Q}(\mathcal{W}_{B_{\pi}})$ is the splitting field of $P_{B_{\pi}}(X)$. The Galois group $\mathrm{Gal}(\mathbb{Q}(\mathcal{W}_{B_{\pi}})/\mathbb{Q})$ is a subgroup of the wreath product $(\mathbb{Z}/2\mathbb{Z})^{g}\rtimes S_{g}$. This is the same as the Galois group of the generic CM field of degree $2g$, where $g=[\mathbb{Q}(\pi+\overline{\pi}):\mathbb{Q}]$.

The multiplicative group generated by $\mathcal{W}_{B_{\pi}}$ is denoted by $\Phi_{B_{\pi}}$. For a suitable base change $B_{\widetilde{\pi}}$ of $B_{\pi}$ to a larger extension, the group $\Phi_{B_{\widetilde{\pi}}}$ is a free abelian group. In the generic case, it is a free abelian group of rank $\dim B_{\pi}+1$.

For an abelian variety $B$ over a field $F$, $B(F)$ denotes the group of $F$-valued points on $B$. For an integer $n$, $B[n]$ denotes the $n$-torsion subgroup of $B(\overline{F})$ where $\overline{F}$ is the algebraic closure of $F$. The field extension generated by the coordinates of the points in $B[n]$ is denoted by $F(B[n])$.

For an integer $N\geq 1$, $\zeta_{{}_{N}}$ denotes a primitive $N$-th root of unity. $\phi(N)$ denotes the Euler totient function and $\Phi_{N}(X)$ denotes the $N$-th cyclotomic polynomial

[TABLE]

which is a degree $\phi(N)$ polynomial irreducible in $\mathbb{Z}[X]$.

For a number field $K$, we denote its Hilbert class field by $\mathrm{H}(K)$. For a modulus $\mathfrak{m}$ in a number field $K$, we denote the ray class field of $\mathfrak{m}$ by $K^{\mathfrak{m}}$.

We denote the Galois closure of $K$ over $\mathbb{Q}$ by $\widetilde{K}$. If $K$ is a CM field, we denote its maximal totally real subfield by $K^{+}$. We denote the ring of integers by $\mathcal{O}_{K}$.

Definition 1.1**.**

An abelian variety $A$ over a field $F$ is simple if it does not contain a strict non-zero abelian subvariety. We say $A$ is absolutely or geometrically simple if the base change $A\times_{F}\overline{F}$ to the algebraic closure is simple.

Definition 1.2**.**

An abelian variety $A$ is iso-simple if it has a unique simple abelian subvariety up to isogeny.

We state a few well-known facts about abelian varieties over finite fields. We refer the reader to notes [Oo95] for proofs and further details.

Proposition 1.1**.**

For any simple abelian variety $B$ over a finite field $\mathbb{F}_{q}$, the abelian variety $B\times_{\mathbb{F}_{q}}\overline{\mathbb{F}}_{q}$ is iso-simple.

With this setup, let $\pi$ be a Weil number corresponding to $B$ and let $\widetilde{B}$ be the unique simple component (up to isogeny) of the base change $B\times_{\mathbb{F}_{q}}\overline{\mathbb{F}}_{q}$ to the algebraic closure. Let $N$ be the smallest integer such that $\widetilde{B}$ has a model over the field $\mathbb{F}_{q^{N}}$. Then $\widetilde{B}$ corresponds to the Weil number $\pi^{N}$ and we have an isogeny

[TABLE]

Proposition 1.2**.**

Let $\pi$ be a Weil $q$-integer and write $D_{\pi}:=\operatorname{End}^{0}(B_{\pi})$. Then $D_{\pi}$ is a central division algebra over $\mathbb{Q}(\pi)$ and its Hasse invariants are given by

[TABLE]

In particular, $\operatorname{End}^{0}(B_{\pi})$ is commutative if and only if the local degrees $[\mathbb{Q}(\pi)_{v}:\mathbb{Q}_{p}]$ annihilate the Newton slopes $\frac{v(\pi)}{v(q)}$. For instance, if $B_{\pi}$ is ordinary, the slopes $\frac{v(\pi)}{v(q)}$ are either [math] or $1$ and hence, $\operatorname{End}^{0}(B_{\pi})$ is commutative.

1.3 A few preliminary results

The following well-known result describes the embedding degree for a fixed prime $\ell$ and a simple abelian variety corresponding to a Weil number $\pi$ prime to $\ell$.

Proposition 1.3**.**

Let $B_{\pi}$ be a simple abelian variety over a finite field $\mathbb{F}_{q}$ corresponding to a Weil number $\pi$ and let $\ell$ be a prime not dividing $q$. The order \big{|}B_{\pi}(\mathbb{F}_{q})\big{|} of the group of $\mathbb{F}_{q}$-points is given by

[TABLE]

where $m_{\pi}$ is the multiplicity of $\pi$ in the characteristic polynomial.

The next few lemmas in this section might be obvious to most readers but we record them here since we will need them repeatedly in the subsequent sections.

Lemma 1.4**.**

Let $\pi$ be a Weil number and $B_{\pi}$ the corresponding abelian variety over a finite field $\mathbb{F}_{q}$. For any rational prime $\ell$, the following are equivalent:

$(1)$* $\pi-1$ lies in some prime $\mathfrak{l}$ of $\mathbb{Q}(\mathcal{W}_{B_{\pi}})$ lying over $\ell$.*

$(2)$* $\ell$ divides the order \big{|}B_{\pi}(\mathbb{F}_{q})\big{|}.*

Proof 1*.*

$(1)\Rightarrow(2)$: If $\pi-1\in\mathfrak{l}$, then \big{|}B_{\pi}(\mathbb{F}_{q})\big{|}=\operatorname{Nm}(1-\pi)\in\mathfrak{l} and since \big{|}B_{\pi}(\mathbb{F}_{q})\big{|} is a rational integer, \big{|}B_{\pi}(\mathbb{F}_{q})\big{|}\in\mathfrak{l}\cap\mathbb{Z}=\ell\mathbb{Z}.

$(2)\Rightarrow(1)$: Fix a prime $\mathfrak{l}$ of $\mathbb{Q}(\mathcal{W}_{B_{\pi}})$ lying over $\ell$. If $\operatorname{Nm}(1-\pi)\in\ell\mathbb{Z}$, then there exists $\sigma\in\mathrm{Gal}_{\mathbb{Q}}$ such that $1-\sigma^{-1}(\pi)\in\mathfrak{l}$. Hence, $1-\pi\in\sigma(\mathfrak{l})$.

Lemma 1.5**.**

The following are equivalent:

$(1)$* $\ell$ divides \big{|}B_{\pi}(\mathbb{F}_{q})\big{|} and $B_{\pi}$ has embedding degree $N$ with respect to $\ell$.*

$(2)$* There exists a prime $\mathfrak{l}$ of $\mathbb{Q}(W_{B_{\pi}})$ lying over $\ell$ such that $\pi\equiv 1\pmod{\mathfrak{l}}$ and $\Phi_{N}(\overline{\pi})\in\mathfrak{l}$.*

Proof 2*.*

Let $\Phi_{N}(X)$ denote the $N$-th cyclotomic polynomial.

$(1)\Rightarrow(2)$: Since $\ell$ divides $P_{B_{\pi}}(1)$, it is clear that $\pi\equiv 1\pmod{\mathfrak{l}}$ for some prime $\mathfrak{l}$ lying over $\ell$. Now, $q\equiv\overline{\pi}\pmod{\mathfrak{l}}$ and since $\Phi_{N}(q)\in\mathfrak{l}$, it follows that $\Phi_{N}(\overline{\pi})\in\mathfrak{l}$.

$(2)\Rightarrow(1)$: If $\pi-1\in\mathfrak{l}$, then $\operatorname{Nm}_{\mathbb{Q}(\pi)/\mathbb{Q}}(1-\pi)\in\operatorname{Nm}_{\mathbb{Q}(\pi)/\mathbb{Q}}(\mathfrak{l})=\ell\mathbb{Z}$ and hence, $\ell$ divides \big{|}B_{\pi}(\mathbb{F}_{q})\big{|}. Furthermore, since $\Phi_{N}(\overline{\pi})\equiv\Phi_{N}(q)\pmod{\mathfrak{l}}$, it follows that $\Phi_{N}(q)\in\mathfrak{l}\cap\mathbb{Z}=\ell\mathbb{Z}$.

Lemma 1.6**.**

Let $B_{\pi}$ be an abelian variety over $\mathbb{F}_{q}$ and let $\ell$ be any rational prime not dividing $q$. Let $K/\mathbb{Q}$ be any number field and let $\ell\mathcal{O}_{K}=\mathfrak{l}_{1}^{e_{1}}\cdots\mathfrak{l}_{r}^{e_{r}}$ be the prime decomposition of $\ell$ in $K$. For each index $i$, let $d_{i}$ be the order of $q$ in $(\mathcal{O}_{K}/\mathfrak{l}_{i}^{e_{i}})^{*}$. The integer $d_{i}$ is independent of the index $i$ and is the embedding degree of $B_{\pi}$ with respect to $\ell$.

Proof 3*.*

For any index $i$ and integer $d$, $\Phi_{d}(q)\in\mathfrak{l}_{i}$ if and only if $\Phi_{d}(q)\in\mathfrak{l}_{i}\cap\mathbb{Z}=\ell\mathbb{Z}$.

The following well-known theorem shows that for elliptic curves, the embedding degree coincides with the the degree of the field extension generated by the $\ell$-torsion points.

Theorem 1.7**.**

$\mathrm{(Koblitz)}$* Let $E$ be an elliptic curve over $\mathbb{F}_{q}$ and let $\ell$ be a prime dividing $|E(\mathbb{F}_{q})|$. Suppose $\ell\nmid(q-1)$. Then the embedding degree with respect to $\ell$ is $[\mathbb{F}_{q}(E[\ell]):\mathbb{F}_{q}]$.*

Lemma 1.8**.**

$\mathrm{([Kow03])}$* Let $B_{\pi}$ be a simple abelian variety over $\mathbb{F}_{q}$ and let $n$ be an integer prime to $q$. Then the degree $[\mathbb{F}_{q}(B_{\pi}[n]):\mathbb{F}_{q}]$ is given by*

[TABLE]

The following corollary follows immediately.

Corollary 1.9**.**

Let $\ell$ be a prime that does not divide $q$ and let $\mathfrak{l}$ be a prime of $\widetilde{L}:=\mathbb{Q}(\mathcal{W}_{B_{\pi}})$ lying over $\ell$. For every $\sigma\in\mathrm{Gal}_{\mathbb{Q}}$, let $d_{\sigma}$ be the order of $\sigma(\pi)$ in $(\mathcal{O}_{L}/\mathfrak{l}^{e}\mathcal{O}_{L})^{*}$ where $e$ is the ramification index of $\ell$ in $\mathbb{Q}(\mathcal{W}_{B_{\pi}})/\mathbb{Q}$ . Then the degree $[\mathbb{F}_{q}(B_{\pi}[\ell]):\mathbb{F}_{q}]$ is given by $\mathrm{lcm}(d_{\sigma})_{\sigma}$.

Proof 4*.*

We write $d:=\mathrm{lcm}(d_{\sigma})_{\sigma}$. Let $\mathfrak{l}_{1}$ be any prime of $\mathbb{Q}(\mathcal{W}_{B_{\pi}})$ lying over $\ell$. Then there exists $\sigma\in\mathrm{Gal}_{\mathbb{Q}}$ such that $\mathfrak{l}=\sigma(\mathfrak{l}_{1})$. So $\pi^{d_{\sigma}}\equiv 1\pmod{\mathfrak{l}_{1}^{e}}$ and hence, $\pi^{d}\equiv 1\pmod{\ell}$.

Conversely, if $\pi^{d_{1}}\equiv 1\pmod{\ell}$ for some integer $d_{1}$, then in particular, $\pi^{d_{1}}\equiv 1\pmod{\sigma^{-1}(\mathfrak{l}^{e})}$ and hence, $\sigma(\pi)^{d_{1}}\equiv 1\pmod{\mathfrak{l}^{e}}$. Hence, $d$ divides $d_{1}$.

Remark. The assumption that $\gcd(n,q)=1$ is necessary to ensure that $B_{\pi}[n]$ is etale. Clearly, if $\pi^{d}\equiv 1\pmod{\ell\mathcal{O}_{\mathbb{Q}(\pi)}}$, then $\overline{\pi}^{d}\equiv 1\pmod{\ell\mathcal{O}_{\mathbb{Q}(\pi)}}$ and hence, $q^{d}\equiv 1\pmod{\ell}$ since complex conjugation preserves the ideal $\ell\mathcal{O}_{\mathbb{Q}(\pi)}$. So the embedding degree $n$ always divides the degree $[\mathbb{F}_{q}(B_{\pi}[\ell]):\mathbb{F}_{q}]$ of the field generated by all $\ell$-torsion points. Thus, we have the inclusion

[TABLE]

But unlike the case of elliptic curves, the degree $[\mathbb{F}_{q}(B_{\pi}[\ell]):\mathbb{F}_{q}]$ can be substantially larger than the embedding degree in the case of higher dimensional abelian varieties.

In pairing based cryptography, it is eminently desirable for the prime $\ell$ to be substantially larger than the embedding degree with respect to $\ell$. One way to achieve this is to construct an abelian variety $B$ over a finite field $\mathbb{F}_{q}$ such that the full embedding degree, i.e. the degree of the extension generated by the $\ell$-torsion points is substantially larger than the embedding degree. By Koblitz’s theorem, this is not possible for elliptic curves since the two notions coincide. However, as shown in the next section, this is possible for dimension two or greater.

1.4 Newton Polygons

Let $B$ be an abelian variety over an algebraically closed field $k$ of characteristic $p>0$. The group scheme $B[p^{\infty}]$ is a $p$-divisible group of rank $\leq\dim B$. Let $D(B[p^{\infty}])$ denote the Dieudonne module. Then $D(B[p^{\infty}])\otimes_{k}W(k)[\frac{1}{p}]$ is a direct sum of pure isocrystals by the Dieudonne-Manin classification theorem. Let $\lambda_{1}<\cdots<\lambda_{r}$ be the distinct slopes and let $m_{i}$ denote the multiplicity of $\lambda_{i}$. The sequence $m_{1}\times\lambda_{1},\cdots,m_{r}\times\lambda_{r}$ is called the Newton polygon of $B$.

Definition 1.3**.**

A Newton polygon is admissible if it fulfills the following conditions:

1. The breakpoints are integral, meaning that for any slope $\lambda$ of multiplicity $m_{\lambda}$, we have $m_{\lambda}\cdot\lambda\in\mathbb{Z}$.

2. The polygon is symmetric, meaning that for each slope $\lambda$, the slopes $\lambda$ and $1-\lambda$ have the same multiplicity.

Let $\pi$ be a Weil $q$-integer and let $B_{\pi}$ be the corresponding simple abelian variety over $\mathbb{F}_{q}$. Then the Newton slopes of $B_{\pi}$ are given by $\{v(\pi)/v(q)\}_{v}$ where $v$ runs through the places of $\mathbb{Q}(\pi)$ lying over $p$. In particular, the Newton polygon is symmetric and hence, all slopes lie in the interval $[0,1]$. A far more subtle fact is that the converse is also true, i.e. every admissible Newton polygon occurs as the Newton polygon of a simple abelian variety over a finite field. This was formerly known as Manin’s conjecture until proven by Serre. We refer the reader to [Tat69] for the proof.

Theorem 1.10**.**

The Newton polygon of an abelian variety over a finite field is admissible. Conversely, any admissible polygon occurs as the Newton polygon of some abelian variety over a finite field of any prescribed characteristic.

Definition 1.4**.**

An simple abelian variety of dimension $g$ over a field $F$ is ordinary if its Newton polygon is $g\times 0\;,\;g\times 1$.

For an abelian variety corresponding to a Weil $q$-integer $\pi$, the Newton slopes are given by $\frac{v(\pi)}{v(q)}$ as $v$ runs through the places of $\mathbb{Q}(\pi)$ lying over the prime $p$ that divides $q$. The element $\frac{v(\pi)}{v(q)}\in\mathbb{Q}/\mathbb{Z}$ is [math] precisely when $v$ does not divide $\pi$. Similarly, $\frac{v(\pi)}{v(q)}=1$ if and only if $v$ divides $\pi$ but not $\overline{\pi}$. Thus, $B_{\pi}$ being ordinary is equivalent to $\pi$ being coprime to $\overline{\pi}$ in $\mathbb{Q}(\pi)$ (or in any field extension of $\mathbb{Q}(\pi)$).

Definition 1.5**.**

An simple abelian variety of dimension $g$ over a field $F$ is supersingular if its Newton polygon is $2g\times 1/2$.

2 The supersingular case

We first show that the embedding degree can be arbitrarily large. The supersingular case will be key here.

Definition 2.1**.**

An abelian variety $A$ over a finite field of characteristic $p$ is supersingular if all of its Newton slopes are $\frac{1}{2}$.

For dimension $1$ or $2$, one may alternatively define a supersingular abelian variety as one with no $p$-torsion points or equivalently with no [math] as a Newton slope. But that does not extend to higher dimensions, as evidenced by absolutely simple abelian threefolds with Newton polygon $3\times\frac{1}{3}\;,\;3\times\frac{2}{3}$. It is a well-known fact that a $g$-dimensional supersingular abelian variety is isogenous over the algebraic closure to the $g$-th power of the supersingular elliptic curve.

Lemma 2.1**.**

*Let $\pi$ be a Weil $q$-integer corresponding to a simple abelian variety of dimension $g$. The following are equivalent:

$1$. $B_{\pi}$ is supersingular

$2$. $\pi^{N}\in\mathbb{Z}$ for some integer $N$.

$3$. $B_{\pi}\times_{\mathbb{F}_{q}}\overline{\mathbb{F}}_{q}$ is isogenous to a power of the supersingular elliptic curve.

$4$. $\operatorname{End}^{0}(B_{\pi})\cong\operatorname{Mat}_{g}(\mathbb{Q}_{p,\infty})$, the quaternion algebra over $\mathbb{Q}$ ramified only at $p$ and $\infty$*

Lemma 2.2**.**

Let $\pi_{{}_{1}},\pi_{{}_{2}}$ be Weil $q$-integers. The corresponding simple abelian varieties over $\mathbb{F}_{q}$ are twists of each other if and only if $\sigma(\pi_{{}_{1}})\cdot\pi_{{}_{2}}^{-1}$ is a root of unity for some $\sigma\in\mathrm{Gal}_{\mathbb{Q}}$.

Proof 5*.*

($\Rightarrow$): Suppose $B_{\pi_{{}_{1}}}$, $B_{\pi_{{}_{2}}}$ are isogenous over some extension $\mathbb{F}_{q^{N}}$. Then $\pi_{{}_{1}}^{N}$ and $\pi_{{}_{2}}^{N}$ are conjugates over $\mathbb{Q}$. Choose $\sigma\in\mathrm{Gal}_{\mathbb{Q}}$ such that $\sigma(\pi_{{}_{1}}^{N})=\pi_{{}_{2}}^{N}$. Then $(\sigma(\pi_{{}_{1}})\cdot\pi_{{}_{2}}^{-1})^{N}=1$ and hence, $\sigma(\pi_{{}_{1}})\cdot\pi_{{}_{2}}^{-1}$ is an $N$-th root of unity.

$(\Leftarrow)$: Suppose $(\sigma(\pi_{{}_{1}})\cdot\pi_{{}_{2}}^{-1})^{N}=1$ for some $\sigma\in\mathrm{Gal}_{\mathbb{Q}}$. Then $\sigma(\pi_{{}_{1}}^{N})=\pi_{{}_{2}}^{N}$ and hence, $B_{\pi_{{}_{1}}^{N}}$ is isogenous to $B_{\pi_{{}_{2}}^{N}}$.

In particular, if $\pi$ is a Weil $q$-integer corresponding to a supersingular abelian variety, then $\frac{\pi}{\sqrt{q}}$ is a root of unity.

Corollary 2.3**.**

Let $B$ be a simple supersingular abelian variety over a finite field $\mathbb{F}_{q}$. Then $\dim B=\phi(N)$ or $\frac{\phi(N)}{2}$ for some integer $N$.

Proof 6*.*

Let $\pi$ be the corresponding Weil $q$-integer. Then $\pi=\sqrt{q}\cdot\zeta_{{}_{N}}$ where $N$ is an integer and $\zeta_{{}_{N}}$ is a primitive $N$-th root of unity. For brevity, write $D_{\pi}:=\operatorname{End}^{0}(B)$ and let $p$ be the characteristic of $\mathbb{F}_{q}$. By Honda-Tate theory, $2\dim B=[\mathbb{Q}(\pi):\mathbb{Q}]\cdot[D_{\pi}:\mathbb{Q}(\pi)]^{1/2}$. Now,

[TABLE]

Furthermore, the Newton slopes are all $\frac{1}{2}$. So the Hasse invariants of $D_{\pi}$ are $\frac{1}{2}\cdot[\mathbb{Q}(\pi)_{v}:\mathbb{Q}_{p}]$ at the places $v$ lying over $p$. Thus, the least common denominator of the Hasse invariants is either $1$ or $2$ and hence, $[D_{\pi}:\mathbb{Q}(\pi)]=1$ or $4$.

If $\sqrt{q}\notin\mathbb{Q}(\zeta_{{}_{N}})$, then $p$ is ramified in $\mathbb{Q}(\pi)/\mathbb{Q}$ and hence, the Hasse invariants of $D_{\pi}$ are [math] in $\mathbb{Q}/\mathbb{Z}$, meaning that $D_{\pi}=\mathbb{Q}(\pi)$. This completes the proof.

Proposition 2.4**.**

Let $N$ be any integer and let $q$ be a prime power that is a perfect square. Then there exists a simple supersingular abelian variety $B$ over $\mathbb{F}_{q}$ and a rational prime $\ell$ such that:

-the group $B(\mathbb{F}_{q})$ of $\mathbb{F}_{q}$-points has order divisible by $\ell$.

-the embedding degree of $B$ with respect to $\ell$ is $N$.

Proof 7*.*

Let $\pi$ be the Weil $q$-integer $\sqrt{q}\cdot\zeta_{{}_{2N}}$ where $\zeta_{{}_{2N}}$ is a primitive $2N$-th root of unity. Let $B$ be the corresponding simple abelian variety over $\mathbb{F}_{q}$. Then $B_{\pi}$ is supersingular.

Now, the order of $B(\mathbb{F}_{q})$ is given by:

[TABLE]

Thus, any prime $\ell$ dividing $\Phi_{2N}(\sqrt{q})$ but not dividing $2N$ fulfills the hypothesis of the proposition. Since such a prime always exists unless $(q,N)=(4,3)$, this completes the proof.

Clearly, the prime $\ell$ constructed in the last proposition is $\equiv 1\pmod{N}$. So choosing a moderately large value for $N$ results in $\ell$ being a substantially large prime.

The simple abelian variety constructed in the last proposition is of dimension ${\phi(2N)}{}$ and is far from absolutely simple. Later, we shall provide a construction that yields an absolutely simple abelian variety of any prescribed dimension $g$ with embedding degree any prescribed integer $N$ with respect to some prime $\ell$.

Proposition 2.5**.**

Let $B$ be a simple supersingular abelian variety of dimension $g$ over $\mathbb{F}_{q}$. Then for any prime $\ell$ dividing $|B(\mathbb{F}_{q})|$, the embedding degree of $B$ with respect to $\ell$ is $\leq 4g^{2}$

Proof 8*.*

Let $\pi$ be the associated Weil number and let $p$ be the prime dividing $q$. Then $\pi=\sqrt{q}\cdot\zeta_{{}_{N}}$ where $\zeta_{{}_{N}}$ is a primitive $N$-th root of unity for some integer $N$. The case where $N\in\{1,2\}$ is trivial. So we may assume $N\geq 3$. Thus, $\mathbb{Q}(\pi)=\mathbb{Q}(\zeta_{N})$, which is a CM field.

Now,

[TABLE]

Furthermore, $v(\pi)/v(q)=1/2$ at the places of $\mathbb{Q}(\zeta_{N})$ lying over $p$ and [math] elsewhere. Thus, $D_{\pi}$ is either $\mathbb{Q}(\zeta_{N})$ or the quaternion algebra over $\mathbb{Q}(\zeta_{N})$ ramified exclusively at the primes lying over $p$, depending on whether the local degree of a prime of $\mathbb{Q}(\zeta_{N})$ lying over $p$ is even or odd. Hence, $g=\phi(N)$ or $\frac{1}{2}\cdot\phi(N)$.

Now, $\pi\equiv 1\pmod{\mathfrak{l}}$ for some prime $\mathfrak{l}$ of $\mathbb{Q}(\mathcal{W}_{B})$ lying over $\ell$. So $q\equiv\zeta_{{}_{N}}^{-2}\pmod{\mathfrak{l}}$ and hence, $\ell$ divides $\Phi_{M}(q)$ where $M=\frac{N}{\gcd(2,N)}$. Thus, the embedding degree divides $N$. Now, $\phi(N)=g$ or $2g$ and hence, $N\leq 4g^{2}$.

Remark: This is just a straightforward generalization of the observation that supersingular elliptic curves have embedding degrees at most $6$. This arises from the fact that imaginary quadratic fields do not contain any roots of unity other than those of torsion $4$ or $6$. The upshot is that supersingular abelian varieties make largely unsuitable candidates for pairing based cryptography.

3 Base changes with prescribed embedding and full embedding degrees

The following proposition demonstrates that Koblitz’s aforementioned theorem does not generalize to higher dimensions. In fact, if an abelian variety of dimension $\geq 2$ satisfies some rather generic conditions, there exists a base change with prescribed embedding and full embedding degrees.

Theorem 3.1**.**

Let $B_{\pi}$ be an absolutely simple abelian variety of dimension $\geq 2$ over a finite field $\mathbb{F}_{q}$ such that the multiplicative group $\Phi_{B_{\pi}}$ generated by $\mathcal{W}_{B_{\pi}}$ is free abelian of rank $\geq 3$. Let $m$, $n$ be prescribed integers. Then there exists a base change $B_{\widetilde{\pi}}$ of $B_{\pi}$ to some finite extension $\mathbb{F}_{\widetilde{q}}$ and a prime $\ell$ such that:

*- $\ell$ divides *$|B_{\widetilde{\pi}}(\mathbb{F}_{q})|$

- $B_{\widetilde{\pi}}$ has embedding degree $n$ with respect to $\ell$.

- $B_{\widetilde{\pi}}$ has full embedding degree $m\cdot n$ with respect to $\ell$, meaning $[\mathbb{F}_{\widetilde{q}}(B_{\widetilde{\pi}}[\ell]):\mathbb{F}_{\widetilde{q}}]=m\cdot n$.

Proof 9*.*

We write $L:=\mathbb{Q}(\pi)$ and denote its Galois closure over $\mathbb{Q}$ by $\widetilde{L}$. Choose a conjugate $\pi_{{}_{1}}$ of $\pi$ such that $\pi_{{}_{1}}$ lies outside the subgroup of $\Phi_{B_{\pi}}$ generated by $\pi$ and $\overline{\pi}$. By Kummer theory, the field $\widetilde{L}(\zeta_{mn},\sqrt[mn]{\pi},\sqrt[mn]{\overline{\pi}},\sqrt[mn]{\pi_{{}_{1}}})$ is abelian over $\widetilde{L}(\zeta_{mn})$ with Galois group $(\mathbb{Z}/mn\mathbb{Z})^{3}$. We choose a prime $\mathfrak{l}$ of $\widetilde{L}(\zeta_{mn})$ such that:

- $\mathfrak{l}$ is of local degree one over $\mathbb{Q}$.

- $\mathfrak{l}$ splits completely in $\widetilde{L}(\zeta_{mn},\sqrt[m\cdot n]{\pi})$.

- The decomposition field of $\mathfrak{l}$ in $\widetilde{L}(\zeta_{mn},\sqrt[m\cdot n]{\overline{\pi}})$ is $\widetilde{L}(\zeta_{mn},\sqrt[m]{\overline{\pi}}).$

- $\mathfrak{l}$ is inert in $\widetilde{L}(\zeta_{mn},\sqrt[m\cdot n]{\pi_{{}_{1}}})$.

Note that by the Chebotarev density theorem, the set of primes fulfilling these conditions has positive density. Let $\ell$ be the rational prime lying under $\mathfrak{l}$. By construction, $\ell\equiv 1\pmod{m\cdot n}$ and

[TABLE]

for some integers $i$, $j$ co-prime to $m\cdot n$. We write

[TABLE]

for brevity. Now, $\widetilde{\pi}$ is a Weil $\widetilde{q}$-integer corresponding to the base change of $B_{\pi}$ to $\mathbb{F}_{\widetilde{q}}$. Furthermore, $\widetilde{\pi}\equiv 1\pmod{\mathfrak{l}}$ and hence, $\ell$ divides $|B_{\pi}(\mathbb{F}_{\widetilde{q}})|$. On the other hand, the complex conjugate $\overline{\widetilde{\pi}}$ of $\widetilde{\pi}$ has order $n$ in $(\mathcal{O}_{\widetilde{L}(\zeta_{{}_{N}})}/\mathfrak{l})^{*}$ and since $\widetilde{q}\equiv\overline{\widetilde{\pi}}\pmod{\mathfrak{l}}$, it follows that $\Phi_{n}(\widetilde{q})\in\mathfrak{l}$. Thus, $B_{\widetilde{\pi}}$ has embedding degree $n$ with respect to $\ell$.

Now, the full embedding degree $[\mathbb{F}_{\widetilde{q}}(B_{\widetilde{\pi}}[\ell]):\mathbb{F}_{\widetilde{q}}]$ of $B_{\widetilde{\pi}}$ with respect to $\ell$ is is given by

[TABLE]

Since $\ell$ splits completely in $\widetilde{L}(\zeta_{mn})$, the abelian group $(\mathcal{O}_{\widetilde{L}(\zeta_{mn})}/\ell\mathcal{O}_{\widetilde{L}(\zeta_{mn})})^{*}$ is a product of $[{\widetilde{L}(\zeta_{mn})}:\mathbb{Q}]$ copies of $\mathbb{F}_{\ell}^{*}$. In particular, the group is $(\ell-1)$-torsion and hence, the order of any $\mathrm{Gal}_{\mathbb{Q}}$-conjugate of $\widetilde{\pi}$ in $(\mathcal{O}_{{\widetilde{L}(\zeta_{mn})}}/\ell\mathcal{O}_{{\widetilde{L}(\zeta_{mn})}})^{*}$ divides $m\cdot n$.

By construction, $\widetilde{\pi}_{{}_{1}}:=\pi_{{}_{1}}^{{}^{\frac{\ell-1}{m\cdot n}}}$ has order $m\cdot n$ in $(\mathcal{O}_{\widetilde{L}(\zeta_{{}_{mn}})}/\mathfrak{l})^{*}$. Thus, $m\cdot n$ divides the degree $[\mathbb{F}_{\widetilde{q}}(B_{\widetilde{\pi}}[\ell]):\mathbb{F}_{\widetilde{q}}]$, which forces equality.

Remark. Note that the condition that $\Phi_{B_{\pi}}$ is free abelian of rank $\geq 3$ is quite generic when the dimension is $\geq 2$. The only class of exceptions is that of the abelian varieties of type $\operatorname{IV}(1,d)$ which we will encounter in the next section.

Proposition 3.2**.**

Let $B_{\pi}$ be an absolutely simple abelian variety corresponding to a Weil $q$-integer $\pi$ such that $B_{\pi}$ has dimension $\geq 2$ and $\Phi_{B_{\pi}}$ is free abelian. Unless \big{|}W_{B_{\pi}}\big{|}\leq 2, the abelian group $\Phi_{B_{\pi}}$ has rank $\geq 3$.

Proof 10*.*

Since any supersingular abelian variety decomposes as a product of supersingular elliptic curves over the algebraic closure, we may assume $B_{\pi}$ is not supersingular. Thus, there do not exist non-zero integers $x,y$ such that $\pi^{x}=q^{y}$.

Suppose $\Phi_{B_{\pi}}$ has rank $\leq 2$. Let $\sigma\in\mathrm{Gal}_{\mathbb{Q}}$ be an automorphism such that $\sigma(\pi)\notin\{\pi,\overline{\pi}\}$. Then $\sigma(\pi)=\pi^{k_{1}}\cdot q^{k}$ for some non-zero integers $k,k_{1}$ such that $k_{1}+2k=1$, $(k,k_{1})\neq(1,-1)$. So

[TABLE]

In particular, if $\sigma$ has order $n$, we have $\pi^{k_{1}^{n}}=q^{-k(k_{1}^{n}-1)/(k_{1}-1)}$, a contradiction since $B_{\pi}$ is not supersingular.

We note that the condition that $\Phi_{B_{\pi}}$ is free abelian is necessary for the preceding proposition to work. We describe a class of $3$-dimensional absolutely simple abelian varieties $B_{\pi}$ for which \big{|}\mathcal{W}_{B_{\pi}}\big{|}=6 and $\Phi_{B_{\pi}}$ is of rank $2$.

Let $p\neq 3$ be a prime and let $\pi_{1}$ be an ordinary Weil $p$-integer corresponding to an ordinary elliptic curve over $\mathbb{F}_{p}$. Then $\mathbb{Q}(\pi_{1})$ is an imaginary quadratic field in which $p$ splits into two distinct principal prime ideals $(\pi_{1})$ and $(\overline{\pi}_{1})$. Let $\pi$ be a zero of $X^{3}-\pi_{1}^{2}\cdot\overline{\pi}_{1}$. Then $\pi$ is a Weil $p$-integer corresponding to a simple abelian variety $B_{\pi}$ (up to isogeny) of dimension $3$ over $\mathbb{F}_{p}$. The set $\mathcal{W}_{B_{\pi}}$ is given by

[TABLE]

where $\zeta_{3}$ is a cube root of unity. Thus, \big{|}\mathcal{W}_{B_{\pi}}\big{|}=6 and $\Phi_{B_{\pi}}$ has rank $2$. $B_{\pi}$ has Newton polygon

[TABLE]

and its endomorphism algebra is isomorphic to the degree six CM field $\mathbb{Q}(\pi)$.

A base change of $B_{\pi}$ to the field $\mathbb{F}_{p^{3}}$ yields the abelian variety $B_{\pi^{3}}:=B_{\pi}\times_{\mathbb{F}_{p}}\mathbb{F}_{p^{3}}$ with

[TABLE]

and in particular, $\Phi_{B_{\pi^{3}}}$ is free abelian of rank $2$. The abelian variety $B_{\pi^{3}}$ is absolutely simple and its endomorphism algebra $D_{\pi^{3}}$ is a $9$-dimensional central division algebra over the imaginary quadratic field $\mathbb{Q}(\pi_{1})$ with Hasse invariants $\frac{1}{3}$ and $\frac{2}{3}$ at the two places lying over $p$. The degree six CM field $\mathbb{Q}(\pi)$ has an embedding in this division algebra.

We thank the anonymous referee for recommending the inclusion of this counter-example in the case where $\Phi_{B_{\pi}}$ is not assumed to be free abelian.

4 The ordinary case

Having seen why supersingular abelian varieties are unsuitable candidates, we now look at the other end of the spectrum, which is ordinary abelian varieties. The primary task of this subsection is to address the following:

Problem: For prescribed integers $g$, $N$, construct an ordinary $g$-dimensional abelian variety $B$ over a finite field $\mathbb{F}_{q}$ with embedding degree $N$ with respect to a prime $\ell$ dividing $|B(\mathbb{F}_{q})|$.

Clearly, for this to be possible, the prime $\ell$ must split completely in $\mathbb{Q}(\zeta_{{}_{N}})$. We first observe that such a construction is not always possible if the prime $\ell\equiv 1\pmod{N}$ is prescribed.

Example. Let $L$ be a CM field of degree $2g$ such that $L/\mathbb{Q}$ is cyclic and $L$ is linearly disjoint with $\mathbb{Q}(\zeta_{{}_{N}})$. Let $\ell$ be a rational prime that splits completely in $\mathbb{Q}(\zeta_{{}_{N}})$ but is inert in $L/\mathbb{Q}$.

Let $\pi$ be an ordinary Weil number in $L$ corresponding to a simple abelian variety over the finite field $\mathbb{F}_{q}$ of size $q:=\pi\cdot\overline{\pi}$. If $\ell$ divides \big{|}B_{\pi}(\mathbb{F}_{q})\big{|}, then $\pi\equiv 1\pmod{\mathfrak{l}}$ for some prime $\mathfrak{l}$ of $\ell$ lying over $\ell$. But since $\ell\mathcal{O}_{L}$ is assumed to be a prime ideal, it follows that $\pi\equiv 1\pmod{\ell}$. So $\overline{\pi}\equiv 1\pmod{\ell}$ and hence, $q\equiv 1\pmod{\ell}$. Thus, any Weil number in $L$ corresponds to an abelian variety with embedding degree $1$ with respect to $\ell$.

The motivation. Let $B_{\pi}$ be an ordinary abelian variety of dimension $g$ over a finite field $\mathbb{F}_{q}$ of characteristic $p$. Write $q=p^{k}$. Suppose the number field $L:=\mathbb{Q}(\pi)$ is abelian. Then $p$ splits completely in $L$. Now, the principal ideals $\pi\mathcal{O}_{L}$ and $\overline{\pi}\mathcal{O}_{L}$ have prime decompositions

[TABLE]

where the $\mathfrak{p}_{1},\;\overline{\mathfrak{p}}_{1},\;\cdots,\;\mathfrak{p}_{g},\;\overline{\mathfrak{p}}_{g}$ are distinct primes. Let $\sigma_{i}\in\mathrm{Gal}(L/\mathbb{Q})$ be the element such that $\sigma_{i}(\mathfrak{p}_{1})=\mathfrak{p}_{i}$. Then $\Phi:=\{\sigma_{i}:1\leq i\leq g\}$ is a CM type for $L$.

Thus, when it comes to constructing ordinary abelian varieties over prime fields, CM types are a natural place to look.

The reflex field. Let $L$ be a CM field of degree $2g$ and let $\widetilde{L}$ be its Galois closure over $\mathbb{Q}$. A CM-type $\Phi=\{\phi_{1},\cdots,\phi_{g}\}$ for $L$ is a set of embeddings $L\hookrightarrow\widetilde{L}$ such that $\overline{\Phi}=\{\overline{\phi}_{1},\cdots,\overline{\phi}_{g}\}$ is disjoint from $\Phi$ and the union $\Phi\coprod\overline{\Phi}$ is the complete set of embeddings $L\hookrightarrow\widetilde{L}$. The map

[TABLE]

is called the type norm with repect to $\Phi$. Clearly, this map satisfies

[TABLE]

Let $\widetilde{L}$ denote the Galois closure of $L$ over $\mathbb{Q}$ and let $S$ be the union of left cosets of $\mathrm{Gal}({L}/\mathbb{Q})$ in $\mathrm{Gal}(\widetilde{L}/\mathbb{Q})$. Set $\Psi:=\{\sigma^{-1}:\sigma\in S\}$ and let $\widehat{H}$ be the stabilizer of $\Psi$ in $\mathrm{Gal}(\widetilde{L}/\mathbb{Q})$. Then $\widehat{H}$ defines a subfield of $\widetilde{L}$ and we have $\widehat{H}=\{\gamma\in\mathrm{Gal}(\widetilde{L}/\mathbb{Q}):\Psi\gamma=\Psi\}$. These cosets define an embedding of $\widehat{L}$ into $\widetilde{L}$. We call $(\widehat{L})$ the reflex field of $(L,\Phi)$ and $\Psi$ the reflex type.

The map

[TABLE]

maps the field $\widehat{L}$ to $L$. This is called the reflex norm of $\Psi$. In the generic case, the field $\widetilde{L}$ is of degree $2^{g}\cdot g!$ and $\widehat{L}$ is of degree $2^{g}$ with $\mathrm{Gal}(\widetilde{L}/\widehat{L})=S_{g}$, the symmetric group on $g$ letters.

Theorem 4.1**.**

Let $L$ be a fixed CM field of degree $\geq 4$ and let $m$, $n$ be prescribed integers. Let $p$ be a rational prime that splits completely in the Hilbert class field $\mathrm{H}(L)$ of $L$. There exists an absolutely simple ordinary abelian variety $B$ over the prime field $\mathbb{F}_{p}$, a $p$-power $q$ and a prime $\ell$ such that:

- $\operatorname{End}^{0}(B)\cong L$

- $\ell$ divides $|B(\mathbb{F}_{q})|$ and $B\times_{\mathbb{F}_{p}}\mathbb{F}_{q}$ has embedding degree $n$ with respect to $\ell$.

- $B\times_{\mathbb{F}_{p}}\mathbb{F}_{q}$ has full embedding degree $m\cdot n$ with respect to $\ell$.

Proof 11*.*

Let $K$ be the maximum totally real subfield of $L$ and let $\widetilde{K}$, $\widetilde{L}$ be the respective Galois closures over $\mathbb{Q}$. We fix a primitive CM type $\Phi$ for $L$ and denote the reflex of $(L,\Phi)$ by $(\widehat{L},\Psi)$.

Note that the Hilbert class field $\mathrm{H}(\widetilde{L})$ of $\widetilde{L}$ coincides with the Galois closure $\widetilde{\mathrm{H}(L)}$ of $\mathrm{H}(L)$ over $\mathbb{Q}$. Since $p$ splits completely in $\mathrm{H}(L)$, it also splits completely in the Galois closure $\widetilde{\mathrm{H}(L)}=\mathrm{H}(\widetilde{L})$ of $\mathrm{H}(L)$. We choose a prime $\widetilde{\mathfrak{p}}$ of $\widetilde{L}$ lying over $p$. Thus,

-$\widetilde{\mathfrak{p}}$* has local degree one over $\mathbb{Q}$.*

-$\widetilde{\mathfrak{p}}$* splits completely in the Hilbert class field $\mathrm{H}(\widetilde{L})$.*

The second condition ensures that $\widetilde{\mathfrak{p}}$ is principal. We write $\widetilde{\mathfrak{p}}=\widetilde{\alpha}\mathcal{O}_{\widetilde{L}}$. Define $\widehat{\mathfrak{p}}:=\widetilde{\mathfrak{p}}\cap\widehat{L}$ and $\widehat{\alpha}:=\operatorname{Nm}_{\widetilde{L}/\widehat{L}}(\widetilde{\alpha})$. Then $\widehat{\mathfrak{p}}$ has local degree one over $\mathbb{Q}$ and $\widehat{\mathfrak{p}}=\widehat{\alpha}\mathcal{O}_{\widehat{L}}$. In particular, the prime $\widehat{\mathfrak{p}}$ of $\widehat{L}$ is principal. Set $\pi:=\operatorname{Nm}_{\Psi}(\widehat{\alpha})$. Then $\pi\cdot\overline{\pi}=p$ and since the map $\psi:\widetilde{L}\longrightarrow\widetilde{L}$ maps $\widehat{L}$ to $L$, it follows that $\pi\in\mathcal{O}_{L}$. Furthermore, the ideals $(\pi)$ and $(\overline{\pi})$ of $\mathcal{O}_{{L}}$ are coprime and hence, $\pi$ is an ordinary Weil $p$-integer.

Now, the multiplicative group $\Phi_{B_{\pi}}$ generated by the Galois conjugates of $\pi$ is free abelian of rank $\geq 3$. Suppose, by way of contradiction, that $\Phi_{B_{\pi}}$ is of rank $\leq 2$. Let $\pi_{1}$ be a conjugate of $\pi$ other than $\pi$, $\overline{\pi}$. Then there exist non-zero integers $r_{1}$, $r_{2}$, $r_{3}$ such that $\pi_{1}^{r_{1}}=\pi^{r_{2}}\overline{\pi}^{r_{3}}$. If $r_{2},r_{3}>0$, it follows that $\pi$ is divisible all primes of $\mathbb{Q}(\pi)$ lying over $p$, a contradiction since $B_{\pi}$ is ordinary. If $r_{2}<0$, it follows that $(\pi_{1})$ divides $\overline{\pi}^{r_{3}}$ in $\mathcal{O}_{\mathbb{Q}(\pi)}$, a contradiction since $(\pi_{1},\overline{\pi}_{1})=(1)$ in $\mathbb{Q}(\pi_{1})$.

The theorem now follows from Theorem 3.1.

Theorem 4.2**.**

Let $L$ be a fixed CM field of degree $2g\geq 4$. Let $m$, $n$ be prescribed integers and $\ell$ a rational prime $\equiv 1\pmod{m\cdot n}$ that splits completely in $L/\mathbb{Q}$. There exists a simple ordinary abelian variety $B_{\pi}$ over a prime field $\mathbb{F}_{p}$ such that:

- $\operatorname{End}^{0}(B_{\pi})\cong L$.

- $\ell$ divides the order \big{|}B_{\pi}(\mathbb{F}_{p})\big{|} of the group of $\mathbb{F}_{p}$-points.

- $B_{\pi}$ has embedding degree $n$ with respect to $\ell$.

- $B_{\pi}$ has full embedding degree $m\cdot n$ with respect to $\ell$, meaning $[\mathbb{F}_{p}(B_{\pi}[\ell]):\mathbb{F}_{p}]=m\cdot n$.

Proof 12*.*

Let $\widetilde{L}$ be a Galois closure of $L$ over $\mathbb{Q}$. Then $\widetilde{L}$ is a Galois CM field. Since $\ell$ splits completely in $L$ and is $\equiv 1\ (\mathrm{mod}\ m\cdot n)$, it splits completely in $\widetilde{L}(\zeta_{mn})$.

We fix a primitive CM type $\Phi$ for $\widetilde{L}$ that is stable under the action of $\mathrm{Gal}(\widetilde{L}/L)$. So $\mathrm{Gal}(\widetilde{L}/\mathbb{Q})=\Phi\cup\overline{\Phi}$ and the image of the map

[TABLE]

lands in $L$. We may assume without loss of generality that $\Phi$ is not preserved or swapped for $\overline{\Phi}$ under the action of $\mathrm{Gal}_{\mathbb{Q}}$, i.e. there exists a $\tau\in\mathrm{Gal}_{\mathbb{Q}}$ and $\sigma_{1},\sigma_{2}\in\Phi$ such that $\sigma_{1},\overline{\sigma}_{2}\in\tau(\Phi)$.

Let $\mathfrak{l}$ be a prime of $\widetilde{L}$ lying over $\ell$. Then

[TABLE]

Let $r\in\mathbb{Z}$ be a rational integer such that $\Phi_{mn}(r)\in\mathfrak{l}$. Then $\Phi_{mn}(r)\in\ell\mathbb{Z}$.

Let $\widetilde{L}^{\ell\mathcal{O}_{\widetilde{L}}}$ denote the ray class field of the modulus $\ell\mathcal{O}_{\widetilde{L}}$ and let $\widetilde{L}^{\sigma(\mathfrak{l})}$ denote the ray class field of the modulus $\sigma(\mathfrak{l})$ for any $\sigma\in\mathrm{Gal}_{\mathbb{Q}}$. Then

[TABLE]

and each $\mathrm{Gal}(\widetilde{L}^{\sigma(\mathfrak{l})}/\widetilde{L})$ is isomorphic to the quotient group $\mathcal{O}_{L}^{\times}/(\mathfrak{l}+1)$, which is cylic of order $\ell-1$ has a subgroup of order $mn$. The Chebotarev density theorem applied to the extension $\widetilde{L}^{\ell\mathcal{O}_{\widetilde{L}}}/\widetilde{L}$ implies that the Dirichlet density of principal prime ideals of $\widetilde{L}$ generated by elements $\alpha$ satisfying the following properties is positive:

- $\alpha$ generates a principal prime ideal in $\mathcal{O}_{\widetilde{L}}$.

- $\alpha\equiv r\ (\mathrm{mod}\ \sigma_{1}^{-1}\mathfrak{l})\;$, $\;\alpha\equiv r^{m-1}\ (\mathrm{mod}\ \overline{\sigma}_{2}^{-1}(\mathfrak{l}))$.

- $\alpha\equiv 1\ (\mathrm{mod}\ \sigma(\mathfrak{l}))$ for every $\sigma\in\mathrm{Gal}(\widetilde{L}/\mathbb{Q})\setminus\{\sigma_{1}^{-1},\overline{\sigma}_{2}^{-1}\}$

Let $p$ be the rational prime lying under $\alpha\mathcal{O}_{\widetilde{L}}$. We set $\pi:=\mathrm{Nm}_{\Phi}(\alpha)$. Then $\pi\in\mathcal{O}_{L}$ and $\sigma(\pi)\cdot\overline{\sigma(\pi)}=p$ for any $\sigma\in\mathrm{Gal}_{\mathbb{Q}}$. Furthermore, the ideals of $\mathcal{O}_{L}$ generated by $\pi$ and $\overline{\pi}$ are coprime and hence, the abelian variety corresponding to the Weil $p$-integer $\pi$ is ordinary.

Now, we have $\sigma_{1}(\alpha)\equiv r\ (\mathrm{mod}\ \mathfrak{l})$, $\overline{\sigma}_{2}(\alpha)\equiv r^{1-m}\ (\mathrm{mod}\ \mathfrak{l})$ and $\sigma(\alpha)\equiv 1\ (\mathrm{mod}\ \mathfrak{l})$ for every $\sigma\in\mathrm{Gal}_{\mathbb{Q}}\setminus\{\sigma_{1}^{-1},\overline{\sigma}_{2}^{-1}\}$. In particular, since $\sigma(\alpha)\equiv 1\ (\mathrm{mod}\ \mathfrak{l})$ for every $\sigma\in\tau\Phi$, we have $\tau(\pi)\equiv 1\ (\mathrm{mod}\ \mathfrak{l})$. Thus, $\ell$ divides the order $|B_{\pi}(\mathbb{F}_{p})|$.

Furthermore, $p=\pi\cdot\overline{\pi}\equiv r\cdot r^{m-1}\equiv r^{m}\ (\mathrm{mod}\ \mathfrak{l})$. So $p$ has order $n$ modulo $\mathfrak{l}$ and hence, $B_{\pi}$ has embedding degree $n$ with respect to $\ell$.

Lastly, $\pi\equiv r\ (\mathrm{mod}\ \mathfrak{l})$ and hence, $\pi$ has order $m\cdot n$ modulo $\mathfrak{l}$. Furthermore, any $\mathrm{Gal}_{\mathbb{Q}}$-conjugate of $\pi$ is a product over some Galois conjugates of $\alpha$ and we have $\sigma(\alpha)^{m\cdot n}\equiv 1\ (\mathrm{mod}\ \mathfrak{l})$ for every $\sigma\in\mathrm{Gal}(\widetilde{L}/\mathbb{Q})$. Hence, $\sigma(\pi)^{m\cdot n}\equiv 1\ (\mathrm{mod}\ \mathfrak{l})$. Thus, $B_{\pi}$ has full embedding degree $m\cdot n$ with respect to $\ell$.

To construct such a Weil $p$-integer $\pi$, the most straightforward way would be as follows:

1. Randomly sample an algebraic integer $\alpha\in\mathcal{O}_{\widetilde{L}}$ that satisfy the congruences described in the proof.

2. Subject $p:=\mathrm{Nm}_{\widetilde{L}/\mathbb{Q}}(\alpha)$ to a probabilistic primality test such as Miller-Rabin.

3. If $p$ passes the primality test, accept $\pi:=\mathrm{Nm}_{\Phi}(\alpha)$ as a Weil $p$-integer with the desired properties. If not, return to Step 1 (i.e. sample another value for $\alpha$).

The prime number theorem implies that the expected runtime for finding a suitable Weil number $\pi$ in this manner is polynomial in $\log(\ell)$.

4.1 Jacobians with prescribed embedding and full embedding degrees

We discuss the existence of Jacobians of small dimensions that fulfill the hypothesis of the preceding theorem. We will need the following two results regarding ordinary abelian surfaces from [How95].

Lemma 4.3**.**

$(\mathrm{[How95],\;Lemma\;}12.1)$* Let $B_{\pi}$ be a simple ordinary abelian surface over a finite field $\mathbb{F}_{q}$ such that no abelian variety in its isogeny class over $\mathbb{F}_{q}$ is principally polarized. Then $\mathbb{Q}(\mathcal{W}_{B_{\pi}})$ is biquadratic.*

Theorem 4.4**.**

$(\mathrm{[How95],\;Theorem\;}1.3)$* Any principally polarized simple ordinary abelian surface over a finite field $\mathbb{F}_{q}$ is a Jacobian of a hyperelliptic curve over $\mathbb{F}_{q}$.*

Corollary 4.5**.**

Let $L$ be a fixed CM field of degree $2g$ with $g\in\{2,3\}$, $m,n$ prescribed integers and $\ell$ a rational prime $\equiv 1\pmod{m\cdot n}$ that splits completely in $L/\mathbb{Q}$. There exists a smooth projective curve $C$ of genus $g$ over a finite field $\mathbb{F}_{q}$ such that:

- $\operatorname{End}^{0}(\mathrm{Jac}(C))\cong L$.

- $\ell$ divides the order \big{|}\mathrm{Jac}(C)(\mathbb{F}_{q})\big{|} of the group of $\mathbb{F}_{q}$-points.

- $\mathrm{Jac}(C)$ has embedding degree $n$ with respect to $\ell$.

- $\mathrm{Jac}(C)$ has full embedding degree $n$ with respect to $\ell$, i.e. $[\mathbb{F}_{q}(\mathrm{Jac}(C)[\ell]):\mathbb{F}_{q}]=m\cdot n$.

If $g=2$ and $L$ is not a biquadratic field, there exists a prime $p$ and a hyperelliptic curve $C$ over $\mathbb{F}_{p}$ fulfilling these conditions.

Proof 13*.*

We construct a simple ordinary abelian variety $B$ of dimension $g$ over a prime field $\mathbb{F}_{p}$ fulfilling the conditions in the preceding theorem. We treat the cases $g=2$ and $g=3$ separately.

Case 1*: $g=2$*

It follows from Theorem 13.3 of [How95] that there exists a Jacobian of a curve in the same isogeny class as $B$ over $\mathbb{F}_{p}$. Furthermore, this curve is hyperelliptic since it is smooth projective of genus two.

In particular, if $L$ is not biquadratic, Lemma 12.1 of [How95] implies that there exists a principally polarized abelian variety $B_{1}$ over $\mathbb{F}_{p}$ that is isogenous to $B$. Now, by ([How95], Theorem 1.3), $B_{1}$ is the Jacobian of a hyperelliptic curve $C_{1}$ over $\mathbb{F}_{p}$, which completes the proof.

Case 2*: $g=3$*

Since $B$ is simple of odd dimension, Theorem 1.2 of [How95] implies that there exists a principally polarized abelian $\widetilde{B}$ over $\mathbb{F}_{p}$ that is isogenous to $B$. It is well-known that every simple principally polarized abelian variety of dimension $\leq 3$ over an algebraically closed field is the Jacobian of some smooth projective curve. Hence, there exists a prime power $q$ such that $\widetilde{B}\times_{\mathbb{F}_{p}}\mathbb{F}_{q}$ is the Jacobian of a smooth projective genus three curve that is either hyperelliptic or planar quartic.

For a principally polarized abelian surface $B_{\pi}$ over a prime finite field $\mathbb{F}_{p}$, we have $\#B_{\pi}=P_{B_{\pi}}(1)$. On the other hand, if $C$ is a genus two hyperelliptic curve with $\operatorname{Jac}(C)=B$, then

[TABLE]

Hence, to construct such a curve, it suffices to find a curve whose sets of $\mathbb{F}_{p}$ and $\mathbb{F}_{p^{2}}$-points satisfy this equation. Since $\#C(\mathbb{F}_{p}))$ and $\#C(\mathbb{F}_{p^{2}})$ lie in the respective Hasse-Weil intervals, we have $\#C(\mathbb{F}_{p})=p+1-a_{1}$, $\#C(\mathbb{F}_{p^{2}})=p^{2}+1+2a_{2}-a_{1}^{2}$ where $P_{B_{\pi}}(X)=X^{4}-a_{1}X^{3}+a_{2}X^{2}-pa_{3}X+p^{2}$. Algorithms for the construction of such curves using Gundlach invariants are studied in [LY10].

5 Abelian varieties of type $\operatorname{IV}(1,d)$

In this section, we study abelian varieties of type $\operatorname{IV}(1,d)$ over finite fields. The purpose here is to limit the size of the number field $\mathbb{Q}(\mathcal{W}_{B_{\pi}})$ while allowing the dimension of the (absolutely simple) abelian variety and the endomorphism algebra to be arbitrarily large.

Definition 5.1**.**

A simple abelian variety $A$ over a field $F$ is said to be of type $\operatorname{IV}$ in Albert’s classification if it satisfies the following conditions:

1. $\operatorname{End}^{0}(A)$ is a central division algebra over a CM field $K$ equipped with an involution $\;*\;$ of the second kind.

2. $\operatorname{End}^{0}(A)$ is split at all the places $v$ of $K$ such that $v={v}^{*}$.

3. For any place $v$ of $K$, we have $\mathrm{inv}_{v}(\operatorname{End}^{0}(A))+\mathrm{inv}_{{v}^{*}}(\operatorname{End}^{0}(A))=0$ in $\mathbb{Q}/\mathbb{Z}$.

Furthemore, we say such an abelian variety $A$ is of type $\operatorname{IV}(e,d)$ if the center $K$ of $\operatorname{End}^{0}(A)$ is a CM field of degree $2e$ and $\operatorname{End}^{0}(A)$ is of dimension $d^{2}$ over its center. When the field of definition is a finite field, Honda-Tate theory implies that the dimension of $A$ is given by

[TABLE]

We say $A$ is potentially of type $\operatorname{IV}(e,d)$ if the base change to a suitable field extension $\widetilde{F}/F$ yields an abelian variety $\widetilde{A}:=A\times_{F}\widetilde{F}$ that is of type $\operatorname{IV}(e,d)$. In the paragraph following Corollary 5.8, we discuss a class of absolutely simple abelian varieties that are not of type $\operatorname{IV}(1,d)$ but are potentially of type $\operatorname{IV}(e,d)$. In other words, a suitable base change yields an abelian variety with more endomorphisms.

Over a finite field of size $q$, a simple abelian $B_{\pi}$ corresponding to a Weil $q$-integer $\pi$ is of type $\operatorname{IV}(1,d)$ if and only if $\mathbb{Q}(\pi)$ is an imaginary quadratic field and the least common denominator of the Newton slopes of $B_{\pi}$ is $d$. We will use these abelian varieties to demonstrate that there exist absolutely simple abelian varieties of a prescribed dimension and embedding degree with respect to some rational prime dividing the size of the group of $\mathbb{F}_{q}$-points.

Lemma 5.1**.**

Let $g$ be an integer $\geq 3$. Let $B$ be a simple $g$-dimensional abelian variety over a finite field $\mathbb{F}_{q}$ such that one of the Newton slopes of $B$ is $\frac{j}{g}$ for some integer $j<g$ such that $\gcd(j,g)=1$. Then $B$ is absolutely simple.

Proof 14*.*

Let $\pi$ be the Weil number corresponding to $B$. Suppose, by way of contradiction, that $\widetilde{B}=B\times_{\mathbb{F}_{q}}\mathbb{F}_{q^{N}}$ is not simple. Since $\widetilde{B}$ has the same Newton polygon as $B$, it follows that $\widetilde{B}$ has a simple abelian subvariety $B^{\prime}$ which has $\frac{j}{g}$ as a Newton slope. Let $m$ be the multiplicity of the slope $\frac{j}{g}$ in the Newton polygon of $B^{\prime}$. Then $m<\dim B^{\prime}<g$. Since a Newton polygon has integral breakpoints, $\frac{m\cdot j}{g}\in\mathbb{Z}$ and hence, $g$ divides $m$. Since $m<g$ we have a contradiction.

Proposition 5.2**.**

Let $B$ be a simple abelian variety of type $\operatorname{IV}(1,g)$ over a finite field $\mathbb{F}_{q}$ for some integer $g\geq 3$. Then $B$ has dimension $g$ and has Newton polygon $g\times\frac{j}{g}\;,\;g\times\frac{g-j}{g}$ for some integer $j<\frac{g}{2}$ prime to $g$.

Proof 15*.*

It follows from the definition of an abelian variety of type $\operatorname{IV}(1,g)$ that the endomorphism algebra $\operatorname{End}^{0}(B)$ is a central division algebra dimension $g^{2}$ over its center $K$ which is an imaginary quadratic field. Thus, the dimension of $B$ is given by

[TABLE]

Let $\pi$ be the Weil number associated to $B$. Then $\mathbb{Q}(\pi)$ is an imaginary quadratic field in which $p$ splits. Let $v$ be any $p$-adic valuation on $\mathbb{Q}(\pi)$. The Newton slopes of $B$ are given by

[TABLE]

and since $p$ splits in $\mathbb{Q}(\pi)/\mathbb{Q}$, the set of Hasse invariants of $\operatorname{End}^{0}(B)$ is the same as the set of Newton slopes of $B$. Now, $g=[\operatorname{End}^{0}(B):\mathbb{Q}(\pi)]$ is the least common denominator of the Hasse invariants. Hence, the least common denominator of the Newton slopes is $g$, meaning that $\frac{v(\pi)}{v(q)}=\frac{j}{g}$ for some integer $j<\frac{g}{2}$ prime to $g$.

Corollary 5.3**.**

Any abelian variety of type $\operatorname{IV}(1,d)$ over a finite field is absolutely simple.

Proof 16*.*

This follows immediately from the last two propositions.

Proposition 5.4**.**

Let $B_{\pi}$ be an absolutely simple abelian variety over a finite field $\mathbb{F}_{q}$ such that $|\mathcal{W}_{B_{\pi}}|\leq 2$. Then $B$ is either an elliptic curve or an abelian variety of type $\operatorname{IV}(1,d)$ where $d=\dim B$.

Proof 17*.*

Any supersingular abelian variety over the algebraic closure $\overline{\mathbb{F}}_{q}$ is isogenous to a a power of a supersingular elliptic curve over $\overline{\mathbb{F}}_{q}$. Thus, if $B_{\pi}$ is not an elliptic curve, it can be assumed to not be supersingular.

Clearly, [\mathbb{Q}(\pi):\mathbb{Q}]=\big{|}\mathcal{W}_{B_{\pi}}\big{|}\leq 2. The only real Weil $q$-integers are $\pm\sqrt{q}$. So, if $\mathbb{Q}(\pi)$ is a totally real field, then $B_{\pi}$ is supersingular. Hence, we may assume $\mathbb{Q}(\pi)$ is a imaginary quadratic field. Write $D_{\pi}:=\operatorname{End}^{0}(B_{\pi})$. Then

[TABLE]

and hence, $[D_{\pi}:\mathbb{Q}(\pi)]=d^{2}$.

Proposition 5.5**.**

Let $B_{\pi}$ be an abelian variety of type $\operatorname{IV}(1,d)$ over $\mathbb{F}_{q}$ and $\ell$ be a prime such that $\ell$ divides \big{|}B_{\pi}(\mathbb{F}_{q})\big{|} and $\ell\nmid q\cdot(q-1)$. Then the embedding degree of $B_{\pi}$ with respect to $\ell$ coincides with the full embedding degree $[\mathbb{F}_{q}(B_{\pi}[\ell]):\mathbb{F}_{q}]$.

Proof 18*.*

Since $\ell$ divides \big{|}B_{\pi}(\mathbb{F}_{q})\big{|}, there exists a prime $\mathfrak{l}$ of $\mathbb{Q}(\pi)$ lying over $\ell$ such that $\pi\equiv 1\pmod{\mathfrak{l}}$. Let $N$ be the embedding degree. Then $q$ has order $N$ in $(\mathcal{O}_{\mathbb{Q}(\pi)}/\mathfrak{l})^{*}$ and since $q\equiv\overline{\pi}\pmod{\mathfrak{l}}$, it follows that $\overline{\pi}$ has order $N$ in $(\mathcal{O}_{\mathbb{Q}(\pi)}/\mathfrak{l})^{*}$. Thus, $\pi^{N}\equiv 1\pmod{\ell\mathcal{O}_{\mathbb{Q}(\pi)}}$, which implies that the degree $[\mathbb{F}_{q}(B_{\pi}[\ell]):\mathbb{F}_{q}]$ divides $N$.

Proposition 5.6**.**

Let $p$ be a fixed prime and let $d\geq 3$, $N$ $\geq 2$ be prescribed integers. Then there exists an absolutely simple abelian variety $B$ of dimension $d$ over a finite field $\mathbb{F}_{q}$ of characteristic $p$ and a prime divisor $\ell$ of $|B(\mathbb{F}_{q})|$ such that

- $B$ has embedding degree $N$ with respect to $\ell$.

- For any extension $F$ of $\mathbb{F}_{q}$ and any prime $\ell^{\prime}$ dividing $|B(F)|$, the embedding degree and the full embedding degree of $B$ with respect to $\ell^{\prime}$ coincide.

Proof 19*.*

Let $B$ be an absolutely simple abelian variety of type $\operatorname{IV}(1,d)$ over $\mathbb{F}_{q}$. Then $\dim B=d$ and $L:=\mathbb{Q}(\pi)$ is an imaginary quadratic field in which $p$ splits. By construction, the subgroup of $L^{*}/L^{*N}$ generated by $\{\pi,\overline{\pi}\}$ is isomorphic to $(\mathbb{Z}/N\mathbb{Z})^{2}$. From Kummer theory, it follows that

[TABLE]

Choose a prime $\mathfrak{l}$ of $L(\zeta_{{}_{N}})$ such that:

- $\mathfrak{l}$ has local degree one over $\mathbb{Q}$.

- $\mathfrak{l}$ splits in $L(\zeta_{{}_{N}},\sqrt[N]{\pi})$.

- $\mathfrak{l}$ is inert in $L(\zeta_{{}_{N}},\sqrt[N]{\overline{\pi}})$.

The set of primes fulfilling these conditions has Dirichlet density ${\phi(N)}\cdot{N^{-2}}$ and in particular, such a prime exists. Let $\ell$ be the rational prime lying under $\mathfrak{l}$. Set $\pi_{{}_{0}}:=\pi^{{}^{\frac{\ell-1}{N}}}$, $q_{{}_{0}}:=q^{{}^{\frac{\ell-1}{N}}}$. Then $\pi_{{}_{0}}\equiv 1\pmod{\mathfrak{l}}$ and hence, $\ell$ divides $|B(\mathbb{F}_{q_{{}_{0}}})|$. On the other hand, $q_{{}_{0}}$ has order $N$ in $(\mathcal{O}_{L(\zeta_{{}_{N}})}/\mathfrak{l})^{*}$ and hence, $\ell$ divides $\Phi_{N}(q_{{}_{0}})$. Thus, the abelian variety $B_{\pi_{{}_{0}}}=B_{\pi}\times_{\mathbb{F}_{q}}\mathbb{F}_{q_{{}_{0}}}$ and the prime $\ell$ fulfill the conditions.

Example. We provide an example of an abelian variety of type $\operatorname{IV}(1,d)$ that arises as a Jacobian of a hyperelliptic curve. Let $d$ be an odd prime such that $\ell:=2d+1$ is also a prime. Consider the genus $\ell$ hyperelliptic curve

[TABLE]

over $\mathbb{Q}$. Let $\zeta_{\ell}\in\overline{\mathbb{Q}}$ be a fixed primitive $\ell$-th root of unity. The curve $C\times_{\mathbb{Q}}{\mathbb{Q}(\zeta_{\ell})}$ is endowed with the automorphism

[TABLE]

and hence, the Jacobian $\operatorname{Jac}(C)$ has action by the ring $\mathbb{Z}[\zeta_{\ell}]$. Since

[TABLE]

it follows that $\operatorname{Jac}(C)$ is simple with endomorphism ring $\mathbb{Z}[\zeta_{\ell}]$.

The curve $C$ has good reduction away from the set $\{2,\ell\}$. Since the extension $\mathbb{Q}(\zeta_{\ell})/\mathbb{Q}$ is abelian, it follows from the theory of complex multiplication that the Newton slopes of the reduction $\operatorname{Jac}(C)_{p}$ at any prime of good reduction are determined by the splitting of $p$ in the field $\mathbb{Q}(\zeta_{\ell})$. In particular, if $p$ is a prime of inertia degree $d$ in $\mathbb{Q}(\zeta_{\ell})$, the Newton polygon of $\operatorname{Jac}(C_{p})$ is given by

[TABLE]

for some integer $j\leq d-1$ prime to $d$. Thus, $\operatorname{Jac}(C_{p})$ is absolutely simple and $\operatorname{Jac}(C_{p})\times_{\mathbb{F}_{p}}\mathbb{F}_{p^{d}}$ is of type $\operatorname{IV}(1,d)$.

5.0.1 The minimum field of definition

Lemma 5.7**.**

*Let $B_{\pi}$ be an absolutely simple abelian variety over a finite field $k$ with

$[D_{\pi}:\mathbb{Q}(\pi)]=d^{2}$. Suppose the extension $\mathbb{Q}(\mathcal{W}_{B_{\pi}})/\mathbb{Q}$ is such that the decomposition group of a prime of $\mathbb{Q}(\mathcal{W}_{B_{\pi}})$ lying over $p$ is a normal subgroup of $\mathrm{Gal}(\mathbb{Q}(\mathcal{W}_{B_{\pi}})/\mathbb{Q})$. Then:*

$1$. $p$ splits completely in $\mathbb{Q}(\mathcal{W}_{B_{\pi}})/\mathbb{Q}$.

$2$. The Newton slopes of $B_{\pi}$ have least common denominator $d$.

Proof 20*.*

This is lemma 5.3 of [Th17].

Remark: In particular, the hypothesis of the lemma is satisfied when $\mathbb{Q}(\pi)/\mathbb{Q}$ is abelian.

Corollary 5.8**.**

If there exists an abelian variety $B$ of type $\operatorname{IV}(1,d)$ over $\mathbb{F}_{p^{k}}$, then $d$ divides $k$.

Proof 21*.*

Let $\pi$ be the corresponding Weil number. As noted earlier, $B$ is absolutely simple. Furthermore, the extension $\mathbb{Q}(\pi)/\mathbb{Q}$ is quadratic and in particular, abelian. Hence, it follows from the lemma that $p$ splits (completely) in $\mathbb{Q}(\pi)/\mathbb{Q}$. From Proposition 2.14, it follows that the Newton polygon is

[TABLE]

for some integer $j<d$ such that $\gcd(j,d)=1$. The Newton slopes are given by $\frac{v(\pi)}{v(p^{k})}=\frac{v(\pi)}{k\cdot v(p)}$ where $v$ runs through the places of $\mathbb{Q}(\pi)$ lying over $p$. Since $p$ splits completely in $\mathbb{Q}(\pi)/\mathbb{Q}$, it follows that $\frac{v(\pi)}{v(p)}$ is an integer and hence, have $d$ divides $k$.

Note that the abelian variety $B$ could have a $B_{0}$ model over a proper subfield of $\mathbb{F}_{p^{d}}$, even though $B_{0}$ would not be of type $\operatorname{IV}(1,d)$.

Example. For instance, let $\pi_{1}$ be an ordinary Weil $p$-integer corresponding to an ordinary elliptic curve over $\mathbb{F}_{p}$ and set $\pi:=\sqrt[d]{\pi_{1}^{d-1}\cdot\overline{\pi}_{1}}$. Then $\pi$ is a Weil $p$-integer corresponding to a simple abelian variety of dimension $d$ over $\mathbb{F}_{p}$ and with the endomorphism algebra $\mathbb{Q}(\pi)$ a CM field of degree $2d$. On the other hand, the Weil $p^{d}$-integer $\pi^{d}=\pi_{1}^{d-1}\cdot\overline{\pi}_{1}$ is an algebraic integer of degree $2$ and the corresponding abelian variety over $\mathbb{F}_{p^{d}}$ is of type $\operatorname{IV}(1,d)$.

We now show that the converse to Corollary 5.8 is also true.

Proposition 5.9**.**

Let $p$ be a prime and $d$ any integer $\geq 3$. There exists an abelian variety of type $\operatorname{IV}(1,d)$ over $\mathbb{F}_{p^{d}}$.

Proof 22*.*

Let $\pi$ be a Weil $p$-integer corresponding to an ordinary elliptic curve over $\mathbb{F}_{p}$, meaning that $\gcd(\pi,\overline{\pi})=(1)$ and $p=\pi\cdot\overline{\pi}$. Then $\pi$ and $\overline{\pi}$ generate distinct principal prime ideals in $\mathbb{Q}(\pi)$.

Now, $\widetilde{\pi}:=\pi^{d-1}\cdot\overline{\pi}$ is a Weil $p^{d}$-integer. Let $B_{\widetilde{\pi}}$ be the corresponding abelian variety (up to isogeny) over $\mathbb{F}_{p^{d}}$. The Newton polygon of $B_{\widetilde{\pi}}$ is

[TABLE]

Clearly, $\mathbb{Q}(\widetilde{\pi})=\mathbb{Q}(\pi)$ and in particular, the center of $\operatorname{End}^{0}(B_{\widetilde{\pi}})$ is the imaginary quadratic field $\mathbb{Q}(\pi)$. Furthermore, there are two primes in $\mathbb{Q}(\pi)$ lying over $p$ and the Hasse invariants of $\operatorname{End}^{0}(B)$ are given by

[TABLE]

Since $p$ splits (completely) in $\mathbb{Q}(\pi)/\mathbb{Q}$, we have $[\mathbb{Q}(\pi)_{(\widetilde{\pi})}:\mathbb{Q}_{p}]=[\mathbb{Q}(\pi)_{(\overline{\widetilde{\pi}})}:\mathbb{Q}_{p}]=1$ and hence, $\operatorname{End}^{0}(B_{\widetilde{\pi}})$ is ramified at the primes $(\pi)$ and $(\overline{\pi})$ with Hasse invariants $\frac{1}{d}$ and $\frac{d-1}{d}$ respectively. In particular, the least common denominator of the Hasse invariants is $d$ and hence, $\operatorname{End}^{0}(B_{\widetilde{\pi}})$ is of dimension $d^{2}$ over its center.

Acknowledgements: The author thanks the anonymous referee for helpful feedback and for suggesting several improvements to previous drafts.

References

[BCF] Benger, Charlemagne, D. Freeman, On the security of pairing-friendly abelian varieties over non-prime fields

[FFS08] D. Freeman, M. Streng, P. Stevenhagen, Abelian varieties with prescribed embedding degree, Algorithmic Number Theory. ANTS 2008. Lecture Notes in Computer Science, vol 5011

[Gal] S. Galbraith, Supersingular curves in Cryptography

[GMV07] S. Galbraith, Mckee, Valenca, Ordinary abelian varieties having small embedding degree, Finite Fields and their Applications, 13:800–814, 2007

[Hit] L. Hitt, On an Improved Definition of the Embedding Degree

[How95] E. Howe, Principally polarized ordinary abelian varieties over finite fields, Transactions of the AMS, Volume 347, Number 7, July 1995

[Kow03] E. Kowalski, Some local-global applications of Kummer theory, Manuscripta Math., 111(1), 2003.

[Kow06]        , Weil numbers generated by other Weil numbers, J. London Math. Soc. (2) 74 (2006).

[LY10] K. Lauter, T. Yang, Computing genus 2 curves from invariants on the Hilbert moduli space

[MOV93] A. Menezes, T. Okamoto, and S. Vanstone. Reducing elliptic curve logarithms to logarithms in a finite field IEEE Transactions on Information Theory 39 (1993),1639–1646.

[Oort] F. Oort, Abelian Varieties over finite fields

[Shi60] G. Shimura, Abelian Varieties with Complex Multiplication and Modular Functions, Princeton University Press

[ST66] J.P. Serre, J. Tate, Good reduction of abelian varieties, Ann. of Math. (2), 88, 1968

[Tat69] J. Tate, Classes d’isogenie des varietes abeliennes sur un corps fini

[Th17] S. Thakur, On some abelian varieties of type $IV$, Preprint (in revision at Math Zeit.)

Email: stevethakur01@gmail.com

Steve Thakur

Cybersecurity Research Group

Battelle Institute

Columbus, OH.