Counting points on hyperelliptic curves of type $y^2=x^{2g+1} + ax^{g+1} + bx$

TL;DR

This paper develops efficient algorithms for counting points on hyperelliptic curves of specific types over finite fields, providing both computational methods and characteristic polynomial classifications for various genera.

Contribution

It introduces new algorithms with sub-polynomial complexity for point counting on certain hyperelliptic curves and classifies Frobenius polynomials for genus 2 to 7.

Findings

Algorithms for genus 3 and 4 with complexity $ ilde{O}( ext{log}^4 p)$ and $ ilde{O}( ext{log}^8 p)$

Complete list of Frobenius characteristic polynomials for genus 2-7 curves

Enhanced understanding of point counting on hyperelliptic curves of specific forms

Abstract

In this work, we investigate hyperelliptic curves of type $C: y^2 = x^{2g+1} + ax^{g+1} + bx$ over the finite field $\mathbb{F}_q, q = p^n, p > 2$. For the case of $g = 3$ and $4$ we propose algorithms to compute the number of points on the Jacobian of the curve with complexity $\tilde{O}(\log^4{p})$ and $\tilde{O}(\log^8{p})$. For curves of genus $2-7$ we give a complete list of the characteristic polynomials of Frobenius endomorphism modulo $p$.

Tables

Table 1. Table 1: Characteristic polynomials modulo p 𝑝 p for hyperelliptic curves of the form C : y 2 = x 2 ​ g + 1 + a ​ x g + 1 + b ​ x : 𝐶 superscript 𝑦 2 superscript 𝑥 2 𝑔 1 𝑎 superscript 𝑥 𝑔 1 𝑏 𝑥 C:y^{2}=x^{2g+1}+ax^{g+1}+bx over a prime finite field 𝔽 p , p > 2 , p |̸ g , P m := P m ​ ( − a 2 ​ b ) formulae-sequence subscript 𝔽 𝑝 𝑝 2 assign conditional 𝑝 𝑔 subscript 𝑃 𝑚 subscript 𝑃 𝑚 𝑎 2 𝑏 \mathbb{F}_{p},p>2,p\not|~{}g,P_{m}:=P_{m}(-\frac{a}{2\sqrt{b}}) , b i := b p − 1 i assign subscript 𝑏 𝑖 superscript 𝑏 𝑝 1 𝑖 b_{i}:=\sqrt{b}^{\frac{p-1}{i}} .

$g$	conditions	${\chi }_{C,p}\left(T\right)\left(modp\right)$
2	$p\equiv 1\left(mod4\right)$	$T^2\left(T-b_4^3{P}_{\frac{p-1}{4}}\right)\left(T-b_4{P}_{\frac{p-1}{4}}\right)$
2	$p\equiv 3\left(mod4\right)$	$T^2\left(T^2-b_2^2{P}_{\frac{p-3}{4}}^2\right)$
3	$p\equiv 1\left(mod3\right)$	$T^3\left(T-b_2{P}_{\frac{p-1}{2}}\right)\left(T-b_6^5{P}_{\frac{p-1}{6}}\right)\left(T-b_6{P}_{\frac{p-1}{6}}\right)$
3	$p\equiv 2\left(mod3\right)$	$T^3\left(T-b_2{P}_{\frac{p-1}{2}}\right)\left(T^2-b_2^2{P}_{\frac{p-5}{6}}^2\right)$
4	$p\equiv 1\left(mod8\right)$	$T^4\left(T-b_8^5{P}_{\frac{3p-3}{8}}\right)\left(T-b_8^3{P}_{\frac{3p-3}{8}}\right)\left(T-b_8^7{P}_{\frac{p-1}{8}}\right)\left(T-b_8{P}_{\frac{p-1}{8}}\right)$
4	$p\equiv 3\left(mod8\right)$	$T^4\left(T^2-b_2^3{P}_{\frac{3p-1}{8}}{P}_{\frac{p-3}{8}}\right)\left(T^2-b_2{P}_{\frac{3p-1}{8}}{P}_{\frac{p-3}{8}}\right)$
4	$p\equiv 5\left(mod8\right)$	$T^4\left(T^2-b_4^5{P}_{\frac{3p-7}{8}}{P}_{\frac{p-5}{8}}\right)\left(T^2-b_4^3{P}_{\frac{3p-7}{8}}{P}_{\frac{p-5}{8}}\right)$
4	$p\equiv 7\left(mod8\right)$	$T^4\left(T^2-b_2^2{P}_{\frac{3p-5}{8}}^2\right)\left(T^2-b_2^2{P}_{\frac{p-7}{8}}^2\right)$
5	$p\equiv 1\left(mod5\right)$	$T^5\left(T-b_2{P}_{\frac{p-1}{2}}\right)\left(T-b_{10}^7{P}_{\frac{3p-3}{10}}\right)\left(T-b_{10}^3{P}_{\frac{3p-3}{10}}\right)\left(T-b_{10}^9{P}_{\frac{p-1}{10}}\right)\left(T-b_{10}{P}_{\frac{p-1}{10}}\right)$
5	$p\equiv 2\left(mod5\right)$	$T^5\left(T^4-b_2^4{P}_{\frac{3p-1}{10}}^2{P}_{\frac{p-7}{10}}^2\right)\left(T-b_2{P}_{\frac{p-1}{2}}\right)$
5	$p\equiv 3\left(mod5\right)$	$T^5\left(T^4-b_2^4{P}_{\frac{3p-9}{10}}^2{P}_{\frac{p-3}{10}}^2\right)\left(T-b_2{P}_{\frac{p-1}{2}}\right)$
5	$p\equiv 4\left(mod5\right)$	$T^5\left(T^2-b_2^2{P}_{\frac{3p-7}{10}}^2\right)\left(T^2-b_2^2{P}_{\frac{p-9}{10}}^2\right)\left(T-b_2{P}_{\frac{p-1}{2}}\right)$
6	$p\equiv 1\left(mod12\right)$	$T^6(T-b_{12}^7{P}_{\frac{5p-5}{12}})(T-b_{12}^5{P}_{\frac{5p-5}{12}})(T-b_{12}^9{P}_{\frac{p-1}{4}})(T-b_{12}^3{P}_{\frac{p-1}{4}})(T-b_{12}^{11}{P}_{\frac{p-1}{12}})\times$ $\times \left(T-b_{12}{P}_{\frac{p-1}{12}}\right)$
6	$p\equiv 5\left(mod12\right)$	$T^6\left(T^2-b_2^3{P}_{\frac{5p-1}{12}}{P}_{\frac{p-5}{12}}\right)\left(T^2-b_2{P}_{\frac{5p-1}{12}}{P}_{\frac{p-5}{12}}\right)\left(T-b_4^3{P}_{\frac{p-1}{4}}\right)\left(T-b_4{P}_{\frac{p-1}{4}}\right)$
6	$p\equiv 7\left(mod12\right)$	$T^6\left(T^2-b_2^2{P}_{\frac{p-3}{4}}^2\right)\left(T^2-b_3^4{P}_{\frac{5p-11}{12}}{P}_{\frac{p-7}{12}}\right)\left(T^2-b_3^2{P}_{\frac{5p-11}{12}}{P}_{\frac{p-7}{12}}\right)$
6	$p\equiv 11\left(mod12\right)$	$T^6\left(T^2-b_2^2{P}_{\frac{5p-7}{12}}^2\right)\left(T^2-b_2^2{P}_{\frac{p-3}{4}}^2\right)\left(T^2-b_2^2{P}_{\frac{p-11}{12}}^2\right)$
7	$p\equiv 1\left(mod7\right)$	$T^7(T-b_2{P}_{\frac{p-1}{2}})(T-b_{14}^9{P}_{\frac{5p-5}{14}})(T-b_{14}^5{P}_{\frac{5p-5}{14}})(T-b_{14}^{11}{P}_{\frac{3p-3}{14}})(T-b_{14}^3{P}_{\frac{3p-3}{14}})\times$ $\times \left(T-b_{14}^{13}{P}_{\frac{p-1}{14}}\right)\left(T-b_{14}{P}_{\frac{p-1}{14}}\right)$
7	$p\equiv 2\left(mod7\right)$	$T^7{\left(T^3-b_2^3{P}_{\frac{5p-3}{14}}{P}_{\frac{3p-13}{14}}{P}_{\frac{p-9}{14}}\right)}^2\left(T-b_2{P}_{\frac{p-1}{2}}\right)$
7	$p\equiv 3\left(mod7\right)$	$T^7\left(T^6-b_2^6{P}_{\frac{5p-1}{14}}^2{P}_{\frac{3p-9}{14}}^2{P}_{\frac{p-3}{14}}^2\right)\left(T-b_2{P}_{\frac{p-1}{2}}\right)$
7	$p\equiv 4\left(mod7\right)$	$T^7{\left(T^3-b_2^3{P}_{\frac{5p-13}{14}}{P}_{\frac{3p-5}{14}}{P}_{\frac{p-11}{14}}\right)}^2\left(T-b_2{P}_{\frac{p-1}{2}}\right)$
7	$p\equiv 5\left(mod7\right)$	$T^7\left(T^6-b_2^6{P}_{\frac{5p-11}{14}}^2{P}_{\frac{3p-1}{14}}^2{P}_{\frac{p-5}{14}}^2\right)\left(T-b_2{P}_{\frac{p-1}{2}}\right)$
7	$p\equiv 6\left(mod7\right)$	$T^7\left(T^2-b_2^2{P}_{\frac{5p-9}{14}}^2\right)\left(T^2-b_2^2{P}_{\frac{3p-11}{14}}^2\right)\left(T^2-b_2^2{P}_{\frac{p-13}{14}}^2\right)\left(T-b_2{P}_{\frac{p-1}{2}}\right)$

Equations

$$y^2=x^{2g+1}+a{x}^{g+1}+bx.$$

$$Z(X/{\mathbb{F}}_q;T)=\exp \left(\sum _{k=1}^{\infty }\frac{\#X({\mathbb{F}}_{q^k})}{k}{T}^k\right)=\frac{L_{X,q}(T)}{(1-T)(1-qT)}.$$

$$L_{X,q}(T)=q^g{T}^{2g}+a_1{q}^{g-1}{T}^{2g-1}+...+a_g{T}^g+a_{g-1}{T}^{g-1}+...+a_{1}T+1,$$

$$(\sqrt{q}-1{)}^{2g}\le \#J_X({\mathbb{F}}_q)\le (\sqrt{q}+1{)}^{2g}.$$

$$C^{\prime }:y^2=x^{2g+1}+c{x}^{g+1}+x,c=\pm \frac{a}{\sqrt{b}}$$

$$s:(x,y)\mapsto \left(\frac{1}{x},\frac{y}{x^{g+1}}\right)$$

$$r:(x,y)\mapsto \left({\zeta }_{g}x,{\zeta }_{2g}y\right)$$

$$J_{C^{\prime }}({\mathbb{F}}_q)\sim J_{C^{\prime }/⟨s⟩}({\mathbb{F}}_q)\times J_{C^{\prime }/⟨s\omega ⟩}({\mathbb{F}}_q).$$

$$X_1^{\prime }:y^2=D_g(x)+c$$

$$X_1^{\prime }:y^2=(x+2)(D_g(x)+c),$$

$$X_2^{\prime }:y^2=(x^2-4)(D_g(x)+c)$$

$$X_2^{\prime }:y^2=(x-2)(D_g(x)+c),$$

$$y^2=xf(x^2-2)+c$$

$$y^2=(x+2)(f(x^2-2)+c)$$

$$D_g(x,\alpha )=\prod _{k=1,kodd}^{2g-1}(x-\sqrt{\alpha }({\zeta }_{4g}^k+{\zeta }_{4g}^{-k}))=f(x^2-2),$$

$$x^{2g}+1=x^g\left(x+\frac{1}{x}\right)f\left(x^2+\frac{1}{x^2}\right)=x^{g-1}\left(x+\frac{1}{x}\right)D_g\left(x+\frac{1}{x}\right)$$

$$x^{2g}+1=x^{g}f\left(x^2+\frac{1}{x^2}\right)=x^g{D}_g\left(x+\frac{1}{x}\right)$$

$$D_g(x+1/x)=x^g+1/x^g$$

$${\eta }^2=({\xi }^2-4)(D_g(\xi )+c)$$

$${\eta }^2=(\xi -2)(D_g(\xi )+c)$$

$$J_C({\mathbb{F}}_q[\sqrt[4g]{b}])\simeq J_{C^{\prime }/⟨s⟩}({\mathbb{F}}_q[\sqrt[4g]{b}])\times J_{C^{\prime }/⟨\omega s⟩}({\mathbb{F}}_q[\sqrt[4g]{b}]).$$

$$X/⟨\sigma ⟩:y^2=D_g(x,\alpha )+a$$

$$X/⟨\omega \sigma ⟩:y^2=(x^2-4\alpha )(D_g(x,\alpha )+a),$$

$$X/⟨\sigma ⟩:y^2=(x+2\sqrt{\alpha })(D_g(x,\alpha )+a)$$

$$X/⟨\omega \sigma ⟩:y^2=(x-2\sqrt{\alpha })(D_g(x,\alpha )+a).$$

$$y^2=x^{g+1}\left(D_g\left(x+\frac{\alpha }{x},\alpha \right)+a\right).$$

$${\eta }^2=(D_2(\xi ,b)-2\alpha )(D_g(\xi ,\alpha )+a)=({\xi }^2-4\alpha )(D_g(\xi ,\alpha )+a)$$

$${\eta }^2=(\xi -2\sqrt{\alpha })(D_g(\xi ,\alpha )+a)$$

$$J_X\sim J_{X/⟨\sigma ⟩}\times J_{X/⟨\omega \sigma ⟩}.$$

$$J_C({\mathbb{F}}_q[\sqrt[g]{b}])\sim J_{X/⟨\sigma ⟩}({\mathbb{F}}_q[\sqrt[g]{b}])\times J_{X/⟨\sigma \omega ⟩}({\mathbb{F}}_q[\sqrt[g]{b}])$$

Full text

Introduction

Let $\mathbb{F}_{q}$ be a finite field of size $q=p^{n}$ and characteristic $p>2$.

Let $C$ be a genus $g$ hyperelliptic curve defined over $\mathbb{F}_{q}$ by equation

[TABLE]

For genus $2$ case it is known [1] that the Jacobian $J_{C}$ of the curve $C$ splits into product of certain explicitly given elliptic curves over some extension of base field. There are also explicit formulae [2] expressing the number of points on the Jacobian of the curve in terms of traces of Frobenius of the elliptic curves.

The purpose of this note is to generalize results for $g=2$ to the higher genera ($g\geq 3$) and derive algorithms for counting points on $J_{C}$ in this case. To speed up point counting, where it is possible, we use connection of the Cartier-Manin matrix of the curve $C$ with Legendre polynomials from [3]. On the other side, this connection is also used to obtain new congruences for Legendre polynomials $P_{\frac{p-1}{8}},P_{\frac{3p-3}{8}}$ extending the results from the works [4, 5, 6, 7].

Background and notation. Let $X$ be a genus $g$ hyperelliptic curve defined over finite field $\mathbb{F}_{q}$. A zeta-function of the curve $X$ is given by

[TABLE]

The polynomial $L_{X,q}(T)$ has a form

[TABLE]

where $a_{i}\in\mathbb{Z}$ and $a_{i}\leq\binom{2g}{i}q^{\frac{i}{2}}$. Coefficients of the polynomial $L_{X,q^{k}}(T)$ are denoted by $a_{i,k}$.

Let $J_{X}(\mathbb{F}_{q})$ be the Jacobian of the curve over finite field $\mathbb{F}_{q}$ and let $\chi_{X,q}(T)$ be the characteristic polynomial of the Frobenius endomorphism on $J_{X}$. Then we have $L_{X}(T)=T^{2g}\chi_{X,q}(\frac{1}{T})$ and $\#J_{X}(\mathbb{F}_{q})=L_{X,q}(1)=\chi_{X,q}(1)$. Because of that, point-counting on the Jacobian is equivalent to determining of $\chi_{X,q}(T)$ (or $L_{X,q}(T)$).

The order of the Jacobian satisfies Hasse-Weil bounds

[TABLE]

For more details on curves over finite fields and their Jacobians we refer to [8, §5.2].

Organization of the paper. In Section 1 we obtain a decomposition of $J_{C}\sim J_{X_{1}}\times J_{X_{2}}$ over $\mathbb{F}_{q}[\sqrt[g]{b}]$ for odd $g$ and over $\mathbb{F}_{q}[\sqrt[2g]{b}]$ in case of $g$ is even. For curves $X_{1}$ and $X_{2}$, we provide explicit equations in terms of Dickson polynomials. This is done by using results and methods from [9, 10, 11, 12].

Section 2 is devoted to the study of Cartier-Manin matrix of the curve $C$. We obtain a complete list of possible polynomials $\chi_{C,p}(T)\mod{p}$. This fills missing cases in our previous work [3]. We use this list to derive a point-counting algorithm in genus $3$ case and to find new congruences for Legendre polynomials connected with genus $4$ curves.

Section 3 contains description of a general method for counting points on $J_{C}(\mathbb{F}_{q})$ using decomposition from Section 1 and results from Section 2. Sections 4, 5 contain algorithms and implementation details for $g=3,4$.

1 Decomposition of the $J_{C}$.

The curve $C$ is isomorphic to curve

[TABLE]

over finite field $\mathbb{F}_{q}[\sqrt[4g]{b}]$ via isomorphism $(x,y)\mapsto(b^{\frac{1}{2g}}x,b^{\frac{2g+1}{4g}}y)$. Because of that, we can get decomposition for $J_{C}$ over $\mathbb{F}_{q}[\sqrt[4g]{b}]$ from decomposition of $J_{C^{\prime}}$. Since the curve $C^{\prime}$ has automorphisms, we can decompose $J_{C^{\prime}}$ by using method of Kani and Rosen[13]. In the work of Paulhus[9] there is decomposition for the curve $C^{\prime}$ over algebraically closed field. But the method works over any field as long as we know the group of automorphisms or its subgroups. Thus, we need to obtain information about subgroups of this group over finite field.

Denote by $Aut_{C}(\mathbb{F}_{q})$ an automorphism group of curve over the finite field $\mathbb{F}_{q}$, $\mathcal{C}_{m}$ a cyclic group of order $m$ and by $\mathcal{D}_{m}$ a dihedral group of order $m$. Let also $\zeta_{m}$ be a primitive $m$-root of unity. Every hyperelliptic curve has hyperelliptic involution, denote it by $\omega:(x,y)\mapsto(x,-y)$.

All possible groups of automorphisms for hyperelliptic curve over algebraically closed field are known [14, 15]. In [11] there are explicit automorphisms for curve $C^{\prime}$. We collect them in the following proposition.

Proposition 1**.**

Let $C^{\prime}:y^{2}=x^{2g+1}+cx^{g+1}+x$ be a genus $g$ hyperelliptic curve defined over a finite field $\mathbb{F}_{q},q=p^{n}$.

$Aut_{C^{\prime}}(\mathbb{F}_{q})$* contains a non-hyperelliptic involution*

[TABLE]

and subgroup $\mathcal{C}_{2}\times\mathcal{C}_{2}$. 2. 2.

If $p\nmid 2g$ and $2g|q-1$ then $Aut_{C^{\prime}}(\mathbb{F}_{q})$ contains an automorphism

[TABLE]

of order $2g$ and subgroup $\mathcal{D}_{4g}$.

Decomposition for the Jacobian of the curve $C^{\prime}$ in case of $g=3,4$ follows from Proposition 1 and [10, Th. 4]:

• •

(genus 3) $J_{C^{\prime}}\sim E\times J_{X^{\prime}}$ if $\mathcal{C}_{2}\times\mathcal{C}_{2}\subseteq Aut_{\mathbb{F}_{q}}(C^{\prime})$ and $J_{C^{\prime}}\sim E_{1}^{2}\times E_{2}$ if $\mathcal{D}_{12}\subseteq Aut_{\mathbb{F}_{q}}(C^{\prime})$

• •

(genus 4) $J_{C^{\prime}}\sim J_{X^{\prime}_{1}}\times J_{X^{\prime}_{2}}$ if $\mathcal{C}_{2}\times\mathcal{C}_{2}\subseteq Aut_{\mathbb{F}_{q}}(C^{\prime})$ and $J_{C^{\prime}}\sim J_{X^{\prime}_{1}}^{2}$ if $\mathcal{D}_{16}\subseteq Aut_{\mathbb{F}_{q}}(C^{\prime})$

Note that condition $\mathcal{C}_{2}\times\mathcal{C}_{2}\subseteq Aut_{\mathbb{F}_{q}}(C^{\prime})$ holds in any field, therefore we always have corresponding decomposition. But $\mathcal{D}_{4g}\subseteq Aut_{C^{\prime}}$ holds in the field $\mathbb{F}_{q}[\zeta_{2g}]$, so we should work in an extension of $\mathbb{F}_{q}$ of degree upto $2g$ to get decomposition. The degree of this extension is the smallest integer $k$ such that $2g|q^{k}-1$.

Since the group of automorphisms contains $\mathcal{C}_{2}\times\mathcal{C}_{2}$ the Jacobian splits as

[TABLE]

To find equations for quotients of the curve $C^{\prime}$, we can use the following theorem.

Theorem 1**.**

Let $C^{\prime}:y^{2}=x^{2g+1}+cx^{g+1}+x$ be a genus $g$ hyperelliptic curve defined over a finite field $\mathbb{F}_{q}$ where $q=p^{n}$, $p>2$, $\gcd(g,p)=1$. Denote by $D_{m}(x,\alpha)$ and $D_{m}:=D_{m}(x,1)$ a Dickson polynomial of degree $m$. Then

the quotient of the curve $C^{\prime}$ modulo the involution $s:(x,y)\mapsto\left(\frac{1}{x},\frac{y}{x^{g+1}}\right)$ is given by

[TABLE]

if $g$ is odd and by

[TABLE]

if $g$ is even. 2. 2.

the quotient of the curve $C^{\prime}$ modulo the involution $s\omega:(x,y)\mapsto\left(\frac{1}{x},-\frac{y}{x^{g+1}}\right)$ is given by

[TABLE]

if $g$ is odd and by

[TABLE]

if $g$ is even.

Proof.

1. From [11, Prop.3] we have that the quotient $C^{\prime}/\left<s\right>$ is given by

[TABLE]

if $n$ is odd and

[TABLE]

in case of $g$ is even. The polynomial $f\in\mathbb{F}_{q}$ is the monic polynomial whose roots are all the numbers $\zeta+\frac{1}{\zeta}$ for $\zeta\in\mathbb{\overline{F}}_{q},\zeta^{g}=-1,\zeta\neq-1$.

In the work [12, §7.3] it was shown that for odd $g$ we have $xf(x^{2}-2)=D_{g}(x)$.

The result for even $g$ follows from the factorization of the Dickson polynomial [16, Th.1] over $\mathbb{\overline{F}}_{q}$

[TABLE]

where $\zeta_{4g}$ is a primitive $4g$-root of unity.

2. The proof is similar to the proof in [11, Prop.2] with addition of Dickson polynomials. We use relations

[TABLE]

for odd $g$ and

[TABLE]

for even $g$.

A function field of $C^{\prime}/\left<s\omega\right>$ is a field of $s\omega$-invariant functions from function field of $C^{\prime}$. It’s generated by $\xi=\left(x+\frac{1}{x}\right)$, $\eta=\frac{y}{x^{\frac{g-1}{2}}}\left(1-\frac{1}{x^{2}}\right)$ in the case of $g$ odd and by $\xi=\left(x+\frac{1}{x}\right),\eta=\frac{y}{x^{\frac{g}{2}}}\left(1-\frac{1}{x}\right)$ when $g$ is even.

Using the relations and a property of Dickson polynomials:

[TABLE]

we find an equation

[TABLE]

for odd $g$ and

[TABLE]

for even $g$. ∎

Theorem 1 allows us to find explicit equations for quotient curves in the decomposition of $C^{\prime}$ over finite field $\mathbb{F}_{q}$. Since $C\simeq C^{\prime}$ we obtain decomposition for the curve $C$:

[TABLE]

The theorem can be generalized to the more general class of curves using results from [12, §7.3]. It gives us better decomposition for $J_{C}$, which occurs over the field $\mathbb{F}_{q}[\sqrt[g]{b}]$ in the case of odd $g$ and over $\mathbb{F}_{q}[\sqrt[2g]{b}]$ when $g$ is even.

Theorem 2**.**

Let $X:y^{2}=x^{2g+1}+ax^{g+1}+\alpha^{g}x$ be a genus $g$ hyperelliptic curve defined over the finite field $\mathbb{F}_{q}$. Let $\omega$ be a hyperelliptic involution. Then the curve has a non-hyperelliptic involution $\sigma:(x,y)\mapsto(\frac{\alpha}{x},y\frac{\alpha^{\frac{g+1}{2}}}{x^{g+1}})$ and equations for quotients of the curve $X$ modulo involutions $\sigma$ and $\omega\sigma$ are following.

If $g$ is odd then

[TABLE]

and

[TABLE]

where $D_{g}(x,\alpha)$ is a Dickson polynomial of degree $g$. 2. 2.

If $g$ is even then

[TABLE]

and

[TABLE]

Proof.

The case of equation (1) is proved in [12, §7.3]. The case of $b=1$ for equations (1) and (3) is proved in [11], but without using Dickson polynomials. We use a similar approach to prove the remaining cases.

Dickson polynomials have a property $D_{g}\left(x+\frac{\alpha}{x}\right)=x^{g}+(\frac{\alpha}{x})^{g}$. This allows us to write the equation of $X$ in a form

[TABLE]

The function field of the curve $X/\left<\omega\sigma\right>$ is a field of $(\omega\sigma)$-invariant functions on $X$. It is generated by the functions $\xi=x+\frac{\alpha}{x}$ and $\eta=\frac{y}{x^{\frac{g-1}{2}}}\left(1-\frac{\alpha}{x^{2}}\right)$ in the case of odd $g$ and by $\xi=x+\frac{\alpha}{x}$ and $\eta=\frac{y}{x^{\frac{g}{2}}}\left(1-\frac{\sqrt{\alpha}}{x}\right)$ when $g$ is odd.

By using the property of Dickson polynomials, we find

[TABLE]

for odd $g$ and

[TABLE]

when $g$ is even. This proves (2) and (4).

The case (3) can be proved in the same way by taking $\xi=x+\frac{\alpha}{x}$ and $\eta=\frac{y}{x^{\frac{g}{2}}}\left(1+\frac{\sqrt{\alpha}}{x}\right)$. ∎

In the case of (3) and (4) the automorphism $\sigma$ is defined over $\mathbb{F}_{q}[\sqrt{\alpha}]$, so the quotient maps and quotient curves are defined over this field. A map $(x,y)\mapsto(-x,iy)$ is an isomorphism of the curves. Therefore, the curves are twists of degree $2$ to each other.

Since the curve $X$ has the non-hyperelliptic involution $\sigma$, we can split the Jacobian by using the method of Kani-Rosen [13, 9]:

[TABLE]

The equations for quotients are known from the Theorem 2. Therefore, the problem of point counting on the curve $X$ is reduced to counting points on the quotients.

The curve $C$ is a curve $X$ with $\alpha=\sqrt[g]{b}$. Automorphisms are defined over the field $\mathbb{F}_{q}[\sqrt[g]{b}]$ or $\mathbb{F}_{q}[\sqrt[2g]{b}]$, therefore we have decomposition

[TABLE]

for odd $g$ and

[TABLE]

in case of even $g$.

In addition, for odd genus we have a map $C\to E$ given by $(x,y)\mapsto(x^{g},yx^{\frac{g-1}{2}})$, where $E$ is an elliptic curve with equation

[TABLE]

This map is in fact a quotient map by automorphism $r^{2}$ for $r$ from Proposition 1. So, the Jacobian $J_{C}$ is always split in this case and we have $J_{C}\sim E\times A$, where $A$ is an abelian variety. Therefore, counting points on the curves of odd genus is reduced to counting points on the abelian variety $A$.

In case of $g=2$ the decomposition is similar to the decomposition by Satoh [1], but it obtained with different method.

It remains to compute $\#J_{C}(\mathbb{F}_{q})$ from $\#J_{C}(\mathbb{F}_{q}[\sqrt[g]{b}])$ for odd $g$ and from $\#J_{C}(\mathbb{F}_{q}[\sqrt[2g]{b}])$ in the even case.

We present a method to compute $\#J_{C}(\mathbb{F}_{q})$ in Section 3.

2 Cartier-Manin matrix of the curve $C$

Let $p>2$ and $X$ be a genus $g$ hyperelliptic curve defined by equation

[TABLE]

where $f$ is monic and $\deg{f}=2g+1$. Denote by $c_{i}$ coefficients in expansion of $f(x)^{\frac{p-1}{2}}$. A matrix

[TABLE]

is called Cartier-Manin matrix of the curve $X$. Let

[TABLE]

where $(W^{t})^{(p^{i})}$ denotes a matrix obtained from $W^{t}$ by raising each of its elements to $p^{i}$-th power. Then we have a formula [17, 18]:

[TABLE]

In this section we show how to compute this matrices for finite fields of big characteristic, i.e. for finite fields with $p>2^{160}$.

It is known that the number of points on certain elliptic curves can be expressed through Legendre polynomials. Therefore, some instances of the polynomials from [3, Table 1,2] can be computed for finite fields of big characteristic using the Schoof-Elkies-Atkin algorithm (see [19] and [8, §17.2.2]). We collect such cases in the following theorem.

Theorem 3** ([5, 6, 7]).**

Let $c\in\mathbb{F}_{p},p>3$. Then

$P_{\frac{p-1}{2}}(c)\equiv(\frac{-6}{p})t_{2}\pmod{p}$, where $t_{2}$ is a trace of Frobenius of an elliptic curve:

[TABLE] 2. 2.

$P_{\lfloor\frac{p}{3}\rfloor}(c)\equiv(\frac{p}{3})t_{3}\pmod{p}$, where $t_{3}$ is a trace of Frobenius of an elliptic curve

[TABLE] 3. 3.

$P_{\lfloor\frac{p}{4}\rfloor}(c)\equiv(\frac{6}{p})t_{4}\pmod{p}$, where $t_{4}$ is a trace of Frobenius of an elliptic curve

[TABLE] 4. 4.

$P_{\lfloor\frac{p}{6}\rfloor}(c)\equiv(\frac{3}{p})t_{6}\pmod{p}$, where $p>5$ and $t_{6}$ is a trace of Frobenius of an elliptic curve

[TABLE]

Using this theorem we can compute Cartier-Manin matrix of curve $C^{\prime}$ of genus $3$ completely. For the case of $g>3$ we get partial information. For example, the polynomial $P_{\frac{p-1}{2}}$ appears in formulae for $g=5,7$ in [3, Table 1,2]. Also, we can obtain new congruences for Legendre polynomials using tables from [3] and decomposition of $J_{C^{\prime}}$ from Section 1.

To find a Cartier-Manin matrix of the curve $C$, we connect this matrix with the matrix of the curve $C^{\prime}$ using a theorem.

Theorem 4**.**

Let $C:y^{2}=x^{2g+1}+ax^{g+1}+bx$ be a genus $g$ hyperelliptic curve defined over a finite field $\mathbb{F}_{q},q=p^{n},p>2,\gcd(p,g)=1$ and let $W=(w_{i,j}(a,b))$ be a Cartier-Manin matrix of $C$, and $m=\frac{p-1}{2}$. Then

$w_{i,j}(a,b)=b^{m+\frac{m-(ip-j)}{2g}}w_{i,j}\left(\frac{a}{\sqrt{b}},1\right)=b^{m+\frac{m-(ip-j)}{2g}}P_{\frac{ip-j}{g}-\frac{p-1}{2g}}(-\frac{a}{2\sqrt{b}})$* for $ip-j\equiv m\pmod{g}$ and* 2. 2.

$w_{i,j}=0$, otherwise.

Proof.

[TABLE]

where the sum goes all integers $k_{0},k_{1},k_{2}\geq 0$ such that

[TABLE]

Therefore,

[TABLE]

By Theorem 3 from [3] we have $w_{i,j}(a,b)=b^{m+\frac{m-(ip-j)}{2g}}P_{\frac{ip-j}{g}-\frac{p-1}{2g}}$ for $ip-j\equiv\frac{p-1}{2}\pmod{g}.$ ∎

This theorem allows us to compute Cartier-Manin matrix for the curve $C$ from the matrix of the curve $C^{\prime}$. Note that we should work in the field $\mathbb{F}_{q^{2}}$ in the case of $\sqrt{b}\not\in\mathbb{F}_{q}$, but the result belongs to $\mathbb{F}_{q}$.

The curves $C$ and $C^{\prime}$ are isomorphic over the field $\mathbb{F}_{q}[\sqrt[4g]{b}]$, but the theorem works even in the case when the curves are not isomorphic over $\mathbb{F}_{q}$.

Now, we can derive all possibilities for $\chi_{C}(T)\pmod{p}$ using the same method as in [3]. First, it follows from Theorem 4 that Cartier-Manin matrix $W$ of $C$ is (generalized) permutation matrix with permutation $\sigma$ defined by

[TABLE]

A decomposition of $\sigma=\sigma_{1}\cdot...\cdot\sigma_{k}$ into disjoint cycles corresponds to factorization of the characteristic polynomial of the matrix $W$:

[TABLE]

The same result holds for the matrix $W_{p}$ if we take $\sigma\equiv ip^{n}-\frac{p^{n}-1}{2}\pmod{p}$.

By formula (5), we have

[TABLE]

By combining (7) with Theorem 4 we can now express $\chi_{C,q}(T)\mod{p}$ in terms of Legendre polynomials.

Fixing genus $g$ and a number $s$, such that $p\equiv s\pmod{g}$ for odd genus $g$ and $p\equiv s\pmod{2g}$ in case of $g$ is even, we fix permutation $\sigma$. So, for each genus we have $g$ variants for $\chi_{C}(T)\pmod{p}$. We enumerate them all in Table 1 for $g=1-7$. The polynomials are given in factored form (over extension of $\mathbb{F}_{q}$), but all coefficients belong to $\mathbb{F}_{p}$ after expansion.

Congruences for Legendre polynomials. From Section 1, we have $J_{C^{\prime}}(\mathbb{F}_{q})\sim J_{X^{\prime}_{1}}\times J_{X^{\prime}_{2}}$. Therefore,

[TABLE]

Combining this with (7) we obtain

[TABLE]

A number of congruences for Legendre polynomials $P_{\frac{ip-j}{g}-\frac{p-1}{2g}}$ can be found by comparing coefficients of polynomials from two sides of this equation. We give an example of such congruences in Section 5.

The Jacobians $J_{X^{\prime}_{1}}$ and $J_{X^{\prime}_{2}}$ are ”generically” absolutely simple [11, Cor.6]. So, we have obtained a connection of characteristic polynomials of absolutely simple abelian varieties with Legendre polynomials.

Previous results [4, 5, 6, 7] connect Legendre polynomials with elliptic curves. But transition to hyperelliptic curves gives us more results.

3 Computing the order of $J_{C}(\mathbb{F}_{q})$.

Since we know the decomposition of Jacobian over the extension of finite field, it remains to compute $\chi_{C,q}(T)$ from $\chi_{C,q^{k}}(T)$, where $k$ such that $\mathbb{F}_{q}[\sqrt[g]{b}]\simeq\mathbb{F}_{q^{k}}$ for odd $g$ and $\mathbb{F}_{q}[\sqrt[2g]{b}]\simeq\mathbb{F}_{q^{k}}$ for even $g$.

We do this by using a formula for $L$-polynomials from [20, p.195]:

[TABLE]

By comparing coefficients, we obtain a system of $2gk$ equations of $g$ unknowns $a_{1},...,a_{g}$.

This system is big in general, so to optimize process we adopt a step-by-step method for genus $2$ case from [2]. This gives us an Algorithm 1.

The system of equations in the step 1 can be precomputed for fixed genus. It contains at most $2gk_{j}$ equations with $g$ unknowns of degree $k_{j}$.

To solve the system, we use resultants to eliminate variables $a_{2,i},...,a_{g,i}$. This gives us one polynomial in variable $a_{1,i}$. To find roots of this polynomial, we factor it over $\mathbb{F}_{l}$ (for prime $l>4g\sqrt{q}$) in the same way as it is done in [1] (for $g=2$). For each solution $a_{1,i}$ we substitute it in previous equation which depends only on $a_{1,i}$ and some other variable $a_{m,i}$. Then we factor resulting polynomial to find possible solutions for $a_{m,i}$ and so on. In the end, we obtain a list of possible tuples $(a_{1,i},...,a_{g,i})$. To exclude extra solutions, we first use Hasse-Weil bound and after that we eliminate remaining solutions by choosing random points on $J_{C}(\mathbb{F}_{q^{i}})$ and multiplying candidates for $\#J_{C}(\mathbb{F}_{q^{i}})$ by it.

For curves with simple Jacobians this gives us an unique solution in the end of algorithm. For curves with non-simple Jacobian the algorithm returns result up to twists of factors in the Jacobian decomposition.

Twists. To compute $L_{X_{1},q^{n}}(T)$ and $L_{X_{2},q^{n}}(T)$ in step 1, we first compute characteristic polynomials for the twists of $X_{1},X_{2}$, defined over $\mathbb{F}_{q}[\sqrt{b}]$. After that, we determine $L_{X_{1},q^{n}}(T)$ and $L_{X_{2},q^{n}}(T)$ from characteristic polynomials of twists using precomputed systems of equations for the step 1.

The twists for even $g$ are given by equations

[TABLE]

For odd $g$, we have

[TABLE]

and

[TABLE]

Remark 1*.*

The curve $\tilde{X}_{1}$ is a curve with explicit real multiplication [21, §7.1.1]. Due to recent result of Abelard [22] the problem of counting points on this curve has complexity $O(\log^{8}{q})$ for any fixed genus $g$.

We provide implementation of the Algorithm 1 for the case of $g=4$ in Section 5. The algorithm for $g=3$ in Section 4 uses Cartier-Manin matrices instead.

4 Genus 3

In this case, we have $J_{C}(\mathbb{F}_{q})\sim E\times A$ for some abelian variety $A$ of dimension $2$ and to determine $\chi_{C,p}(T)$ we have to find a characteristic polynomial $\chi_{A,p}(T)$ of $A$. Let

[TABLE]

To find coefficients $b_{1},b_{2}$, we compute $\chi_{A,p}(T)\pmod{p}$ by using results from Section 2. After that, we determine coefficients $b_{1},b_{2}$ by using inequalities $|b_{1}|\leq 4\sqrt{p}$ and $|b_{2}|\leq 6p$ in the same way as in [23, Alg.1]. To do this, we make a list of candidates for $b_{1},b_{2}$ and determine the right one by multiplying random point in $J_{C}(\mathbb{F}_{p})$ by candidate for $\#J_{C}(\mathbb{F}_{p})=1+p^{2}+b_{1}(p+1)+b_{2}$.

The computation of $\chi_{C,p}(T)$ is as follows. From Table 1 we have

[TABLE]

for $p\equiv 1\pmod{3}$ and

[TABLE]

for $p\equiv 2\pmod{3}$. Computation of Legendre polynomials $P_{\frac{p-1}{2}},P_{\frac{p-1}{6}},P_{\frac{p-5}{6}}$ in case of $\sqrt{b}\in\mathbb{F}_{p}$ can be done by Theorem 3 using SEA-algorithm.

In case of $b\not\in\mathbb{F}_{p}$ values of our Legendre polynomials are not in $\mathbb{F}_{p}$. So in this case, we compute $\chi_{C,p^{2}}(T)\pmod{p}$ and restore $\chi_{C,p}(T)\pmod{p}$ from this polynomial by solving system

[TABLE]

By using method described in Section 2, we obtain

[TABLE]

for $p\equiv 1\pmod{3}$ and

[TABLE]

in case of $p\equiv 2\pmod{3}$.

The computation of $P_{\frac{p-1}{2}}^{p+1},P_{\frac{p-1}{6}}^{p+1},P_{\frac{p-5}{6}}^{p+1}$ is equivalent to computing of Frobenius traces $t_{2,2},t_{6,2}$ for elliptic curves $E_{2},E_{6}$ over $\mathbb{F}_{p^{2}}$. It can be done using SEA-algorithm. After solving (9) the determination of $\chi_{C,p}(T)$ from $\chi_{C,p}(T)\pmod{p}$ is the same as for the case $\sqrt{b}\in\mathbb{F}_{p}$. However, in this case we have more possible candidates.

The described method leads to Algorithm 2.

Complexity. The most time-consuming part of the algorithm is the computation of traces of Frobenius $t_{2},t_{6},t_{6,2}$. It can be done with Schoof-Elkies-Atkin algorithm. Therefore, the complexity of Algorithm 2 is $\tilde{O}(\log^{4}{p})$.

We implemented this algorithm in Sage [24]. In the case of split abelian variety $A$ there can be many candidates for coefficients $(b_{1},b_{2})$ which pass the test by multiplying by random point of $J_{C}$. So in this case, we return the list of polynomials. This situation occurs because solutions of system of equations correspond to twists of elliptic curves in decomposition of $J_{C}$ and therefore polynomials are expected to have a common factor.

Example 4.1**.**

Let $p=fa16da0d09e774b881f9a8836ccc55d1$ (128-bit),

$a=e565b9386557e274880cd235cd733d8c$,

$b=aacc117a8fefc11ca37befa58beb2be9$.

By applying the algorithm, we obtain

$t_{2}=4d089c83177cc1f8$,

$b_{1}=945309b8f7ad6614$,

$b_{2}=a426bbdfdd37d53206f17355b5106441$.

The computation took $7.01$ sec. on laptop with Core i7-4700HQ CPU clocked at 2.40GHz.

We have $\mathbb{Q}$-irreducible polynomials $\chi_{p,A}(T)$ and $\chi_{p^{2},A}(T)$. Therefore, $A$ is simple over $\mathbb{F}_{p}$ and $\mathbb{F}_{p^{2}}$. The number of points on $A$ is

[TABLE]

It has a large divisor $r=e27313cdfeb582ed1111bb6c69c2ac8686d6674146864b7$ of cryptographic size $187$ bit. Thus, abelian variety $A$ is suitable for cryptography based on discrete logarithm problem.

Another way for point-counting in genus $3$ case is to derive an explicit formulae for the $\#J_{C}(\mathbb{F}_{q})$ as it is done in [2] for genus $2$. A complete list of the characteristic polynomials for the genus $3$ curves to appear in [25].

5 Genus 4

In this case from the results of Section 1, we have

[TABLE]

where

[TABLE]

and

[TABLE]

To compute the order of Jacobian $\#J_{C}(\mathbb{F}_{q})$, we compute characteristic polynomials of the genus $2$ curves $X_{1},X_{2}$ over $\mathbb{F}_{q}[\sqrt[8]{b}]$ and determine $\chi_{C,q}(T)$ from them. Since the curves $X_{1},X_{2}$ are isomorphic over $\mathbb{F}_{q}[\sqrt[8]{b},\sqrt{-1}]$, it’s enough to compute one of the characteristic polynomials and choose the sign in coefficients of second one depending on whether $-1$ is a square in $\mathbb{F}_{q}$ or not. For fast calculation of $\chi_{X_{1}}(T)$ over $\mathbb{F}_{q}[\sqrt[8]{b}]$, we use twist of $X_{1}$ defined over $\mathbb{F}_{q}[\sqrt{b}]$ by equation

[TABLE]

We compute the characteristic polynomial of $\tilde{X}_{1}$ over $\mathbb{F}_{q}[\sqrt{b}]$ and determine the characteristic polynomial of $X_{1}$ over $\mathbb{F}_{q}[\sqrt[8]{b}]$ by using formulae from [2, p.5]:

[TABLE]

[TABLE]

After computation of characteristic polynomial of $X_{1}$ over $\mathbb{F}_{q}[\sqrt[8]{b}]$ we compute step-by-step the characteristic polynomial $\chi_{C,q}(T)$ descending over quadratic extensions. We do this by solving following system of equations obtained from (8):

[TABLE]

[TABLE]

[TABLE]

[TABLE]

From (10) and (11) we have for $a_{1}\neq 0$:

[TABLE]

[TABLE]

By substituting (15) to (12) and (13), we obtain

[TABLE]

and

[TABLE]

After substituting (14) in above equations, eliminating $a_{4}$ by taking resultant, and dividing by $a_{1}^{4}$, we obtain degree $16$ polynomial in $a_{1}$

[TABLE]

where coefficients $c_{i}$ are given in Appendix A.

From this, we have at most $16$ possible values for $a_{1}$. To find them, we use the same technique as in [1, §4]. We factor this polynomial over $\mathbb{F}_{l}$ for $l>16\sqrt{q}$ and exclude solutions which does not satisfy the bound $|a_{1}|\leq 8\sqrt{q}$. For each $a_{1}$ there are at most $2$ possible tuples $(a_{2},a_{3},a_{4})$. So, we have obtained $32$ candidates for $\#J_{C}(\mathbb{F}_{q})$. The right one can be found by taking random points on Jacobian and multiplying it by candidate for the Jacobian order. The described method leads to Algorithm 3.

Complexity. The factorization of polynomial over finite field $\mathbb{F}_{l}$ in Algorithm 3 takes time $\tilde{O}(\log{l})=\tilde{O}(\log{q})$ (see [26, Th.14.14, p.390]). Computation of the characteristic polynomial $\chi_{X_{1},p}(T)$ of genus $2$ curve $X_{1}$ can be done in time $\tilde{O}(\log^{8}{p})$ using Gaudry-Schost algorithm [27]. Therefore, the Algorithm 3 has complexity $\tilde{O}(\log^{8}{p})$.

Note that the algorithm is less efficient than SEA algorithm with complexity $\tilde{O}(\log^{4}{p})$, but still more efficient than general algorithms [28, 29] for point-counting on genus $4$ curves.

Implementation of algorithm. We implemented the algorithm in Sage[24] computer algebra system.

Example 5.1**.**

Let $p=4398046511233$, $a=4231746819984$, $b=141248343157$. Applying the algorithm we obtained coefficients of $\chi_{C}(T)$:

[TABLE]

and

[TABLE]

The polynomial $\chi_{p}(T)$ is $\mathbb{Q}$-irreducible and therefore $J_{C}$ is simple.

The order of Jacobian

[TABLE]

has size $167$ bit.

The computation took $42$ min. $24$ sec. on laptop with Core i7-4700HQ CPU clocked at 2.40GHz.

New congruences for Legendre polynomials. From decomposition of the curve $C^{\prime}$ and results for genus $4$ from [3, Table 1,2] or Table 1 we obtain new congruences for Legendre polynomials:

[TABLE]

[TABLE]

Where $\rho\in\mathbb{F}_{p}$, $d=b_{1}^{2}-4b_{2}$, $b_{1},b_{2}$ are coefficients of the Frobenius polynomial of the curve $X^{\prime}_{1}$ with $c=-2\rho$.

Example 5.2**.**

It is easy to find an example where the curve $X^{\prime}_{1}$ has absolutely simple Jacobian. If $c=7$ and $p=7$ we have $\chi_{D,p}(T)=T^{4}-4T^{3}+16T^{2}-28T+49$. This polynomial is $\mathbb{Q}$-irreducible, therefore $J_{D}$ is simple. By result of [30] if a simple ordinary abelian surface is geometrically split, then it splits over an extension of base field of degree at most $6$. By straightforward check, we can see that all $\chi_{D,p^{k}}(T)$ for $k\leq 6$ are $\mathbb{Q}$-irreducible. Therefore, the curve $D$ with $c=3,p=7$ has absolutely simple Jacobian. Thus, we have obtained congruences for Legendre polynomials $P_{\frac{p-1}{8}},P_{\frac{3p-3}{8}}$ which connect them with genus $2$ curves that have absolutely simple Jacobians.

Conclusion

In this paper, we have derived two algorithms to compute the number of points on the Jacobian of hyperelliptic curves $C$ in case of $g=3$ and $g=4$ with complexity $\tilde{O}(\log^{4}{p})$ and $\tilde{O}(\log^{8}{p})$. We obtained a complete list of $\chi_{C,p}(T)\pmod{p}$ (Table 1).

The method for deriving new congruences for Legendre polynomials were obtained in Section 2. And new congruences for Legendre polynomials $P_{\frac{p-1}{8}}$ and $P_{\frac{3p-3}{8}}$ were found by using this method in Section 5.

This work is an extended and refined version of preliminary results presented by author on the conference SibeCrypt’18 [31].

Appendix A Genus 4. Equation for $a_{1}$.

[TABLE]

[TABLE]

[TABLE]