Discrete logarithms in quasi-polynomial time in finite fields of fixed characteristic

TL;DR

This paper demonstrates that the discrete logarithm problem in finite fields of fixed characteristic can be solved in quasi-polynomial expected time, significantly improving the understanding of its computational complexity.

Contribution

The authors establish a quasi-polynomial time algorithm for discrete logarithms in finite fields of fixed characteristic, advancing the field of computational number theory.

Findings

Discrete logarithm problem solvable in quasi-polynomial time

Expected time complexity is $(pn)^{2 ext{log}_2(n) + O(1)}$

Results impact cryptographic security assumptions

Abstract

We prove that the discrete logarithm problem can be solved in quasi-polynomial expected time in the multiplicative group of finite fields of fixed characteristic. More generally, we prove that it can be solved in the field of cardinality $p^n$ in expected time $(pn)^{2\log_2(n) + O(1)}$.

Equations

$$x^q\equiv \frac{h_0}{h_1}\mathrm{mod}I$$

$$\mathcal{Q}=\{P\in E({\overline{\mathbf{F}}}_q)\mid {\varphi }_q(P)=P+Q\}.$$

$${\varphi }_{q^i}(P)={\varphi }_{q^{i-1}}(P+Q)={\varphi }_{q^{i-1}}(P)+Q,$$

$$r=\lceil \frac{4\log (n)-\log (4)}{\log (p)}\rceil ,$$

$$1\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}$$

$$\mathrm{Log}(N_{k/{\mathbf{F}}_q}(D))=\sum _{i=1}^t{\alpha }_i\cdot \mathrm{Log}(N_{k/{\mathbf{F}}_q}(D_i)).$$

$$\tilde{\mathfrak{F}}=\{N_{{\mathbf{F}}_{q^{2^c}}/{\mathbf{F}}_q}(D)\mid D\in {\mathrm{Div}}_{{\mathbf{F}}_{q^{2^c}}}(E,\mathcal{I}),D>0,\mathrm{deg}(D)\le 2\}.$$

$$\mathfrak{F}=\{f\in {\mathbf{F}}_q[E]\mid \exists D\in \tilde{\mathfrak{F}}\text{ such that }\mathrm{div}(f)=ND-\mathrm{deg}(f)[0_E]\}.$$

$${\phi }_P:V⟶{\overline{\mathbf{F}}}_q(E):\{\begin{array}{ll}{x}^{q+1}& ⟼(x\circ {\tau }_{Q+P^{(q)}})\cdot (x\circ {\tau }_P),\\ x^q& ⟼x\circ {\tau }_{Q+P^{(q)}},\\ x& ⟼x\circ {\tau }_P,\\ 1& ⟼1.\end{array}$$

$$X_0$$

$$\log ({\phi }_P(f))=\log (f\circ {\tau }_P)=\sum _{i=1}^{q+1}\log (L_i\circ {\tau }_P).$$

$$\mathrm{Log}(N_{k/{\mathbf{F}}_q}(D))=$$

$$=$$

$$+2\cdot \mathrm{Log}(N_{k/{\mathbf{F}}_q}([-P]))+2\cdot \mathrm{Log}(N_{k/{\mathbf{F}}_q}([-Q-P^{(q)}])).$$

$$\left(\begin{array}{cc}a& b\\ c& d\end{array}\right)\star f(x)=(cx+d{)}^{\mathrm{deg}f}f\left(\frac{ax+b}{cx+d}\right).$$

$$\Xi :\mathbf{P}({\Lambda }_n)\times \mathbf{P}({\Lambda }_n)$$

$$X_0=\{f\in \overline{{\mathrm{PGL}}_3\star \mathfrak{d}}\mid \phi (f)\equiv 0\mathrm{mod}D\}.$$

$$\log (\phi (f))=\log (\psi (f))=\sum _{i=1}^{q+1}\log (\psi (L_i)).$$

$$\mathrm{div}(\phi (f))=D+D^{\prime }-3[0_E]-3[-Q],$$

$$\mathrm{Log}(N_{k/{\mathbf{F}}_q}(D))$$

$$=\sum _{i=1}^{q+1}\log (N_{k/{\mathbf{F}}_q}(\psi (L_i)))-\mathrm{Log}(N_{k/{\mathbf{F}}_q}(D^{\prime }))+3\cdot [k:{\mathbf{F}}_q]\cdot \mathrm{Log}([Q]).$$

$$E\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}$$

$$\mathrm{Log}((f_{\varphi }\circ \tau {)}^{\ast }(\mathrm{div}(g)))=\mathrm{Log}((f_{\varphi }\circ {\varphi }_E{)}^{\ast }(\mathrm{div}(g)))=\mathrm{Log}(({\varphi }_X\circ f{)}^{\ast }(\mathrm{div}(g))).$$

$$E\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}$$

$$X_0=\{(f,P)\mid {\phi }_P(f)\equiv 0\mathrm{mod}D\}\subset \mathbf{P}(V)\times E,$$

$$C=\{(f,P,r_1,r_2,r_3)\mid (f,P)\in X_0,\text{ and the }{r}_i\text{-values are three distinct roots of }f\}.$$

$$X_0$$

$$X_1=\{(f,P,r)\mid (f,P)\in X_0,\text{ and }f(r)=0\}\subset \mathbf{P}(V)\times E\times {\mathbf{P}}^1.$$

$$X_1{\times }_{X_0}{X}_1$$

$$\cong \{(f,P,r_1,r_2)\mid (f,P)\in X_0,\text{ and }f(r_1)=f(r_2)=0\}.$$

$$(B{\times }_{X_0}A){\times }_B((B{\times }_{X_0}B)\setminus {\Delta }_B)$$

Full text

1. Introduction

In this article we prove the following theorem.

Theorem 1.1**.**

Given any prime number $p$ and any positive integer $n$, the discrete logarithm problem in the group $\mathbf{F}_{p^{n}}^{\times}$ can be solved in expected time $(pn)^{2\log_{2}(n)+O(1)}$.

Fixing the characteristic $p$, the complexity of solving the discrete logarithm problem in the family of groups $\mathbf{F}_{p^{n}}^{\times}$ is then $n^{2\log_{2}(n)+O\left(1\right)}$. Therefore the discrete logarithm problem in finite fields of fixed characteristic can be solved in quasi-polynomial expected time. This result significantly improves upon the complexity $L_{p^{n}}(1/2)$ proved by Pomerance in 1987 [Pom87] — using the $L$-notation $L_{q}(\alpha)=\exp\left(O\left((\log q)^{\alpha}(\log\log q)^{1-\alpha}\right)\right)$. The quasi-polynomial complexity has been conjectured to be reachable since [BGJT14], where a first heuristic algorithm was proposed. More generally, Theorem 1.1 implies that for any parameter $\alpha\in(0,1/2)$, discrete logarithms can be computed in expected time $L_{p^{n}}(\alpha+o(1))$ in any family of fields where $p=L_{p^{n}}(\alpha)$.

Following the first heuristic algorithm of [BGJT14], a new one was proposed in [GKZ18]. The latter algorithm is proven to terminate in quasi-polynomial expected time for finite fields of fixed characteristic that admit a suitable model. Heuristically, it seems to be easy to compute such a model for any given field, but attempts to prove that it always exists have failed [Mic19]. Nevertheless, the approach of [GKZ18] has been perceived as the most promising way towards a fully rigorous algorithm. Our approach in the present article is similar, and we take advantage of the geometric insights developed in [KW18]. The main difference with all previous work is that we rely on a different model for the field: one that can be proven to exist, eliminating the need for heuristics. This model is introduced in Section 2. The main difficulty is then to construct an algorithm that provably works in this model. The general strategy is similar to that of [GKZ18], yet their algorithm does not immediately translate to the new model. An overview of the new algorithm is presented in Section 3. The remainder of the article is dedicated to the proof.

2. A suitable model for the finite field

The recent algorithms to compute discrete logarithms in small characteristic all exploit properties of a very particular model for the field. It is assumed that the field is of the form $\mathbf{F}_{q^{d\ell}}$, for a prime power $q$ and integers $d$ and $\ell$, and there exist two polynomials $h_{0}$ and $h_{1}$ in $\mathbf{F}_{q^{d}}[x]$ of degree at most $2$, and an irreducible factor $I$ of $h_{1}x^{q}-h_{0}$ of degree $\ell$. The field is then represented as $\mathbf{F}_{q^{d\ell}}\cong\mathbf{F}_{q^{d}}[x]/(I)$, and the relation

[TABLE]

is the key ingredient leading to heuristic quasi-polynomial algorithms, assuming that such a model of $\mathbf{F}_{q^{d\ell}}$ can be found where $q$ and $d$ are small enough. A proof that such a model can always be found seems out of reach, therefore we propose to use another one. All we need is a property similar to Equation (1): applying Frobenius is equivalent to a small degree rational function.

Definition 2.1** (Elliptic curve model).**

Consider a prime power $q$ and an integer $n>1$. Suppose there is an ordinary elliptic curve $E$ defined over $\mathbf{F}_{q}$, a rational point $Q\in E(\mathbf{F}_{q})$ and an irreducible divisor $\mathscr{I}$ of degree $n$ over $\mathbf{F}_{q}$ such that for any $f\in\overline{\mathbf{F}}_{q}(E)$ with no pole at $\mathscr{I}$, one has $f\circ\phi_{q}\equiv f\circ\tau_{Q}\mod\mathscr{I}$, where $\phi_{q}$ is the $q$-Frobenius and $\tau_{Q}$ is the translation by $Q$. Then, $\mathbf{F}_{q}[\mathscr{I}]\cong\mathbf{F}_{q^{n}}$, and we call $(E,Q,\mathscr{I})$ a $(q,n)$-elliptic curve model of the field $\mathbf{F}_{q^{n}}$.

Remark 1*.*

Given two functions $f$ and $g$ with no pole at $\mathscr{I}$, the congruence $f\equiv g\mod\mathscr{I}$ means that ${\mathrm{div}}^{+}(f-g)\geq\mathscr{I}$, where ${\mathrm{div}}^{+}(h)$ is the positive part of the divisor of $h$ (equivalently, $f$ and $g$ have the same value at the geometric points of $\mathscr{I}$). The field $\mathbf{F}_{q}[\mathscr{I}]$ is the residue field at $\mathscr{I}$, i.e., the quotient $\mathscr{O}_{\mathscr{I}}/\mathfrak{m}_{\mathscr{I}}$ where $\mathscr{O}_{\mathscr{I}}\subset\mathbf{F}_{q}(E)$ is the subring of functions with no pole at $\mathscr{I}$, and $\mathfrak{m}_{\mathscr{I}}\subset\mathscr{O}_{\mathscr{I}}$ is the (maximal) ideal of functions that are zero modulo $\mathscr{I}$.

We now show how to construct such a model. Consider a prime power $q$ and an integer $n>1$. Let $E$ be an elliptic curve defined over the finite field $\mathbf{F}_{q}$, and let $\phi_{q}$ be its $q$-Frobenius. Suppose that $E(\mathbf{F}_{q})$ contains a point $Q$ of order $n$. Let

[TABLE]

The kernel of the isogeny $\phi_{q}-\operatorname{id}_{E}$ is $E(\mathbf{F}_{q})$, and $\mathscr{Q}=(\phi_{q}-\operatorname{id}_{E})^{-1}(Q)$ is a translation of $E(\mathbf{F}_{q})$. In particular, $|\mathscr{Q}|=|E(\mathbf{F}_{q})|$. Let $P\in\mathscr{Q}$ and $i$ any positive integer. Since $\phi_{q}(P)=P+Q$ and

[TABLE]

a simple induction yields $\phi_{q^{i}}(P)=P+iQ$. Also, since $Q$ is of order $n$, the isogeny $\phi_{q^{n}}$ is the first Frobenius fixing $P$. The orbit of $P$ under the action of $\phi_{q}$ is a place of degree $n$ over $\mathbf{F}_{q}$. Therefore $\mathscr{Q}$ consists of $|E(\mathbf{F}_{q})|/n$ irreducible components of degree $n$ over $\mathbf{F}_{q}$. If $\mathscr{I}$ is one of these components, then $\mathbf{F}_{q}[\mathscr{I}]\cong\mathbf{F}_{q^{n}}$. Therefore, a $(q,n)$-elliptic curve model can be constructed from an elliptic curve $E$ containing an $\mathbf{F}_{q}$-rational point $Q$ of order $n$.

Given a finite field of the form $\mathbf{F}_{p^{n}}$, for a prime number $p$ and an integer $n$, there does not necessarily exist an elliptic curve model for $\mathbf{F}_{p^{n}}$, but we show in the following that one can find an extension of that field of degree logarithmic in $n$ which does admit an elliptic curve model. The construction relies on the following theorem.

Theorem 2.2** ([Wat69, Theorem 4.1, condition (I)]).**

For any integer $t$ coprime to $q$ such that $|t|\leq 2q^{1/2}$, there is an ordinary elliptic curve $E$ defined over $\mathbf{F}_{q}$ such that $|E(\mathbf{F}_{q})|=q+1-t$.

We deduce the following proposition.

Proposition 2.3**.**

Let $n\leq\sqrt{2}q^{1/4}$ be a non-negative integer. There exists an ordinary elliptic curve defined over $\mathbf{F}_{q}$ containing an $\mathbf{F}_{q}$-rational point of order $n$.

Proof.

We first prove that there is an elliptic curve $E$ over $\mathbf{F}_{q}$ such that $n^{2}$ divides $|E(\mathbf{F}_{q})|$. Since $n^{2}\leq 2q^{1/2}$, there exists an integer $m$ such that $|q+1-mn^{2}|\leq 2q^{1/2}$ and $|q+1-(m+1)n^{2}|\leq 2q^{1/2}$. Either $q+1-mn^{2}$ or $q+1-(m+1)n^{2}$ is coprime to $p$, so by Theorem 2.2, there is an ordinary elliptic curve over $\mathbf{F}_{q}$ with either $mn^{2}$ or $(m+1)n^{2}$ rational points.

We have shown that there is an elliptic curve $E$ defined over $\mathbf{F}_{q}$ such that $n^{2}$ divides $|E(\mathbf{F}_{q})|$. From [Sil86, Corollary 6.4], there are two integers $a$ and $b$ such that the group of rational points $E(\mathbf{F}_{q})$ is isomorphic to $\mathbf{Z}/a\mathbf{Z}\oplus\mathbf{Z}/ab\mathbf{Z}$. Then, $n^{2}$ divides $a^{2}b$, so $n$ divides $ab$. Therefore $E(\mathbf{F}_{q})$ contains a point of order $n$. ∎

Theorem 2.4**.**

For any prime number $p$ and integer $n$, one can find in deterministic polynomial time in $p$ and $n$ an integer $r={O(\log(n))}$ and a $(p^{r},n)$-elliptic curve model of the finite field $\mathbf{F}_{p^{rn}}$.

Proof.

Let $r$ be a positive integer and $q=p^{r}$. From Proposition 2.3, the existence of an elliptic curve model is ensured whenever $n\leq\sqrt{2}p^{r/4}$, which holds whenever $r\geq(4\log(n)-\log(4))/\log(p)$. Therefore, the construction of the elliptic curve model is as follows: let

[TABLE]

and $q=p^{r}$. Find an elliptic curve $E$ defined over $\mathbf{F}_{q}$ and a point $Q\in E(\mathbf{F}_{q})$ of order $n$. As $q$ is polynomial in $p$ and $n$, these can be found in deterministic polynomial time by an exhaustive search. Finally, let $\mathscr{I}$ be any irreducible component of $\mathscr{Q}=\{P\in E(\overline{\mathbf{F}}_{q}):\phi_{q}(P)=P+Q\}$. ∎

In the rest of this article, we suppose that the elliptic curve $E$ is in (generalised) Weierstrass form, so that we naturally have coordinates $x$ and $y$ such that $x$ is of degree $2$ and $y$ of degree $3$, and for any $P\in E$, we have $x(P)=x(-P)$.

3. Overview

The following theorem, summarising a series of refinements [EG02, Die11, GKZ18], shows that to obtain an algorithm to compute discrete logarithms, it is sufficient to have a descent procedure.

Theorem 3.1** ([Wes18, Theorem 1.4]).**

Consider a finite cyclic group $G$ of order $n$. Assume we are given a set $\mathfrak{F}=\{f_{1},\dots,f_{m}\}\subset G$ (called the factor base), for some integer $m$, and an algorithm Descent that on input $f\in G$ outputs a sequence $(e_{j})_{j=1}^{m}$ such that $f=\prod_{j=1}^{m}f_{j}^{e_{j}}$. Then, there is a probabilistic algorithm that computes discrete logarithms in $G$ at the expected cost of $O(m\log\log n)$ calls to the descent procedure Descent, and an additional $O(m^{3}\log\log n)$ operations in $\mathbf{Z}/n\mathbf{Z}$.

Therefore, to prove Theorem 1.1, it is sufficient to devise an efficient descent algorithm. Fix a $(q,n)$-elliptic curve model $(E,Q,\mathscr{I})$ for the finite field $\mathbf{F}_{q^{n}}$.

3.1. Logarithms of divisors

The notion of logarithm can be extended from field elements to divisors of the elliptic curve as follows. Let $N=|E(\mathbf{F}_{q})|$. For any field extension $k/\mathbf{F}_{q}$, let $\operatorname{Div}^{0}_{k}(E)$ be the group of degree zero divisors of $E$ defined over $k$, and let $\operatorname{Div}^{0}_{k}(E,\mathscr{I})$ be the subgroup of divisors which do not intersect $\mathscr{I}$. Given a point $P\in E$, the corresponding divisor is written $[P]$. Let $\ell$ be the largest divisor of $q^{n}-1$ coprime to $N$. We can focus on the problem of computing discrete logarithms modulo $\ell$. Indeed, since $N=O(q)$, any prime divisor of $N$ can be handled by the baby-step giant-step method in polynomial time in $q$, and we can apply the Pohlig-Hellman method to compute the ‘full’ discrete logarithms. We denote by $\log$ the logarithm function modulo $\ell$, with respect to an arbitrary generator of the multiplicative group of the finite field. We have the following commutative diagram where each line is exact

[TABLE]

where $\mathbf{F}_{q}(E)_{\mathscr{I}}^{\times}$ is the multiplicative group of rational functions on $E$ defined over $\mathbf{F}_{q}$ whose divisors do not intersect $\mathscr{I}$. The function $\mathrm{Log}$ sends any divisor $D\in\operatorname{Div}^{0}_{\mathbf{F}_{q}}(E,\mathscr{I})$ to the element $\log(f)/N$, where $f$ is any function with divisor $ND$ (which is principal). Given an effective divisor $D$ not intersecting $\mathscr{I}$, we also define $\mathrm{Log}(D)=\mathrm{Log}(D-\deg(D)[0_{E}])$.

Let $\mathscr{D}_{i}=E^{i}/\mathfrak{S}_{i}$ be the variety of degree $i$ effective divisors on $E$, where $\mathfrak{S}_{i}$ is the $i$-th symmetric group. Let $\mathscr{P}_{i}\subset\mathscr{D}_{i}$ be the subvariety of divisors $\sum_{i}[P_{i}]$ such that $\sum_{i}P_{i}=0_{E}$. Given two subvarieties $\mathscr{A}\subset\mathscr{D}_{n}$ and $\mathscr{B}\subset\mathscr{D}_{m}$, we write $\mathscr{A}+\mathscr{B}=\{A+B\mid A\in\mathscr{A},B\in\mathscr{B}\}\subset\mathscr{D}_{m+n}$. Given a point $P\in E$, we define $\mathscr{P}_{2}(P)=\{[P_{0}]+[P_{1}]\mid P_{0}+P_{1}=P\}\subset\mathscr{D}_{2}$.

3.2. Elimination and zigzag

Consider a field extension $k/\mathbf{F}_{q}$ and a divisor $D\in\mathscr{D}_{n}(k)$. A degree $n$–to–$m$ elimination is an algorithm that finds a list $(D_{i})_{i=1}^{t}$ of divisors over $E$ of degrees at most $m$ and integers $(\alpha_{i})_{i=1}^{t}$ such that

[TABLE]

The integer $t$ is called the expansion factor of the elimination. To build a descent algorithm, we first construct degree $4$–to–$3$ and $3$–to–$2$ elimination algorithms (in Propositions 6.14 and 6.6 respectively) with expansion factors at most some value $C$. Combining these two eliminations, we obtain a degree $4$–to–$2$ elimination algorithm with expansion factor at most $C^{2}$. A descent can then be constructed following the zigzag approach developed in [GKZ18], as done in Proposition 7.2. The idea is the following. The logarithm of the finite field element that we wish to descend is first represented as the logarithm of an irreducible divisor $D$ over $\mathbf{F}_{q}$ of degree a power of two, say $2^{e+2}$. Over the field $\mathbf{F}_{q^{2^{e}}}$, the divisor $D$ splits as $2^{e}$ irreducible divisors of degree $4$. If $D^{\prime}$ is any of these, then $D=N_{\mathbf{F}_{q^{2^{e}}}/{\mathbf{F}_{q}}}(D^{\prime})$. Applying the degree $4$–to–$2$ elimination to $D^{\prime}$, the value ${\mathrm{Log}}(D)$ can be rewritten as a linear combination of logarithms $\mathrm{Log}(N_{\mathbf{F}_{q^{2^{e}}}/{\mathbf{F}_{q}}}(D_{i}))$ where each $D_{i}$ has degree $2$. Now, taking the norm of each $D_{i}$ to the subfield $\mathbf{F}_{q^{2^{e-1}}}$, we obtain divisors of degree $4$ again, but over a smaller field. One can apply the degree $4$–to–$2$ elimination recursively, until all the divisors involved are of small degree, over a small field $\mathbf{F}_{q^{2^{c}}}$ (with $c=O(1)$). These small divisors form the set

[TABLE]

We can finally rewrite our logarithm as a combination of logarithms of elements of the factor base

[TABLE]

One difficulty in this approach is that the elimination algorithms might fail for certain divisors, which we call traps. We show that traps are rare, in the sense that they form a proper sub-variety of $\mathscr{D}_{4}$ or $\mathscr{D}_{3}$ of bounded degree. The descent must then carefully avoid traps. In particular, we show that given a divisor that is not a trap, an elimination allows to rewrite it in terms of smaller degree divisors that are themselves not traps — otherwise the descent could reach a dead end.

Remark 2*.*

Note that along the descent, we encounter divisors of degree at most $4$ over extensions of $\mathbf{F}_{q}$ of degrees powers of $2$. We are therefore not worried of encountering any divisor intersecting $\mathscr{I}$ — at which ${\mathrm{Log}}$ would not be defined — so long as the order of $Q$ is not divisible only by $2$ and $3$ (which can be enforced, by replacing if necessary the extension degree $n$ by $5n$).

3.3. Degree 3–to–2 elimination

Consider an extension $k/\mathbf{F}_{q}$ and a divisor $D\in\mathscr{D}_{3}(k)$. Let $V=\mathrm{span}(x^{q+1},x^{q},x,1)$. We define the morphisms $\varphi_{P}$ for any $P\in E$ as

[TABLE]

These linear morphisms are chosen so that for any vector $f\in V$ and point $P\in E$, we have the relation $\varphi_{P}(f)\equiv f\circ\tau_{P}\mod\mathscr{I}$. Now, define the algebraic variety

[TABLE]

We will see that it is a curve. Let $(f,P)\in X_{0}(k)$ be one of its $k$-rational points. We will prove that there are many such rational points where the polynomial $f$ splits into linear factors over $k$, i.e., $f=\prod_{i=1}^{q+1}L_{i}$ with $L_{i}$ linear over $k$. Assuming this is the case, then we have a 3–to–2 elimination. Indeed, on one hand,

[TABLE]

On the other hand, from the definition of $X_{0}$ and the fact that $\varphi_{P}(f)$ has degree $4$, we have $\mathrm{div}(\varphi_{P}(f))=D+[P^{\prime}]-2[-P]-2[-Q-P^{(q)}],$ where $P^{\prime}$ is a point of $E(k)$. We deduce

[TABLE]

The right-hand side is a sum of logarithms of divisors of degree $1$ or $2$ over $k$. Therefore, the 3–to–2 elimination algorithm simply consists in constructing $X_{0}$, and pick uniformly at random rational points $(f,P)\in X_{0}(k)$ until $f$ splits as a product of linear terms. It remains to prove that this happens with good probability. This is formalised in Proposition 6.6.

3.4. On the action of ${\mathrm{PGL}}_{n}$ and splitting probabilities

For the 3–to–2 elimination sketched above to work, we rely on the idea that for $(f,P)\in X_{0}(k)$, the polynomial $f$ splits into linear factors over $k$ with good probability. This polynomial $f$ has degree $q+1$, so at first glance it seems it should split with very small probability $1/(q+1)!$. However, and this is the key of previous (heuristic) quasi-polynomial algorithms, the polynomials in $V$ have a very particular structure and a fraction $1/O(q^{3})$ of them split over $k$. This high splitting probability can be understood from the action of ${\mathrm{PGL}}_{2}$ on ${\mathbf{P}}(V)$. We denote by $\star$ the action of invertible $2\times 2$ matrices on univariate polynomials defined as follows:

[TABLE]

It induces an action of ${\mathrm{PGL}}_{2}$ on ${\mathbf{P}}(V)$, also written $\star$. The space ${\mathbf{P}}(V)$ is the closure of the orbit ${\mathrm{PGL}}_{2}\star(x^{q}-x)$, and if $m\in{\mathrm{PGL}}_{2}(k)$, then $m\star(x^{q}-x)$ splits as a product of linear polynomials over $k$, which allows to deduce that a significant portion of the polynomials in ${\mathbf{P}}(V)(k)$ split over $k$. These observations are developed and exploited in [KW18].

This idea is sufficient for the previous heuristic algorithms and for our 3–to–2 elimination, but to obtain a rigorous 4–to–3 elimination algorithm, we need to work with higher dimensional objects. Let $V_{n}=\mathrm{span}(x_{i}^{q}x_{j}\mid i,j\in\{0,1,\dots,n-1\})$. Then, $n\times n$ matrices naturally act on these polynomials by substituting $x_{i}$ with the scalar product of the $i$-th row with $(x_{0},x_{1},\dots,x_{n-1})^{t}$. This induces an action of ${\mathrm{PGL}}_{n}$ on ${\mathbf{P}}(V_{n})$, written $\star$. Let $\mathfrak{d}_{n}=x_{0}^{q}x_{1}-x_{1}^{q}x_{0}\in{\mathbf{P}}(V_{n})$. The orbit ${\mathrm{PGL}}_{n}\star\mathfrak{d}$ is a subvariety of ${\mathbf{P}}(V_{n})$, but as soon as $n>2$, this orbit is not dense anymore. However, as illustrated in the following lemma, it remains the relevant subvariety to consider as we wish to find polynomials that split into linear factors.

Lemma 3.2**.**

The only polynomials in $V_{n}$ with 3 distinct linear factors are in the orbit ${\mathrm{PGL}}_{n}\star\mathfrak{d}_{n}$. The only polynomials with a double linear divisor are in the orbits ${\mathrm{PGL}}_{n}\star(x_{0}^{q}x_{1})$ and ${\mathrm{PGL}}_{n}\star x_{0}^{q+1}$.

Proof.

For the first part, suppose that the three factors are not collinear, and apply the action of a matrix sending them to $x_{0},x_{1}$ and $x_{2}$. The resulting polynomial is divisible by $x_{0}x_{1}x_{2}$, a contradiction. So the three factors must be collinear, and send them to $x_{0}$, $x_{1}$ and $x_{0}+x_{1}$. For the second part, send the double divisor to $x_{0}^{2}$. ∎

Consider the vector space $\Lambda_{n}=\mathrm{span}(x_{i}\mid i\in\{0,\dots,n-1\})$ of linear polynomials. As in the ${\mathrm{PGL}}_{2}$ case, we have that for any $m\in{\mathrm{PGL}}_{n}(k)$, the polynomial $m\star\mathfrak{d}_{n}$ splits into linear factors over $k$. Before sketching how to use these observations to build a 4–to–3 elimination algorithm, we note that the closure of ${\mathrm{PGL}}_{n}\star\mathfrak{d}_{n}$ is well understood: it consists of ${\mathrm{PGL}}_{n}\star\mathfrak{d}_{n}$ itself and the closure of ${\mathrm{PGL}}_{n}\star(x_{0}^{q}x_{1})$ (one way to see this is to show that the subvariety of ${\mathbf{P}}(V_{n})\times{\mathbf{P}}(\Lambda_{n})^{3}$ of points $(f,\ell_{1},\ell_{2},\ell_{3})$ where $\ell_{1}\ell_{2}\ell_{3}$ divides $f$ is closed, and apply Lemma 3.2). Now, the closure of ${\mathrm{PGL}}_{n}\star(x_{0}^{q}x_{1})$ is the image of the morphism

[TABLE]

This closure therefore coincides with the image of the Segre embedding of ${\mathbf{P}}(\Lambda_{n})\times{\mathbf{P}}(\Lambda_{n})\cong{\mathbf{P}}^{n-1}\times{\mathbf{P}}^{n-1}$ into ${\mathbf{P}}(V_{n})\cong{\mathbf{P}}^{n^{2}-1}$.

The points in ${\mathrm{PGL}}_{n}\star(x_{0}^{q}x_{1})$ are called the exceptional points of the closure of ${\mathrm{PGL}}_{n}\star\mathfrak{d}_{n}$, and they play a crucial role in our analysis of the descents. In particular, a divisor being a trap or not is closely related to the properties of the exceptional points that appear in $X_{0}$.

3.5. Degree 4–to–3 elimination algorithm

Consider an extension $k/\mathbf{F}_{q}$ and a divisor $D\in\mathscr{D}_{4}(k)$. Consider the vector space $V=V_{3}$ as defined above, the element $\mathfrak{d}=x_{0}^{q}x_{1}-x_{0}x_{1}^{q}\in V$, and its orbit ${\mathrm{PGL}}_{3}\star\mathfrak{d}\subset{\mathbf{P}}(V)$. Define the morphism $\psi:V\rightarrow{\overline{\mathbf{F}}_{q}}[E]$ which substitutes $x_{0},x_{1}$ and $x_{2}$ with $1$, $x$, and $y$ respectively. Now, define the morphism $\varphi:V\rightarrow{\overline{\mathbf{F}}_{q}}(E)$ with $\varphi(x_{i}^{q}x_{j})=(\psi(x_{i})\circ\tau_{Q})\cdot\psi(x_{j})$. Observe that $\varphi(f)\equiv\psi(f)\mod\mathscr{I}$ for any $f\in V$. Define

[TABLE]

Let $f\in X_{0}(k)$. As briefly justified in the previous paragraph, when $f$ is in the orbit ${\mathrm{PGL}}_{3}\star\mathfrak{d}$, we can expect it to split into linear factors over $k$ with good probability, i.e., $f=\prod_{i=1}^{q+1}L_{i}$ with $L_{i}\in\Lambda_{3}=\mathrm{span}(x_{j}\mid j\in\{0,1,2\})$. When this happens, we have a 4–to–3 elimination. Indeed, on one hand,

[TABLE]

On the other hand,

[TABLE]

where $D^{\prime}$ is an effective divisor of degree $2$ defined over the field $k$. We deduce

[TABLE]

The right-hand side is a sum of logarithms of divisors of degree $1$, $2$ of $3$ over $k$. Therefore, the 4–to–3 elimination algorithm consists in constructing $X_{0}$ and pick uniformly at random rational points $f\in X_{0}(k)$ until $f$ splits as a product of linear terms. We need to prove that this happens with good probability. This is formalised in Proposition 6.14.

3.6. Traps

The two types of elimination sketched above work for ‘most’ degree $3$ and degree $4$ divisors. There are however certain divisors for which we cannot guarantee that the elimination succeeds: these trap divisors form subvarieties $\mathscr{T}_{3}\subset\mathscr{D}_{3}$ and $\mathscr{T}_{4}\subset\mathscr{D}_{4}$. When $D$ is not a trap divisor, we can prove that the elimination succeeds, but another problem might arise: it could be that all possible eliminations of this divisor involve traps, so the descent cannot be iteratively applied. We deal with this issue in Section 6.

3.7. A general approach for elimination

The elimination algorithms above are special cases of a more general construction which will be sketched in the following. Although only the two special cases are used in the rest of the article, the general perspective may provide the reader with some useful insight. Let $n\geq 2$ be an integer, $\phi_{E}=\operatorname{id}\times\phi_{q}\times\cdots\times\phi_{q^{n-1}}:E\longrightarrow E^{n}$ and $\tau=\operatorname{id}\times\tau_{Q}\times\cdots\times\tau_{(n-1)Q}:E\longrightarrow E^{n}$. If $f:E\longrightarrow X$ is a morphism to a variety $X$, we have the commutative diagram

[TABLE]

with $f_{\phi}=f\times f^{(q)}\times\cdots\times f^{(q^{n-1})}$ and $\phi_{X}=\operatorname{id}\times\phi_{q}\times\cdots\times\phi_{q^{n-1}}$. For any rational function $g$ of the variety $X^{n}$ we get

[TABLE]

In order to obtain an elimination algorithm one constucts sufficiently many morphisms $f$ satisfying the following two restrictions:

• •

The divisor $(f_{\phi}\circ\tau)^{*}({\mathrm{div}}(g))$ is of low degree. For this we choose the morphism $f$ to be sufficiently simple (of “low degree” in some sense).

• •

The divisor $\phi_{X}^{*}({\mathrm{div}}(g))$ decomposes into “simple” (“low degree” in some sense) divisors. If $f$ is chosen as above, the pullback to $E$ also decomposes into low degree divisors.

One can construct many morphisms $f$ satisfying the first restrictions by choosing them as a composition of several morphisms such that some of the morphisms are automorphisms of varieties with large automorphisms groups (e.g., ${\mathbf{P}}^{m}$ or genus one curves). To eliminate a divisor $D$, one then has to find one such morphism $f$ such that $D$ appears in the decomposition of $(f_{\phi}\circ\tau)^{*}({\mathrm{div}}(g))$.

The degree $3$–to–$2$ and $4$–to–$3$ eliminations are two special cases. Let $X={\mathbf{P}}^{n-1}$ with coordinates $(x_{0}:\ldots:x_{n-1})$, let $2\leq m\leq n$ and, denoting the coordinates of the $i$-th factor of $X^{n}$ by $(x_{0,i}:\ldots:x_{n-1,i})$, let $g=\frac{\det(D_{m})}{\prod_{i=0}^{m-1}x_{0,i}}$ with $D_{m}=(x_{i,j})_{0\leq i<m,0\leq j<m}$. Then it follows that $\phi_{X}^{*}(g)$ has a pole of order $1+\ldots+q^{m-1}$ at $x_{0}=0$ and simple zeros at $\sum_{i=0}^{m-1}a_{i}x_{i}=0$ for $(a_{0}:\ldots:a_{m-1})\in{\mathbf{P}}^{m}(\mathbf{F}_{q})$.

1. (1)

With $n=1$, let $X={\mathbf{P}}^{1}$ and $g$ be as above. Choose $f$ to be the composition

[TABLE]

with $f_{1}$ being a translation and $f_{2}$ being an element of ${\mathrm{PGL}}_{2}$. Then the positive part of the divisor on the left hand side of (2) has degree $4$ and the positive part on the right hand side decomposes into $q+1$ divisors of degree $2$, and we obtain the $3$–to–$2$ elimination described above. 2. (2)

Let $f$ be the composition

[TABLE]

where $f_{2}$ is an element of the automorphism group ${\mathrm{PGL}}_{n}$. For $n=3$ one may choose $m=2$ and $f_{1}$ to be the usual embedding so that the positive part of the divisor on the left hand side of (2) has degree $6$ and the positive part on the right hand side decomposes into $q+1$ divisors of degree $3$; this leads to the $4$–to–$3$ elimination described above. One may also choose $m=3$ and $f_{1}=\imath\circ x$ where $\imath$ is any embedding of ${\mathbf{P}}^{1}$ into ${\mathbf{P}}^{2}$, implying that the relevant degrees are $6$ and $2$ respectively, which will give a $4$–to–$2$ elimination; this is not considered in this paper.

4. Degree $3$–to–$2$ elimination

In this section, we consider a degree $3$ divisor $D$ on $E$, defined over $k$. Note however that the main ideas, and notably the roadmap presented in Section 4.1, also apply to the degree $4$–to–$3$ elimination. We suppose $D$ does not belong to a set of exceptional divisors, the traps $\mathscr{T}_{3}\subset\mathscr{D}_{3}$, defined in Section 4.2. Consider the vector space $V=\mathrm{span}(x^{q+1},x^{q},x,1)$ in the algebra ${\overline{\mathbf{F}}_{q}}[x]$. As explained in 3.3, we can associate to the divisor $D$ a variety

[TABLE]

and our goal in this section is to prove that for a significant proportion of the pairs $(f,P)\in X_{0}(k)$, the polynomial $f$ splits into linear terms over $k$. The general strategy is similar to that of [KW18]: we define a curve $C$ and a morphism $C\rightarrow X_{0}$ such that the image of any $k$-rational point of $C$ is a pair $(f,P)$ such that $f$ splits into linear terms over $k$. Such a curve $C$ can be defined in ${\mathbf{P}}(V)\times E\times{\mathbf{P}}^{1}\times{\mathbf{P}}^{1}\times{\mathbf{P}}^{1}$ as

[TABLE]

Similarly to [KW18, Proposition 4.1], Lemma 3.2 implies that if $(f,P,r_{1},r_{2},r_{3})\in C(k)$, then $f$ splits into linear factors over $k$ (and therefore leads to an elimination, as explained in Section 3.3).

Before proceeding, we note that the definition of $X_{0}$ above works only on the open set of pairs $(f,P)$ where $P\not\in\{-D_{i}\mid i=1,...,4\}$ and $P^{(q)}\not\in\{-D_{i}-Q\mid i=1,...,4\}$, otherwise $\varphi_{P}(f)$ might have a pole on $D$. The closure can actually be defined as

[TABLE]

where $L(Z)$ is the Riemann-Roch space of rational functions $f$ such that ${\mathrm{div}}(f)\geq-Z$.

4.1. Roadmap

We need to show that $C$ has a lot of $k$-rational points. It is sufficient to prove that $C$ has at least one absolutely irreducible component defined over $k$, then apply Hasse-Weil bounds. There again, our strategy draws inspiration from [KW18]. Instead of considering directly $C$, whose points encode triples of roots, we start with the following variety which considers a single root at a time:

[TABLE]

We can then increase the number of roots by considering fibre products over the projection ${\theta:X_{1}\rightarrow X_{0}}$. Indeed, we have

[TABLE]

This product contains a diagonal component $\Delta_{X_{1}}$ isomorphic to $X_{1}$, which corresponds to quadruples $(f,P,r,r)$. The other components $X_{2}=X_{1}\times_{X_{0}}X_{1}\setminus\Delta_{X_{1}}$ encode pairs of distinct roots (points of the form $(f,P,r,r)$ can still appear in $X_{2}$, but they imply that $r$ is a double root of $f$). We can iterate this construction, and consider the product $X_{2}\times_{X_{1}}X_{2}$ over the projection $X_{1}\times_{X_{0}}X_{1}\rightarrow X_{1}$ to the first factor. This product encodes triples of roots, and the curve $C$ embeds into the non-diagonal part $X_{3}=X_{2}\times_{X_{1}}X_{2}\setminus\Delta_{X_{2}}$. In the rest of this section, we prove sequentially that $X_{0}$, $X_{1}$, $X_{2}$, $X_{3}$ and $C$ contain absolutely irreducible components defined over $k$.

The following lemma allows us to prove irreducibility results through fibre products.

Lemma 4.1**.**

Let $Y$ and $Z$ be two absolutely irreducible, complete curves over $k$, and consider a cover $\eta:Z\rightarrow Y$. Suppose there is a point $s\in Y$ and two distinct points $a,b\in Z$ such that $\eta^{-1}(s)=\{a,b\}$. If $s,a$ and $b$ are analytically irreducible, and the normalisation of $\eta$ is unramified at $a$, then $Z\times_{Y}Z\setminus\Delta_{Z}$ is absolutely irreducible, where $\Delta_{Z}$ is the diagonal component.

Proof.

The same proof as [KW18, Lemma 4.2] implies this result, where smoothness is replaced by analytic irreducibility (both imply that a point belongs to a single irreducible component). ∎

Remark 3*.*

The term analytically refers to properties of the completion of the local ring. A point is analytically irreducible if the completion of the corresponding local ring has no zero divisors (equivalently, a single branch passes through this point: it desingularises as a single point).

The following proposition defines our strategy: the rest of our analysis of the $3$–to–$2$ elimination consists in showing that our cover $\theta:X_{1}\rightarrow X_{0}$ satisfies the necessary conditions to apply Proposition 4.2.

Proposition 4.2**.**

Let $X_{0}$ and $X_{1}$ be complete curves over $k$, and suppose $X_{0}$ is absolutely irreducible. Let $\theta:X_{1}\rightarrow X_{0}$ be a cover of degree at least $3$. Let $X_{2}=(X_{1}\times_{X_{0}}X_{1})\setminus\Delta_{X_{1}}$, and $X_{3}=(X_{2}\times_{X_{1}}X_{2})\setminus\Delta_{X_{2}}$ (for the projection $X_{2}\rightarrow X_{1}$ to the first factor). Suppose that

1. (1)

there is a point $s\in X_{0}$ and two distinct points $a,b\in X_{1}$ such that $\theta^{-1}(s)=\{a,b\}$, 2. (2)

the points $a,b\in X_{1}$ and $(b,b)\in X_{2}$ are analytically irreducible, 3. (3)

the normalisation of the cover $\theta$ is unramified at $a$.

Then, either

1. (1)

the curve $X_{1}$ is absolutely irreducible, and so is $X_{3}$, or 2. (2)

the curve $X_{1}$ is the union of two absolutely irreducible components $A$ and $B$, with $a\in A$ and $b\in B$, and

[TABLE]

is an absolutely irreducible component of $X_{3}$ defined over $k$.

Remark 4*.*

Applied to the cover $\theta:X_{1}\rightarrow X_{0}$ defined above, we choose $s\in X_{0}$ to be one of the exceptional points in $X_{0}\cap S$, which have the form $((x-\alpha)(x-\beta)^{q},P)$. Then,

[TABLE]

We then prove that all the conditions of the proposition are satisfied, which implies that $X_{3}$ contains an absolutely irreducible component defined over $k$, which by Hasse-Weil bounds implies that $X_{3}$ has a lot of rational points.

Proof.

First, we prove that either the curve $X_{1}$ is absolutely irreducible, or it splits into two absolutely irreducible components $A$ and $B$ defined over $k$. Since $X_{1}$ is complete and $X_{0}$ is absolutely irreducible, each of the absolutely irreducible components of $X_{1}$ surjects to $X_{0}$ through $\theta$. The points $a$ and $b$ are the only two preimages of $s$, and since they are analytically irreducible, each belongs to exactly one absolutely irreducible component of $X_{1}$. Therefore, $X_{1}$ has at most two components. Assuming $X_{1}$ is not absolutely irreducible, let $A$ be the component containing $a$, and $B$ the component containing $b$. Since the normalisation of $\theta$ is not ramified at $a$, the cover $\theta$ restricts to a birational morphism $A\rightarrow X_{0}$. Yet, $\theta$ is of degree at least $3$, so it does not restrict to a birational morphism $B\rightarrow X_{0}$. Since $\theta$ is defined over $k$, the components $A$ and $B$ are not $\operatorname{Gal}(\overline{k}/k)$-conjugate, so they are each defined over $k$.

Next, we prove Point 1. If $X_{1}$ is absolutely irreducible, then $X_{2}$ is absolutely irreducible from Lemma 4.1, and we deduce that $X_{3}$ is absolutely irreducible from Lemma 4.1 again. Note that we need here that $X_{2}\rightarrow X_{1}$ is unramified at $(b,a)\in X_{2}$, a consequence of the fact that $\theta$ is unramified at $a$.

We now prove Point 2. Assume that $X_{1}$ decomposes as $A\cup B$. We first show that $X_{2}$ is the union of the absolutely irreducible components $A\times_{X_{0}}B$, $B\times_{X_{0}}A$, and $(B\times_{X_{0}}B)\setminus\Delta_{B}$, each defined over $k$. We have

[TABLE]

Both $A\times_{X_{0}}B$ and $B\times_{X_{0}}A$ are birational to $B$, so they are absolutely irreducible. The point $(b,b)\in(B\times_{X_{0}}B)\setminus\Delta_{B}$ is analytically irreducible (so it can only be in one component), and is the only preimage of the point $b\in B$ through the projection to the first factor. Therefore $B\times_{X_{0}}B$ is absolutely irreducible. Finally, we prove that $X_{3}$ contains an absolutely irreducible component defined over $k$. Consider the component of $X_{3}$ of the form

[TABLE]

with respect to the projections to the first factor $B\times_{X_{0}}A\rightarrow B$ and $B\times_{X_{0}}B\rightarrow B$. The projection $Y\rightarrow(B\times_{X_{0}}B)\setminus\Delta_{B}$ is an isomorphism, so $Y$ is absolutely irreducible. ∎

4.2. Traps

Recall that we need $D$ not to be a trap: we now define what this means. Let

[TABLE]

In addition, a fourth kind of traps $\mathscr{T}_{3}^{3}$ is defined in Proposition 4.4. The set of traps is $\mathscr{T}_{3}=\bigcup_{i=0}^{3}\mathscr{T}_{3}^{i}$, and we suppose that $D\not\in\mathscr{T}_{3}$. The following lemma allows us to prove that traps can always be avoided in the descent algorithm (in particular, not every divisor is a trap).

Lemma 4.3**.**

Let $P_{0}\in E$. If $P_{0}^{(q)}\not\in\{P_{0}-Q,P_{0}+2Q\}$, then $\mathscr{P}_{2}(P_{0})+[-P_{0}]\not\subset\mathscr{T}_{3}$.

Proof.

This easily follows from the above definitions, and Proposition 4.4. ∎

4.3. Exceptional points of $X_{0}$

Let $S=\overline{{\mathrm{PGL}}_{2}\star x^{q}}\subset{\mathbf{P}}(V)$ be the subvariety of exceptional points. In this section we give an explicit list of the $24$ points in $X_{0}\cap(S\times E)$ (or only $12$ points in characteristic $2$). Let $f=(x-\beta)^{q}(x-\alpha)\in S$, and suppose $(f,P)\in X_{0}$. Then, $D$ divides the positive part of

[TABLE]

where $P_{\gamma}$ is any of the two points such that $x(P_{\gamma})=\gamma$. There are three ways to split $D=D^{\prime}+[D_{3}]$ where $D^{\prime}$ is of degree $2$ and $D_{3}$ is a point. Each such splitting induces two possible ways for $D$ to divide ${\mathrm{div}}(\varphi_{P}(f))$: either $D^{\prime}$ divides ${\mathrm{div}}(\varphi_{P}(x-\alpha))$ and $[D_{3}]$ divides ${\mathrm{div}}(\varphi_{P}((x-\beta)^{q}))$, or the reverse. Let $c$ be the number of two-torsion points on $E$; it is $2$ in characteristic $2$ (recall that $E$ is ordinary) and $4$ otherwise. Each of these $6$ configurations gives rise to $c$ possible values of $f$, and we find that $X_{0}\cap S\times E$ contains a total of $6c$ points (we observe below that they project to $6c$ distinct points in $E$). Indeed, if $D^{\prime}=[D_{1}]+[D_{2}]$, $D^{\prime}$ divides ${\mathrm{div}}(\varphi_{P}(x-\alpha))$ and $[D_{3}]$ divides ${\mathrm{div}}(\varphi_{P}((x-\beta)^{q}))$, we get that $P$ is any of the $c$ points such that $2P=-(D_{1}+D_{2})$. Then, $\alpha=x(P+D_{1})$ and $\beta^{q}=x(P^{(q)}+Q+D_{3})$. Similarly, if $[D_{3}]$ divides ${\mathrm{div}}(\varphi_{P}(x-\alpha))$ and $D^{\prime}$ divides ${\mathrm{div}}(\varphi_{P}((x-\beta)^{q}))$, we get that $P$ is any of the $c$ points such that $2P^{(q)}=-(D_{1}+D_{2}+2Q)$. Then, $\alpha=x(P+D_{3})$ and $\beta^{q}=x(P^{(q)}+Q+D_{1})$.

Assuming that $D_{i}\neq D_{j}$ for $i\neq j$ and $(D_{i}+D_{j})^{(q)}\neq(D_{i}+D_{k})+2Q$ for any $i,j,k$ (with $i\neq j$ and $i\neq k$), then the $6c$ points are distinct. Therefore, since $D$ is not in $\mathscr{T}_{3}^{0}\cup\mathscr{T}_{3}^{1}$, the intersection $X_{0}\cap(S\times E)$ projects to $6c$ distinct points in $E$.

4.4. Irreducibility of $X_{0}$

Let $P\in E$. From the Riemann-Roch theorem, $\dim(L(2[-P]+2[-Q-P]))=4$ and $\dim(L(2[-P]+2[-Q-P]-D))=1$. Since $\dim(V)=4$, we generically expect $\varphi_{P}:V\rightarrow\dim(L(2[-P]+2[-Q-P]))$ to be a bijection and thereby $\varphi_{P}^{-1}(L(2[-P]+2[-Q-P]-D))$ to be of dimension $1$, in which case there is exactly one $f\in{\mathbf{P}}(V)$ such that $(f,P)\in X_{0}$. If this is indeed the case for all $P\in E$, then the projection $X_{0}\rightarrow E$ is a bijection. Let us prove that it is always the case.

By contradiction, suppose there is a point $P\in E$ such that $L={\mathbf{P}}(\varphi_{P}^{-1}(L(2[-P]+2[-Q-P]-D)))$ has dimension at least $1$. From Section 4.3, the variety $L$ intersects $S$ only at one point, so it must be a line tangent to $S$ at that point. Write $D=\sum_{i=1}^{3}[D_{i}]$, $u_{i}=x(D_{i}+P)$ and $v_{i}=x(D_{i}+Q+P^{(q)})$. Without loss of generality, the intersection point is $(x^{q}-v_{3})(x-u_{1})$. There are two cases to distinguish: either $u_{1}=u_{2}$, or $v_{3}=v_{2}$ (corresponding to the two cases exhibited in Section 4.3). The points $a_{q+1}x^{q+1}+a_{q}x^{q}+a_{1}x+a_{0}\in L$ satisfy (by construction) the three equations

[TABLE]

Also, since $L$ is tangent to $S$ at $(x^{q}-v_{3})(x-u_{1})$, they also satisfy the equation

[TABLE]

These linear equations can be represented by the matrix

[TABLE]

Since $L$ has dimension at least $1$, the rank of this matrix is at most $2$. We now show that when $D$ is not a trap, $M$ is of rank $3$, a contradiction (implying that $X_{0}\rightarrow E$ is a bijection). In the case where $u_{1}=u_{2}$, we have $u_{1}\neq u_{3}$ (because $D\not\in\mathscr{T}_{3}^{0}$), so

[TABLE]

Since $D\not\in\mathscr{T}_{3}^{0}$, the values $v_{i}$ are not all equal, so the rank of $M$ is $3$. The case $v_{3}=v_{2}$ is similar.

We have proved that the projection $X_{0}\rightarrow E$ is a bijection. Now, $X_{0}$ contains at least one smooth point: for instance, consider one of the points of the form $((x-\beta)^{q}(x-\alpha),P)\in X_{0}$ where $2P=-(D_{1}+D_{2})$. The Jacobian matrix is

[TABLE]

and has rank $4$ since $(\frac{\partial e}{\partial x_{P}},\frac{\partial e}{\partial y_{P}})\neq(0,0)$ (because $E$ is smooth), $u_{1}=u_{2}$ (by construction of the point), $u_{2}\neq u_{3}$ (because $D\not\in\mathscr{T}_{3}^{0}$), and $v_{1}\neq v_{2}$ (because $D\not\in\mathscr{T}_{3}^{1}$). We deduce that $X_{0}$ is a smooth and absolutely irreducible curve.

4.5. Local analysis of $X_{1}$

Let us compute some equations for $X_{1}$. We see it as a subvariety of ${\mathbf{P}}^{3}\times E\times{\mathbf{P}}^{1}$, parameterized by the (affine) variables $a_{q},a_{1},a_{0},x_{E},y_{E},r$ (where the corresponding polynomial is $x^{q+1}+a_{q}x^{q}+a_{1}x+a_{0}\in{\mathbf{P}}(V)$, the elliptic curve point is $P=(x_{P},y_{P})\in E$, and the root is $r\in{\mathbf{P}}^{1}$). As above, let $D=\sum_{i=1}^{3}[D_{i}]$, $u_{i}=x(P+D_{i})$ and $v_{i}=x(P^{(q)}+D_{i}+Q)$. The defining polynomials of $X_{1}$ are the equation $e\in\mathbf{F}_{q}[x_{P},y_{P}]$ of the elliptic curve $E$ and the four polynomials

[TABLE]

Recall that for any $P_{0}\in E$, we have $\mathscr{P}_{2}(P_{0})=\{[R]+[T]\mid R+T=P_{0}\}\subset\mathscr{D}_{2}$.

Proposition 4.4**.**

There is a point $s\in X_{0}\cap(S\times E)$ of which both preimages through $\theta$ in $X_{1}$ are smooth, unless $D$ belongs to a strict closed subvariety $\mathscr{T}_{3}^{3}$ of $\mathscr{D}_{3}$. For any $P_{0}\in E$, we have $\mathscr{P}_{2}(P_{0})+[-P_{0}]\not\subset\mathscr{T}_{3}^{3}$.

Proof.

The Jacobian matrix associated to the given defining polynomials of $X_{1}$ is

[TABLE]

Since $X_{0}$ is smooth, the top-left $5\times 4$ submatrix has rank $4$. Therefore the above matrix has rank $5$ at any point where $r^{q}+a_{1}\neq 0$. Therefore, the only points that could be singular on $X_{1}$ correspond to polynomials of the form $(x-\beta)^{q}(x-\alpha)=x^{q+1}-\alpha x^{q}-\beta^{q}x+\beta^{q}\alpha$, together with the elliptic curve point $(x_{0},y_{0})$ and the root $\beta$. In terms of the coordinates $(a_{q},a_{1},a_{0},x_{E},y_{E},r)$, such a point is given by $(-\alpha,-\beta^{q},\beta^{q}\alpha,x_{0},y_{0},\beta)$. It is non-singular if and only if the matrix

[TABLE]

has rank $4$ at this geometric point.

Let $\mathscr{T}_{3}^{3}$ be the subvariety of $\mathscr{D}_{3}$ of divisors $D$ for which this matrix is singular at all the corresponding $24$ exceptional points (or $12$ in characteristic $2$). Fix $P_{0}\in E$, and let us show that $\mathscr{P}_{2}(P_{0})+[-P_{0}]\not\subset\mathscr{T}_{3}^{3}$. Let $P\in E$, and

[TABLE]

The point $((x-\beta)^{q}(x-\alpha),P)$ is on the induced $X_{0}$ for $\alpha=x(P+D_{1})=x(P+D_{2})$ and $\beta^{q}=x(P^{(q)}+D_{3}+Q)$. At this exceptional point, the matrix simplifies to

[TABLE]

It is easy to see that $v_{1}-v_{2}$ and $u_{3}-\beta$ are non-zero rational functions of $P$. Then, at almost all $P$, the matrix is singular if and only if the following matrix is singular111A word of caution: with $u_{i}=x(P+D_{i})$, and substituting $D_{1}=-P_{0}$ and $D_{2}=P_{0}-2P$, we get $u_{1}=u_{2}$ for every $P$, with this family of divisors $D$. It could then seem that the second line of this $2\times 2$ matrix is zero. This is not the case, because $\frac{\partial u_{i}}{\partial x_{P}}$ is the derivative of $u_{i}=x(P+D_{i})$ considered as a function of $P$, for constant $D_{i}$.:

[TABLE]

An explicit computation shows that for any $D_{1}$, the determinant of this matrix is a non-zero rational function of $P$. Indeed, using the addition formula for the short Weierstrass equation $y^{2}=x^{3}+Ax+B$ in characteristic larger than $3$, we get that the numerator of this determinant divides a rational function in which the two leading terms are

[TABLE]

The explicit computations being cumbersome, we provide a Magma script222https://github.com/Calodeon/dlp-proof/blob/master/3to2elimination.m. This numerator is a non-zero rational function of $P$ if $y(D_{1})\neq 0$ or $A\neq-3x(D_{1})^{2}$. If $y(D_{1})=0$ and $A=-3x(D_{1})^{2}$, then $B=2x(D_{1})^{3}$, and the discriminant of the short Weierstrass equation is zero, a contradiction. The cases of characteristic $2$ and $3$ are similar (and the arguments are indeed simpler since the exhibited leading coefficients are $x^{27}$ and $x^{39}y$ respectively). We deduce that for any $D_{1}$, all but finitely many points $P$ give rise to a non-singular point. With $D_{1}=-P_{0}$, we have shown that $\mathscr{P}_{2}(P_{0})+[-P_{0}]\not\subset\mathscr{T}_{3}^{3}$. ∎

In the rest of this section, we fix the point $s$ from Proposition 4.4. With $s=((x-\beta)^{q}(x-\alpha),P_{0})$, let $a=((x-\beta)^{q}(x-\alpha),P_{0},\alpha)$ and $b=((x-\beta)^{q}(x-\alpha),P_{0},\beta)$, the two preimages of $s$ through $\theta$. These points $s,a$ and $b$ are the ones that will allow us to apply Proposition 4.2. Since these points are smooth, they are analytically irreducible.

Lemma 4.5**.**

The morphism $X_{1}\rightarrow X_{0}$ is unramified at $a$.

Proof.

In terms of the coordinates $(a_{q},a_{1},a_{0},x_{E},y_{E},r)$, the point $a=((x-\beta)^{q}(x-\alpha),P_{0},\alpha)\in X_{1}$ is the tuple $(-\alpha,-\beta^{q},\beta^{q}\alpha,x_{0},y_{0},\alpha)$. With a linear change of variables, send this point to the origin, and to avoid heavy notation, we still write $(a_{q},a_{1},a_{0},x_{E},y_{E},r)$ for the translated variables. Since $X_{0}$ is non-singular, it admits a local parameterisation $a_{q},a_{1},a_{0},x,y\in k[[t]]$ at $s$. Then, the curve $X_{1}$ is given analytically at $a$ by the equation

[TABLE]

The induced morphism between the completions of the local rings is then given by

[TABLE]

Since $\alpha^{q}-\beta^{q}\neq 0$, the variable $t$ does not divide the linear term of $G$, and the morphism is therefore unramified at $a$. ∎

4.6. Local analysis of $X_{2}$

In this section, we show that the point $(b,b)\in X_{2}$ is analytically irreducible.

Lemma 4.6**.**

Consider a morphism of smooth curves $\eta:Z\rightarrow Y$ over some field $k$. Suppose that at some point $z\in Z$, the induced morphism between the completions of the local rings is given by

[TABLE]

where $B(0,0)\neq 0$ and $B(0,r)$ has a non-zero linear term. Then, the point $(z,z)\in(Z\times_{Y}Z)\setminus\Delta_{Z}$ is analytically irreducible.

Proof.

Up to isomorphism, $\eta^{*}_{z}$ can be written as

[TABLE]

where $U(0)\neq 0$ and $U(r)$ has a non-zero linear term. Then, the completion of the local ring at $(z,z)\in(Z\times_{Y}Z)\setminus\Delta_{Z}$ is $k[[r,r^{\prime}]]/C(r,r^{\prime})$ where

[TABLE]

Unsurprisingly, $(z,z)$ is singular: this corresponds to the fact that $\eta$ is ramified at $z$, with ramification index $q>2$. Let us blow up the equation $C(r,r^{\prime})$ by introducing a variable $s$ and the equation $r^{\prime}=rs$ (the case $r=r^{\prime}s$ is symmetric). Substituting in $C$, we obtain

[TABLE]

The equation of the blowup is $H(r,s)=C(r,rs)/r^{q-1}$. The only solution of $H(0,s)=0$ is at $s=1$, so there is only one point in the blowup, and it remains to see that it is smooth. Write $U(r)=u_{0}+u_{1}r+r^{2}\tilde{U}(r)$, and $s^{\prime}=s-1$. We have

[TABLE]

Therefore, $u_{1}\neq 0$ is the coefficient of the monomial $r$ in $H(r,s)$, so $H(r,s)$ has a non-zero linear term, implying that the point at $r=0$ and $s=1$ is smooth. ∎

Proposition 4.7**.**

The point $(b,b)\in X_{2}$ is analytically irreducible.

Proof.

Recall that $s\in X_{0}$ is the point from Proposition 4.4, and $a,b\in X_{1}$ are its two preimages through $\theta$. We start as in the proof of Lemma 4.5. In terms of the coordinates $(a_{q},a_{1},a_{0},x_{E},y_{E},r)$, the point $b=((x-\beta)^{q}(x-\alpha),P_{0},\beta)\in X_{1}$ is the tuple $(-\alpha,-\beta^{q},\beta^{q}\alpha,x_{0},y_{0},\beta)$, and we send this point to the origin via a linear change of variables (again, to avoid heavy notation, we still write $(a_{q},a_{1},a_{0},x_{E},y_{E},r)$ for the translated variables). Let $a_{q},a_{1},a_{0},x,y\in k[[t]]$ be the local parameterisation of $X_{0}$ at $s$. The curve $X_{1}$ is given analytically at $b$ by the equation

[TABLE]

Since $b$ is non-singular, $a_{q}\beta^{q}+a_{1}\beta+a_{0}=tF(t)$ with $F(0)\neq 0$. Writing $a_{1}=tH(t)$, we get

[TABLE]

Since $D\not\in\mathscr{T}_{3}^{2}$, we have $\alpha\neq\beta$, so up to multiplication by a unit, $G$ is of the form $t-r^{q}B(t,r)$ for some $B(t,r)$ such that $B(0,0)\neq 0$. We need to show that $B(0,r)$ has a non-zero linear term. Write $v_{3}=\tilde{v}_{3}+\beta^{q}$. From equation $F_{3}$ (defined on page 4.5), we have

[TABLE]

Since $v_{3}$ is a $q$-th power, we get that $H(0)=\frac{a_{1}}{t}(0)=-\frac{F(0)}{u_{3}(0)-\beta}$. We deduce that the linear term of $B(0,r)$ is $-F(0)^{-1}(1-\frac{\alpha-\beta}{u_{3}(0)-\beta})$. Since $D\not\in\mathscr{T}_{3}^{0}$, $u_{3}(0)\neq\alpha$, so $B(0,r)$ has a non-zero linear term. We conclude with Lemma 4.6. ∎

4.7. Irreducibility of $X_{3}$

We are finally ready to prove the main result of this section.

Proposition 4.8**.**

For any divisor $D\in(\mathscr{D}_{3}\setminus\mathscr{T}_{3})(k)$, the curve $X_{3}$ contains an absolutely irreducible component defined over $k$.

Proof.

We have shown that $\theta:X_{1}\rightarrow X_{0}$ satisfies all the conditions of Proposition 4.2, so the result follows. ∎

5. Degree $4$–to–$3$ elimination

As for the degree $3$–to–$2$ elimination, we are going to apply Proposition 4.2. Consider an extension $k/\mathbf{F}_{q}$ and a divisor $D\in\mathscr{D}_{4}(k)$. Recall from Section 3.5 that we work with the vector space $V=\mathrm{span}(x_{i}^{q}x_{j}\mid i,j\in\{0,1,2\})$, the morphism $\psi:V\rightarrow{\overline{\mathbf{F}}_{q}}[E]$ which substitutes $x_{0},x_{1}$ and $x_{2}$ with $1$, $x$, and $y$ respectively, and the morphism $\varphi:V\rightarrow L(3[-Q]+3[0_{E}])$ with $\varphi(x_{i}^{q}x_{j})=(\psi(x_{i})\circ\tau_{Q})\cdot\psi(x_{j})$. Let $K$ be the preimage through $\varphi$ of $L(3[-Q]+3[0_{E}]-D)$. We then have

[TABLE]

where $\mathfrak{d}=x_{0}^{q}x_{1}-x_{1}^{q}x_{0}\in V$. The space ${\mathbf{P}}(K)$ is a hyperplane in ${\mathbf{P}}(V)$, which we denote by $H$. We prove in Lemma 5.5 that $X_{0}$ is a curve. Let us represent the elements of $V$ (or ${\mathbf{P}}(V)$) as column vectors

[TABLE]

The hyperplane $H$ is the kernel of the matrix

[TABLE]

where each $H_{ij}$ is a column vector of dimension $4$. With $\Lambda=\mathrm{span}(x_{i}\mid i\in\{0,1,2\})$, the curve $X_{1}$ is defined as

[TABLE]

and we set $X_{2}=X_{1}\times_{X_{0}}X_{1}\setminus\Delta_{X_{1}}$ and $X_{3}=X_{2}\times_{X_{1}}X_{2}\setminus\Delta_{X_{2}}$ as in Section 4.1.

5.1. Exceptional points of $X_{0}$

Let $D=\sum_{i=1}^{4}[D_{i}]\in\mathscr{D}_{4}(k)$ be the divisor of $E$ to be eliminated, and let $H$ be the induced hyperplane. Suppose that $D$ is not divisible by a principal divisor of degree $3$ (being divisible by a principal divisor would correspond to the traps of type $\mathscr{T}_{4}^{4}$ defined in Section 5.2). Let $uv^{q}\in S\cap H$ be an exceptional point of $X_{0}$. We have $\varphi(uv^{q})=u\cdot(v^{(q)}\circ\tau_{Q})$ (where $v^{(q)}$ is $v$ with coefficients raised to the power $q$), which is of degree $6$ since $u$ and $v^{(q)}\circ\tau_{Q}$ are each of degree $3$. Since $D$ divides $\varphi(uv^{q})$ and $D$ is not divisible by a principal divisor of degree $3$, we have a permutation $\sigma\in\mathfrak{S}_{4}$ such that

[TABLE]

and

[TABLE]

The second equality implies

[TABLE]

Note that, as should be expected, the number of ways to split $D$ into two parts of two points is exactly the degree of $S$ (recall that $S$ is the image of the Segre embedding ${\mathbf{P}}(\Lambda)\times{\mathbf{P}}(\Lambda)\rightarrow{\mathbf{P}}(V)$). The above constitutes an exhaustive description of the set of exceptional points $S\cap H.$

There are $6$ exceptional points $U^{i}{V^{i}}^{q}$ in the intersection of $X_{0}$ with $S$. Up to reindexing, we necessarily have the following triples of aligned points:

[TABLE]

[TABLE]

They arise as follows. Consider the $6$ pairs of distinct points dividing $D=\sum_{i=1}^{4}[D_{i}]$,

[TABLE]

For each $i$, if $d_{i}=(D_{j},D_{k})$, then $U^{i}$ defines the line passing through $D_{j}$ and $D_{k}$, while ${V^{i}}^{(q)}$ defines the line passing through $D_{m}+Q$ and $D_{n}+Q$, where $\{j,k,m,n\}=\{1,2,3,4\}$. With this indexing, we can see that $U^{4},U^{5},$ and $U^{6}$ are aligned because they all have a root at $D_{1}$ (i.e., the corresponding lines intersect at the point $D_{1}$). All the alignments listed above arise in this way.

As in the $3$–to–$2$ case, we follow the strategy outlined in Section 4.1, so we fix a point $s\in X_{0}$, say $s=(V^{1})^{q}U^{1}$, and its two preimages $a=((V^{1})^{q}U^{1},U_{1})$ and $b=((V^{1})^{q}U^{1},V^{1})$ in $X_{1}$.

5.2. Summary of the traps

As long as $D$ is not a trap, there should be no other alignment between the points $U^{i}$ and $V^{i}$ than the ones listed above. Hence we define the following varieties of traps, where $\ell(R,S)$ denotes the line passing through $R$ and $S$ :

[TABLE]

The conditional statements are to be understood as “*there exist indices $i,j,m,n,r,s$ such that $i\neq j$, $m\neq n$, $r\neq s$, and… *”. Let $\mathscr{T}_{4}^{\prime}=\bigcup_{i=0}^{4}\mathscr{T}_{4}^{i}$. Note that the full variety of traps $\mathscr{T}_{4}$ (rather than $\mathscr{T}_{4}^{\prime}$) requires an additional component, studied in Section 5.9.

Lemma 5.1**.**

For any points $P_{0},P_{1}\in E$ such that either $P_{0}\neq P_{1}$ or $P_{0}^{(q)}\neq P_{0}+2Q$, we have ${\mathscr{P}_{2}(P_{0})+\mathscr{P}_{2}(P_{1})\not\subset\mathscr{T}_{4}^{\prime}}$.

Proof.

Let $R,T\in E$, and $D=\sum_{i=1}^{4}[D_{i}]\in\mathscr{P}_{2}(P_{0})+\mathscr{P}_{2}(P_{1})$, where

[TABLE]

We simply need to show that $D\not\in\mathscr{T}_{4}$ except for certain pairs $(R,T)$ that belong to some strict subvariety of $E^{2}$. There are many conditions to check in order to verify whether or not $D\in\mathscr{T}_{4}$; we use symmetries (exchanging $R$ and $T$, replacing $R$ with $P_{0}-R$, or some permutations of the three sets $\{i,j\},\{m,n\},\{r,s\}$) to significantly reduce this number.

First, let us characterise the cases where $D\not\in\mathscr{T}_{4}^{0}$. Up to symmetry, we can assume that $1$ belongs to two of the pairs of indices, and even that $(i,j)=(1,3)$, $m=1$ and $n\in\{2,4\}$. As long as $D_{2}=P_{0}-R$ and $D_{4}=P_{1}-T$ are not on the line $\ell(R,T)$ (which corresponds to a strict subvariety of $E^{2}$), we have $\ell(D_{i},D_{j})\cap\ell(D_{m},D_{n})=\{R\}$. The condition for $D\in\mathscr{T}_{4}^{0}$ is then

[TABLE]

and for each allowable $(r,s)$, it corresponds to $(R,T)$ belonging to a strict subvariety of $E^{2}$. This implies that $\mathscr{P}_{2}(P_{0})+\mathscr{P}_{2}(P_{1})\not\subset\mathscr{T}_{4}^{0}$. The fact that $\mathscr{P}_{2}(P_{0})+\mathscr{P}_{2}(P_{1})\not\subset\mathscr{T}_{4}^{1}$ follows from the observation that $\mathscr{T}_{4}^{1}$ is a translation by $-Q$ of $\mathscr{T}_{4}^{0}$, and that $\mathscr{P}_{2}(P_{0}+2Q)+\mathscr{P}_{2}(P_{0}+2Q)\not\subset\mathscr{T}_{4}^{0}$.

The condition $D\not\in\mathscr{T}_{4}^{2}$ enjoys fewer symmetries and is therefore more cumbersome. First assume that $\{i,j\}\cap\{m,n\}\neq\emptyset$. Then, up to symmetry, we can assume $i=m=1$, and apart from a strict subvariety of $E^{2}$, we have $\ell(D_{i},D_{j})^{(q)}\cap\ell(D_{m},D_{n})^{(q)}=\{R^{(q)}\}$. The conditions for $D\in\mathscr{T}_{4}^{2}$ become

[TABLE]

for any allowable $r\neq s$. None of them is satisfied as long as

[TABLE]

which for any fixed $T$ corresponds to finitely many values of $R$ to be avoided.

It remains to consider the cases where $\{i,j\}\cap\{m,n\}=\emptyset$. To continue the proof, let us work in $E^{4}$ instead of $\mathscr{D}_{4}$. More precisely, write

[TABLE]

such that $\mathscr{T}_{4}^{2}$ is the union of the varieties $\pi(T_{4}^{2}(i,j,m,n,r,s))$ for all allowable indices, where $\pi:E^{4}\rightarrow\mathscr{D}_{4}$ is the natural projetion. It is then sufficient to show that for each allowable $(i,j,m,n,r,s)$, we have $\pi^{-1}(\mathscr{P}_{2}(P_{0})+\mathscr{P}_{2}(P_{1}))\not\subset\pi^{-1}(\pi(T_{4}^{2}(i,j,m,n,r,s)))$. This is equivalent to showing that $\pi^{-1}(\mathscr{P}_{2}(P_{0}))\times\pi^{-1}(\mathscr{P}_{2}(P_{1}))\not\subset T_{4}^{2}(i,j,m,n,r,s)$ for any allowable indices; this follows from the facts that $\pi^{-1}(\mathscr{P}_{2}(P_{0}))\times\pi^{-1}(\mathscr{P}_{2}(P_{1}))$ is absolutely irreducible, and that for any permutation $\sigma\in\mathfrak{S}_{4}$, we have

[TABLE]

Up to symmetry, it is sufficient to consider $(i,j,m,n)=(1,2,3,4)$ or $(i,j,m,n)=(1,3,2,4)$.

First, suppose that $(i,j,m,n)=(1,2,3,4)$. Again up to symmetries, it is sufficient to consider $(r,s)=(2,3)$ or $(3,4)$. Suppose $(r,s)=(3,4)$, and let

[TABLE]

First, if $P_{0}=P_{1}$, then $\ell(D_{1},D_{2})^{(q)}\cap\ell(D_{3},D_{4})^{(q)}=-P_{0}^{(q)}$, and $\ell(D_{3}+Q,D_{4}+Q)\cap E=\{T+Q,P_{0}-T+Q,-P_{0}-2Q\}$ does not contain $-P_{0}^{(q)}$ for almost all points $R$ and $T$ (as long as $P_{0}^{(q)}\neq P_{0}+2Q$). If $P_{0}\neq P_{1}$, let $R=T$. Then, $\ell(D_{1},D_{2})^{(q)}\cap\ell(D_{3},D_{4})^{(q)}=R^{(q)}$. The condition becomes $R^{(q)}\in\ell(D_{3}+Q,D_{4}+Q)$. But $R^{(q)}$ is on $E$, and

[TABLE]

For all but finitely many points $R$, we have that $R^{(q)}$ does not belong to this intersection.

The case $(r,s)=(2,3)$ is similar. The same reasoning allows to conclude for the remaining cases $(i,j,m,n,r,s)\in\{(1,3,2,4,1,2),(1,3,2,4,1,3)\}$, at least for $P_{0}\neq P_{1}$; for $P_{0}=P_{1}$, one should choose $T$ to be one of the points such that $2T=P_{0}$ and $T^{(q)}\neq-P_{0}-2Q$, then observe that for almost all $R$, the condition for $\mathscr{T}_{4}^{2}$ is not satisfied. The proof for $\mathscr{T}^{3}_{4}$ is similar, and the proof for $\mathscr{T}^{4}_{4}$ is easy. ∎

Lemma 5.2**.**

Suppose $D$ is not a trap. Pick a matrix in ${\mathrm{PGL}}_{3}$ sending $U^{1}$ to $x_{0}$, $V^{1}$ to $x_{1}$, and $V^{2}$ to $x_{2}$, and let it act on ${\mathbf{P}}(V)$. In the matrix defining the transformation of $H$, the submatrices

[TABLE]

each have full rank $4$.

Proof.

Using a matrix of ${\mathrm{PGL}}_{3}$ as described, we can suppose that $U^{1}=x_{0}$, $V^{1}=x_{1}$, and $V^{2}=x_{2}$. Since $(V^{1})^{q}U^{1}=x_{1}^{q}x_{0}\in H$, we have that $H_{10}$ is the zero vector. Suppose by contradiction that $\mathrm{rank}\begin{pmatrix}H_{00}&H_{01}&H_{02}&H_{20}\end{pmatrix}\leq 3$. Then, a non-trivial linear-combination of the rows has the form

[TABLE]

Applied to $U^{2}$ and $V^{2}=x_{2}$, we get that $U^{2}$ is on the line $(0:D_{21}:D_{22})$. But $U^{1}=x_{0}$ also lies on this line, therefore so does $U^{5}$. The relation applied to $(U^{5},V^{5})$ implies that $U^{5}$ lies on the line $(0:D_{11}:D_{12})$ (unless $V^{5}$ is on the line $(0:1:0)$, which already contains $U^{1}=x_{0}$ and $V^{2}=x_{2}$, a contradiction). But $U^{1}$ also does, so $(0:D_{21}:D_{22})=(0:D_{11}:D_{12})$. The relation becomes

[TABLE]

where $(\alpha,\beta)\neq(0,0)$ are coefficient such that $\alpha(D_{21},D_{22})=\beta(D_{11},D_{12})$. We conclude that $(0:\alpha:\beta)$ is the line passing through $(V^{3})^{(q)}$,$(V^{4})^{(q)}$ and $(V^{6})^{(q)}$, and it also contains $x_{0}=(U^{1})^{(q)}$, a contradiction.

Now, suppose by contradiction that $\mathrm{rank}\begin{pmatrix}H_{00}&H_{01}&H_{11}&H_{12}\end{pmatrix}\leq 3$. We get a non-trivial linear combination of the rows of the form

[TABLE]

First, we cannot have $C_{02}=0$, otherwise the above line gives the relation $v_{2}^{q}(C_{20}u_{0}+C_{21}u_{1}+C_{22}u_{2})$: since no more than three of the $U^{i}$-points can be on the line $(C_{20}:C_{21}:C_{22})$, at least three of the $V^{i}$-points must be on the line $(0:0:1)$, which also contains $U^{1}$, a contradiction. We can therefore assume that $C_{02}=1$. We deduce that the line through $U^{2}$ and $U^{3}$ is $(C_{20}:C_{21}:C_{22})$ (for $U^{3}$, we use the fact that $V^{3}_{0}=0$ because $V^{3}$ is aligned with $V^{1}$ and $V^{2}$). This line contains $U^{6}$. We get that

[TABLE]

We get that either $V_{0}^{6}=0$, implying that $V^{6}$ is aligned with $V^{1},V^{2},V^{3}$ (which are in the line $(1:0:0)$), or $U_{2}^{6}=0$, implying that $U^{6}$ is aligned with $U^{1}$ and $V^{1}$. Both cases are traps. The same proof leads to $\mathrm{rank}\begin{pmatrix}H_{00}&H_{02}&H_{11}&H_{12}\end{pmatrix}=4$. ∎

5.3. Irreducibility of $X_{0}$

In this section, we prove that $X_{0}$ has an absolutely irreducible component defined over $k$. To do so, we first find an equation for $X_{0}$ in the plane. Recall that ${\mathbf{P}}(\Lambda)$ has coordinates $u_{0},u_{1}$ and $u_{2}$, and each point $(u_{0}:u_{1}:u_{2})$ represents the linear polynomial $u_{0}x_{0}+u_{1}x_{1}+u_{2}x_{2}$. Its dual space ${\mathbf{P}}(\Lambda)^{\vee}$ has coordinates $t_{0},t_{1}$ and $t_{2}$, and any element $(t_{0}:t_{1}:t_{2})\in{\mathbf{P}}(\Lambda)^{\vee}$ represents the line in ${\mathbf{P}}(\Lambda)$ with equation $u_{0}t_{0}+u_{1}t_{1}+u_{2}t_{2}=0$. Define a subvariety $\mathscr{O}$ of ${\mathbf{P}}(V)\times{\mathbf{P}}(\Lambda)^{\vee}$ by the six polynomials $e_{k}=\sum_{j=0}^{2}a_{kj}t_{j}$ and $f_{k}=\sum_{i=0}^{2}a_{ik}t_{i}^{q}$ for $k=0,1,2$, where $a_{ij}$ are the coordinates of ${\mathbf{P}}(V)$.

Lemma 5.3**.**

The variety $\mathscr{O}$ is the closure of the orbit ${\mathrm{PGL}}_{3}\star(\mathfrak{d},(0:0:1))$. Furthermore, for any point $(f,\ell)\in\mathscr{O}$, any linear factor of $f$ is on the line $\ell\subseteq{\mathbf{P}}(\Lambda)$.

Proof.

Notice that ${\mathrm{PGL}}_{3}$ acts on both $\mathscr{O}$ and ${\mathbf{P}}(\Lambda)^{\vee}$, and the projection $\mathscr{O}\rightarrow{\mathbf{P}}(\Lambda)^{\vee}$ is ${\mathrm{PGL}}_{3}$-equivariant. The group ${\mathrm{PGL}}_{3}$ acts faithfully on ${\mathbf{P}}(\Lambda)^{\vee}$, and the fibre of $(0:0:1)$ through $\mathscr{O}\rightarrow{\mathbf{P}}(\Lambda)^{\vee}$ is the subvariety ${\mathbf{P}}(V_{2})\times\{(0:0:1)\}\subset{\mathbf{P}}(V)\times{\mathbf{P}}(\Lambda)^{\vee}$ where $V_{2}=\mathrm{span}(x_{i}^{q}x_{i}\mid i,j\in\{0,1\})$. Any $f\in{\mathbf{P}}(V_{2})$ is a polynomial in $x_{0}$ and $x_{1}$, so its linear factors necessarily lie on the line in ${\mathbf{P}}(\Lambda)$ defined by $\ell=(0:0:1)$ (i.e., by the equation $u_{2}=0$), proving the second part of the lemma. The group ${\mathrm{PGL}}_{2}$ acts on this fibre through the embedding into ${\mathrm{PGL}}_{3}$ as the $2\times 2$ upper-left minor. We conclude from [KW18, Lemma 2.2], which implies that the fibre ${\mathbf{P}}(V_{2})\times\{(0:0:1)\}$ is the closure of the action of ${\mathrm{PGL}}_{2}$, proving the first part of the lemma. ∎

Let $h_{1},\dots,h_{4}$ be the linearly independent linear polynomials in the $a_{ij}$-coordinates which define the hyperplane $H\subset{\mathbf{P}}(V)$ of codimension $4$, and let $C=\mathscr{O}\cap(H\times{\mathbf{P}}(\Lambda)^{\vee})$, so that $X_{0}$ is a subvariety of $C$. Let $C^{\prime}\subset{\mathbf{P}}(\Lambda)^{\vee}$ be the projection of $C$ to the second factor of ${\mathbf{P}}(V)\times{\mathbf{P}}(\Lambda)^{\vee}$. In the remainder of this section, we prove that all the absolutely irreducible components of $C^{\prime}$ (and therefore also of $X_{0}$) are defined over $k$.

Lemma 5.4**.**

The projection $C\rightarrow C^{\prime}$ is an injective map on the geometric points.

Proof.

We proceed by contradiction. Suppose there exist two distinct points $(f,\ell),(g,\ell)\in C$, where $f,g\in H\subset{\mathbf{P}}(V)$. Up to the action of ${\mathrm{PGL}}_{3}$, we can suppose $\ell=(0:0:1)$. Any linear combination of $f$ and $g$ is still in $H$, and still in ${\mathbf{P}}(V_{2})\subset\mathscr{O}$, so still in $C$. Then, $C$ contains ${\mathbf{P}}(V_{2})\cap H$. Since $S\cap{\mathbf{P}}(V_{2})$ is a surface of degree $2$, either the intersection ${\mathbf{P}}(V_{2})\cap H$ contains two distinct exceptional points $v^{q}u$ where $u,v\in{\mathbf{P}}(\Lambda_{2})$, or it is tangent to $S$. Both cases are traps. ∎

Lemma 5.5**.**

The plane curve $C^{\prime}$ is defined by the polynomial (in projective coordinates $t_{0},t_{1},t_{2}$)

[TABLE]

where $H_{ij}$ denotes the $4$-dimensional vector whose entries are the coefficients of $a_{ij}$ in $h_{1},\dots,h_{4}$. The curve $C^{\prime}$ has degree $2q+2$.

Proof.

The six polynomials $e_{k}$, $f_{k}$, $k=0,1,2$, as well as $h_{1},\ldots,h_{4}$ are linear polynomials in the $a_{ij}$-coordinates, thus they can be written as $Ma_{vec}$ where $M$ is the $10\times 9$-matrix of coefficients and

[TABLE]

Pick a row of $M$ corresponding to one of the six polynomials $e_{k}$, $f_{k}$, $k=0,1,2$, add a column to $M$ containing zeros except at the chosen row where the entry is $t_{k}^{-q}$ if $e_{k}$ was chosen and $t_{k}^{-1}$ if $f_{k}$ was chosen, denote the resulting $10\times 10$-matrix by $M^{\prime}$ and let $f=\det(M^{\prime})$. If two rows (of the six above) are chosen and the corresponding entries are set in the adjoined column (with a possible sign change of one of them), it follows from the relation $\sum_{k=0}^{2}t_{k}^{q}e_{k}-\sum_{k=0}^{2}t_{k}f_{k}=0$ that the determinant of the matrix is zero. Then Laplace expansion with respect to the adjoined column shows that the definition of $f$ is independent (up to sign) of the choice of one of the six rows. By choosing $f_{2}$, deleting the adjoined column as well as the row corresponding to $f_{2}$ and setting $t_{2}=0$ it follows from $\sum_{k=0}^{1}t_{k}^{q}e_{k}-\sum_{k=0}^{1}t_{k}f_{k}=0$ that the determinant of the resulting matrix is zero which implies that $f$ is a polynomial. Therefore $f$ defines the variety $C^{\prime}$.

It remains to show that $f$ has degree $2q+2$. Choose an arbitrary point $P\in C\cap(S\times{\mathbf{P}}(\Lambda)^{\vee})$. There is an element $g\in{\mathrm{PGL}}_{3}$ which maps $P$ to $(x_{1}^{q}x_{0},(0:0:1))$. Since this element is a linear transformation of ${\mathbf{P}}(\Lambda)^{\vee}$, it does not change the degree of the curve, and we can simply assume that $(x_{1}^{q}x_{0},(0:0:1))\in C$. This implies that in each equation $h_{i}$, the coefficient of $a_{10}$ is zero. Now, an simple computation shows that the coefficient of the monomial $t_{2}^{2q}t_{0}t_{2}$ is $\det\begin{pmatrix}H_{00}&H_{01}&H_{11}&H_{12}\end{pmatrix}$. From Lemma 5.2, it is not zero, so the degree of the equation is $2q+2$. ∎

Lemma 5.6**.**

Let $N$ be the matrix from Lemma 5.5, such that $f=t_{2}^{-1}\det(N)$ is an equation defining $C^{\prime}$. We have

[TABLE]

where $m_{ij}$ is the $(i,j)$-minor of $N$.

Proof.

This is an elementary application of Jacobi’s formula $d\det(N)=\operatorname{tr}(\mathrm{adj}(N)dN)$, where $\mathrm{adj}(N)$ is the adjoint matrix, and $dN$ is the differential of $N$. ∎

Corollary 5.7**.**

The image in $C^{\prime}$ of any point in $C\cap S$ is smooth.

Proof.

Let $P\in C\cap S$. There is an element $g\in{\mathrm{PGL}}_{3}$ which maps $P$ to $(x_{1}^{q}x_{0},(0:0:1))$. This transformation will map the $4$-codimensional hyperplane $\tilde{H}\subset{\mathbf{P}}(V)$ used in the definition of $X_{0}$ to a $4$-codimensional hyperplane $H$ with defining polynomials $h_{1},\ldots,h_{4}$, for each of which the coefficient of $a_{10}$ is zero. From Lemma 5.6, and the fact that $m_{31}(0:0:1)=m_{57}(0:0:1)=0$, we get that

[TABLE]

From Lemma 5.2, the latter determinant is non-zero, hence the image of $P$ on $C^{\prime}$ is smooth. ∎

Let us now study the singularities of $C^{\prime}$ away from $S$. As above, up to a transformation by a matrix $g\in{\mathrm{PGL}}_{3}$, it is sufficient to study the point $(x_{1}^{q}x_{0}-x_{0}x_{1}^{q},(0:0:1))\in\mathscr{O}\cap H$ with $H_{01}=H_{10}$. Note that with this transformation, the $H_{ij}$-columns change, and they do not have, for instance, the properties of Lemma 5.2. We now have that the minors $m_{31},m_{57},m_{45},m_{58}$ are all zero at $(0:0:1)$, and

[TABLE]

The point is singular if and only if both determinants are zero, i.e.,

[TABLE]

From now on, suppose that the point is indeed singular, so there is a linear combination of the linear equations $h_{i}$ that has the form $\alpha a_{20}+\beta a_{21}+\gamma a_{22}$, corresponding to the row vector

[TABLE]

One must have $(\alpha,\beta)\neq(0,0)$, otherwise all the points in $X_{0}\cap S$ satisfy the equation $v_{2}^{q}u_{2}=0$, meaning that among all the linear functions $U^{i}$ and $V^{i}$, at least six of them are on the line ${(0:0:1)}\in{\mathbf{P}}(V)^{\vee}$, a trap. Let us show that the singularity has multiplicity $q$. From the curve equation given in Lemma 5.5, we derive that the quadratic terms at our point $(x_{1}^{q}x_{0}-x_{0}x_{1}^{q},{(0:0:1)})$ are

[TABLE]

which are all zero since $\mathrm{rank}\begin{pmatrix}H_{00}&H_{01}&H_{02}&H_{11}&H_{12}\end{pmatrix}\leq 3.$ Now, the terms of degree $q$ are

[TABLE]

which are not both zero, as that would imply $(\alpha,\beta)=(0,0)$. So the multiplicity is $q$.

We now show that the blowup of this singularity is either a single smooth point or a node. Without loss of generality, assume $h_{1}=\alpha a_{20}+\beta a_{21}+\gamma a_{22}$, and denote by $\tilde{H}_{ij}$ the $3$-dimensional vector whose entries are the coefficients of $a_{ij}$ in $h_{2},h_{3}$ and $h_{4}$. Then, restricting to the affine plane $\mathbf{A}^{2}\subset{\mathbf{P}}(\Lambda)^{\vee}$ defined by $t_{2}=1$, and considering one affine chart of the blowup at $P_{0}=(0,0)$ obtained by setting $t_{1}=st_{0}$, one obtains the equation

[TABLE]

where

[TABLE]

for the pre-image (the equality follows by multiplying the last three columns by $t_{0}^{q}$ as well as multiplying the first, second, fifth and sixth row by $t_{0}^{-q}$). At $t_{0}=0$, the determinant of $M_{2}$ becomes, up to sign,

[TABLE]

So the preimage $P_{1}$ of $P_{0}$ in the blowup of $C^{\prime}$ is the single point at $t_{0}=0$ and $s=(\beta/\alpha)^{1/q}$. Note that if $\alpha=0$, then $\beta\neq 0$ and one can simply consider another affine patch of the blowup.

Let $\delta=(\beta/\alpha)^{1/q}$, and set $v=s-\delta$ so that $P_{1}$ is given by $t_{0}=v=0$. We now show that either $P_{1}$ is non-singular, or it is a singular point of multiplicity $2$ with two branches with distinct tangents. To do so, we compute the linear and quadratic terms of $\det(M_{2})$. It is sufficient to compute $\det(M_{2})$ modulo the ideal $(t_{0}^{q},v^{q})$ in $k[t_{0},v]$. Up to sign, it is equal to the determinant of $M_{3}$ with

[TABLE]

and by subtracting the second column from the fourth one, subtracting $\delta^{q}$ times the seventh column from the fourth one as well as adding the eighth column to the fourth one, it follows that $\det(M_{3})=t_{0}\det(M_{4})$ with

[TABLE]

From $\det(M_{3})=t_{0}\det(M_{4})$, we deduce that the constant term of $\det(M_{4})$ gives the linear term of the equation, and the linear term in $v$ for $\det(M_{4})$ gives us the quadratic term in $t_{0}v$ in $\det(M_{3})$. In order to find these two terms, we can set $t_{0}=0$ in $M_{4}$. Subtracting the eighth column from the second, subtracting $\delta^{q}$ times the eighth from the fifth one, and removing the second row as well as the eighth one, one obtains that $\det(M_{4})=\pm\det(M_{5})$ with

[TABLE]

By subtracting the seventh column from the first one and removing the first row as well as the seventh column, one obtains $\det(M_{5})=\pm\det(M_{6})$ with

[TABLE]

By subtracting the fourth column from the sixth one and removing the second row as well as the fourth column, one obtains $\det(M_{6})=\pm\det(M_{7})$ with

[TABLE]

and by subtracting $\delta+v$ times the third column from the fifth one, subtracting $\delta^{q}-\delta-v$ times the sixth column from the fifth one and removing the first two rows as well as the third and sixth column, one obtains $\det(M_{7})=\pm\det(M_{8})$ with

[TABLE]

Finally, we have $\det(M_{8})=\delta\det(M_{9})-\det(M_{10})+v\det(M_{9})$ with

[TABLE]

Therefore the linear terms of the equation of the blowup of $C^{\prime}$ consist only of $\pm(\delta\det(M_{9})-\det(M_{10}))t_{0}$, implying that $P_{1}$ is non-singular if $\delta\det(M_{9})\neq\det(M_{10})$.

If $\delta\det(M_{9})=\det(M_{10})$, then $P_{1}$ is singular, and the quadratic term of the equation is of the form $t_{0}(\epsilon t_{0}+\det(M_{9})v)$ for some coefficient $\epsilon$. As long as $\det(M_{9})\neq 0$, $P_{1}$ is a singularity of multiplicity $2$, with $2$ distinct tangents.

Suppose that $\det(M_{9})=\det(M_{10})=0$. We get that

[TABLE]

Therefore, there is a linear combination of the equations defining the hyperplane that has the form

[TABLE]

Consider the points $(v_{0}x_{0}+v_{1}x_{1}+v_{2}x_{2})^{q}(u_{0}x_{0}+u_{1}x_{1}+u_{2}x_{2})\in H\cap S$. First, they must satisfy the equation

[TABLE]

so either $v_{2}=0$ or $\alpha u_{0}+\beta u_{1}+\gamma u_{2}=0$. Second, they must satisfy the equation

[TABLE]

For the points such that $\alpha u_{0}+\beta u_{1}+\gamma u_{2}\neq 0$, one must have $v_{2}=0$, and thereby $v_{0}+\delta v_{1}=0$. The only possibility is $(v_{0}:v_{1}:v_{2})=(-\delta:1:0)$. Therefore, there can only be one point such that $\alpha u_{0}+\beta u_{1}+\gamma u_{2}\neq 0$ (two such points would share the factor $-\delta^{q}x_{0}^{q}+x_{1}^{q}$, a contradiction). So all the points of $H\cap S$ satisfy $\alpha u_{0}+\beta u_{1}+\gamma u_{2}=0$, also a contradiction (among the exceptional points, at most $3$ can lead to $(u_{0}:u_{1}:u_{2})$ being on a given line).

Corollary 5.8**.**

The curve $C^{\prime}$ has four singularities. Each of them has multiplicity $q$, and is either analytically irreducible, or one blowup results in a node (the intersection of two smooth branches with distinct tangents).

Proof.

We have just shown the last part of the statement: any singular point has multiplicity $q$, and is either analytically irreducible, or one blowup results in a node. Let us show that there are four singularities. A point is singular if and only if, after the transformation sending its preimage in $C$ to $(x_{1}^{q}x_{0}-x_{0}x_{1}^{q},(0:0:1))$, we have a relation of the form

[TABLE]

Applied to the points $v^{q}u=(v_{0}x_{0}+v_{1}x_{1}+v_{2}x_{2})^{q}(u_{0}x_{0}+u_{1}x_{1}+u_{2}x_{2})\in H\cap S$, we get

[TABLE]

For each $v^{q}u\in H\cap S$, either $v^{(q)}$ is on the line $(0:0:1)$, or $u$ is on the line $(\alpha:\beta:\gamma)$. There are six such $v^{q}u$, but no more than three values $u$ or $v$ can lie on any given line. Therefore, for three of the $v^{q}u\in H\cap S$, the $v^{(q)}$-values are aligned on $(0:0:1)$, and for the other three $v^{q}u\in H\cap S$, the $u$-values are aligned. Therefore, a point on $C^{\prime}\subset{\mathbf{P}}(V)^{\vee}$ is singular if and only if it corresponds to one of the lines in ${\mathbf{P}}(V)$ that contain three $v^{(q)}$-values; since the divisor is not a trap, there are exactly four such lines. ∎

Lemma 5.9**.**

Let $P$ be a point at the intersection of two components $A$ and $B$ of the curve $C^{\prime}$. The intersection number $I(P,A\cap B)$ is at most $q^{2}/4+1$.

Proof.

The point $P$ is a singularity of $C^{\prime}$, with multiplicity $q$. Its blowup is a node, so it belongs to at most two components of $C^{\prime}$, which in the present case are $A$ and $B$. Let $f:Z\rightarrow{\mathbf{P}}(V)^{\vee}$ be the blowup at $P$, let $\tilde{A}$, $\tilde{B}$ and $\tilde{C}^{\prime}$ be the corresponding blowups of $A$, $B$ and $C^{\prime}$ respectively, let $E$ be the exceptional divisor, and let $\tilde{P}$ the unique preimage of $P$ in $C^{\prime}$ (it is a node, at the intersection of $\tilde{A}$ and $\tilde{B}$). Applying the formula [Ful13, Corollary 6.7.1], we get

[TABLE]

where $e_{P}(A)$ and $e_{P}(B)$ are the multiplicities of $P$ on $A$ and $B$. Since $e_{P}(A)+e_{P}(B)=q$, we have $e_{P}(A)e_{P}(B)\leq(q/2)^{2}$. Since $\tilde{P}$ is a node at the intersection of $\tilde{A}$ and $\tilde{B}$, we have $I(\tilde{P},\tilde{A}\cap\tilde{B})=1$. Therefore, $I(P,A\cap B)\leq(q/2)^{2}+1$. ∎

Proposition 5.10**.**

All the absolutely irreducible component of the curve $X_{0}$ are defined over $k$.

Proof.

Since it is a plane curve, any two components of $C^{\prime}$ must intersect, and they can only do so at the singular points $T\subset C^{\prime}$. Also, a given singular point can be contained in at most $2$ of the components (at most one if it is analytically irreducible, and at most $2$ if its blowup is a node).

First observe that the number of pairs of irreducible components is at most the number of singularities, so there are at most $3$ components. Second, observe that each component is defined over an extension $K/k$ of degree at most $2$. Indeed, degree $4$ or more would contradict the previous observation. For the degree $3$ case, since there are at most three components, there must be exactly $3$ Galois-conjugate components. None of the four singularities can be fixed by the Galois action (such a singularity would appear in all three components). Yet, the number of singularities is not divisible by $3$, a contradiction.

If there is only one absolutely irreducible component, it is $X_{0}$ itself, which is defined over $k$, and we are done.

If there are two components, either they are both defined over $k$ and we are done, or $C^{\prime}=A\cup B$, where $A$ and $B$ are two Galois-conjugate absolutely irreducible plane curves. We now deal with the latter case. Since $C^{\prime}$ has degree $2q+2$, the components each have degree $q+1$, so by Bézout’s theorem,

[TABLE]

From Lemma 5.9, for any $P\in T$ we have $I(P,A\cap B)\leq q^{2}/4+1$, so $(q+1)^{2}\leq q^{2}+4$, a contradiction.

Finally, it remains to deal with the case were there are $3$ components. If they are all defined over $k$, we are done, so let us suppose that $C^{\prime}=A\cup A^{\sigma}\cup B$, where $A$ is defined over a quadratic extension of $k$ and $\sigma$ is the corresponding conjugation. Let $a=\deg(A)$ and $b=\deg(B)$. The only possible configurations of the singular points $T=\{P_{1},\dots,P_{4}\}$ are

1. (1)

$A\cap A^{\sigma}=\{P_{1}\}=\{P_{1}^{\sigma}\},A\cap B=\{P_{2}\},A^{\sigma}\cap B=\{P_{3}\}=\{P_{2}^{\sigma}\},\text{ and }P_{4}=P_{4}^{\sigma}\in B,$ or 2. (2)

$A\cap A^{\sigma}=\{P_{1},P_{4}\}=\{P_{1}^{\sigma},P_{4}^{\sigma}\},A\cap B=\{P_{2}\},A^{\sigma}\cap B=\{P_{3}\}=\{P_{2}^{\sigma}\}.$

Write $e_{i}(Z)=e_{P_{i}}(Z)$ for the multiplicity of $P_{i}$ on any component $Z$. Observe that $a\geq q/2$ (in the case (1), it follows from $e_{1}(A)=e_{1}(A^{\sigma})$, and $e_{1}(A)+e_{1}(A^{\sigma})=q$; in the case (2), it follows from $a\geq\max\{e_{1}(A),e_{4}(A)\}$, $e_{i}(A)+e_{i}(A^{\sigma})=q$ for $i\in\{1,4\}$ and $\{P_{1},P_{4}\}=\{P_{1}^{\sigma},P_{4}^{\sigma}\})$. Secondly, from Bézout’s theorem, we have

[TABLE]

Therefore $a\leq\sqrt{q^{2}/2+2}\leq(q+1)/\sqrt{2}$. On one hand, since $2a+b=2q+2$, we get

[TABLE]

On the other hand, we have

[TABLE]

This implies $0.29q(q+1)\leq 1+q^{2}/4$, a contradiction. ∎

5.4. Defining equations for $X_{1}$

Consider the action of ${\mathrm{PGL}}_{3}$ on ${\mathbf{P}}(V)\times{\mathbf{P}}(\Lambda)$, and let $W$ be the closure of the orbit of $({\mathfrak{d}},x_{0})$. Suppose $u=u_{0}x_{0}+u_{1}x_{1}+u_{2}x_{2}\in{\mathbf{P}}(\Lambda)$. We focus on the affine patch $u_{0}=1$, since the rest of the proof is a study of local properties of points on this patch. Consider the matrix

[TABLE]

We have $m^{t}u=x_{0}$, so $u$ divides $f$ if and only if $x_{0}$ divides $m\star f$, i.e., the coefficient of $x_{i}^{q}x_{j}$ in $m\star f$ is zero for any $i,j\neq 0$. Write $f=\sum_{i,j}a_{ij}x_{i}^{q}x_{j}.$ Then,

[TABLE]

We deduce that the equations corresponding to the condition that $u$ divides $f$ are

[TABLE]

for any indices $i,j\neq 0$. Assuming these hold, we have

[TABLE]

Now, since $m\star f$ is divisible by $x_{0}$, it is in ${\mathrm{PGL}}_{3}\star{\mathfrak{d}}$ if and only if $m\star f=\tilde{m}\star{\mathfrak{d}}$ for some matrix $\tilde{m}$ such that $\tilde{m}^{t}x_{0}=x_{0}$. Writing $\tilde{m}^{t}x_{1}=\sum_{i}b_{i}x_{i}$, we get

[TABLE]

Therefore, we obtain $W$ by adding the equation

[TABLE]

We obtain that in the affine patch $u_{0}=1$, the curve $X_{1}$ is defined by these equations for $W$ and the equations defining the hyperplane $H\subset{\mathbf{P}}(V)$.

5.5. Desingularisation at $a\in X_{1}$

Recall that we have fixed an exceptional point $s=(V^{1})^{q}U^{1}\in X_{0}$, and its two preimages $a=((V^{1})^{q}U^{1},U_{1})$ and $b=((V^{1})^{q}U^{1},V^{1})$ in $X_{1}$. We need to prove that the conditions of Proposition 4.2 are satisfied, starting with the analytic irreducibility of $a$.

Lemma 5.11**.**

The point $a\in X_{1}$ is analytically irreducible.

Proof.

Take a matrix in ${\mathrm{PGL}}_{3}$ sending $U^{1}$ to $x_{0}$, $V^{1}$ to $x_{1}$, and $V^{2}$ to $x_{2}$ as in Lemma 5.2. Consider the variety $\tilde{X}_{1}\subset{\mathbf{P}}(V)\times{\mathbf{P}}(\Lambda)\times{\mathbf{P}}(\Lambda)^{\vee}$ with coordinates $a_{ij},u_{i},t_{i}$ (and made affine by $a_{10}=u_{0}=t_{2}=1$) defined by the equations of the hyperplane $H\subset{\mathbf{P}}(V)$, as well as $E_{ij},F_{12}$ and the equations $e_{k}$ and $f_{k}$ from Section 5.3. The equations $e_{0},e_{1}$ and $f_{0}$ are

[TABLE]

If $a_{00}a_{11}^{q}\neq 1$, the last two equations determine $t_{0}$ and $t_{1}$ uniquely for any given $a_{ij}$, so in a neighbourhood of the point $a$ the projection $\tilde{X}_{1}\rightarrow X_{1}$ is one-to-one. Computing the Jacobian matrix, we see that the point is smooth if the matrix $\begin{pmatrix}H_{00}&H_{01}&H_{11}&H_{12}\end{pmatrix}$ has rank $4$, which is the case, as proved in Lemma 5.2. Therefore, $\tilde{X}_{1}\rightarrow X_{1}$ is a desingularisation of $X_{1}$ at $a$. Since $a$ has a single preimage, it is analytically irreducible. ∎

5.6. Blowing up $b\in X_{1}$

Recall that $b=((V^{1})^{q}U^{1},V^{1})$. Also, we have the $6$ points $(V^{i})^{q}U^{i}$ in the intersection with $S$, and the $3$ points $U^{1},U^{3},U^{4}$ are aligned, as well as $V^{2},V^{5},V^{6}$. Apply the action of a matrix in ${\mathrm{PGL}}_{3}$ sending $U^{1}$ to $x_{1}$, and $V^{1}$ to $x_{0}$. With this transformation, $b$ belongs to the affine patch $u_{0}=1$ of ${\mathbf{P}}(V)\times{\mathbf{P}}(\Lambda)$, so we can study it locally through the equations of $X_{1}$ derived in Section 5.4.

Lemma 5.12**.**

When $D$ is not a trap, the matrix defining $H$ can be written as

[TABLE]

with $C_{11}D_{21}-C_{21}D_{11}\neq 0$ and $D_{11}\neq 0$, and the fifth and sixth columns are linearly independent.

Proof.

The matrix can be written in the form

[TABLE]

If $C_{10}D_{20}\neq 0$, the matrix can then be written as in the lemma. By contradiction, suppose that $C_{10}D_{20}=0$; we deduce that there is a relation of the form

[TABLE]

We first show that $(Z_{11},Z_{21})$ and $(Z_{12},Z_{22})$ are linearly independent. By contradiction, suppose there exists $(\alpha,\beta)\neq(0,0)$ such that $\alpha(Z_{12},Z_{22})=\beta(Z_{11},Z_{21})$. The relation becomes

[TABLE]

At most $3$ of the $(V^{i})^{(q)}$-values are on the line $(0:Z_{11}:Z_{21})$, so at least $3$ of the $U^{i}$-values are on the line $(0:\alpha:\beta)$, which also contains $V^{1}$, a contradiction. So $(Z_{11},Z_{21})$ and $(Z_{12},Z_{22})$ are linearly independent.

Applying Relation (3) to $U^{4}$ and $V^{4}$, we get that $(V^{4})^{(q)}$ is on the line

[TABLE]

But $(V^{1})^{(q)}=x_{0}$ also lies on this line, therefore so does $(V^{5})^{(q)}$. Similarly, the relation applied to $U^{5},V^{5}$ implies that $(V^{5})^{(q)}$ lies on the line

[TABLE]

Since $L^{5}$ also contains $(V^{1})^{(q)}$, we have $L^{4}=L^{5}$. Note that $(U^{4}_{1},U^{4}_{2})$ and $(U^{5}_{1},U^{5}_{2})$ are linearly independent (otherwise $U^{4},U^{5}$ and $V^{1}$ would be aligned). Therefore, the equality $L^{4}=L^{5}$ implies that $(Z_{11},Z_{21})$ and $(Z_{12},Z_{22})$ are linearly dependent, a contradiction.

The matrix can be written as stated in the lemma, and it remains to prove the additional properties. A proof similar to the above shows that $C_{11}D_{21}-C_{21}D_{11}=0$ implies that $V^{1},V^{3},$ and $V^{4}$ are aligned, another contradiction.

If the fifth column $H_{11}$ and sixth column $H_{12}$ are linearly dependent, there exists a non-zero pair $(\alpha,\beta)$ such that $\alpha H_{11}=\beta H_{12}$. Then, the polynomial $x_{1}^{q}(\alpha x_{1}-\beta x_{2})$ is an exceptional point of the curve, so $x_{1}$ is one of the $V^{i}$-points, yet $x_{1}=U^{1}$, a contradiction.

Finally, suppose by contradiction that $D_{11}=0$. The case $D_{12}=0$ easily leads to a contradiction, so assume $D_{12}\neq 0$. For any $i\neq 1$, we have $U_{2}^{i}\neq 0$ and

[TABLE]

Since $V^{1}=x_{0}$ belongs to all of these lines, and $V^{1},V^{2},V^{3}$ are aligned, we get

[TABLE]

Let $\alpha=(U_{0}^{2}+U_{1}^{2}D_{21}+U_{2}^{2}D_{22})/U_{2}^{2}=(U_{0}^{3}+U_{1}^{3}D_{21}+U_{2}^{3}D_{22})/U_{2}^{3}$. We have $U^{2},U^{3}\in(1:D_{21}:D_{22}-\alpha)$, and therefore $U^{6}\in(1:D_{21}:D_{22}-\alpha)$. We deduce

[TABLE]

Therefore, either $(V^{6})^{(q)}\in(0:D_{12}:\alpha)$ so $V^{6}$ is aligned with $V^{1},V^{2},V^{3}$, or $U^{6}\in(0:0:1)$, so $U^{6}$ is aligned with $U^{1}$ and $V^{1}$, each being a contradiction. ∎

Lemma 5.13**.**

If $D_{11}D_{12}^{q}\neq D_{11}^{q}D_{21}$, the point $b\in X_{1}$ is analytically irreducible.

Remark 5*.*

We deal with the case $D_{11}D_{12}^{q}=D_{11}^{q}D_{21}$ in Section 5.9.

Proof.

From Lemma 5.12, we can rewrite the matrix defining $H$ as

[TABLE]

Let us blow up via $u_{2}t_{1}=u_{1}t_{2}$, and focus on the affine patch $t_{1}=1$. We get the equations

[TABLE]

For any $Z\in\{A,B,C,D\}$, write $Z_{*i}=Z_{1i}+Z_{2i}t_{2}^{q}$, and $Z_{i*}=Z_{i1}+Z_{i2}t_{2}$. We get the relations

[TABLE]

Eliminating $a_{00},a_{02},a_{10}$ and $a_{20}$ in the ring of formal power series $k[[u_{1},t_{2}]]$ yields

[TABLE]

for some $b_{ij}$ and $c_{ij}$ in $k[[u_{1},t_{2}]]$. In the affine patch $a_{01}=1$, we get the equation

[TABLE]

and removing the factor $u_{1}^{q}$,

[TABLE]

Lemma 5.12 implies that $(D_{11},D_{21})\neq(0,0)$, therefore $D_{*1}(t_{2})=0$ has a unique solution (possibly at infinity), with multiplicity $q$. We have

[TABLE]

Since $(C_{11},C_{21})$ and $(D_{11},D_{21})$ are not collinear (Lemma 5.12), the polynomials $C_{*1}$ and $D_{*1}$ do not share a root. We deduce that when $D_{11}D_{12}^{q}\neq D_{11}^{q}D_{21}$, the power series $c_{20}$ is a unit, and we are done. ∎

Remark 6*.*

Note for later that, in the variables $t=(D_{*1}(t_{2}))^{1/q}$ and $u_{1}$, the power series $c_{ij}$ reduced modulo $(u_{1},t^{2})$ are linear polynomials which do not all have the same root (because the fifth and sixth columns in Lemma 5.12 are linearly independent).

5.7. Ramification

The goal of this section is to show that the normalisation of the cover $X_{1}\rightarrow X_{0}$ is unramified at $a$ (condition 3 in Proposition 4.2).

To do so, we work with the desingularisations $C\subset{\mathbf{P}}(V)\times{\mathbf{P}}(\Lambda)^{\vee}$ and $\tilde{X}_{1}\subset{\mathbf{P}}(V)\times{\mathbf{P}}(\Lambda)\times{\mathbf{P}}(\Lambda)^{\vee}$ at $s$ and $a$, introduced in Section 5.3 and Lemma 5.11 respectively. As previously, we take a matrix in ${\mathrm{PGL}}_{3}$ sending $U^{1}$ to $x_{0}$, $V^{1}$ to $x_{1}$, and $V^{2}$ to $x_{2}$, and we work with the coordinates $a_{ij},u_{i},t_{i}$ for ${\mathbf{P}}(V)\times{\mathbf{P}}(\Lambda)\times{\mathbf{P}}(\Lambda)^{\vee}$ (made affine by $a_{10}=u_{0}=t_{2}=1$). Recall that $C$ is defined by the equations of the hyperplane $H\subset{\mathbf{P}}(V)$, and the equations $e_{k}$ and $f_{k}$ from Section 5.3, and $\tilde{X}_{1}$ is defined by the same equations together with $E_{ij}$ and $F_{12}$. The cover $\tilde{X}_{1}\rightarrow C$ is a restriction and corestriction of the projection ${\mathbf{P}}(V)\times{\mathbf{P}}(\Lambda)\times{\mathbf{P}}(\Lambda)^{\vee}\rightarrow{\mathbf{P}}(V)\times{\mathbf{P}}(\Lambda)^{\vee}$. Therefore, if one of $a_{ij}$ or $t_{i}$ is a uniformizing parameter for $a$ on $\tilde{X}_{1}$, then the cover is unramified at $a$. Let us show that it is the case. From $E_{11}$, if $u_{1}$ is a uniformizing parameter at $a$, then so is $a_{11}$. From $E_{12}$, the same holds for $u_{2}$ and $a_{12}$. Therefore, either

1. (1)

$a_{11}$ or $a_{12}$ is a local parameter at $a$ on $\tilde{X}_{1}$, or 2. (2)

neither $u_{1}$ nor $u_{2}$ is a local parameter at $a$ on $\tilde{X}_{1}$, so one of $a_{ij}$ or $t_{i}$ must be (because $\tilde{X}_{1}$ is smooth at $a$).

In either case, we deduce that the cover is unramified at $a$.

5.8. Blowing up $(b,b)\in X_{2}$

Lemma 5.14**.**

If $D_{11}D_{12}^{q}\neq D_{11}^{q}D_{21}$, the point $(b,b)$ is analytically irreducible.

Proof.

Analytically at the point $b$, the desingularised equation derived in Lemma 5.13 is of the form (up to multiplication by a unit in $k[[u,t]]$)

[TABLE]

where $B(u,t)$ is a unit (and more precisely, $B(u,t)\equiv c_{20}(u,t)^{-1}\equiv\gamma_{0}-\gamma_{1}t\mod(u,t^{2})$, where $c_{20}(u,t)\equiv\gamma_{0}+\gamma_{1}t\mod(u,t^{2})$ and $\gamma_{0}\neq 0$). The fibre product at this point with respect to the projection to $X_{0}$ is given by the equations in $k[[u,t,v,s]]$

[TABLE]

for all pairs $i,j$. There is an automorphism of $k[[u,t]]$ sending $u-t^{q}B(u,t)$ to $u$ while fixing $t$. It sends $u$ to some $F(u,t)=u+t^{q}G(u,t)$ where $G$ is another unit (which also satisfies $G(u,t)\equiv\gamma_{0}-\gamma_{1}t\mod(u,t^{2})$). The same applied to $k[[v,s]]$ sends $v-s^{q}B(v,s)$ to $v$, and $v$ to $F(v,s)$, and fixes $s$. Therefore the curve is isomorphic to the curve given by the equations in $k[[t,s]]$

[TABLE]

For simplicity, we just write

[TABLE]

Write $F(t)=t^{q}G(t)$ where $G(t)=G(0,t)$ is a unit (with $G(t)\equiv\gamma_{0}-\gamma_{1}t\mod t^{2}$). The equations above are divisible by $t-s$ (which corresponds to the diagonal component of the fibre product). By blowing up with $t=st^{\prime}$, we get

[TABLE]

The numerator has a factor $s^{q^{2}+q}$, the exceptional divisor. The remaining factor has a unique solution at $s=0$ given by $t^{\prime}=1$. In terms of the variables $(t^{\prime}-1)$ and $s$, its smallest degree term is $\gamma_{0}^{q}(\gamma_{0}\delta_{1}-\gamma_{1}\delta_{0})s(t^{\prime}-1)$ where $c_{ij}(u,t)\equiv\delta_{0}+\delta_{1}t\mod(u,t^{2})$. From Remark 6, there are indices $i,j$ such that $\gamma_{0}\delta_{1}-\gamma_{1}\delta_{0}\neq 0$, therefore the blowup is non-singular. ∎

5.9. The case $D_{11}D_{12}^{q}=D_{11}^{q}D_{21}$

It only remains to show that the case $D_{11}D_{12}^{q}=D_{11}^{q}D_{21}$ can be avoided: it corresponds to $D$ being some kind of trap.

Lemma 5.15**.**

One can choose $s\in X_{0}\cap S$ such that $D_{11}D_{12}^{q}\neq D_{11}^{q}D_{21}$, unless $D$ belongs to a strict closed subvariety $\mathscr{T}_{4}^{5}$ of $\mathscr{D}_{4}$. For any $P_{0},P_{1}\in E$, we have $\mathscr{P}_{2}(P_{0})+\mathscr{P}_{2}(P_{1})\not\subset\mathscr{T}_{4}^{5}$.

Proof.

Let $\mathscr{T}_{4}^{5}$ be the subvariety of $\mathscr{D}_{4}$ such that $D_{11}D_{12}^{q}=D_{11}^{q}D_{21}$ for all the corresponding exceptional points. We need to show that for any $P_{0},P_{1}\in E$, we have $\mathscr{P}_{2}(P_{0})+\mathscr{P}_{2}(P_{1})\not\subset\mathscr{T}_{4}^{5}$. Consider points $R,T\in E$, and the divisor $D=\sum_{i=1}^{4}[D_{i}]\in\mathscr{P}_{2}(P_{0})+\mathscr{P}_{2}(P_{1})$ where

[TABLE]

We will assume that $(R,T)$ does not fall in certain strict subvarieties of $E^{2}$. With $R\neq T$ and $P_{0}-R\neq P_{1}-T$, let $u^{1}=\ell(D_{1},D_{3})$, and $(v^{1})^{(q)}=\ell(D_{2}+Q,D_{4}+Q)$. More explicitly, we have

[TABLE]

The following computation shows that $D_{11}D_{12}^{q}-D_{11}^{q}D_{21}$ evaluated at the exceptional point $(v^{1})^{q}u^{1}$ is a non-zero rational function of $R$ and $T$. Note that the $v^{1}_{i}$-values are not rational functions of $R$ and $T$, but the $(v^{1}_{i})^{q}$-values are. Consider the matrix

[TABLE]

which sends the line $u^{1}$ to the line $(0:1:0)$ and $v^{1}$ to the line $(1:0:0)$. Observe that this matrix is non-singular away from a strict subvariety of pairs $(R,T)\in E^{2}$. Indeed, we have that $(v_{0}^{1}u_{1}^{1}-v_{1}^{1}u_{0}^{1})^{q}$ is a non-zero rational function of $R$ and $T$: up to a linear transformation, we can assume $(0,0)\in E$, and choose $T=P_{1}-(0,0)$, so that $(v_{0}^{1})^{q}=0$ and $(v_{1}^{1})^{q}=y(D_{2}+Q)$; we get $(v_{0}^{1}u_{1}^{1}-v_{1}^{1}u_{0}^{1})^{q}=-(y(D_{2}+Q)u_{0}^{1})^{q}$, and neither $y(D_{2}+Q)$ nor $u_{0}^{1}$ is the zero function of $R$. For any $j$, we have $m(D_{j})=(a_{0}^{j}:a_{1}^{j}:a_{2}^{j})$ and $m^{(q)}(D_{j}+Q)=(b_{0}^{j}:b_{1}^{j}:b_{2}^{j})$ where

[TABLE]

Note that $a_{1}^{1}=a_{1}^{3}=0$ and $b_{0}^{2}=b_{0}^{4}=0$. The matrix defining $H$ (after applying the action of $m$) is

[TABLE]

From Lemma 5.12, apart from a strict subvariety of $(P_{0},P_{1})\in E^{2}$, one must have

[TABLE]

We deduce

[TABLE]

Suppose by contradiction that $D_{11}D_{12}^{q}-D_{11}^{q}D_{21}=0$. We have $D_{11}^{q}D_{12}^{q^{2}}-D_{11}^{q^{2}}D_{21}^{q}\in k(E)$. Consider a universal $k$-derivation ${d}$ of $k(E)$. We have already proved in Lemma 5.12 that when $D$ is not in $\cup_{i=1}^{4}\mathscr{T}_{4}^{i}$, then $D_{11}\neq 0$. We can therefore apply the derivation to the equality $\frac{D_{21}^{q}}{D_{11}^{q}}=\frac{D_{12}^{q^{2}}}{D_{11}^{q^{2}}}$, and get ${d}\left(\frac{D_{21}^{q}}{D_{11}^{q}}\right)=0$, so ${d}(D_{11}^{q})D_{21}^{q}-D_{11}^{q}{d}(D_{21}^{q})=0$. All the factors $(a_{i}^{j})^{q}$ and $(b_{i}^{j})^{q}$ are in $k(E)^{q}$ and are therefore annihilated by the derivation, except possibly the factors $(a_{0}^{j})^{q}$ since $(v^{1})^{q}=\ell\left(D_{2}+Q,D_{4}+Q\right)\not\in k(E)^{q}$. Writing $A_{i}^{j}=(a_{i}^{j})^{q}$ and $B_{i}^{j}=(b_{i}^{j})^{q}$, we get

[TABLE]

Then,

[TABLE]

It remains to prove that each factor on the right-hand side is a non-zero rational function. It is easy to see that each occurring $A_{i}^{j}$ and $B_{i}^{j}$ is non-zero. Let us prove that ${d}(A_{0}^{4})A_{0}^{2}-{d}(A_{0}^{2})A_{0}^{4}\neq 0$. Writing $V_{i}^{j}=(v_{i}^{j})^{q}$, we have

[TABLE]

Fixing $D_{4}$, its term of highest pole at $D_{2}=0$ is

[TABLE]

of order $3q+O(1)$, unless $(({d}(V_{1}^{1})V_{2}^{1}-V_{1}^{1}{d}(V_{2}^{1}))x(D_{4})-({d}(V_{2}^{1})V_{0}^{1}-V_{2}^{1}{d}(V_{0}^{1})))$ is the zero function, which happens for finitely many $D_{4}$ because is has a pole of order $2q+O(1)$ at $D_{4}=0$. For the latter point, we are using the fact that ${d}(V_{1}^{1})V_{2}^{1}-V_{1}^{1}{d}(V_{2}^{1})$ is itself non-zero; indeed choosing as above the point $T$ such that $D_{4}+Q=(0,0)$, it is easy to see that there is a derivation $\partial$ such that

[TABLE]

Finally, we prove in a similar way that $B_{1}^{4}B_{2}^{2}-B_{1}^{2}B_{2}^{4}\neq 0$, choosing $T$ such that $D_{4}+Q=(0,0)$ and observing that $B_{1}^{4}B_{2}^{2}-B_{1}^{2}B_{2}^{4}=(u_{0}^{1})^{q^{2}}y(D_{2}+Q)^{q}$ is a non-zero function of $R$. ∎

5.10. Irreducibility of $X_{3}$

We can now prove the main result of this section.

Proposition 5.16**.**

For any divisor $D\in(\mathscr{D}_{4}\setminus\mathscr{T}_{4})(k)$, the curve $X_{3}$ contains an absolutely irreducible component defined over $k$.

Proof.

We have shown that $\theta:X_{1}\rightarrow X_{0}$ satisfies all the conditions of Proposition 4.2, so the result follows. ∎

6. Avoiding traps

Recall from Section 3.2 that the zigzag descent consists in applying the $4$–to–$3$ and $3$–to–$2$ eliminations recursively until all remaining divisors are in the factor base

[TABLE]

Here, $c$ is the smallest integer so that the eliminations work for any extension $k=q^{2^{i}}$ where $i\geq c$. We show in this section that $c=O(1)$ is an absolute constant.

Now, to show that eliminations work all the way down to the factor base, we need to show that traps can be avoided. Paradoxically, to avoid traps, we need to add more traps. Originally, a divisor is a trap if it cannot be eliminated into smaller degree divisors. These are traps of level [math]. Now, we want to call a divisor a trap also if it can be eliminated, but only into divisors that are themselves traps. We call these traps of level $1$, and so on. For a rigorous definition, let $x_{0}=1$, $x_{1}=x$ and $x_{2}=y$ in $k[E]$, and for $n=2$ or $3$ let $V_{n}=\mathrm{span}(x_{i}^{q}x_{j}\mid i,j<n)$ and $\Lambda_{n}=\mathrm{span}(x_{i}\mid i<n)$. Recall that the $4$–to–$3$ elimination arises from the relation $\varphi(f)\equiv\psi(f)\mod\mathscr{I}$ for any $f\in V_{3}$. Indeed, when $f$ splits as a product of linear factors $f=\prod_{i=1}^{q+1}L_{i}$, and applying the norm and the logarithm maps, we deduce

[TABLE]

for some divisor $D^{\prime}$ of degree $2$. The sum on the left is referred to as the left-hand side of the elimination, and the terms on the right are the right-hand side of the elimination. Similarly, for the $3$–to–$2$ elimination, we get relations of the form

[TABLE]

where the sum on the left is the left-hand side of the elimination, and the terms on the right are the right-hand side of the elimination.

Consider the morphisms

[TABLE]

The intuition behind these morphisms is the following. Given any degree $4$ divisor $D$, the corresponding $X_{1}$ is a curve in ${\mathbf{P}}(V_{3})\times{\mathbf{P}}(\Lambda_{3})$. Suppose $f\in X_{0}$ splits as a product of linear polynomials $f=\prod_{i=1}^{q+1}L_{i}$. For any such $f$, the preimages of $f$ in $X_{1}$ are the points $(f,L_{i})$, and we have $\delta^{\prime}(f,L_{i})={\mathrm{div}}(L_{i})+3[0_{E}]$. Therefore, $\delta^{\prime}(X_{1})$ contains all the degree $3$ divisors susceptible to appear on the left-hand side of the elimination. In particular, we wish to show that $\delta^{\prime}(X_{1})$ does not consist only of traps. Similarly, $\delta_{i}$ allows to capture the divisors susceptible to appear on the left-hand side of the $3$–to–$2$ elimination. Note that $\delta_{i}$ captures only the ‘positive’ part of ${\mathrm{div}}(u\circ\tau_{P})$; since the terms ${\mathrm{Log}}(N_{k/\mathbf{F}_{q}}([-P]))$ also appear on the right-hand side, we will account for them as terms of the right-hand side.

Consider the natural morphisms $\pi_{3}:E^{3}\rightarrow\mathscr{D}_{3}$ and $\pi_{4}:E^{4}\rightarrow\mathscr{D}_{4}$. For any $i\geq 0$, let $T_{3}(i,0)=\pi_{3}^{-1}(\mathscr{T}_{3})$ and $T_{4}(i,0)=\pi_{4}^{-1}(\mathscr{T}_{4})$. For any $i>0$, let $T_{3}(i,1)$ be the set of pairs $(P_{1},P_{2})\in E^{2}$ such that

[TABLE]

For any $i>0$, let $T_{4}(i,1)$ be the set of pairs $(P_{1},P_{2})\in E^{2}$ such that

[TABLE]

For any $1<j\leq 2i-1$ define $T_{3}(i,j)=T_{4}(i-1,j-1)\subset E^{2}$, and for any $1<j\leq 2i$ define $T_{4}(i,j)=T_{3}(i,j-1)\subset E^{2}.$ Now, for every $i$, let

[TABLE]

Finally, we can define traps at level $i$ as

[TABLE]

The following proposition suggests this is the correct notion of traps: if a divisor is not a trap at a certain level, then its eliminations do not all lead to traps at the level below (at least on the left-hand side). Given a divisor $D$ of degree $3$ (respectively, of degree $4$), we write $X_{1}(D)$ for the corresponding curve $X_{1}$ as defined in Section 4.1 (respectively, in Section 5).

Proposition 6.1**.**

For any $i\geq c$,

1. (1)

if $D\in\mathscr{D}_{4}$ and $D\not\in\mathscr{T}_{4}(i)$, then $\delta^{\prime}(X_{1}(D))\not\subset\mathscr{T}_{3}(i)$, and 2. (2)

if $D\in\mathscr{D}_{3}$ and $D\not\in\mathscr{T}_{3}(i+1)$, then $\delta_{i+1}(X_{1}(D))\not\subset\mathscr{T}_{4}(i)$.

Proof.

Suppose $D\not\in\mathscr{T}_{4}(i)$. So there is a pair $(P_{1},P_{2})\not\in T_{4}(i)$ such that $[P_{1}]+[P_{2}]$ divides $D$. In particular, $(P_{1},P_{2})\not\in T_{4}(i,1)$ so $[P_{1}]+[P_{2}]+[-P_{1}-P_{2}]\not\in\mathscr{T}_{3}.$ Also, for any $1<j\leq 2(i-c+1)$, we have $(P_{1},P_{2})\not\in T_{4}(i,j)=T_{3}(i,j-1)$ so $(P_{1},P_{2})\not\in T_{3}(i).$ From Section 5.1, $[P_{1}]+[P_{2}]+[-P_{1}-P_{2}]-3[0_{E}]$ is the divisor of a linear factor of an exceptional point of $X_{1}(D))$. Therefore,

[TABLE]

proving that $\delta^{\prime}(X_{1}(D))\not\subset\mathscr{T}_{3}(i)$. The second point is proved in the same way. ∎

6.1. Degree of trap subvarieties

Let $n\in\{3,4\}$. Embedding $E$ in ${\mathbf{P}}^{2}$, we can naturally see $E^{n}$ as a variety in $\left({\mathbf{P}}^{2}\right)^{n}$. When referring to the degree of a subvariety of $E^{n}$, we refer to its degree through the Segre embedding. Alternatively, we could consider its degree in the projectivization of the affine patch $\mathbf{A}^{2n}$, and as long as the variety properly intersects the hyperplane at infinity, these two notions of degree differ by a factor $O(1)$.

The variety $\mathscr{D}_{n}$ can be seen as a subvariety of ${\mathbf{P}}\left({S}^{n}(\mathbf{A}^{3})\right)\cong{\mathbf{P}}^{\binom{n+2}{2}-1}$, where ${S}^{n}(\mathbf{A}^{3})$ is the $n$-th symmetric power of the vector space $\mathbf{A}^{3}$ (i.e., the image of $(\mathbf{A}^{3})^{\otimes n}$ in the symmetric algebra $S(\mathbf{A}^{3})$). Each morphism $\pi_{n}:E^{n}\rightarrow\mathscr{D}_{n}$ is the restriction of the natural morphism $\left({\mathbf{P}}^{2}\right)^{n}\rightarrow{\mathbf{P}}\left({S}^{n}(\mathbf{A}^{3})\right)$. We refer to the embedding $\mathscr{D}_{n}\subset{\mathbf{P}}^{\binom{n+2}{2}-1}$ when discussing the degree of a pure dimensional subvariety of $\mathscr{D}_{n}$ (it is pure dimensional of all the components have the same dimension). An important observation is that for any variety $\mathscr{A}\subset E^{n}$, the degree of $\mathscr{A}$ differs from the degree of $\pi_{n}(\mathscr{A})\subset\mathscr{D}_{n}$ by a factor $O(1)$. If a variety $\mathscr{A}$ has components of different dimension, we let $\mathrm{dim}(\mathscr{A})$ be the dimension of the highest dimensional component, and $\deg(\mathscr{A})$ be the smallest degree of a variety of pure dimension $\mathrm{dim}(\mathscr{A})$ containing $\mathscr{A}$ (note that this notion of degree will only be used to obtain upper bounds on the number of rational points of a variety). It is easy to see that with this notion of degree, we have $\deg(\mathscr{T}_{3})=q^{O(1)}$ and $\deg(\mathscr{T}_{4})=q^{O(1)}$.

Lemma 6.2**.**

For $i>0$ and any $j>0$,

[TABLE]

Proof.

These identities easily follow from the recursive definitions of $T_{3}(i,j)$ and $T_{4}(i,j)$. ∎

Lemma 6.3**.**

There exists $c=O(1)$ such that for any $i\geq c$, we have $\deg(T_{4}(i,1))=q^{O(1)}$ and $\deg(T_{3}(i,1))=q^{2^{i-1}+O(1)}$.

Proof.

The fact that $\deg(T_{4}(i,1))=q^{O(1)}$ follows from $\deg(\mathscr{T}_{3})=q^{O(1)}$. For the case of $T_{3}(i,1)$, let $f_{j}(P_{1},P_{2},P_{3},P_{4})$ be the equations defining $\pi^{-1}(\mathscr{T}_{4})\subset E^{4}$. By construction of $\mathscr{T}_{4}$, each of them has degree $q^{O(1)}$. Choosing any of these equations (at least a non-trivial one), say $f_{1}$, we have,

[TABLE]

There is a constant $c$ such that for all $i>c$, the equation

[TABLE]

is non-trivial. This equation has degree $q^{2^{i-1}+O(1)}$, and so does $T_{3}(i,1)$. ∎

Corollary 6.4**.**

There exists $c=O(1)$ such that for any $i\geq c$,, we have $\deg(\mathscr{T}_{3}(i))=q^{2^{i-1}+O(1)}$ and $\deg(\mathscr{T}_{4}(i))=q^{2^{i-1}+O(1)}$.

Proof.

From Lemmata 6.2 and 6.3, we deduce that for any $i>0$ and $j>0$,

[TABLE]

The result follows from the definitions of $\mathscr{T}_{3}(i)$ and $\mathscr{T}_{4}(i)$. ∎

6.2. Degree $3$–to–$2$ elimination

The following proposition allows to avoid traps appearing on the left-hand side during the $3$–to–$2$ elimination.

Proposition 6.5**.**

For any $i>0$, if $D\in\mathscr{D}_{3}$ and $D\not\in\mathscr{T}_{3}(i)$, then

[TABLE]

Proof.

Since $D\not\in\mathscr{T}_{3}(i)$, Proposition 6.1 implies that $\delta_{i}(X_{1}(D))\not\subset\mathscr{T}_{4}(i-1)$. Since $\delta_{i}(X_{1}(D))$ is absolutely irreducible, and $\mathscr{T}_{4}(i-1)$ is closed, they intersect properly. Also, $\deg(\delta_{i}(X_{1}(D)))=q^{2^{i-1}+O(1)}$ and $\deg(\mathscr{T}_{4}(i-1))=q^{2^{i-2}+O(1)}$. Applying Bézout’s theorem,

[TABLE]

which proves the proposition. ∎

Proposition 6.6** (Degree $3$–to–$2$ elimination).**

Consider the field $k=\mathbf{F}_{q^{2^{i}}}$ and a divisor $D\in(\mathscr{D}_{3}\setminus\mathscr{T}_{3}(i))(k)$. There exists $c=O(1)$ such that for any $i\geq c$, there is a probabilistic algorithm that finds a list $(D_{j})_{j=1}^{q+1}$ of effective divisors of degree $2$ over $k$, three divisors $D_{1}^{\prime},D_{2}^{\prime},D_{3}^{\prime}$ of degree $1$ over $k$ and, integers $\alpha_{1},\alpha_{2},\alpha_{3}$ such that

[TABLE]

in expected time polynomial in $q$ and $2^{i}$. Furthermore, it ensures that

1. (1)

for any $D_{j}$, we have $N_{k/\mathbf{F}_{q^{2^{i-1}}}}(D_{j})\not\in\mathscr{T}_{4}(i-1)$, and 2. (2)

for any $D_{j}^{\prime}$, we have $N_{k/\mathbf{F}_{q^{2^{i-2}}}}(D^{\prime}_{j})\not\in\mathscr{T}_{4}(i-2)$.

Proof.

Consider an affine patch $A$ of the ambient space (which intersects all the components of $X_{3}$), and the corresponding restriction $\widetilde{X}_{3}\subset A$. We have $\deg(\widetilde{X}_{3})=q^{O(1)}$. From Proposition 4.8 and [Bac96, Theorem 3.1], we have

[TABLE]

The algorithm simply consists in generating random points of $\widetilde{X}_{3}(k)$, which can be done in polynomial time since the degree of the curve is polynomial in $q$. Each $(f,P,u_{1},u_{2},u_{3})\in\widetilde{X}_{3}(k)$ gives a possible elimination, as described in Section 3.3. It only remains to prove that with high probability, no trap appears in the elimination.

Fix a linear factor $u$, and consider the subvariety $H_{u}$ of $A$ parameterising polynomials of which $u$ is a factor. Let us show that $\widetilde{X}_{3}\cap H_{u}$ contains at most $(q+1)\deg(\widetilde{X}_{3})=q^{O(1)}$ points. First, one cannot have $\widetilde{X}_{3}\subset H_{u}$ (or the exceptional points would form a subvariety of dimension $1$, so $D$ would be a trap), so $\widetilde{X}_{3}\cap H_{u}$ has dimension [math]. Let $H_{u}^{\prime}\subset H_{u}$ be the (degree 1) subspace of $A$ where $u=u_{1}$; the intersection $\widetilde{X}_{3}\cap H_{u}^{\prime}$ has dimension [math] and contains at most $\deg(\widetilde{X}_{3})$ points. If $(f,P)\in X_{0}\setminus S$ and $u$ is a factor of $f$, there are $q^{3}-q$ points in $X_{3}$ projecting to $(f,P)$, and $q^{2}-q$ of them are in $H^{\prime}_{u}$. Therefore, there are at most $(q+1)\deg(\widetilde{X}_{3})$ points in $\widetilde{X}_{3}\cap H_{u}$. Similarly, we can bound the number of divisors coprime to $D$ occuring in the functions $\varphi_{P}(f)$, for $(f,P,u,v,w)\in X_{3}$, by looking at the hyperplanes $H_{P}={\mathbf{P}}(V)\times\{P\}\times({\mathbf{P}}^{1})^{3}$ for $P\in E$: we have as previously that for any $P$, the intersection $\widetilde{X}_{3}\cap H_{P}$ contains at most $\deg(\widetilde{X}_{3})$ points, and the three points coprime to $D$ appearing in the divisor of $\varphi_{P}(f)$ are $P_{0}=-2P-2Q-2P^{q}-\sigma D$, $P_{1}=-P$, and $P_{2}=-Q-P^{(q)}$ (where $\sigma D\in E$ is the sum of the points of $D$). Since values of $P$ are in $O(q)$-to-$1$ correspondence with values of $P_{\ell}$ (for each $\ell\in\{0,1,2\}$), we deduce that any divisor coprime to $D$ appears in at most $O(q\deg(\widetilde{X}_{3}))=q^{O(1)}$ of the functions $\varphi_{P}(f)$, for $(f,P,u,v,w)\in X_{3}$.

Each element in $X_{3}(k)$ gives a relation where the right-hand side is a divisor of the form $D+[P_{0}]-2[P_{1}]-2[P_{2}]$, and $P_{\ell}\in E(k)$. Let $\ell\in\{0,1,2\}$. Ranging over all rational points $X_{3}(k)$, the point $P_{\ell}$ takes $q^{2^{i}+O(1)}$ distinct values. Any such point can be descended to $N_{k/\mathbf{F}_{q^{2^{i-2}}}}([P_{\ell}])\in\mathscr{D}_{4}(\mathbf{F}_{q^{2^{i-2}}})$. Applying [Bac96, Theorem 3.1], there are only $q^{3\cdot 2^{i-2}+2^{i-3}+O(1)}$ such divisors that are traps.

Now, let us look at traps that could appear on the left-hand side. The degree $4$ divisors that can appear on the left-hand side are $\delta_{i}(X_{1}(D))$. Since $D\not\in\mathscr{T}_{3}(i)$, Proposition 6.5 implies that $|(\delta_{i}(X_{1}(D))\cap\mathscr{T}_{4}(i-1))(\mathbf{F}_{q^{2^{i-1}}})|\leq q^{3\cdot 2^{i-2}+O(1)}$. Therefore, at most $q^{3\cdot 2^{i-2}+O(1)}$ points of $X_{3}(k)$ give rise to a trap on the left-hand side.

Finally, if $G\subset\widetilde{X}_{3}(k)$ is the subset of points giving an elimination that does not involve traps on either side, we get

[TABLE]

Therefore, for $i$ larger than some absolute constant, more than half the points of $X_{3}(k)$ are in $G$, so choosing uniformly random points in $X_{3}(k)$, the elimination succeeds in expected polynomial time in $q$ and $2^{i}$. ∎

6.3. Degree $4$–to–$3$ elimination

The following proposition allows to avoid traps appearing on the left-hand side during the $4$–to–$3$ elimination.

Proposition 6.7**.**

For any $i\geq c$, if $D\not\in\mathscr{T}_{4}(i)$, then

[TABLE]

Proof.

Since $D\not\in\mathscr{T}_{4}(i)$ and $i\geq c$, we have $\delta^{\prime}(X_{1}(D))\not\subset\mathscr{T}_{3}(i)$. Since $\delta^{\prime}(X_{1}(D))$ is absolutely irreducible and $\mathscr{T}_{3}(i)$ is closed, they intersect properly so $\dim(\delta^{\prime}(X_{1}(D))\cap\mathscr{T}_{3}(i))=0$. Now, $\deg(\delta^{\prime}(X_{1}(D)))=q^{O(1)}$ and $\deg(\mathscr{T}_{3}(i))=q^{2^{i-1}+O(1)}$. Applying Bézout’s theorem,

[TABLE]

∎

The following results allow to avoid traps on the right-hand side during the $4$–to–$3$ elimination.

Lemma 6.8**.**

For any $S,R\in E$ such that $S^{(q)}\not\in\{S-Q,S+2Q\}$, we have $\mathscr{P}_{2}(S)+\mathscr{P}_{2}(R)\not\subset\mathscr{T}_{4}$ and $\mathscr{P}_{2}(S)+[-S]\not\subset\mathscr{T}_{3}$.

Proof.

This is simply a summary of Lemmata 4.3, 5.1 and 5.15. ∎

Lemma 6.9**.**

As long as the order of $Q$ is not a power of two (which can be enforced), there is no $S\in E(\mathbf{F}_{q^{2^{i}}})$ such that $S^{(q)}\in\{S-Q,S+2Q\}$.

Proof.

Suppose $S^{(q)}=S+jQ$ for $j\in\{-1,2\}$. Then, for any integer $r$, $S^{(q^{r})}=S+rjQ$. The smallest $r$ such that $S^{(q^{r})}=S$ is the order of $jQ$, which is not a power of two. So $S$ cannot be defined over a power-of-two degree extension of $\mathbf{F}_{q}$, i.e., it cannot be defined over a field $\mathbf{F}_{q^{2^{i}}}$. ∎

For any positive integer $i$ and any $P\in E$, let $\mathscr{B}_{i}(S)=\left\{F+F^{\left(q^{2^{i}}\right)}\ \middle|\ F\in\mathscr{P}_{2}(S)\right\}$.

Lemma 6.10**.**

Let $S\in E(\mathbf{F}_{q^{2^{i}}})$. There exists $c=O(1)$ such that for any $i\geq c$, we have that $\mathscr{B}_{i-1}(S)\not\subset\mathscr{T}_{4}$.

Proof.

We show that there exists $c=O(1)$ such that for any $i\geq c$, there exists $D\in\mathscr{P}_{2}(S)$ such that $D+D^{\left(q^{2^{i-1}}\right)}\not\in\mathscr{T}_{4}$. Let $\mathscr{A}=\left(\mathscr{P}_{2}(S)+\mathscr{P}_{2}\left(S^{\left(q^{2^{i-1}}\right)}\right)\right)\cap\mathscr{T}_{4}$. Since $\mathscr{P}_{2}(S)+\mathscr{P}_{2}\left(S^{\left(q^{2^{i-1}}\right)}\right)$ is an absolutely irreducible surface and is not contained in $\mathscr{T}_{4}$ (which is closed), the intersection $\mathscr{A}$ is a curve. We have

[TABLE]

where $c(\mathscr{A})$ is the number of absolutely irreducible components of $\mathscr{A}$. On the other hand, observe that through the morphism $\mathscr{P}_{2}(S)\rightarrow\mathscr{B}_{i-1}(S)$, each point has at most $4$ preimages, so

[TABLE]

Therefore there exists $c=O(1)$ such that for any $i\geq c$, $|\mathscr{A}(\mathbf{F}_{q^{2^{i-1}}})|<|\mathscr{B}_{i-1}(S)(\mathbf{F}_{q^{2^{i-1}}})|$, hence $\mathscr{B}_{i-1}(S)\not\subset\mathscr{A}$. Since $\mathscr{B}_{i-1}(S)\cap\mathscr{T}_{4}\subset\mathscr{A}$, we deduce that for $i\geq c$, we have $\mathscr{B}_{i-1}(S)\not\subset\mathscr{T}_{4}$. ∎

Lemma 6.11**.**

Let $S\in E(\mathbf{F}_{q^{2^{i}}})$, and let $A(S)=\{(P,S-P)\mid P\in E\}\subset E^{2}$. There exists $c=O(1)$ such that for any $i$ and $j$ such that $i-\lfloor j/2\rfloor+1\geq d$, we have $A(S)\not\subset T_{4}(i,j)$.

Proof.

From Lemma 6.2, it suffices to prove that there exists $c=O(1)$ such that $A(S)\not\subset T_{4}(i,1)$ and $A(S)\not\subset T_{3}(i,1)$ for any $i\geq c$. Since $\mathscr{P}_{2}(S)+[-S]\not\subset\mathscr{T}_{3}$, there is a divisor $[P]+[S-P]\in\mathscr{P}_{2}(S)$ such that $[P]+[S-P]+[-S]\not\in\mathscr{T}_{3}$ which by definition implies that $(P,S-P)\not\in T_{4}(i,1)$. Also, from Lemma 6.10, we can choose $c=O(1)$ which ensures that $\mathscr{B}_{i-1}(S)\not\subset\mathscr{T}_{4}$, so there exists $F=[P]+[S-P]\in\mathscr{P}_{2}(S)$ such that $F+F^{\left(q^{2^{i-1}}\right)}\not\in\mathscr{T}_{4}$, which implies that $(P,S-P)\not\in T_{3}(i,1)$. ∎

Lemma 6.12**.**

Let $S\in E(\mathbf{F}_{q^{2^{i}}})$. There exists $c=O(1)$ such that for any $i\geq c$, we have that $\mathscr{B}_{i-1}(S)\not\subset\mathscr{T}_{4}(i-1).$

Proof.

Let $c$ be the maximum between the constants $c$ of Lemmata 6.10 and 6.11. Recall that

[TABLE]

From Lemma 6.10, $\mathscr{B}_{i-1}(S)\not\subset\mathscr{T}_{4}$. From Lemma 6.11, there exists a divisor $F=[P]+[S-P]\in\mathscr{P}_{2}(S)$ such that $(P,S-P)\not\in T_{4}(i-1)$, so

[TABLE]

The absolute irreducibility of $\mathscr{B}_{i-1}(S)$ (it is an image of $\mathscr{P}_{2}(S)$) allows to conclude. ∎

Proposition 6.13**.**

Let $S\in E(\mathbf{F}_{q^{2^{i}}})$. There exists $c=O(1)$ such that for any $i\geq c$, $|\mathscr{B}_{i-1}(S)\cap\mathscr{T}_{4}(i-1)|\leq q^{\frac{3}{2}2^{i-1}+O(1)}$.

Proof.

From Lemma 6.12, we have $\mathscr{B}_{i-1}(S)\not\subset\mathscr{T}_{4}(i-1)$. Since $\mathscr{B}_{i-1}(S)$ is absolutely irreducible and $\mathscr{T}_{4}(i-1)$ is closed, we have $\dim(\mathscr{B}_{i-1}(S)\cap\mathscr{T}_{4}(i-1))<\dim(\mathscr{B}_{i-1}(S))=1$. Therefore, from Bézout’s theorem,

[TABLE]

∎

Proposition 6.14** (Degree $4$–to–$3$ elimination).**

Consider the field $k=\mathbf{F}_{q^{2^{i}}}$ and a divisor $D\in(\mathscr{D}_{4}\setminus\mathscr{T}_{4}(i))(k)$. There exists $c=O(1)$ such that for any $i\geq c$, there is a probabilistic algorithm that finds a list $(D_{j})_{j=1}^{q+1}$ of effective divisors of degree $3$ over $k$, and one effective divisor $D^{\prime}$ of degree $2$ over $k$ such that

[TABLE]

and runs in expected time polynomial in $q$ and $2^{i}$. Furthermore, it ensures that $D_{i}\not\in\mathscr{T}_{3}(i)$ for each index $i$, and $N_{k/\mathbf{F}_{q^{2^{i-1}}}}(D^{\prime})\not\in\mathscr{T}_{4}(i-1)$.

Proof.

This proof is similar to the proof of Proposition 6.6. We consider an affine patch $A$ of the ambient space, and the corresponding $\widetilde{X}_{3}$, and we have $\deg(\widetilde{X}_{3})=q^{O(1)}$. From Proposition 5.16 and [Bac96, Theorem 3.1], we have

[TABLE]

As in the $3$–to–$2$ case, the algorithm consists in generating random points of $\widetilde{X}_{3}(k)$. Each $(f,u_{1},u_{2},u_{3})\in\widetilde{X}_{3}(k)$ gives a possible elimination, as described in Section 3.5, and it remains to prove that with high probability, no trap appears in the elimination.

Fix a linear factor $u$, and consider the subvariety $H_{u}$ of $A$ parameterising polynomials of which it is a factor. One can prove in the same way as in Proposition 6.6 that $\widetilde{X}_{3}\cap H_{u}$ contains at most $(q+1)\deg(\widetilde{X}_{3})$ points. We now prove that any divisor coprime to $D$, $[0_{E}]$ and $[-Q]$ appears in at most $\deg(\widetilde{X}_{3})$ of the functions $\varphi(f)$, for $(f,u_{1},u_{2},u_{3})\in\widetilde{X}_{3}$. Indeed, the divisor of $\varphi(f)$ is of the form $D+D^{\prime}-3[0_{E}]-3[-Q]$, with $D^{\prime}\in\mathscr{P}_{2}(-\sigma D-3Q)$ where $\sigma D$ is the sum of the points of $D$. Therefore, a divisor coprime to $D$, $[0_{E}]$ and $[-Q]$ appears for two polynomials $f$ and $g$ if and only if $\varphi(f)$ and $\varphi(g)$ only differ by a scalar factor. The subvariety $H_{D^{\prime}}$ of $A$ of points $(f,u_{1},u_{2},u_{3})$ where ${\mathrm{div}}(\varphi(f))=D+D^{\prime}-3[0_{E}]-3[-Q]$ is of degree $1$, and does not contain $\widetilde{X}_{3}$, so the intersection $\widetilde{X}_{3}\cap H_{D^{\prime}}$ contains at most $\deg(\widetilde{X}_{3})$ elements.

Proposition 6.13 implies that at most $q^{\frac{3}{2}2^{i-1}+O(1)}$ divisors $D^{\prime}\in\mathscr{P}_{2}(-\sigma D-3Q)$ give rise to a trap at level $i-1$ on the right-hand side. So at most $\deg(\widetilde{X}_{3})q^{\frac{3}{2}2^{i-1}+O(1)}=q^{\frac{3}{2}2^{i-1}+O(1)}$ points of $X_{3}$ give rise to a trap on the right-hand side.

Now, let us look at traps that could appear on the left-hand side. The degree $3$ divisors that can appear on the left-hand side are $\delta^{\prime}(X_{1}(D))$. Since $D=F+F^{\left(q^{2^{i}}\right)}$ for some $F\in\mathscr{D}_{2}$ and $D\not\in\mathscr{T}_{4}(i)$, Proposition 6.7 implies that $|(\delta^{\prime}(X_{1}(D))\cap\mathscr{T}_{3}(i))(\mathbf{F}_{q^{2^{i}}})|\leq q^{2^{i-1}+O(1)}$. Therefore, at most $q^{2^{i-1}+O(1)}$ points of $X_{3}$ give rise to a trap on the left-hand side.

Finally, if $G\subset\widetilde{X}_{3}(k)$ is the subset of points giving an elimination that does not involve traps on either side, we get

[TABLE]

Therefore, for $i$ larger than some absolute constant, more than half the points of $X_{3}(k)$ are in $G$, so choosing uniformly random points in $X_{3}(k)$, the elimination succeeds in expected polynomial time in $q$ and $2^{i}$.

∎

7. Proof of the main theorem

Lemma 7.1**.**

Given a polynomial $F\in\mathbf{F}_{q}[E]$, there is a probabilistic polynomial-time algorithm that finds an irreducible polynomial $G\in\mathbf{F}_{q}[E]$ of degree $2^{e+2}$ such that $G\equiv F\mod\mathscr{I}$, for some integer $e=\log_{2}(n)+O(1)$. Furthermore, $G=N_{\mathbf{F}_{q^{2^{e}}}/\mathbf{F}_{q}}(D)$ for some irreducible divisor $D\in(\mathscr{D}_{4}\setminus\mathscr{T}_{4}(e))(\mathbf{F}_{q^{2^{e}}})$.

Proof.

This is an application of the Chebotarev density theorem for function fields. Let $H(\mathscr{I})$ be the ray class field modulo $\mathscr{I}$ of $\mathbf{F}_{q}(E)$, and $\varphi:\operatorname{Cl}_{\mathscr{I}}\rightarrow\operatorname{Gal}(H(\mathscr{I})/\mathbf{F}_{q}(E))$ the Artin map from the ray class group. Recall that $\operatorname{Cl}_{\mathscr{I}}=D(\mathscr{I})/P(\mathscr{I})$ where $D(\mathscr{I})$ is the group of fractional ideals of $\mathbf{F}_{q}[E]$ coprime to $\mathscr{I}$ and $P(\mathscr{I})$ is the subgroup of principal ideals generated by elements $f\in\mathbf{F}_{q}[E]$ such that $f\equiv 1\mod\mathscr{I}$. From [Sal06, p. 520], $\varphi$ is an isomorphism.

Let $e>\log_{2}(n)-1$ be an integer, and pick a uniformly random function $f\in\mathbf{F}_{q}[E]$ of degree $2^{e+2}$ such that $f\equiv 0\mod\mathscr{I}$. Let $G=F+f$. Then, $G\equiv F\mod\mathscr{I}$, and $G$ is uniformly distributed among the functions of degree $2^{e+2}$ in the $\mathscr{I}$-ray class of $F$. Recall that $n=\deg(\mathscr{I})$ and $N=\#E(\mathbf{F}_{q})$. Let $S_{\mathbf{F}_{q}}(E,\mathscr{I})$ be the set of irreducible divisors of $E$ other than $\mathscr{I}$, defined over $\mathbf{F}_{q}$. Applying the Chebotarev density theorem [Ros13, Theorem 9.13B] to $H(\mathscr{I})/\mathbf{F}_{q}(E)$, we get that for any $d>0$,

[TABLE]

where $[-]_{\mathscr{I}}$ denotes the $\mathscr{I}$-ray class. Let $d=2^{e+2}$. Since $\#\operatorname{Cl}_{\mathscr{I}}=N(q^{n}-1)/(q-1)$, we get

[TABLE]

On the other hand, applying [Bac96, Theorem 3.1], we have $|\mathscr{T}_{4}(e)(\mathbf{F}_{q^{2^{e}}})|=q^{3\cdot 2^{e}+O(1)}$. So for $e=\log_{2}(n)+O(1)$, the random prime divisor $G$ is not a trap with overwhelming probability. ∎

Let $c=O(1)$ be the smallest integer such that both degree $4$–to–$3$ and $3$–to–$2$ eliminations from Propositions 6.14 and 6.6 are guaranteed to work for $i\geq c$. Let

[TABLE]

The factor base for the descent algorithm is defined as

[TABLE]

Proposition 7.2** (Zigzag descent).**

Given a polynomial $F\in\mathbf{F}_{q}[E]$, there is a probabilistic algorithm that finds integers $(\alpha_{f})_{f\in\mathfrak{F}}$ such that

[TABLE]

and that runs in expected time $q^{2\log_{2}(n)+O(1)}$.

Proof.

First apply Lemma 7.1 to find an irreducible polynomial $G$ in $\mathbf{F}_{q}[E]$ of degree $2^{e+2}$ such that $G\equiv F\mod\mathscr{I}$, and such that $\log(G)={\mathrm{Log}}(N_{\mathbf{F}_{q^{2^{e}}}/\mathbf{F}_{q}}(D))$ for some irreducible divisor $D\in(\mathscr{D}_{4}\setminus\mathscr{T}_{4}(e))(\mathbf{F}_{q^{2^{e}}})$. Applying the degree $4$–to–$3$ elimination (Proposition 6.14), there is a list $(D_{i})_{i=1}^{q+1}$ of effective divisors of degree $3$ over $\mathbf{F}_{q^{2^{e}}}$ and an effective divisor $D^{\prime}$ of degree $2$ over $\mathbf{F}_{q^{2^{e}}}$ such that

[TABLE]

Since $D_{i}\in\mathscr{D}_{3}\setminus\mathscr{T}_{3}(e)$, one can apply the degree $3$–to–$2$ elimination (Proposition 6.6), rewriting each of them as combinations of smaller degree polynomials. At this stage, the quantity ${\mathrm{Log}}(N_{\mathbf{F}_{q^{2^{e}}}/\mathbf{F}_{q}}(D))$ is expressed as a product of $O(q^{2})$ terms involving divisors of degree $1$ or $2$ over $\mathbf{F}_{q^{2^{e}}}$. They give irreducible divisors of degree $4$ by considering the norm to $\mathbf{F}_{q^{2^{e-1}}}$ or $\mathbf{F}_{q^{2^{e-2}}}$ (and these divisors do not belong to $\mathscr{T}_{4}(e-1)$ or $\mathscr{T}_{4}(e-2)$ respectively), hence one can recursively apply the degree $4$–to–$3$ and $3$–to–$2$ eliminations, until all the resulting divisors are in the set $\widetilde{\mathfrak{F}}$. We obtain a linear combination of logarithms of factor base elements via the fact that for any $D\in\widetilde{\mathfrak{F}}$, we have ${\mathrm{Log}}(D)=\log(f)/N$, where $f$ is any function such that $\mathrm{div}(f)=ND$. ∎

7.1. Proof of the main theorem

Theorem 1.1 follows immediately from Theorem 3.1, Theorem 2.4, and Proposition 7.2.

8. Acknowledgements

The authors wish to thank Zsolt Patakfalvi for discussions that led to the proof of Proposition 5.10, and Arjen K. Lenstra for valuable comments that helped improve the quality of this manuscript. Part of this work was supported by the Swiss National Science Foundation under grant number 200021-156420, and by the ERC Advanced Investigator Grant 740972 (ALGSTRONGCRYPTO).