trisection for supersingular genus 2 curves in ... · pdf fileunicamp.jpg ubiobio.jpg...

Unicamp.jpgUBiobio.jpg

Trisection for supersingular genus 2 curves in characteristic 2

Josep Miret1, Jordi Pujolas1, and Nicolas Theriault2

1Departament de Matematica, Universitat de Lleida, Espana.

2Departamento de Matematica, Universidad del Bıo-Bıo, Chile.

Miret, Pujolas y Theriault (U.Lleida & Ubiobio) Trisection for supersingular genus 2 curves 1 / 25


1 Introduction

2 3-torsions

3 TrisectionsGeneral caseSpecial cases

4 Structure of Jac(C)[3∞](F2m )Structure of Jac(C)[3](F2m )Structure of Jac(C)[3k ](F2m ), k > 1



Supersingular Hyperelliptic Curves of Genus 2

Let Fq be a finite field of characteristic 2, then a super singular curve of genus 2 can begiven by an equation of the form

y 2 + h0y = x5 + f3x3 + f1x + f0

with h0 6= 0.

From a hyper elliptic curve, we can define the divisor class group: the quotient group ofthe divisors of degree zero modulo the principal divisors.

The reduced divisors in each class group can be given in Mumford representation,

D = [u(x), v(x)],

with u monic of degree at most 2, deg(v) < deg(u), and satisfying u|v 2 + h0v + f .



Trisections

Given a reduced divisor D3 = [u3(x), v3(x)], we want to find all the possible reduceddivisors D1 = [u1(x), v1(x)] such that

D3 = 3D1,

the trisections of D3.

From the group structure, we know that

Jac(C)[3] ≡ (Z/3Z)4 .

Over Fq, the problem consists in computing the 81 trisections of D3.

Over Fq, we have to identify which of the 81 trisections are defined over Fq.



3-torsions

We are looking for the non-zero trisections of the divisor class 0 (Mumfordrepresentation: [1, 0]), i.e. divisors D such that 3D ≡ 0.

We first observe that for curves of genus 2, D must have weight 2, soD = [u(x), v(x)] = [x2 + u1x + u0, v1x + v0].

Rather than solve 3D = 0, we will solve 2D ≡ −D = [x2 + u1x + u0, v1x + (v0 + h0)].

To do this we look for an auxiliary polynomial k(x) such that v(x) in 2D = [u(x)2, v(x)]is of the form v(x) = v(x) + k(x)u(x).



3-torsions

The coefficients of x0, x1, x2, and x3 in

k21u(x)2 =

v 2(x) + h0v(x) + f (x)

u(x)+ h0k(x) + k2(x)u(x).

give us 4 equations in {u1, u0, v1, v0, k1, k0}, and the divisibility condition

v(x)2 + h0v(x) + f (x) ≡ 0 mod u(x)

gives us two more, completing the system.

In the system, u1, u0, and v1 can be written in terms of k1, k0 and v0.



3-torsions

k1 satisfies the degree 5 equation

h0k15 + f3k1

4 + 1 = 0,

k0 satisfies a degree 8 equation (depending on k1)

k41 k0

8 + h20k

101 k0

4 + h20k

81 k0

2 + h30k

121 k0 + f 2

1 k121 + f3h

20k

101 + h2

0k61 = 0,

and v0 satisfies a degree 2 equation (depending on k1 and k0)

k21 v0

2 + h0k21 v0 + k2

1 f0 + h0k30 = 0.

Theorem

There is a bijection between triples of solutions (k1, k0, v0) ∈ F2m × F2m × F2m satisfyingthe three equations above, and the set of divisors of order 3 in Jac(C)(F2m ).



Factorization types

Pu1 (X ) is the translate of a 2-linearized polynomial=⇒ The number of roots is 0, 1, 2, 4, 8 in any field extension.

Proposition

The possible factorization types of Pu1 (X ):

[1, 1, 1, 1, 2, 2], [1, 1, 2, 4], [2, 2, 2, 2], [4, 4] if m is odd.

[1, 1, 1, 1, 1, 1, 1, 1], [1, 1, 1, 1, 2, 2], [1, 1, 3, 3], [2, 2, 2, 2], [2, 6], [4, 4] if m is even.

Direct consequences:

Corollary

if 3-torsion subgroup of rank 4, then m is even.

if Pu1 (X ) has 8 linear factors, then m is even.

In general, restricts the possible extension degrees where the 3-torsion divisors are defined.



Reducing 3D1 (Cantor)

Suppose that we obtain 3D1 = [u31(x), v(x)] using Cantor’s composition algorithm (D1 is

not of order 3), then the simple reduction of Cantor works as follows (assuming v(x) hasdegree 5):

ua(x) = Monic

(v 2 + hv + f

u31

)va(x) = v + h mod ua(x)

u3(x) = Monic

(v 2a + hva + f

ua

)v3(x) = va + h mod u3(x).

We refer to this as double linear reduction.

Special cases:

D1 of weight 1

3D1 = [u31(x), v(x)] with v(x) of degree ≤ 4 (simple quadratic reduction)

D3 of weight 1 (va(x) has degree ≤ 2).



De-reduction

Our goal is to go from D3 = [u3, v3] to 3D1 = [u31(x), v(x)], or rather to D1 = [u1, v1]

with v1 = v mod u1, undoing the reduction algorithm.

There should be 81 valid solutions over Fq, and either 0 or 3r solutions over Fq where r isthe 3-rank of the curve over Fq.

Writing va(x) and v(x) as

va(x) = v3(x) + (k1x + k0)u3(x) + h(x)

v(x) = va(x) + (k3x + k2)ua(x) + h(x)

where k1 · k3 6= 0.

Then de-reducing comes down to finding k1x + k0 and k3x + k2 which connect [u3, v3]and [u1, v1] (via [ua, va]).

This is similar to the de-reduction technique used for bisections in genus 2 curves, hencethe name double linear de-reduction.



General case

Using the representations of va(x) and v(x) into the equations for the u(x)-terms, weobtain

ua(x) =1

k21

(v 2

3 + v3h + f

u3+ (k1x + k0)2u3 + (k1x + k0)h

)and then

u1(x)3 =1

k31

(k2

1u3 + (k3x + k2)2ua + (k3x + k2)h).

Expanding this last equality according to the degrees in x , we obtain 6 equations en u11,u10, k0, k1, k2, and k3.

To simplify the equations, we make the substitutions

t1 = 1/k1

t3 = 1/k3

z = t3k2 = k2/k3



General case

From the coefficients of x5 and x4 we get:

u11 = u31 + t21

u10 = u30 + u231 + z2 + k2

0 t21 + u31t

21 + t4

1

and then the coefficients of x2 and x3 can be combined to find k0:

k0 =1

h0u231t

41

t14

1 + u31t121 + t6

1z4 + u2

31t61z

2 + u431t

61 + f3u31t

81

+u31t41z

4 + h0u31t71 + u2

31t21z

4 + u431t

21z

2

+u231v

231t

41 + u3

31u30t41 + f3u31t

41z

2 + u230t

61 + f 2

3 t61

+h0u31t31z

2 + h0u331t

31 + u31u

230t

41 + f3u31u30t

41

+u231u

230t

21 + h0u31u30t

31 + h2

0t41 + u2

31t23

Remark

The case u31 = 0 must be handled separately and is easier than the case u31 6= 0.



General case

The coefficients in x2 and x3 also leave us an equation

0 = t281 + u2

31t241 + t12

1 z8 + u431t

121 z4 + u8

31t121 + f 2

3 u231t

161 + u2

31t81z

8

+ h20u

231t

141 + h2

0u331t

121 + u4

31t41z

8 + u831t

41z

4 + u431v

431t

81 + u6

31u230t

81

+ f 23 u

231t

81z

4 + h20u

431t

101 + u4

30t121 + f 4

3 t121 + h2

0u331t

81z

2 + h20u

231t

61z

4

+ h20u

431t

61z

2 + u231u

430t

81 + f 2

3 u231u

230t

81 + h2

0u331u30t

81 + f3h

20u

331t

81

+ h30u

331t

71 + u4

31u430t

41 + h2

0u231u

230t

61 + h4

0t81 + u4

31t43

and substituting k0 in the coefficients of x0 and x1 gives us two more equations in z , t1

and t3.

After some careful combinations, we can write t3 in terms of t1 and z , and obtain

p1(t1, z) = 0

p2(t1, z) = 0

with p1 of degree 33 in t1 and degree 12 in z , and p2 of degree 15 in t1 and degree 2 in z .



General case

Taking the resultant (in z) of p1 and p2 and cleaning out “parasitic” factors, we find

Resz(p1(t1, z), p2(t1, z)) = t91 · (t5

1 + (u231 + f3)t1 + h0)12 · qD3 (t1)

where qD3 (t1) is a polynomial of degree 81 (except in some special cases).

Proposition

Each non-zero root t1 of qD3 (X ) = 0 corresponds to a trisection D1 of D3 via doublelinear de-reduction.



Weight-1 trisections

If D1 = [x + u10, v10], the reduction of 3D takes only one simple step.Setting v(x) = v3(x) + k0u3(x) + h(x), we obtain the equality

(x + u10)3 =v3(x)2 + v3(x)h0 + f (x)

u3(x)+ k2

0u3(x) + k0h0,

which turns into 3 equations, first

u10 = k20 + u31,

and then

s1(k0) = k40 + k2

0u31 + f3 + u30

s2(k0) =(u2

31 + f3)k2

0 + h0k0 + v 231 + u31f3

Proposition

D3 admits a trisection of weight 1 if and only if

f 63 + f 4

3 u230 + f 3

3 h20u31 + f 2

3 h20u

331 + f 2

3 h20u31u30 + f 2

3 u231v

431 + f3h

40

+f3h20u

531 + h4

0u30 + h20u

531u30 + h2

0u31v431 + u8

31u230 + u6

31v431 + v 8

31 = 0



Weight-1 trisectees

If D3 = [x + u31, v31] (D3 has weight 1), the process is similar to the general case (doublelinear de-reduction), except that no special case can occur. (all trisections have weight 2and all de-reductions are linear).

ua =v 2

3 + v3h + f

u3+ (k1x + k0)2u3 + (k1x + k0)h

(x2 + u11x + u10)3 =u3

k23

+(k3x + k2)2ua

k23

+(k3x + k2)h

k23

From which we get u11, u10 and k0 in terms of k1 and t0 = k2k3

:

u11 = k21 + u30

u10 = k41 + k2

1u30 + f3 + t20

k20 = k6

1 + k21 f3 + k1h0

with the final three equations in terms of k1, t0 and t1 = 1k3

.

Since one equation does not depend on t1, solving the can be reduced (via tworesultants) to a degree 81 polynomial in k1.



Simple quadratic de-reduction

In some cases, D1 and D3 both have weight 2, but v in 3D1 = [u31 , v ] is of degree ≤ 4.

In this case, the reduction requires only one step, and we can write

v(x) = v3(x) + (k2x2 + k1x + k0)u3 + h(x)

Proposition

D3 = [x2 + u31x + u30, v31x + v30] admits a simple quadratic de-reduction only if

u531 + f 2

3 u31 + h20 = 0

and the associated D1 has u11 = u31.

working out the equations, we obtain a degree 9 trisection polynomial

pD3 (t) = t9 + u431h

20t

3 + (u1231 + u6

31v431 + u8

31f2

3 + u531h

20u30)t + u6

31h30.

and u10 = u30 + t2/u31

Remark

If u531 + f 2

3 u31 + h20 = 0, then the trisection polynomial for double linear de-reduction has

degree 72 after removing 9 (false) roots t1 = 0.



Goals

@ supersingular curves of genus 2 over any field F2m with a 3-torsion subgroup ofrank 3

the exponents of Jac(C)[3∞](F2m ) are equal

Jac(C)[3k ](F2m ) has a distinguished basis for every k

For curves with coefficients in F2, the first two results follow from C. Xing’sOn supersingular abelian varieties of dimension two over finite fields (1996).



Structure of the group

Supersingular curves have simplified equation.

D = [x2 + u1x + u0, v1x + v0]D ′ = [x2 + u1x + u′0, v

′1x + v ′0]

}⇒ u1(±(D + D ′) = u1(±(D − D ′))

by direct computation + supersingularity.

Proposition

If Pu1 (X ) has more than 4 roots (type [1, . . . , 1]), then rank(Jac(C)[3]) 6= 3:

if 3-torsion has 3 generators D1,D2,D3 with the same u1, there must be 5 other divisorsin 〈D1,D2,D3〉 with same u1, but they go together in pairs by property above!



Rank 3

Theorem

There are no supersingular C in characteristic 2 such that Jac(C)[3] has rank 3

We can assume factorization type is not [1, . . . , 1]

for each u1 obtain at most 4 u0’s, so need the 5 u1’s over F2m .

40− 13 = 27 remaining pairs (u1, u0) to be found over extension of degree 2, 3, 6because of factorization types.

But we need 26/2 = 13 first coordinates over F2m . This leads to contradiction forevery m = 2, 3, 6.



Distinguished Bases

Corollary (B)

There exists a basis of Jac(C)[3] with elements having the same u1.

In rank 4, there must exist a root u1 leading 8 u0’s. From the divisors with thesefirst components x2 + u1x + u0 there exists a basis of Jac(C)[3]

In rank 2, it follows from the factorization types of Pu1 (x)

Call such divisors “distinguished”



Quadratic De-reductions

Consider the situation:

D = [x2 + u1x + u0, v1x + v0] a divisor such that u1 satisfies

u51 + f 2

3 u1 + h20 = 0

pD(t) = t9 + ...+ u631h

30

the degree 9 quadratic-dereduction polynomial

qD(t1) = (...)t721 + ...+ h24

0

the degree 72 twice-linear-dereduction polynomial.

Proposition (D)

If qD(t1) has a root α1 ∈ F2m then pD(t) has a root β1 ∈ F2m .

That is, if D has a trisection by twice-linear-dereduction D only if it has a trisection byquadratic-dereduction



Group Structure

Theorem

The nonzero exponents of Jac(C)(F2m )[3∞] are equal.

Corollary

For every k, there is a distinguished basis of Jac(C)[3k ](F2m ).

Sketch:

By Corollary (B), we can take a distinguished basis in Jac(C)[3]

By Proposition (D), if a distinguished divisor has a trisection, it has a distinguishedtrisection (this is not trivial in rank 2)

Prove by induction: For D = [x2 + u31x + u30, v31x + v30] ∈ Jac(C)[3k ](F2m ), Ddistinguished of order 3k , =⇒ pD(x) does not depend on undistinguished coefficientsu30, v31, v30 but only on u31 and k.



Group Structure

k = 1: in 3-torsion the only “wrong” coefficients satisfy

h20u30 + v 4

31u31 = f 23 u

331 + u7

31

troubled coefficients in next level pD′(x) are

h20u11 + u31v

411 = h2

0u30 + u31v431 +

(h2

0

u31t2 + (u31 + 1)4t4 +

(f3 + u231)4

h20

t8

).

By induction hypothesis there exists a formula by which h20u30 + u31v

431 depends only

on u31, and t (a root of pD(x) = pku31

(x)), then clearly pD′(x) = pk+1u31

(x) for any D ′.

Hence pD(x) is the same for all distinguished D of order 3k : pD(x) = pku31

(x).



Group Structure

It only remains to show: if 13D 6= ∅ for some undistinguished D,

does there exist a distinguished D of the same order such that 13D 6= ∅?

By induction, suppose there exists a distinguished D ∈ Jac(C)[3k ](F2m ) such that3k−1D equals any distinguished basis elements in Jac(C)[3](F2m ).

Let D ∈ Jac(C)[3k ](F2m ) be undistinguished of order 3k such that 13D 6= ∅.

By definition of k, Jac(C)[3k ] must also contain a distinguished D such that3k−1D = 3k−1D.

=⇒ there exists an E of order 3s with s < k such that D = D + E .Therefore 1

3E 6= ∅, hence 1

3D 6= ∅ and our proof is complete.


trisection for supersingular genus 2 curves in ... · pdf fileunicamp.jpg ubiobio.jpg...

Documents