Isogenies for Point Counting on Genus Two Hyperelliptic Curves with Maximal Real Multiplication

Abstract

Schoof's classic algorithm allows point-counting for elliptic curves over finite fields in polynomial time. This algorithm was subsequently improved by Atkin, using factorizations of modular polynomials, and by Elkies, using a theory of explicit isogenies. Moving to Jacobians of genus-2 curves, the current state of the art for point counting is a generalization of Schoof's algorithm. While we are currently missing the tools we need to generalize Elkies' methods to genus 2, recently Martindale and Milio have computed analogues of modular polynomials for genus-2 curves whose Jacobians have real multiplication by maximal orders of small discriminant. In this article, we prove Atkin-style results for genus-2 Jacobians with real multiplication by maximal orders, with a view to using these new modular polynomials to improve the practicality of point-counting algorithms for these curves. IntroductionEfficiently computing the number of points on the Jacobian of a genus 2 curve over a finite field is an important problem in experimental number theory and numbertheoretic cryptography. When the characteristic of the finite field is small, Kedlaya's algorithm and its descendants provide an efficient solution (see [18], [13], and [12]), while in extremely small characteristic we have extremely fast AGM-style algorithms (see for example [25], [26], and [3]). However, the running times of these algorithms are exponential in the size of the field characteristic; the hardest case, therefore (and also the most important case for contemporary cryptographic applications) is where the characteristic is large, or even where the field is a prime field.So let q be a power of a large prime p, and let C be a genus-2 curve over F q . Our fundamental problem is to compute the number of F q -rational points on the Jacobian J C of C .

Counting points on genus-3 hyperelliptic curves with explicit real multiplication

“…. , 5}, we obtain that |θ 3 is the minimal polynomial of a totally real algebraic number, the discriminant D(µ 0 , µ 1 , µ 2 ) must be nonzero. Equations Ψ c = 0 and (4) imply the following inequality:…”

“…The influence of real multiplication on the complexity of point counting was investigated for genus 2 curves in [12], where the authors decrease the complexity from O((log q) 8 ) [14] to O((log q) 5 ). For genus 2 curves, another related active line of research is to mimic the improvement of Elkies and Atkin by using modular polynomials [3]. However, the main difficulty of this method is to precompute the modular polynomials, which are much larger than their genus 1 counterparts.…”

Computing isogenies from modular equations in genus two

“…Modular polynomials have now been computed in genus 2: the smallest ones are known both for ℓ-isogenies [31] and, in the real multiplication case, cyclic β-isogenies [28,32]. This opened the way for Atkin-style methods in point counting [3], but isogeny computations in genus 2 remain the missing step to generalize Elkies's method.…”

On the distribution of orders of Frobenius action on $\ell$-torsion of abelian surfaces

“…This formula appears in [14] in a slightly different form and with additional restrictions implying that ζ 1 , ζ 2 are primitive. In [3,Prop. 3.14] there is a more restrictive formula for vanilla abelian surfaces with real multiplication.…”