ZETA FUNCTION AND CRYPTOGRAPHIC EXPONENT OF
SUPERSINGULAR CURVES OF GENUS 2
GABRIEL CARDONA AND ENRIC NART
Abstract. We compute in a direct (not algorithmic) way the zeta function
of all supersingular curves of genus 2 over a finite field k, with many geometric
automorphisms. We display these computations in an appendix where we
select a family of representatives of all these curves up to k-isomorphism and
we exhibit equations and the zeta function of all their k/k-twists. As an
application we obtain a direct computation of the cryptographic exponent of
the Jacobians of these curves.
Introduction
One-round tripartite Diffie-Hellman, identity based encryption, and short digital
signatures are some problems for which good solutions have recently been found,
making critical use of pairings on supersingular abelian varieties over a finite field
k. The cryptographic exponent cA of a supersingular abelian variety A is a half-
integer that measures the security against an attack on the DL problem based on
the Weil or the Tate pairings. Also, it is relevant to determine when pairings can
be efficiently computed. Rubin and Silverberg showed in [RS04] that this invariant
is determined by the zeta function of A.
In this paper we give a direct, non-algorithmic procedure to compute the zeta
function of a supersingular curve of genus 2, providing thus a direct computation of
the cryptographic exponent of its Jacobian. This is achieved in Sect. 1. For even
characteristic the results are based on [MN06] and are summarized in Table 2; for
odd characteristic we use results of Xing and Zhu on the structure of the group of
k-rational points of a supersingular abelian surface and we almost determine the
zeta function in terms of the Galois structure of the set of Weierstrass points of the
curve (Tables 3, 4). In the rest of the paper we obtain a complete answer in the case
of curves with many automorphisms. In Sect. 2 we study the extra information
provided by these automorphisms and we show how to obtain the relevant data to
compute the zeta funtion of a twisted curve in terms of data of the original curve
and the 1-cocycle defining the twist. In Sect. 3 we select a family of representatives
of these curves up to k-isomorphism and we apply the techniques of the previous
section to deal with each curve and all its k/k-twists. The results are displayed in
an Appendix in the form of tables.
In what cryptographic applications of pairings concerns, curves with many au-
tomorphisms are interesting too because they are natural candidates to provide
The authors acknowledge support from the projects MTM2006-15038-C02-01 and MTM2006-
11391 from the Spanish MEC.
http://arxiv.org/abs/0704.1951v1
distortion maps on the Jacobian. In this regard the computation of the zeta func-
tion is a necessary step to study the structure of the endomorphism ring of the
Jacobian (cf. [GPRS06]).
1. Zeta Function and Cryptographic Exponent
Let p be a prime number and let k = Fq be a finite field of characteristic p.
We denote by kn the extension of degree n of k in a fixed algebraic closure k,
Gk := Gal(k/k) is the absolute Galois group of k, and σ ∈ Gk the Frobenius
automorphism.
Let C be a projective, smooth, geometrically irreducible, supersingular curve of
genus 2 defined over k. The Jacobian J of C is a supersingular abelian surface over
k (the p-torsion subgroup of J(k) is trivial). Let us recall how supersingularity is
reflected in a model of the curve C:
Theorem 1.1. If p is odd, any curve of genus 2 defined over k admits an affine
Weierstrass model y2 = f(x), with f(x) a separable polynomial in k[x] of degree 5
or 6. The curve is supersingular if and only if M (p)M = 0, where M , M (p) are the
matrices:
cp−1 cp−2
c2p−1 c2p−2
, M (p) =
p−1 c
2p−1 c
, f(x)(p−1)/2 =
If p = 2 a curve of genus 2 defined over k is supersingular if and only if it admits
an affine Artin-Schreier model y2 + y = f(x), with f(x) an arbitrary polynomial in
k[x] of degree 5.
For the first statement see [Yui78] or [IKO86], for the second see [VV92].
For any simple supersingular abelian variety A defined over k, Rubin and Silver-
berg computed in [RS04] the cryptographic exponent cA, defined as the half-integer
such that qcA is the size of the smallest field F such that every cyclic subgroup of
A(k) can be embedded in F ∗. This invariant refines the concept of embedding de-
gree, formerly introduced as a measure of the security of the abelian variety against
the attacks to the DLP by using the Weil pairing [MOV93] or the Tate pairing
[FR94] (see for instance [Gal01]).
Let us recall the result of Rubin-Silverberg, adapted to the dimension two case.
After classical results of Tate and Honda, the isogeny class of A is determined by
the Weil polynomial of A, fA(x) = x
4 + rx3 + sx2 + qrx + q2 ∈ Z[x], which is
the characteristic polynomial of the Frobenius endomorphism of the surface. For A
supersingular the roots of fA(x) in Q are of the form
q ζ, where
q is the positive
square root of q and ζ is a primitive m-th root of unity.
Theorem 1.2. Suppose A is a simple supersingular abelian surface over Fq and
let ℓ > 5 be any prime number dividing |A(Fq)|. Then, the smallest half-integer cA
such that qcA − 1 is an integer divisible by ℓ is given by
m/2, if q is a square,
m/(2,m), if q is not a square .
In particular, the cryptographic exponent cA is an invariant of the isogeny class
of A. The complete list of simple supersingular isogeny classes of abelian surfaces
can be found in [MN02, Thm. 2.9]. It is straightforward to find out the m-th root
of unity in each case. We display the computation of cA in Table 1.
Table 1. Cryptographic exponent cA of the simple supersingular
abelian surface A with Weil polynomial fA(x) = x
4 + rx3 + sx2 +
qrx + q2
(r, s) conditions on p and q cA
(0,−2q) q nonsquare 1
(0, 2q) q square, p ≡ 1 (mod 4) 2
q, 3q) q square, p ≡ 1 (mod 3) 3/2
(−2√q, 3q) q square, p ≡ 1 (mod 3) 3
(0, 0) (q nonsquare, p 6= 2) or (q square, p 6≡ 1 (mod 8)) 4
(0, q) q nonsquare 3
(0,−q) (q nonsquare, p 6= 3) or (q square, p 6≡ 1 (mod 12)) 6
q, q) q square, p 6≡ 1 (mod 5) 5/2
(−√q, q) q square, p 6≡ 1 (mod 5) 5
5q, 3q) q nonsquare, p = 5 5
2q, q) q nonsquare, p = 2 12
Therefore, the computation of the cryptographic exponent of the Jacobian J of
a supersingular curve C amounts to the computation of the Weil polynomial of J ,
which is related in a well-known way to the zeta function of C. We shall call fJ(x)
the Weil polynomial of C too.
The computation of fJ(x) has deserved a lot of attention because for the crypto-
graphic applications one needs to know the cardinality |J(Fq)| = fJ(1) of the group
of rational points of the Jacobian. However, in the supersingular case the current
“counting points” algorithms are not necessary because there are more direct ways
to compute the polynomial fJ(x).
The aim of this section is to present these explicit methods, which take a different
form for p odd or even. For p = 2 the computation of fJ(x) is an immediate
consequence of the methods of [MN06], based on ideas of van der Geer-van der
Vlugt; for p > 2 we derive our results from the group structure of J(Fq), determined
in [Xin96], [Zhu00], and from the exact knowledge of what isogeny classes of abelian
surfaces do contain Jacobians [HNR06]. In both cases we shall show that fJ (x) is
almost determined by the structure as a Galois set of a finite subset of k, easy to
compute from the defining equation of C.
1.1. Computation of the Zeta Function when p = 2. We denote simply by
tr the absolute trace trk/F2 . Recall that ker(tr) = {x + x2 | x ∈ k} is an F2-linear
subspace of k of codimension 1.
Every projective smooth geometrically irreducible supersingular curve C of genus
2 defined over k admits an affine Artin-Schreier model of the type:
C : y2 + y = ax5 + bx3 + cx+ d, a ∈ k∗, b, c, d ∈ k,
which has only one point at infinity [VV92]. The change of variables y = y + u,
u ∈ k, allows us to suppose that d = 0 or d = d0, with d0 ∈ k\ker(tr) fixed. Twisting
C by the hyperelliptic twist consists in adding d0 to the defining equation. If we
denote by J ′ the Jacobian of the twisted curve we have fJ′(x) = fJ(−x). Thus, for
the computation of fJ(x) we can assume that d = 0.
The structure as a Gk-set of the set of roots in k of the polynomial P (x) =
a2x5 + b2x+ a ∈ k[x] almost determines the zeta function of C [MN06, Sect.3].
Table 2. Weil polynomial x4 + rx3 + sx2 + qrx+ q2 of the curve
y2+ y = ax5+ bx3+ cx, for q nonsquare (left) and q square (right)
P (x) N, M (r, s)
(1)(4) N = 0 (±
2q, 2q)
N = 1 (0, 0)
(2)(3) M = 0 (±
2q, q)
M = 1 (0, q)
N = 0 (±2
2q, 4q)
(1)3(2) N = 1 (0, 2q)
N = 2 (0, 0)
N = 3 (0,−2q)
P (x) N, M (r, s)
(5) (±√q, q)
N = 0 (0,−q)
(1)2(3) N = 1 (0, q)
N = 2 (±2√q, 3q)
M = 0 (±2√q, 2q)
(1)(2)2 M = 1 (0, 0)
M = 2 (0, 2q)
N = 1 (0,−2q)
(1)5 N = 3 (0, 2q)
N = 5 (±4√q, 6q)
In Table 2 we write P (x) = (n1)
r1(n2)
r2 · · · (nm)rm to indicate that ri of the
irreducible factors of P (x) have degree ni. Also, we consider the linear operator
T (x) := tr((c+ b2a−1)x) and we define
N := number of roots z ∈ k of P (x) s.t. T (z) = 0,
M := number of irred. quadratic factors x2 + vx+ w of P (x) s.t. T (v) = 0 .
The ambiguity of the sign of r can be solved by computing nD in the Jacobian,
where n is one of the presumed values of |J(Fq)| and D is a random rational divisor
of degree 0.
1.2. Computation of the Zeta Function when p is odd. Let A be a super-
singular abelian surface over k and let rk2(A) := dimF2(A[2](k)).
The structure of A(k) as an abelian group was studied in [Xin96], [Zhu00], where
it is proven that it is almost determined by the isogeny class of A. In fact, if Fi(x)
are the different irreducible factors of fA(x) in Z[x]:
fA(x) =
Fi(x)
ei , 1 ≤ s ≤ 2 =⇒ A(k) ≃ ⊕si=1 (Z/Fi(1)Z)
except for the following cases:
(a) p ≡ 3 (mod 4), q is not a square and fA(x) = (x2 + q)2,
(b) p ≡ 1 (mod 4), q is not a square and fA(x) = (x2 − q)2.
(c) q is a square and fA(x) = (x
2 − q)2.
The possible structure of A(k) in cases (a) and (b) is:
A(k) ≃ (Z/F (1)Z)m ⊕ (Z/(F (1)/2)Z⊕ Z/2Z)n ,
where F (x) denotes respectively x2 + q, x2 − q, and m, n are non-negative integers
such that m+ n = 2 [Zhu00, Thm. 1.1]. In case (c) we have either:
A(k) ≃ (Z/((q − 1)/2)Z)2 ⊕ (Z/2Z)2 , or
A(k) ≃ (Z/((q − 1)/2m)Z)⊕ (Z/((q − 1)/2n)Z)⊕ (Z/2m+nZ) ,
where 0 ≤ m, n ≤ v2(q − 1) [Xin96, Thm. 3]. In this last case we have rk2(A) > 1;
in fact, v2(1 −
q) + v2(1 +
q) = v2(1 − q) = (1/2)v2(F (1)) and we can apply
[Xin96, Lem. 4] to conclude that A(k) has a subgroup isomorphic to (Z/2Z)2.
Table 3. Weil polynomial x4 + rx3 + sx2 + qrx+ q2 of the curve
C when q is nonsquare. The sign ǫ is the Legendre symbol (−1/p)
W p rk2(J) (r, s)
(1)6 or (1)4(2) 4, 3 (0,−2ǫq)
(1)2(2)2 or (2)3 2 (0,±2q)
(1)3(3) 2 not possible
(1)(2)(3) p > 3 1 not possible
p = 3 (±
3q, 2q)
(1)2(4) or (2)(4) 1 (0, 0)
(1)(5) p 6= 5 0 not possible
p = 5 (±
5q, 3q)
p ≡ 1 (mod 3) (0, q)
(3)2 p ≡ −1 (mod 3) 0 (0, ǫq)
p = 3 not possible
(6) p ≡ −1 (mod 3) 0 (0,±q)
p 6≡ −1 (mod 3) (0, q)
Consider now a supersingular curve C of genus 2 defined over k, given by a
Weierstrass equation y2 = f(x), for some separable polynomial f(x) ∈ k[x] of degree
5 or 6. Let J be its Jacobian variety, W = {P0, P1, P2, P3, P4, P5} ⊆ C(k) the set of
Weierstrass points of C, andW (k) ⊆W the subset of k-rational Weierstrass points.
Our aim is to show that the structure ofW as a Gk-set contains enough information
on the 2-adic value of |C(k)| and |J(k)| to almost determine the polynomial fJ(x) =
x4 + rx3 + sx2 + qrx+ q2.
From the fundamental identities
|C(k)| = q + 1 + r, |J(k)| = fJ(1) = (q2 + 1) + (q + 1)r + s,
and the free action of the hyperelliptic involution on C(k) \W (k) we get
(1) r ≡ |W (k)| (mod 2), s ≡ |J(k)| (mod 2) .
On the other hand, J [2] is represented by the classes of the 15 divisors:
Pi − P0, 1 ≤ i ≤ 5, and Pi + Pj − 2P0, 1 ≤ i < j ≤ 5,
together with the trivial class.
Lemma 1.3. Let D = Pi − Pj, with i 6= j, or D = Pi + Pj − 2P0, with 0, i, j
pairwise different. Then, the class of the divisor D is k-rational if and only if Pi, Pj
are both k-rational or quadratic conjugate.
Hence, the Galois structure of W determines rk2(J) and this limits the possible
values of the zeta function of C. Our final results are given in Tables 3, 4, where
we write W = (n1)
r1(n2)
r2 · · · (nm)rm to indicate that there are ri Gk-orbits of
length ni of Weierstrass points. If f(x) has degree 6 this Galois structure mimics
the decomposition f(x) = (n1)
r1(n2)
r2 · · · (nm)rm (same notation as in Sect. 1.1) of
f(x) into a product of irreducible polynomials k[x]. If f(x) has degree 5 then W =
(1)f(x), because in these models the point at infinity is a k-rational Weierstrass
point.
The proof of the content of Tables 3 and 4 is elementary, but long. Instead of
giving all details we only sketch the main ideas:
Table 4. Weil polynomial x4 + rx3 + sx2 + qrx+ q2 of the curve
C when q is a square
W p rk2(J) (r, s)
(1)6 4 (0,−2q) or (±4√q, 6q)
(1)4(2) 3 (0,−2q)
(1)2(2)2 or (2)3 2 (0,±2q)
(1)3(3) p > 3 2 not possible
p = 3 (±√q, 0)
(1)(2)(3) 1 not possible
(1)2(4) or (2)(4) p ≡ 1 (mod 8) 1 not possible
p 6≡ 1 (mod 8) (0, 0)
(1)(5) p ≡ 1 (mod 5) 0 not possible
p 6≡ 1 (mod 5) (±√q, q)
(3)2 (0, q) or (±2√q, 3q)
(6) p ≡ 5 (mod 12) 0 (0,±q)
p 6≡ 5 (mod 12) (0, q)
(I) Waterhouse determined all possible isogeny classes of supersingular elliptic
curves [Wat69]. Thus, it is possible to write down all isogeny classes of supersingular
abelian surfaces by adding to the simple classes given in Table 1 the split isogeny
classes. By [HNR06] we know exactly what isogeny classes of abelian surfaces do
not contain Jacobians and they can be dropped from the list. By the results of Xing
and Zhu we can distribute the remaining isogeny classes according to the possible
values of rk2.
(II) Each structure of W as a Gk-set determines the value of rk2 and, after (I),
it has a reduced number of possibilities for the isogeny classes. By using (1) and
looking for some incoherence in the behaviour under scalar extension to k2 or k3 of
both, the Galois structure of W and the possible associated isogeny classes, we can
still discard some of these possibilities.
In practice, among the few possibilities left in Tables 3 and 4 we can single out
the isogeny class of the Jacobian of any given supersingular curve by computing
iterates of random divisors of degree zero. However, if C has many automorphisms
they provide enough extra information to completely determine the zeta function.
This will be carried out in the rest of the paper. In the Appendix we display
equations of the supersingular curves with many automorphisms and their Weil
polynomial.
2. Zeta Function of Twists
In this section we review some basic facts about twists and we show how to
compute different properties of a twisted curve in terms of the defining 1-cocycle.
From now on the ground field k will have odd characteristic.
Let C be a supersingular curve of genus 2 defined over k and let W ⊆ C(k)
be the set of Weierstrass points of C. We denote by Aut(C) the k-automorphism
group of C and by Autk(C) the full automorphism group of C.
Let φ : C −→ P1 be a fixed k-morphism of degree 2 and consider the group of
reduced geometric automorphisms of C:
(C) := {u′ ∈ Autk(P
1) | u′(φ(W )) = φ(W )} .
We denote by Aut′(C) the subgroup of reduced automorphisms defined over k.
Any automorphism u of C fits into a commutative diagram:
// P1
for certain uniquely determined reduced automorphism u′. The map u 7→ u′ is a
group homomorphism (depending on φ) and we have a central exact sequence of
groups compatible with Galois action:
1 −→ {1, ι} −→ Autk(C)
φ−→ Aut′
(C) −→ 1,
where ι is the hyperelliptic involution. This leads to a long exact sequence of Galois
cohomology sets:
(2) 1 → {1, ι} → Aut(C) φ→ Aut′(C) δ→ H1(Gk, {1, ι}) → H1(Gk,Autk(C)) →
→ H1(Gk,Aut′k(C)) → H
2(Gk, {1, ι}) ≃ Br2(k) = 0 .
The k/k-twists of C are parameterized by the pointed set H1(Gk,Autk(C))
and, since k is a finite field, a 1-cocycle is determined just by the choice of an
automorphism v ∈ Autk(C). The twisted curve Cv associated to v is defined over
k and is determined, up to k-isomorphism, by the existence of a k-isomorphism
f : C −→ Cv, such that f−1fσ = v.
For instance, the choice v = ι corresponds to the hyperelliptic twist C′; if C is
given by a Weierstrass equation y2 = f(x) then C′ admits the model y2 = tf(x), for
t ∈ k∗\(k∗)2. We say that C is self-dual if it is k-isomorphic to its hyperelliptc twist.
If fJ(x) is the Weil polynomial of C, the Weil polynomial of C
′ is fJ′(x) = fJ(−x);
in particular, for a self-dual curve one has fJ(x) = x
4+ sx2+ q2 for some integer s.
It is easy to deduce from (2) the following criterion for self-duality:
Lemma 2.1. The curve C is self-dual if and only if |Aut′(C)| = |Aut(C)|.
One can easily compute the data Aut(Cv), Aut
′(Cv) of the twisted curve Cv, in
terms of Autk(C), Aut
(C) and the 1-cocycle v.
Let f : C −→ Cv be a geometric isomorphism such that f−1fσ = v. We have
Autk(Cv) = f Autk(C)f
−1, and the k-automorphism group is
(3) Aut(Cv) = {fuf−1 | u ∈ Autk(C), u v = v u
Once we fix any k-morphism of degree two, φv : Cv −→ P1, it determines a unique
geometric automorphism f ′ of P1 such that φvf = f
′φ. The reduced group of
k-automorphisms of Cv is
(4) Aut′(Cv) = {f ′u′(f ′)−1 | u′ ∈ Aut′k(C), u
′ v′ = v′(u′)σ} .
In order to compute the zeta function of Cv we consider the geometric isomor-
phism f : J −→ Jv induced by f . We still have f−1fσ = v∗, where v∗ is the
automorphism of J induced by v. Clearly, πvf = f
σπ, where π, πv are the respec-
tive q-power Frobenius endomorphisms of J, Jv. Hence,
f−1πvf = f
−1fσ(fσ)−1πvf = v∗π .
In particular, πv has the same characteristic polynomial than v∗π. From this fact
one can deduce two crucial results (cf. [HNR06, Props.13.1,13.4]).
Proposition 2.2. Suppose q is a square. Let C be a supersingular genus 2 curve
over k with Weil polynomial (x +
q)4 and let v be a geometric automorphism of
C, v 6= 1, ι. Then, the Weil polynomial x4+rx3+sx2+rx+q2 of Cv is determined
as follows in terms of v (in the column v6 = 1 we suppose v2 6= 1, v3 6= 1, ι):
v v2= 1 v2= ι v3= 1 v3= ι v4= ι v5= 1 v5= ι v6= 1 v6= ι
(r, s) (0,−2q) (0, 2q) (−2√q, 3q) (2√q, 3q) (0, 0) (−√q, q) (√q, q) (0, q) (0,−q)
Proposition 2.3. Suppose q is nonsquare. Let C be a supersingular genus 2 curve
over k with Weil polynomial (x2 + ǫq)2, ǫ ∈ {1,−1}, and let v be a geometric
automorphism of C. Then, the Weil polynomial x4 + rx3 + sx2 + rx + q2 of Cv is
determined as follows in terms of the order n of the automorphism vvσ:
n 1 2 3 4 6
(r, s) (0, 2ǫq) (0,−2ǫq) (0,−ǫq) (0, 0) (0, ǫq)
In applying these results the transitivity property of twists can be helpful.
Lemma 2.4. Let u, v be automorphisms of C and let f : C → Cv be a geometric
isomorphism with f−1fσ = v. Then the curve Cu is the twist of Cv associated to
the automorphism fuv−1f−1 of Cv.
For a curve with a large k-automorphism group the following remark, together
with Tables 3 and 4, determines in some cases the zeta function:
Lemma 2.5. Let F ⊆ C(k) be the subset of k-rational points of C that are fixed
by some non-trivial k-automorphism of C. Then,
|C(k)| ≡ |F| (mod |Aut(C)|) .
Proof. The group Aut(C) acts freely on C(k) \ F . �
Note that F contains the set W (k) of k-rational Weierstrass points, all of them
fixed by the hyperelliptic involution ι of C.
In order to apply this result to the twisted curve Cv we need to compute the
Gk-set structure of Wv and |Fv| solely in terms of v.
Lemma 2.6. (1) For any P ∈ W the length of the Gk-orbit of f(P ) ∈ Wv is
the minimum positive integer n such that v vσ · · · vσn−1(P σn) = P . In particular,
|Wv(k)| = |{P ∈ W | v(P σ) = P}|.
(2) The map f−1 stablishes a bijection between Fv and the set
{P ∈ C(k) | v(P σ) = P = u(P ) for some 1 6= u ∈ Autk(C), s.t. u v = v uσ}.
3. Supersingular curves with many automorphisms
For several cryptographic applications of the Tate pairing the use of distor-
tion maps is essential. A distortion map is an endomorphism ψ of the Jacobian
J of C that provides an input for which the value of the pairing is non-trivial:
eℓ(D1, ψ(D2)) 6= 1 for some fixed ℓ-torsion divisors D1, D2. The existence of
such a map is guaranteed, but in practice it is hard to find it in an efficient way.
Usually, one can start with a nice curve C with many automorphisms, consider
a concrete automorphism u 6= 1, u 6= ι, and look for a distortion map ψ in the
subring Z[π, u∗] ⊆ End(J), where π is the Frobenius endomorphism of J and u∗ is
the automorphism of the Jacobian induced by u. If Z[π, u∗] = End(J) it is highly
probable that a distortion map is found. If Z[π, u∗] 6= End(J) it can be a hard
problem to prove that some nice candidate is a distortion map, but at least one is
able most of the time to find a “denominator” m such that mψ lies in the subring
Z[π, u∗]; in this case, if ℓ ∤ m one can use mψ as a distortion map on divisors of
order ℓ. Several examples are discussed in [GPRS06].
The aim of this section is to exhibit all supersingular curves of genus 2 with
many automorphisms, describe their automorphisms, and compute the character-
istic polynomial of π, which is always a necessary ingredient in order to analyze
the structure of the ring Z[π, u∗]. Recall that a curve C is said to have many auto-
morphisms if it has some geometric automorphism other than the identity and the
hyperelliptic involution; in other words, if |Autk(C)| > 2.
Igusa found equations for all geometric curves of genus 2 with many automor-
phisms, and he grouped these curves in six families according to the possible struc-
ture of the automorphism group [Igu60], [IKO86]. Cardona and Quer found a faith-
ful and complete system of representatives of all these curves up to k-isomorphism
and they gave conditions to ensure the exact structure of the automorphism group
of each concrete model [Car03], [CQ06]. The following theorem sums up these
results.
Theorem 3.1. Any curve of genus 2 with many automorphisms is geometrically
isomorphic to one and only one of the curves in these six families:
Equation of C Aut′
(C) Autk(C)
y2 = x6 + ax4 + bx2 + 1 a, b satisfy (5) C2 C2 × C2
y2 = x5 + x3 + ax a 6= 0, 1/4, 9/100 C2 × C2 D8
y2 = x6 + x3 + a p 6= 3, a 6= 0, 1/4, −1/50 S3 D12
y2 = ax6 + x4 + x2 + 1 p = 3, a 6= 0 S3 D12
y2 = x6 − 1 p 6= 3, 5 D12 2D12
y2 = x5 − x p 6= 5 S4 S̃4
p = 5 PGL2(F5) S̃5
y2 = x5 − 1 p 6= 5 C5 C10
(5) (4c3−d2)(c2−4d+18c−27)(c2−4d−110c+1125) 6= 0, c := ab, d := a3+ b3.
Ibukiyama-Katsura-Oort determined, using Theorem 1.1, when the last three
curves are supersingular [IKO86, Props. 1.11, 1.12, 1.13]:
y2 = x6 − 1 is supersingular iff p ≡ −1 (mod 3)
y2 = x5 − x is supersingular iff p ≡ 5, 7 (mod 8)
y2 = x5 − 1 is supersingular iff p ≡ 2, 3, 4 (mod 5)
It is immediate to check that y2 = ax6 + x4 + x2 + 1 is never supersingular if
p = 3. One can apply Theorem 1.1 to the other curves in the first three families to
distinguish the supersingular ones.
Theorem 3.2. Suppose q is a square and let C be a supersingular curve belonging
to one of the first five families of Theorem 3.1. Then there a twist of C with Weil
polynomial (x+
q)4, and this twist is unique.
Proof. Let E be a supersingular elliptic curve defined over Fp. By [IKO86, Prop.
1.3] the Jacobian J of C is geometrically isomorphic to the product of two supersin-
gular elliptic curves, which is in turn isomorphic to E×E by a well-known theorem
of Deligne. The principally polarized surface (J,Θ) is thus geometrically isomorphic
to (E × E, λ) for some principal polarization λ. Since E has all endomorphisms
defined over Fp2 , (E × E, λ) is defined over Fp2 and by a classical result of Weil
it is Fp2 -isomorphic to the canonically polarized Jacobian of a curve C0 defined
over Fp2 . By Torelli, C0 is a twist of C. The Weil polynomial of C0 is (x ±
because the Frobenius polynomial of E is x2 + p. The fact that C0 and C
0 are the
unique twists of C0 with Weil polynomial (x ±
q)4 is consequence of Proposition
2.2. � �
Corollary 3.3. Under the same assumptions:
(1) The Weil polynomial of C is (x±√q)4 if and only if W = (1)6.
(2) If C belongs to one of the first three families of Theorem 3.1, then it admits
no twist with Weil polynomial x4 ± qx2 + q2 or x4 + q2.
(3) If any of the curves y2 = x5 + x3 + ax, y2 = x6 + x3 + a is supersingular
then a ∈ Fp2 .
Proof. (1) By Table 4, the set W0 of Weierstrass points of C0 has Gk-structure
W0 = (1)
6 and Lemma 2.6 shows that for all automorphisms v 6= 1, ι one has
Wv 6= (1)6; thus, only the twists C0 and C′0 have W = (1)6.
(2) The geometric automorphisms v of C0 satisfy neither v
6 = 1, v2 6= 1, v3 6=
1, ι, nor v6 = ι, nor v4 = ι; thus, by Proposition 2.2 the Weil polynomial of a twist
of C0 is neither x
4 ± qx2 + q2 nor x4 + q2.
(3) The Igusa invariants of C0 take values in Fp2 and a can be expressed in terms
of these invariants [CQ05]. � �
In a series of papers Cardona and Quer studied the possible structures of the
pointed sets H1(Gk,Autk(C)) and found representatives v ∈ Autk(C) (identified
to 1-cocycles of H1(Gk,Autk(C))) of the twists of all curves with many automor-
phisms [Car03], [CQ05], [Car06], [CQ06]. In the next subsections we compute the
zeta function and the number of k-automorphisms of these curves when they are
supersingular. A general strategy that works in most of the cases is to apply the
techniques of Sect. 2 to find a twist of C with Weil polynomial (x ± √q)4 (for q
square) or (x2±q)2 (for q nonsquare) and apply then Propositions 2.2, 2.3 to obtain
the zeta function of all other twists of C. The results are displayed in the Appendix
in the form of Tables, where we exhibit moreover an equation of each curve.
3.1. Twists of the curve C : y2 = x5 − 1, for p 6≡ 0, 1 (mod 5). We have
φ(W ) = {∞} ∪ µ5 and Aut′k(C) ≃ µ5. The zeta function of C can be computed
from Tables 3,4 and Lemma 2.5 applied to C⊗k2. If q 6≡ 1 (mod 5) the only twists
are C, C′. If q ≡ 1 (mod 5) there are ten twists and their zeta function can be
deduced from Proposition 2.2. Table 5 summarizes all computations.
3.2. Twists of the curve C : y2 = x5 − x, for p ≡ 5, 7 (mod 8). Now φ(W ) =
{∞, 0, ±1, ±i}. If p = 5 we have Aut′
(C) = Aut(P1). If p 6= 5 the group Aut′
is isomorphic to S4 and it is generated by the transformations T (x) = ix, S(x) =
, with relations S3 = 1 = T 4, ST 3 = TS2. For q nonsquare the zeta function of
C is determined by Table 3; since the curve is defined over Fp we obtain the zeta
function of C over k by scalar extension.
In all cases we can apply Propositions 2.2 and 2.3 to determine the zeta function
of the twists of C. Tables 6, 7, 8 summarize all computations.
3.3. Twists of the curve C : y2 = x6 − 1, for p ≡ −1 (mod 3), p 6= 5. We have
φ(W ) = µ6 and Aut
(C) = {±x, ±ηx,±η2x,± 1
}, where η ∈ Fp2 is a
primitive third root of unity.
The zeta function of C can be computed from Tables 3,4 and Lemma 2.5 applied
to C and C⊗k2. The zeta function of all twists can be determined by Propositions
2.2, 2.3. Tables 9, 10 summarize all computations.
3.4. Twists of the supersingular curve C : y2 = x6 +x3 + a, for p > 3. Recall
that a is a special value making the curve C supersingular and a 6= 0, 1/4, −1/50.
We have now
φ(W ) = {θ, ηθ, η2θ, A
}, Aut′
(C) = {x, ηx, η2x, A
where A, z, θ ∈ k satisfy A3 = a, z2 + z + a = 0, θ3 = z.
The Galois action on W and on Aut′
(C) depends on z and a/z being cubes or
not in their minimum field of definition k∗ or (k2)
∗. This is determined by the fact
that a is a cube or not.
Lemma 3.4. If a is a cube in k∗ then z, a/z are both cubes in k∗ or in (k2)
according to 1− 4a ∈ (k∗)2 being a square or not.
If a is not a cube in k∗ then z, a/z are both noncubes in k∗ or in (k2)
∗, according
to 1− 4a ∈ (k∗)2 being a square or not.
Proof. Let us check that all situations excluded by the statement lead to W =
(1)3(3) or Wv = (1)
3(3) for some twist, in contradiction with Tables 3, 4.
Suppose q ≡ −1 (mod 3). If 1− 4a is a square then a, z, a/z are all cubes in k∗.
If 1 − 4a is not a square then a is a cube and if z, zσ are not cubes in k2 we have
θσ = ω(A/θ), with ω3 = 1, ω 6= 1, and the twist by v = (ω−1(A/x),
ay/x3) has
Wv = (1)
3(3) by Lemma 2.6.
Suppose q ≡ 1 (mod 3). If 1−4a is not a square we have z(q2−1)/3 = a(q−1)/3, so
that a is a cube in k∗ if and only if z, zσ are cubes in k∗2 . Suppose now that 1−4a is
a square. If exactly one of the two elements z, a/z is a cube we have W = (1)3(3);
thus z, a/z are both cubes or noncubes in k∗. In particular, if a is not a cube
then z, a/z are necessarily both noncubes. Finally, if a is a cube and z, a/z are
noncubes in k∗, Lemma 2.6 shows that Wv = (1)
3(3) for the twist corresponding
to v = (ηx, y). � �
For the computation of the zeta functions of the twists it is useful to detect that
some of the combinations a square/nonsquare and 1−4a square/nonsquare are not
possible.
Lemma 3.5. Suppose q ≡ 1 (mod 3).
(1) If q ≡ −1 (mod 4) then 1− 4a is not a square.
(2) If q is nonsquare then a is not a square.
(3) If q is a square then a and 1− 4a are both squares.
Proof. Let Cv be the twist of C corresponding to v(x, y) = (ηx, y).
(1) Supose 1− 4a is a square. If a is a cube we have W = (1)6 and if a is not a
cube we have Wv = (1)
6; by Table 3 we get (r, s) = (0,−2
q) in both cases.
On the other hand, Lemmas 2.5 and 2.6 applied to C⊗k k2 show in both cases that
s ≡ 1 (mod 3); thus, p ≡ 1 (mod 4).
(2) Suppose a is a square. If a is a cube (respectively a is not a cube) we
have W = (1)6 or W = (2)3 (respectively Wv = (1)
6 or Wv = (2)
3), according
to 1 − 4a being a square or not. In all cases we have (r, s) = (0,±2q) by Table
3, and a straightforward application of Lemma 2.5 and (2) of Lemma 2.6 leads to
r ≡ −1 (mod 3), which is a contradiction.
(3) In all cases in which a or 1 − 4a are nonsquares we get (r, s) = (0, q) either
for the curve C or for the curve Cv. This contradicts Corollary 3.3. � �
After these results one can apply the general strategy. The results are displayed
in Tables 11, 12, 13.
3.5. Twists of the supersingular curve C : y2 = x5+x3+ax. Recall that a is a
special value making C supersingular and a 6= 0, 1/4, 9/100. Given z ∈ k satisfying
z2 + z + a = 0 we have φ(W ) = {0, ∞, ±
a/z},
Autk(C) =
(ω2 x, ω y) | ω4 = 1
| w4 = a
Lemma 3.6. If q ≡ 1 (mod 4) then a and 1−4a are both squares or both nonsquares
in k∗. If q is a square then necessarily a and 1− 4a are both squares.
Proof. If a 6∈ (k∗)2, 1−4a ∈ (k∗)2, thenW = (1)4(2) and (r, s) = (0,−2q) by Tables
3,4; this contradicts Lemma 2.5 because |Aut(C)| = |F| = 4 and r ≡ 2 (mod 4).
Suppose now a ∈ (k∗)2, 1 − 4a 6∈ (k∗)2. If a ∈ (k∗)4 then W = (1)2(2)2
and (r, s) = (0,±2q); this contradicts Lemma 2.5 because |Aut(C)| = 8, |F| = 6
if q ≡ 1 (mod 8) and |F| = 2 or 10 if q ≡ 5 (mod 8), so that r ≡ 4 (mod 8)
in both cases. If a 6∈ (k∗)4 we get a similar contradiction for the curve Cv for
v(x, y) = (−x, iy).
If a, 1 − 4a are nonsquares, then W = (1)2(4) and the Weil polynomial of C is
x4 + q2 by Tables 3,4. If q is a square this contradicts Corollary 3.3. � �
Lemma 3.7. If q is a square then a ∈ (k∗)4 if and only if z ∈ (k∗)2.
Proof. Suppose a ∈ (k∗)4, z 6∈ (k∗)2 and let us look for a contradiction. Consider
the k-automorphisms u(x, y) = (−x, iy), v(x, y) = (w
y) of C, where w4 = a.
By Lemma 2.6, Wu = (1)
6 and Cu has Weil polynomial (x ±
q)4 by Corollary
3.3; since u2 = ι, the Weil polynomial of C is (x2 + q)2 by Proposition 2.2 and
Lemma 2.4. The quotient E := C/v is an elliptic curve defined over k and the
Frobenius endomorphism π of E must satisfy π2 = −q. Since q is a square, E has
four automorphisms and its j invariant is necessarily jE = 1728. Now, E has a
Weierstrass equation: Y 2 = (X + 2w)(X2 + 1 − 2w2), where X = (x2 + w2)x−1,
Y = y(x + w)x−2 are invariant under the action of v. The condition jE = 1728 is
equivalent to a = 0 (which was excluded from the beginning) or a = (9/14)2; in
this latter case z is a square in Fp2 and we get a contradiction.
Suppose now a 6∈ (k∗)4, z ∈ (k∗)2. We haveW = (1)6 and C has Weil polynomial
(x ± √q)4 by Corollary 3.3. By Proposition 2.2, the Weil polynomial of Cu is
(x2+q)2. For any choice of w = 4
a, the morphism f(x, y) = (x+w
x−w ,
1+2w2
(x−w)3 )
sets a k2-isomorphism between C and the model:
Cu : y
2 = (x2 − 1)(x4 + bx2 + 1), b = (12
a− 2)/(2
a+ 1),
of Cu. The quotient of this curve by the automorphism (−x, y) is the elliptic curve
E : Y 2 = (X − 1)(X2 + bX + 1). Arguing as above, E has j-invariant 1728, and
this leads to a = 0 (excluded from the beginning) or a = (9/14)2, which is a
contradiction since a would be a fourth power in Fp2 . � �
After these results one is able to determine the zeta function of all twists of C
when q is a square; the results are displayed in Table 14. In the cases where the
Weil polynomial is (x − ǫ√q)4, ǫ = ±1, the methods of section 2 are not sufficient
to determine ǫ; our computation of this sign follows from a study of the 4-torsion
of an elliptic quotient of the corresponding curve.
In order to deal with the case q nonsquare we need to discard more cases.
Lemma 3.8. Suppose q nonsquare. If q ≡ −1 (mod 4) then a and 1 − 4a cannot
be both nonsquares.
If q ≡ 1 (mod 4) and a ∈ (k∗)2 then a ∈ (k∗)4 if and only if z 6∈ (k∗)2.
Proof. If a, 1 − 4a are both nonsquares the polynomial x4 + x2 + a is irreducible
and the Weil polynomial of C is x4 + q2 by Table 3; hence, the Weil polynomial
of C ⊗k k2 is (x2 + q2)2. If q ≡ −1 (mod 4) we have a ∈ k∗ ⊆ (k∗2)4 and this
contradicts Table 14.
Suppose q ≡ 1 (mod 4) and a ∈ (k∗)2; by Lemma 3.6, 1−4a is also a square and
z ∈ k∗. If a ∈ (k∗)4 and z ∈ (k∗)2 we get W = (1)6, and (r, s) = (0,−2q) by Table
3; we get a contradiction because the Jacobian J of C is simple ([MN02, Thm. 2.9])
and C has elliptic quotients over k because the automorphisms (w2/x, (w3y)/x3)
are defined over k. If a 6∈ (k∗)4 and z 6∈ (k∗)2 we get an analogous contradiction
for the curve Cu twisted by u(x, y) = (−x, iy). � �
The results for the case q nonsquare follow now by the usual arguments and they
are displayed in Tables 15, 16.
3.6. Twists of the supersingular curve C : y2 = x6+ax4+bx2+1. Recall that
a, b ∈ k are special values satisfying (5) and making C supersingular; in particular
p > 3. The curve C has four twists because Autk(C) = Aut(C) = {(±x,±y)}
is commutative and has trivial Galois action. The Jacobian of C is k-isogenous
to the product E1 × E2 of the elliptic curves with Weierstrass equations y2 =
x3 + ax2 + bx + 1, y2 = x3 + bx2 + ax + 1, obtained as the quotient of C by the
respective automorphisms v = (−x, y), ιv = (−x,−y). For q nonsquare, these
elliptic curves have necessarily Weil polynomial x2 + q and the Weil polynomial of
C is (x2 + q)2.
Lemma 3.9. If q is a square C has Weil polynomial (x±√q)4.
Proof. By Theorem 3.2 and Proposition 2.2 C has Weil polynomial (x ± √q)4 or
(x2 − q)2. In both cases the elliptic curves E1, E2 have Weil polynomial (x±
and we claim that they are isogenous. Since E(k) ≃ (Z/(1±√q)Z)2 as an abelian
group, our elliptic curves have four rational 2-torsion points and the polynomial
Table 5. Twists of the curve y2 = x5 − 1 for p ≡ 2, 3, 4 (mod 5). The sign
ǫ = ±1 is determined by √q ≡ ǫ (mod 5). The last row provides eight inequivalent
twists corresponding to the four nontrivial values of t ∈ k∗/(k∗)5
Cv v (r, s) s.d. |Aut(Cv)|
y2 = x5 − 1 (x, y)
q ≡ ±2 (mod 5)
q ≡ −1 (mod 5)
q ≡ 1 (mod 5)
(0, 0)
(0, 2q)
(−4ǫ√q, 6q)
y2 = tx5 − 1, t 6∈ (k∗)5 (t
5 x, y) q ≡ 1 (mod 5) (ǫ√q, q) no 10
Table 6. Twists of the curve y2 = x5 − x when q ≡ −1 (mod 8)
Cv v (r, s) s.d. |Aut(Cv)|
y2 = x5 − x (x, y) (0, 2q) yes 8
y2 = x5 + x (ix, 1+i√
y) (0, 2q) yes 4
y2 = (x2 + 1)(x2 − 2tx − 1)(x2 + 2
x − 1)
t2 + 1 6∈ (k∗)2 (−
) (0,−2q) yes 24
y2 = (x2 + 1)(x4 − 4tx3 − 6x2 + 4tx + 1),
t2 + 1 6∈ (k∗)2
, i−1√
(0, 0) yes 4
y2 = x6 − (t + 3)x5 + 5( 2+t−s
)x4 + 5(s − 1)x3
+5( 2−t−s
)x2 + (t − 3)x + 1 irred., s2 + t2 = −2
2(1−i)y
(x+i)3
(0, q) no 6
x3 + ax2 + bx + 1 has three roots e1, e2, e3 ∈ k. Since e1e2e3 = 1, either one or
three of these roots are squares. If only one root is a square we have W = (1)2(2)2,
Wv = (1)
4(2) and C, Cv have both Weil polynomial (x
2 ± q)2, in contradiction
with Theorem 3.2. Hence, the three roots are squares, W = (1)6, and C has Weil
polynomial (x±√q)4 by Corollary 3.3. � �
The zeta function of the twists of C is obtained from Propositions 2.2 and 2.3.
The results are displayed in Table 17. For q square the sign of (x ± √q)4 can be
determined by analyzing the 4-torsion of the elliptic curve y2 = x3 + ax2 + bx+ 1.
Finally, there are special curves over k whose geometric model y2 = x6 + ax4 +
bx2+1 is not defined over k (cf. [Car03, Sect.1]). It is straightforward to apply the
techniques of this paper to determine their zeta function too.
4. Appendix
In this appendix we display in several tables the computation of the zeta func-
tion of the supersingular curves of genus 2 with many automorphisms. For each
curve Cv, we exhibit the number of k-automorphisms and the pair of integers (r, s)
determining the Weil polynomial fJv(x) = x
4 + rx3 + sx2 + qrx+ q2 of Cv. In the
column labelled “s.d” we indicate if C is self-dual. For the non-self-dual curves we
exhibit only one curve from the pair Cv, C
We denote by η, i ∈ k a primitive third, fourth root of unity. For n a positive
integer and x ∈ k∗ we define
νn(x) = 1 if x ∈ (k∗)n, νn(x) = −1 otherwise .
In all tables the parameters s, t take values in k∗.
Conclusion. We show that the zeta function of a supersingular curve of genus two
is almost determined by the Galois structure of a finite set easy to describe in terms
of a defining equation. For curves with many automorphisms this result is refined
to obtain a direct (non-algoritmic) computation of the zeta function in all cases. As
Table 7. Twists of the curve y2 = x5 − x when q ≡ 5 (mod 8)
Cv v p (r, s) s.d. |Aut(Cv)|
y2 = x5 − x (x, y) p > 5
p = 5
(0,−2q) yes 24
y2 = x5 − 4x (−x, iy) (0, 2q) yes 8
y2 = x5 − 2x (ix, 1+i√
y) (0, 0) yes 4
y2 = (x2 + 2)(x4 − 12x2 + 4)
, i−1√
p > 5
p = 5
(0, 2q) yes
y2 = f(t, x)f(
18+(5i−3)t
(5i+3)−2t , x)
f(t, x) = x3 − tx2 + (t − 3)x+ 1 irred.
2(1−i)y
(x+i)3
p > 5
p = 5
(0, q)
y2 = x5 − x − t, trk/F5 (t) = 1 (x + 1, y) p = 5 (
5q, 3q) no 10
y2 = x6 + tx5 + (1 − t)x + 2, irred. ( 3
x−1 ,
(x+1)3
) p = 5 (0,−q) yes 6
Table 8. Twists of the curve y2 = x5 − x when p ≡ 5, 7 (mod 8) and q is a
square. Here ǫ = (−1/√q) and ǫ′ = (−3/√q)
Cv v p (r, s) s.d. |Aut(Cv)|
y2 = x5 − x (x, y) p > 5
p = 5
(−4ǫ√q, 6q) no 48
y2 = x5 − t2x, t 6∈ (k∗)2 (−x, iy) (0, 2q) yes 8
y2 = x5 − tx, t 6∈ (k∗)2 (ix, 1+i√
y) (0, 0) no 8
y2 = (x2 − t)(x4 + 6tx2 + t2),
t 6∈ (k∗)2
, i−1√
p > 5
p = 5
(0,−2q) yes 4
y2 = (x3 − t)(x3 − (15
3 − 26)t),
t 6∈ (k∗)3
2(1−i)y
(x+i)3
p > 5
p = 5
q, 3q) no
y2 = x5 − x − t, trk/F5(t) = 1 (x+ 1, y) p = 5 (
q, q) no 10
y2 = x6 + tx5 + (1 − t)x+ 2, irred. ( 3
x−1 ,
(x+1)3
) p = 5 (0, q) no 12
Table 9. Twists of the curve y2 = x6 − 1 when q ≡ −1 (mod 3), p 6= 5. Here ǫ = (−1/p)
Cv v (r, s) s.d. |Aut(Cv)|
y2 = x6 − 1 (x, y) (0, 2q) iff ǫ = −1 6 + 2ǫ
y2 = x6 − t, t 6∈ (k∗)2 (−x,−y) (0, 2q) iff ǫ = 1 6 − 2ǫ
y2 = x(x2 − 1)(x2 − 9) ( 1
) (0,−2ǫq) yes 12
y2 = (x4 − 2stx3 + (7s + 1)x2 + 2tsx + 1)·
·(x2 − 4
x− 1), t2 + 4 ∈ k∗ \ (k∗)2, s−1 = t2 + 3 (−
) (0, 2ǫq) yes 12
y2 = x6 + 6tx5 + 15sx4 + 20tsx3 + 15s2x2+
+6ts2x + s3, s = t2 − 4 6∈ (k∗)2,
gcd(x(q+1)/3 − 1, x2 − tx + 1) = 1
) (0, ǫq) yes 6
y2 = x6 + 6x5 + 15sx4 + 20sx3 + 15s2x2+
+6s2x + s3, s = t2/(t2 + 4) 6∈ (k∗)2,
gcd(x(q+1)/3 + 1, x2 − tx − 1) = 1
) (0,−ǫq) yes 6
Table 10. Twists of the curve y2 = x6 − 1 when p ≡ −1 (mod 3), p 6= 5 and q
is a square. Here ǫ = (−3/√q)
Cv v (r, s) s.d. |Aut(Cv)|
y2 = x6 − 1 (x, y) (−4ǫ√q, 6q) no 24
y2 = x6 − t3, t 6∈ (k∗)2 (−x, y) (0,−2q) yes 12
y2 = x6 − t2, t 6∈ (k∗)3 (ηx, y) (2ǫ√q, 3q) no 12
y2 = x6 − t, t 6∈ ((k∗)2 ∪ (k∗)3) (−ηx,−y) (0, q) no 12
y2 = x(x2 + 3t)(x2 + t
), t 6∈ (k∗)2 ( 1
) (0, 2q) yes 4
y2 = x6 + 15tx4 + 15t2x2 + t3, t 6∈ (k∗)2 (− 1
) (0,−2q) yes 4
Table 11. Twists of the supersingular curve y2 = x6+x3+a, a 6= 0, 1/4,−1/50,
when q ≡ −1 (mod 3). Here ǫ = ν2(a) and A is the cubic root of a in k
Cv v (r, s) s.d. |Aut(Cv)|
y2 = x6 + x3 + a (x, y) (0, 2q) iff ǫ = −1 3 + ǫ
y2 = θ−3(x − θ)6 − g(x)3 + aθ3(x − θσ)6
g(x) min. polyn. of θ ∈ k2 \ k, Nk2/k(θ) = A
y) (0, 2ǫq) iff ǫ = −1 9 + 3ǫ
y2 = θ(x− η)6 − g(x)3 + aθ−1(x − η2)6
g(x) = x2 + x+ 1, θ ∈ k2 \ (k∗2)
3, Nk2/k(θ) = a
y) (0,−ǫq) no 6
Table 12. Twists of the supersingular curve y2 = x6+x3+a, a 6= 0, 1/4,−1/50,
when q ≡ 1 (mod 3) and q is nonsquare. Here A is a cubic root of a in k and n = 3,
if a ∈ (k∗)3, whereas A = a, n = 1, if a 6∈ (k∗)3
Cv v ν3(a) (r, s) s.d. |Aut(Cv)|
y2 = x6 + x3 + a (x, y)
(0,−2q)
(0, q)
y2 = x6 + tx3 + t2a, t 6∈ (k∗)3
y2 = x6 + ax3 + a3
3 x, y)
(0, q)
(0,−2q)
y2 = θ−n(x − θ)6 − g(x)3 + aθn(x− θσ)6
g(x) min. polyn. of θ ∈ k2 \ k, Nk2/k(θ) = A
y) (0, 2q) yes 2
Table 13. Twists of the supersingular curve y2 = x6+x3+a, a 6= 0, 1/4,−1/50,
when q is a square. Here ǫ = (−3/√q). Also, A is a cubic root of a in k and n = 3,
if a ∈ (k∗)3, whereas A = a, n = 1, if a 6∈ (k∗)3
Cv v ν3(a) (r, s) s.d. |Aut(Cv)|
y2 = x6 + x3 + a (x, y)
(−4ǫ√q, 6q)
q, 3q)
y2 = x6 + tx3 + t2a, t 6∈ (k∗)3
y2 = x6 + ax3 + a3
3 x, y)
q, 3q)
(−4ǫ√q, 6q) no
y2 = θ−n(x − θ)6 − g(x)3 + aθn(x− θσ)6
g(x) min. polyn. of θ ∈ k2 \ k, Nk2/k(θ) = A
y) (0,−2q) no 4
Table 14. Twists of the supersingular curve y2 = x5 + x3 + ax, a 6=
0, 1/4, 9/100, when q is a square. The last row provides two inequivalent twists
according to the two values of
a. Here ǫ = −(−1/√q)ν4(z) and ǫ′ =
−(−1/√q)ν4(tz), where z2 + z + a = 0
Cv v ν4(a) (r, s) s.d. |Aut(Cv)|
y2 = x5 + x3 + ax (x, y)
q, 6q)
(0, 2q)
y2 = x5 + tx3 + at2x, t 6∈ (k∗)2 (−x, t
(0, 2q)
q, 6q)
y2 = g(x)
θ2(x− θσ)4 + g(x)2+
+aθ−2(x− θ)4
, Nk2/k(θ) =
g(x) min. polyn. of θ ∈ k2 \ k
y) (0,−2q) yes 4
Table 15. Twists of the supersingular curve y2 = x5 + x3 + ax, a 6=
0, 1/4, 9/100, when q is nonsquare and a 6∈ (k∗)2
Cv v (−1/p) (r, s) s.d. |Aut(Cv)|
y2 = x5 + x3 + ax (x, y)
(0, 0)
(0, 2q)
y2 = (x2 − a)
a)4 + (x2 − a)2+
+aθ−1(x +
, θ ∈ k2, Nk2/k(θ) = a
(0, 2q)
(0, 0)
Table 16. Twists of the supersingular curve y2 = x5 + x3 + ax, a 6=
0, 1/4, 9/100, when q is nonsquare and a ∈ (k∗)2. Here ǫ = (−1/p). If
p ≡ −1 (mod 4) we assume that
a belongs to (k∗)2
Cv v ν4(a) (r, s) s.d. |Aut(Cv)|
y2 = x5 + x3 + ax (x, y)
(0, 2q)
(0,−2q)
iff ǫ = −1
6 + 2ǫ
y2 = x5 + tx3 + at2x, t 6∈ (k∗)2 (−x, t
(0,−2ǫq)
(0, 2q)
y2 = g(x)
θ2(x− θσ)4 + g(x)2+
+aθ−2(x − θ)4
, Nk2/k(θ) =
g(x) min. polyn. of θ ∈ k2 \ k
y) (0, 2q) iff ǫ = 1 6 − 2ǫ
y2 = g(x)
θ2(x− θσ)4 + g(x)2+
+aθ−2(x − θ)4
, Nk2/k(θ) = −
g(x) min. polyn. of θ ∈ k2 \ k
y) (0, 2ǫq) yes 4
Table 17. Twists of the supersingular curve y2 = x6 + ax4 + bx2 + 1 satisfying (5)
Cv v (r, s) s.d. |Aut(Cv)|
y2 = x6 + ax4 + bx2 + 1 (x, y)
q nonsq.
q square
(0, 2q)
(±4√q, 6q) no 4
y2 = x6 + atx4 + bt2x2 + t3
t 6∈ (k∗)2 (−x,−y)
q nonsq.
q square
(0, 2q)
(0,−2q) no 4
an application one gets a direct computation of the cryptographic exponent of the
Jacobian of these curves. Also, the computation of the zeta function is necessary to
determine the structure of the endomorphism ring of the Jacobian and to compute
distortion maps for the Weil and Tate pairings.
Acknowledgement. It is a pleasure to thank Christophe Ritzenthaler for his help
in finding some of the equations of the twisted curves.
References
[Car03] G. Cardona, On the number of curves of genus 2 over a finite field, Finite Fields and
Their Applications 9 (2003), 505-526.
[CQ05] G. Cardona, J. Quer, Field of moduli and field of definition for curves of genus 2, in
Computational aspects of algebraic curves (T. Shaska, ed.) pp. 71-83., Lecture Notes Series
on Computing 13 (World Scientific).
[Car06] G. Cardona, Representations of Gk-groups and the genus 2 curve y
2 = x5 − x, Journal
of Algebra 303 (2006), 707-721.
[CQ06] G. Cardona, J. Quer, Curves of genus 2 with group of automorphisms isomorphic to D8
or D12, Trans. Amer. Math. Soc. to appear.
[FR94] G. Frey, H.-G. Rück, A remark concerning m-divisibility and the discrete logarithm in the
divisor class group of curves, Mathematics of Computation 62 (1994), 865-874.
[Gal01] S. D. Galbraith, Supersingular curves in cryptography, In ASIACRYPT 2001, volume
2248 of Lecture Notes in Computer Science, 495-513. Springer-Verlag 2001.
[GPRS06] S. D. Galbraith, J. Pujolàs, C. Ritzenthaler, B. Smith, Distortion maps for genus two
curves, http://eprint.iacr.org/2006/375.
[HNR06] E.W. Howe, E. Nart, C. Ritzenthaler, Jacobians in isogeny classes of abelian surfaces
over finite fields, arXiv:math.NT/0607515.
[IKO86] T. Ibukiyama, T. Katsura, F. Oort, Supersingular curves of genus two and class numbers,
Compositio Math. 57 (1986), 127-152.
[Igu60] J.-I. Igusa, Arithmetic variety of moduli for genus two, Annals of Mathematics, 72 (1960)
612-649.
[MN02] D. Maisner, E. Nart, with an appendix by Everett W. Howe, Abelian surfaces over finite
fields as jacobians, Experimental Mathematics, 11 (2002), 321-337.
http://eprint.iacr.org/2006/375
http://arxiv.org/abs/math/0607515
[MN06] D. Maisner, E. Nart, Zeta functions of supersingular curves of genus 2, Canadian Journal
of Mathematics 59 (2007), 372-392.
[MOV93] A.J. Menezes, T. Okamoto, S.A. Vanstone, Reducing Elliptic Curve Logarithms to Log-
arithms in a Finite Field, IEEE Trans. on Information Theory 39 (1993), 1639-1646.
[RS04] K. Rubin, A. Siverberg, Supersingular abelian varieties in cryptology, In Advances in
Cryptology-Crypto’2002, volume 2442 of Lecture Notes in Computer Science, 336-353.
Springer-Verlag 2004.
[VV92] G. van der Geer, M. van der Vlugt, Supersingular curves of genus 2 over finite fields of
characteristic 2, Math. Nachrichten 159 (1992), 73-81.
[Wat69] W.C. Waterhouse, Abelian varieties over finite fields, Annales Scientifiques de l’École
Normale Supérieure (4) 2 (1969), 521-560.
[Xin96] C.P. Xing, On supersingular abelian varieties of dimension two over finite fields, Finite
Fields and Their Applications 2 (1996), 407-421.
[Yui78] N. Yui, On the Jacobian varieties of hyperelliptic curves over fields of characteristic p > 2,
Journal of Algebra 52 (1978), 378-410.
[Zhu00] H.J. Zhu, Group Structures of Elementary Supersingular Abelian Varieties over Finite
Fields, Journal of Number Theory 81 (2000), 292-309.
Dept. Ciències Matemàtiques i Informàtica, Universitat de les Illes Balears, 07122,
Palma de Mallorca, Spain
E-mail address: gabriel.cardona@uib.es
Departament de Matemàtiques, Universitat Autònoma de Barcelona, Edifici C, 08193
Bellaterra, Barcelona, Spain
E-mail address: nart@mat.uab.cat
	Introduction
	1. Zeta Function and Cryptographic Exponent
	1.1. Computation of the Zeta Function when p=2
	1.2. Computation of the Zeta Function when p is odd
	2. Zeta Function of Twists
	3. Supersingular curves with many automorphisms
	3.1. Twists of the curve C2mu-:6muplus1muy2=x5-1, for p0,1 (mod 5)
	3.2. Twists of the curve C2mu-:6muplus1muy2=x5-x, for p5,7 (mod 8)
	3.3. Twists of the curve C2mu-:6muplus1muy2=x6-1, for p-1 (mod 3), p=5
	3.4. Twists of the supersingular curve C2mu-:6muplus1muy2=x6+x3+a, for p>3
	3.5. Twists of the supersingular curve C2mu-:6muplus1muy2=x5+x3+ax
	3.6. Twists of the supersingular curve C2mu-:6muplus1muy2=x6+ax4+bx2+1
	4. Appendix
	References

  We compute in a direct (not algorithmic) way the zeta function of all
supersingular curves of genus 2 over a finite field k, with many geometric
automorphisms. We display these computations in an appendix where we select a
family of representatives of all these curves up to geometric isomorphism and
we exhibit equations and the zeta function of all their twists. As an
application we obtain a direct computation of the cryptographic exponent of the
Jacobians of these curves.

Introduction
One-round tripartite Diffie-Hellman, identity based encryption, and short digital
signatures are some problems for which good solutions have recently been found,
making critical use of pairings on supersingular abelian varieties over a finite field
k. The cryptographic exponent cA of a supersingular abelian variety A is a half-
integer that measures the security against an attack on the DL problem based on
the Weil or the Tate pairings. Also, it is relevant to determine when pairings can
be efficiently computed. Rubin and Silverberg showed in [RS04] that this invariant
is determined by the zeta function of A.
In this paper we give a direct, non-algorithmic procedure to compute the zeta
function of a supersingular curve of genus 2, providing thus a direct computation of
the cryptographic exponent of its Jacobian. This is achieved in Sect. 1. For even
characteristic the results are based on [MN06] and are summarized in Table 2; for
odd characteristic we use results of Xing and Zhu on the structure of the group of
k-rational points of a supersingular abelian surface and we almost determine the
zeta function in terms of the Galois structure of the set of Weierstrass points of the
curve (Tables 3, 4). In the rest of the paper we obtain a complete answer in the case
of curves with many automorphisms. In Sect. 2 we study the extra information
provided by these automorphisms and we show how to obtain the relevant data to
compute the zeta funtion of a twisted curve in terms of data of the original curve
and the 1-cocycle defining the twist. In Sect. 3 we select a family of representatives
of these curves up to k-isomorphism and we apply the techniques of the previous
section to deal with each curve and all its k/k-twists. The results are displayed in
an Appendix in the form of tables.
In what cryptographic applications of pairings concerns, curves with many au-
tomorphisms are interesting too because they are natural candidates to provide
The authors acknowledge support from the projects MTM2006-15038-C02-01 and MTM2006-
11391 from the Spanish MEC.
http://arxiv.org/abs/0704.1951v1
distortion maps on the Jacobian. In this regard the computation of the zeta func-
tion is a necessary step to study the structure of the endomorphism ring of the
Jacobian (cf. [GPRS06]).
1. Zeta Function and Cryptographic Exponent
Let p be a prime number and let k = Fq be a finite field of characteristic p.
We denote by kn the extension of degree n of k in a fixed algebraic closure k,
Gk := Gal(k/k) is the absolute Galois group of k, and σ ∈ Gk the Frobenius
automorphism.
Let C be a projective, smooth, geometrically irreducible, supersingular curve of
genus 2 defined over k. The Jacobian J of C is a supersingular abelian surface over
k (the p-torsion subgroup of J(k) is trivial). Let us recall how supersingularity is
reflected in a model of the curve C:
Theorem 1.1. If p is odd, any curve of genus 2 defined over k admits an affine
Weierstrass model y2 = f(x), with f(x) a separable polynomial in k[x] of degree 5
or 6. The curve is supersingular if and only if M (p)M = 0, where M , M (p) are the
matrices:
cp−1 cp−2
c2p−1 c2p−2
, M (p) =
p−1 c
2p−1 c
, f(x)(p−1)/2 =
If p = 2 a curve of genus 2 defined over k is supersingular if and only if it admits
an affine Artin-Schreier model y2 + y = f(x), with f(x) an arbitrary polynomial in
k[x] of degree 5.
For the first statement see [Yui78] or [IKO86], for the second see [VV92].
For any simple supersingular abelian variety A defined over k, Rubin and Silver-
berg computed in [RS04] the cryptographic exponent cA, defined as the half-integer
such that qcA is the size of the smallest field F such that every cyclic subgroup of
A(k) can be embedded in F ∗. This invariant refines the concept of embedding de-
gree, formerly introduced as a measure of the security of the abelian variety against
the attacks to the DLP by using the Weil pairing [MOV93] or the Tate pairing
[FR94] (see for instance [Gal01]).
Let us recall the result of Rubin-Silverberg, adapted to the dimension two case.
After classical results of Tate and Honda, the isogeny class of A is determined by
the Weil polynomial of A, fA(x) = x
4 + rx3 + sx2 + qrx + q2 ∈ Z[x], which is
the characteristic polynomial of the Frobenius endomorphism of the surface. For A
supersingular the roots of fA(x) in Q are of the form
q ζ, where
q is the positive
square root of q and ζ is a primitive m-th root of unity.
Theorem 1.2. Suppose A is a simple supersingular abelian surface over Fq and
let ℓ > 5 be any prime number dividing |A(Fq)|. Then, the smallest half-integer cA
such that qcA − 1 is an integer divisible by ℓ is given by
m/2, if q is a square,
m/(2,m), if q is not a square .
In particular, the cryptographic exponent cA is an invariant of the isogeny class
of A. The complete list of simple supersingular isogeny classes of abelian surfaces
can be found in [MN02, Thm. 2.9]. It is straightforward to find out the m-th root
of unity in each case. We display the computation of cA in Table 1.
Table 1. Cryptographic exponent cA of the simple supersingular
abelian surface A with Weil polynomial fA(x) = x
4 + rx3 + sx2 +
qrx + q2
(r, s) conditions on p and q cA
(0,−2q) q nonsquare 1
(0, 2q) q square, p ≡ 1 (mod 4) 2
q, 3q) q square, p ≡ 1 (mod 3) 3/2
(−2√q, 3q) q square, p ≡ 1 (mod 3) 3
(0, 0) (q nonsquare, p 6= 2) or (q square, p 6≡ 1 (mod 8)) 4
(0, q) q nonsquare 3
(0,−q) (q nonsquare, p 6= 3) or (q square, p 6≡ 1 (mod 12)) 6
q, q) q square, p 6≡ 1 (mod 5) 5/2
(−√q, q) q square, p 6≡ 1 (mod 5) 5
5q, 3q) q nonsquare, p = 5 5
2q, q) q nonsquare, p = 2 12
Therefore, the computation of the cryptographic exponent of the Jacobian J of
a supersingular curve C amounts to the computation of the Weil polynomial of J ,
which is related in a well-known way to the zeta function of C. We shall call fJ(x)
the Weil polynomial of C too.
The computation of fJ(x) has deserved a lot of attention because for the crypto-
graphic applications one needs to know the cardinality |J(Fq)| = fJ(1) of the group
of rational points of the Jacobian. However, in the supersingular case the current
“counting points” algorithms are not necessary because there are more direct ways
to compute the polynomial fJ(x).
The aim of this section is to present these explicit methods, which take a different
form for p odd or even. For p = 2 the computation of fJ(x) is an immediate
consequence of the methods of [MN06], based on ideas of van der Geer-van der
Vlugt; for p > 2 we derive our results from the group structure of J(Fq), determined
in [Xin96], [Zhu00], and from the exact knowledge of what isogeny classes of abelian
surfaces do contain Jacobians [HNR06]. In both cases we shall show that fJ (x) is
almost determined by the structure as a Galois set of a finite subset of k, easy to
compute from the defining equation of C.
1.1. Computation of the Zeta Function when p = 2. We denote simply by
tr the absolute trace trk/F2 . Recall that ker(tr) = {x + x2 | x ∈ k} is an F2-linear
subspace of k of codimension 1.
Every projective smooth geometrically irreducible supersingular curve C of genus
2 defined over k admits an affine Artin-Schreier model of the type:
C : y2 + y = ax5 + bx3 + cx+ d, a ∈ k∗, b, c, d ∈ k,
which has only one point at infinity [VV92]. The change of variables y = y + u,
u ∈ k, allows us to suppose that d = 0 or d = d0, with d0 ∈ k\ker(tr) fixed. Twisting
C by the hyperelliptic twist consists in adding d0 to the defining equation. If we
denote by J ′ the Jacobian of the twisted curve we have fJ′(x) = fJ(−x). Thus, for
the computation of fJ(x) we can assume that d = 0.
The structure as a Gk-set of the set of roots in k of the polynomial P (x) =
a2x5 + b2x+ a ∈ k[x] almost determines the zeta function of C [MN06, Sect.3].
Table 2. Weil polynomial x4 + rx3 + sx2 + qrx+ q2 of the curve
y2+ y = ax5+ bx3+ cx, for q nonsquare (left) and q square (right)
P (x) N, M (r, s)
(1)(4) N = 0 (±
2q, 2q)
N = 1 (0, 0)
(2)(3) M = 0 (±
2q, q)
M = 1 (0, q)
N = 0 (±2
2q, 4q)
(1)3(2) N = 1 (0, 2q)
N = 2 (0, 0)
N = 3 (0,−2q)
P (x) N, M (r, s)
(5) (±√q, q)
N = 0 (0,−q)
(1)2(3) N = 1 (0, q)
N = 2 (±2√q, 3q)
M = 0 (±2√q, 2q)
(1)(2)2 M = 1 (0, 0)
M = 2 (0, 2q)
N = 1 (0,−2q)
(1)5 N = 3 (0, 2q)
N = 5 (±4√q, 6q)
In Table 2 we write P (x) = (n1)
r1(n2)
r2 · · · (nm)rm to indicate that ri of the
irreducible factors of P (x) have degree ni. Also, we consider the linear operator
T (x) := tr((c+ b2a−1)x) and we define
N := number of roots z ∈ k of P (x) s.t. T (z) = 0,
M := number of irred. quadratic factors x2 + vx+ w of P (x) s.t. T (v) = 0 .
The ambiguity of the sign of r can be solved by computing nD in the Jacobian,
where n is one of the presumed values of |J(Fq)| and D is a random rational divisor
of degree 0.
1.2. Computation of the Zeta Function when p is odd. Let A be a super-
singular abelian surface over k and let rk2(A) := dimF2(A[2](k)).
The structure of A(k) as an abelian group was studied in [Xin96], [Zhu00], where
it is proven that it is almost determined by the isogeny class of A. In fact, if Fi(x)
are the different irreducible factors of fA(x) in Z[x]:
fA(x) =
Fi(x)
ei , 1 ≤ s ≤ 2 =⇒ A(k) ≃ ⊕si=1 (Z/Fi(1)Z)
except for the following cases:
(a) p ≡ 3 (mod 4), q is not a square and fA(x) = (x2 + q)2,
(b) p ≡ 1 (mod 4), q is not a square and fA(x) = (x2 − q)2.
(c) q is a square and fA(x) = (x
2 − q)2.
The possible structure of A(k) in cases (a) and (b) is:
A(k) ≃ (Z/F (1)Z)m ⊕ (Z/(F (1)/2)Z⊕ Z/2Z)n ,
where F (x) denotes respectively x2 + q, x2 − q, and m, n are non-negative integers
such that m+ n = 2 [Zhu00, Thm. 1.1]. In case (c) we have either:
A(k) ≃ (Z/((q − 1)/2)Z)2 ⊕ (Z/2Z)2 , or
A(k) ≃ (Z/((q − 1)/2m)Z)⊕ (Z/((q − 1)/2n)Z)⊕ (Z/2m+nZ) ,
where 0 ≤ m, n ≤ v2(q − 1) [Xin96, Thm. 3]. In this last case we have rk2(A) > 1;
in fact, v2(1 −
q) + v2(1 +
q) = v2(1 − q) = (1/2)v2(F (1)) and we can apply
[Xin96, Lem. 4] to conclude that A(k) has a subgroup isomorphic to (Z/2Z)2.
Table 3. Weil polynomial x4 + rx3 + sx2 + qrx+ q2 of the curve
C when q is nonsquare. The sign ǫ is the Legendre symbol (−1/p)
W p rk2(J) (r, s)
(1)6 or (1)4(2) 4, 3 (0,−2ǫq)
(1)2(2)2 or (2)3 2 (0,±2q)
(1)3(3) 2 not possible
(1)(2)(3) p > 3 1 not possible
p = 3 (±
3q, 2q)
(1)2(4) or (2)(4) 1 (0, 0)
(1)(5) p 6= 5 0 not possible
p = 5 (±
5q, 3q)
p ≡ 1 (mod 3) (0, q)
(3)2 p ≡ −1 (mod 3) 0 (0, ǫq)
p = 3 not possible
(6) p ≡ −1 (mod 3) 0 (0,±q)
p 6≡ −1 (mod 3) (0, q)
Consider now a supersingular curve C of genus 2 defined over k, given by a
Weierstrass equation y2 = f(x), for some separable polynomial f(x) ∈ k[x] of degree
5 or 6. Let J be its Jacobian variety, W = {P0, P1, P2, P3, P4, P5} ⊆ C(k) the set of
Weierstrass points of C, andW (k) ⊆W the subset of k-rational Weierstrass points.
Our aim is to show that the structure ofW as a Gk-set contains enough information
on the 2-adic value of |C(k)| and |J(k)| to almost determine the polynomial fJ(x) =
x4 + rx3 + sx2 + qrx+ q2.
From the fundamental identities
|C(k)| = q + 1 + r, |J(k)| = fJ(1) = (q2 + 1) + (q + 1)r + s,
and the free action of the hyperelliptic involution on C(k) \W (k) we get
(1) r ≡ |W (k)| (mod 2), s ≡ |J(k)| (mod 2) .
On the other hand, J [2] is represented by the classes of the 15 divisors:
Pi − P0, 1 ≤ i ≤ 5, and Pi + Pj − 2P0, 1 ≤ i < j ≤ 5,
together with the trivial class.
Lemma 1.3. Let D = Pi − Pj, with i 6= j, or D = Pi + Pj − 2P0, with 0, i, j
pairwise different. Then, the class of the divisor D is k-rational if and only if Pi, Pj
are both k-rational or quadratic conjugate.
Hence, the Galois structure of W determines rk2(J) and this limits the possible
values of the zeta function of C. Our final results are given in Tables 3, 4, where
we write W = (n1)
r1(n2)
r2 · · · (nm)rm to indicate that there are ri Gk-orbits of
length ni of Weierstrass points. If f(x) has degree 6 this Galois structure mimics
the decomposition f(x) = (n1)
r1(n2)
r2 · · · (nm)rm (same notation as in Sect. 1.1) of
f(x) into a product of irreducible polynomials k[x]. If f(x) has degree 5 then W =
(1)f(x), because in these models the point at infinity is a k-rational Weierstrass
point.
The proof of the content of Tables 3 and 4 is elementary, but long. Instead of
giving all details we only sketch the main ideas:
Table 4. Weil polynomial x4 + rx3 + sx2 + qrx+ q2 of the curve
C when q is a square
W p rk2(J) (r, s)
(1)6 4 (0,−2q) or (±4√q, 6q)
(1)4(2) 3 (0,−2q)
(1)2(2)2 or (2)3 2 (0,±2q)
(1)3(3) p > 3 2 not possible
p = 3 (±√q, 0)
(1)(2)(3) 1 not possible
(1)2(4) or (2)(4) p ≡ 1 (mod 8) 1 not possible
p 6≡ 1 (mod 8) (0, 0)
(1)(5) p ≡ 1 (mod 5) 0 not possible
p 6≡ 1 (mod 5) (±√q, q)
(3)2 (0, q) or (±2√q, 3q)
(6) p ≡ 5 (mod 12) 0 (0,±q)
p 6≡ 5 (mod 12) (0, q)
(I) Waterhouse determined all possible isogeny classes of supersingular elliptic
curves [Wat69]. Thus, it is possible to write down all isogeny classes of supersingular
abelian surfaces by adding to the simple classes given in Table 1 the split isogeny
classes. By [HNR06] we know exactly what isogeny classes of abelian surfaces do
not contain Jacobians and they can be dropped from the list. By the results of Xing
and Zhu we can distribute the remaining isogeny classes according to the possible
values of rk2.
(II) Each structure of W as a Gk-set determines the value of rk2 and, after (I),
it has a reduced number of possibilities for the isogeny classes. By using (1) and
looking for some incoherence in the behaviour under scalar extension to k2 or k3 of
both, the Galois structure of W and the possible associated isogeny classes, we can
still discard some of these possibilities.
In practice, among the few possibilities left in Tables 3 and 4 we can single out
the isogeny class of the Jacobian of any given supersingular curve by computing
iterates of random divisors of degree zero. However, if C has many automorphisms
they provide enough extra information to completely determine the zeta function.
This will be carried out in the rest of the paper. In the Appendix we display
equations of the supersingular curves with many automorphisms and their Weil
polynomial.
2. Zeta Function of Twists
In this section we review some basic facts about twists and we show how to
compute different properties of a twisted curve in terms of the defining 1-cocycle.
From now on the ground field k will have odd characteristic.
Let C be a supersingular curve of genus 2 defined over k and let W ⊆ C(k)
be the set of Weierstrass points of C. We denote by Aut(C) the k-automorphism
group of C and by Autk(C) the full automorphism group of C.
Let φ : C −→ P1 be a fixed k-morphism of degree 2 and consider the group of
reduced geometric automorphisms of C:
(C) := {u′ ∈ Autk(P
1) | u′(φ(W )) = φ(W )} .
We denote by Aut′(C) the subgroup of reduced automorphisms defined over k.
Any automorphism u of C fits into a commutative diagram:
// P1
for certain uniquely determined reduced automorphism u′. The map u 7→ u′ is a
group homomorphism (depending on φ) and we have a central exact sequence of
groups compatible with Galois action:
1 −→ {1, ι} −→ Autk(C)
φ−→ Aut′
(C) −→ 1,
where ι is the hyperelliptic involution. This leads to a long exact sequence of Galois
cohomology sets:
(2) 1 → {1, ι} → Aut(C) φ→ Aut′(C) δ→ H1(Gk, {1, ι}) → H1(Gk,Autk(C)) →
→ H1(Gk,Aut′k(C)) → H
2(Gk, {1, ι}) ≃ Br2(k) = 0 .
The k/k-twists of C are parameterized by the pointed set H1(Gk,Autk(C))
and, since k is a finite field, a 1-cocycle is determined just by the choice of an
automorphism v ∈ Autk(C). The twisted curve Cv associated to v is defined over
k and is determined, up to k-isomorphism, by the existence of a k-isomorphism
f : C −→ Cv, such that f−1fσ = v.
For instance, the choice v = ι corresponds to the hyperelliptic twist C′; if C is
given by a Weierstrass equation y2 = f(x) then C′ admits the model y2 = tf(x), for
t ∈ k∗\(k∗)2. We say that C is self-dual if it is k-isomorphic to its hyperelliptc twist.
If fJ(x) is the Weil polynomial of C, the Weil polynomial of C
′ is fJ′(x) = fJ(−x);
in particular, for a self-dual curve one has fJ(x) = x
4+ sx2+ q2 for some integer s.
It is easy to deduce from (2) the following criterion for self-duality:
Lemma 2.1. The curve C is self-dual if and only if |Aut′(C)| = |Aut(C)|.
One can easily compute the data Aut(Cv), Aut
′(Cv) of the twisted curve Cv, in
terms of Autk(C), Aut
(C) and the 1-cocycle v.
Let f : C −→ Cv be a geometric isomorphism such that f−1fσ = v. We have
Autk(Cv) = f Autk(C)f
−1, and the k-automorphism group is
(3) Aut(Cv) = {fuf−1 | u ∈ Autk(C), u v = v u
Once we fix any k-morphism of degree two, φv : Cv −→ P1, it determines a unique
geometric automorphism f ′ of P1 such that φvf = f
′φ. The reduced group of
k-automorphisms of Cv is
(4) Aut′(Cv) = {f ′u′(f ′)−1 | u′ ∈ Aut′k(C), u
′ v′ = v′(u′)σ} .
In order to compute the zeta function of Cv we consider the geometric isomor-
phism f : J −→ Jv induced by f . We still have f−1fσ = v∗, where v∗ is the
automorphism of J induced by v. Clearly, πvf = f
σπ, where π, πv are the respec-
tive q-power Frobenius endomorphisms of J, Jv. Hence,
f−1πvf = f
−1fσ(fσ)−1πvf = v∗π .
In particular, πv has the same characteristic polynomial than v∗π. From this fact
one can deduce two crucial results (cf. [HNR06, Props.13.1,13.4]).
Proposition 2.2. Suppose q is a square. Let C be a supersingular genus 2 curve
over k with Weil polynomial (x +
q)4 and let v be a geometric automorphism of
C, v 6= 1, ι. Then, the Weil polynomial x4+rx3+sx2+rx+q2 of Cv is determined
as follows in terms of v (in the column v6 = 1 we suppose v2 6= 1, v3 6= 1, ι):
v v2= 1 v2= ι v3= 1 v3= ι v4= ι v5= 1 v5= ι v6= 1 v6= ι
(r, s) (0,−2q) (0, 2q) (−2√q, 3q) (2√q, 3q) (0, 0) (−√q, q) (√q, q) (0, q) (0,−q)
Proposition 2.3. Suppose q is nonsquare. Let C be a supersingular genus 2 curve
over k with Weil polynomial (x2 + ǫq)2, ǫ ∈ {1,−1}, and let v be a geometric
automorphism of C. Then, the Weil polynomial x4 + rx3 + sx2 + rx + q2 of Cv is
determined as follows in terms of the order n of the automorphism vvσ:
n 1 2 3 4 6
(r, s) (0, 2ǫq) (0,−2ǫq) (0,−ǫq) (0, 0) (0, ǫq)
In applying these results the transitivity property of twists can be helpful.
Lemma 2.4. Let u, v be automorphisms of C and let f : C → Cv be a geometric
isomorphism with f−1fσ = v. Then the curve Cu is the twist of Cv associated to
the automorphism fuv−1f−1 of Cv.
For a curve with a large k-automorphism group the following remark, together
with Tables 3 and 4, determines in some cases the zeta function:
Lemma 2.5. Let F ⊆ C(k) be the subset of k-rational points of C that are fixed
by some non-trivial k-automorphism of C. Then,
|C(k)| ≡ |F| (mod |Aut(C)|) .
Proof. The group Aut(C) acts freely on C(k) \ F . �
Note that F contains the set W (k) of k-rational Weierstrass points, all of them
fixed by the hyperelliptic involution ι of C.
In order to apply this result to the twisted curve Cv we need to compute the
Gk-set structure of Wv and |Fv| solely in terms of v.
Lemma 2.6. (1) For any P ∈ W the length of the Gk-orbit of f(P ) ∈ Wv is
the minimum positive integer n such that v vσ · · · vσn−1(P σn) = P . In particular,
|Wv(k)| = |{P ∈ W | v(P σ) = P}|.
(2) The map f−1 stablishes a bijection between Fv and the set
{P ∈ C(k) | v(P σ) = P = u(P ) for some 1 6= u ∈ Autk(C), s.t. u v = v uσ}.
3. Supersingular curves with many automorphisms
For several cryptographic applications of the Tate pairing the use of distor-
tion maps is essential. A distortion map is an endomorphism ψ of the Jacobian
J of C that provides an input for which the value of the pairing is non-trivial:
eℓ(D1, ψ(D2)) 6= 1 for some fixed ℓ-torsion divisors D1, D2. The existence of
such a map is guaranteed, but in practice it is hard to find it in an efficient way.
Usually, one can start with a nice curve C with many automorphisms, consider
a concrete automorphism u 6= 1, u 6= ι, and look for a distortion map ψ in the
subring Z[π, u∗] ⊆ End(J), where π is the Frobenius endomorphism of J and u∗ is
the automorphism of the Jacobian induced by u. If Z[π, u∗] = End(J) it is highly
probable that a distortion map is found. If Z[π, u∗] 6= End(J) it can be a hard
problem to prove that some nice candidate is a distortion map, but at least one is
able most of the time to find a “denominator” m such that mψ lies in the subring
Z[π, u∗]; in this case, if ℓ ∤ m one can use mψ as a distortion map on divisors of
order ℓ. Several examples are discussed in [GPRS06].
The aim of this section is to exhibit all supersingular curves of genus 2 with
many automorphisms, describe their automorphisms, and compute the character-
istic polynomial of π, which is always a necessary ingredient in order to analyze
the structure of the ring Z[π, u∗]. Recall that a curve C is said to have many auto-
morphisms if it has some geometric automorphism other than the identity and the
hyperelliptic involution; in other words, if |Autk(C)| > 2.
Igusa found equations for all geometric curves of genus 2 with many automor-
phisms, and he grouped these curves in six families according to the possible struc-
ture of the automorphism group [Igu60], [IKO86]. Cardona and Quer found a faith-
ful and complete system of representatives of all these curves up to k-isomorphism
and they gave conditions to ensure the exact structure of the automorphism group
of each concrete model [Car03], [CQ06]. The following theorem sums up these
results.
Theorem 3.1. Any curve of genus 2 with many automorphisms is geometrically
isomorphic to one and only one of the curves in these six families:
Equation of C Aut′
(C) Autk(C)
y2 = x6 + ax4 + bx2 + 1 a, b satisfy (5) C2 C2 × C2
y2 = x5 + x3 + ax a 6= 0, 1/4, 9/100 C2 × C2 D8
y2 = x6 + x3 + a p 6= 3, a 6= 0, 1/4, −1/50 S3 D12
y2 = ax6 + x4 + x2 + 1 p = 3, a 6= 0 S3 D12
y2 = x6 − 1 p 6= 3, 5 D12 2D12
y2 = x5 − x p 6= 5 S4 S̃4
p = 5 PGL2(F5) S̃5
y2 = x5 − 1 p 6= 5 C5 C10
(5) (4c3−d2)(c2−4d+18c−27)(c2−4d−110c+1125) 6= 0, c := ab, d := a3+ b3.
Ibukiyama-Katsura-Oort determined, using Theorem 1.1, when the last three
curves are supersingular [IKO86, Props. 1.11, 1.12, 1.13]:
y2 = x6 − 1 is supersingular iff p ≡ −1 (mod 3)
y2 = x5 − x is supersingular iff p ≡ 5, 7 (mod 8)
y2 = x5 − 1 is supersingular iff p ≡ 2, 3, 4 (mod 5)
It is immediate to check that y2 = ax6 + x4 + x2 + 1 is never supersingular if
p = 3. One can apply Theorem 1.1 to the other curves in the first three families to
distinguish the supersingular ones.
Theorem 3.2. Suppose q is a square and let C be a supersingular curve belonging
to one of the first five families of Theorem 3.1. Then there a twist of C with Weil
polynomial (x+
q)4, and this twist is unique.
Proof. Let E be a supersingular elliptic curve defined over Fp. By [IKO86, Prop.
1.3] the Jacobian J of C is geometrically isomorphic to the product of two supersin-
gular elliptic curves, which is in turn isomorphic to E×E by a well-known theorem
of Deligne. The principally polarized surface (J,Θ) is thus geometrically isomorphic
to (E × E, λ) for some principal polarization λ. Since E has all endomorphisms
defined over Fp2 , (E × E, λ) is defined over Fp2 and by a classical result of Weil
it is Fp2 -isomorphic to the canonically polarized Jacobian of a curve C0 defined
over Fp2 . By Torelli, C0 is a twist of C. The Weil polynomial of C0 is (x ±
because the Frobenius polynomial of E is x2 + p. The fact that C0 and C
0 are the
unique twists of C0 with Weil polynomial (x ±
q)4 is consequence of Proposition
2.2. � �
Corollary 3.3. Under the same assumptions:
(1) The Weil polynomial of C is (x±√q)4 if and only if W = (1)6.
(2) If C belongs to one of the first three families of Theorem 3.1, then it admits
no twist with Weil polynomial x4 ± qx2 + q2 or x4 + q2.
(3) If any of the curves y2 = x5 + x3 + ax, y2 = x6 + x3 + a is supersingular
then a ∈ Fp2 .
Proof. (1) By Table 4, the set W0 of Weierstrass points of C0 has Gk-structure
W0 = (1)
6 and Lemma 2.6 shows that for all automorphisms v 6= 1, ι one has
Wv 6= (1)6; thus, only the twists C0 and C′0 have W = (1)6.
(2) The geometric automorphisms v of C0 satisfy neither v
6 = 1, v2 6= 1, v3 6=
1, ι, nor v6 = ι, nor v4 = ι; thus, by Proposition 2.2 the Weil polynomial of a twist
of C0 is neither x
4 ± qx2 + q2 nor x4 + q2.
(3) The Igusa invariants of C0 take values in Fp2 and a can be expressed in terms
of these invariants [CQ05]. � �
In a series of papers Cardona and Quer studied the possible structures of the
pointed sets H1(Gk,Autk(C)) and found representatives v ∈ Autk(C) (identified
to 1-cocycles of H1(Gk,Autk(C))) of the twists of all curves with many automor-
phisms [Car03], [CQ05], [Car06], [CQ06]. In the next subsections we compute the
zeta function and the number of k-automorphisms of these curves when they are
supersingular. A general strategy that works in most of the cases is to apply the
techniques of Sect. 2 to find a twist of C with Weil polynomial (x ± √q)4 (for q
square) or (x2±q)2 (for q nonsquare) and apply then Propositions 2.2, 2.3 to obtain
the zeta function of all other twists of C. The results are displayed in the Appendix
in the form of Tables, where we exhibit moreover an equation of each curve.
3.1. Twists of the curve C : y2 = x5 − 1, for p 6≡ 0, 1 (mod 5). We have
φ(W ) = {∞} ∪ µ5 and Aut′k(C) ≃ µ5. The zeta function of C can be computed
from Tables 3,4 and Lemma 2.5 applied to C⊗k2. If q 6≡ 1 (mod 5) the only twists
are C, C′. If q ≡ 1 (mod 5) there are ten twists and their zeta function can be
deduced from Proposition 2.2. Table 5 summarizes all computations.
3.2. Twists of the curve C : y2 = x5 − x, for p ≡ 5, 7 (mod 8). Now φ(W ) =
{∞, 0, ±1, ±i}. If p = 5 we have Aut′
(C) = Aut(P1). If p 6= 5 the group Aut′
is isomorphic to S4 and it is generated by the transformations T (x) = ix, S(x) =
, with relations S3 = 1 = T 4, ST 3 = TS2. For q nonsquare the zeta function of
C is determined by Table 3; since the curve is defined over Fp we obtain the zeta
function of C over k by scalar extension.
In all cases we can apply Propositions 2.2 and 2.3 to determine the zeta function
of the twists of C. Tables 6, 7, 8 summarize all computations.
3.3. Twists of the curve C : y2 = x6 − 1, for p ≡ −1 (mod 3), p 6= 5. We have
φ(W ) = µ6 and Aut
(C) = {±x, ±ηx,±η2x,± 1
}, where η ∈ Fp2 is a
primitive third root of unity.
The zeta function of C can be computed from Tables 3,4 and Lemma 2.5 applied
to C and C⊗k2. The zeta function of all twists can be determined by Propositions
2.2, 2.3. Tables 9, 10 summarize all computations.
3.4. Twists of the supersingular curve C : y2 = x6 +x3 + a, for p > 3. Recall
that a is a special value making the curve C supersingular and a 6= 0, 1/4, −1/50.
We have now
φ(W ) = {θ, ηθ, η2θ, A
}, Aut′
(C) = {x, ηx, η2x, A
where A, z, θ ∈ k satisfy A3 = a, z2 + z + a = 0, θ3 = z.
The Galois action on W and on Aut′
(C) depends on z and a/z being cubes or
not in their minimum field of definition k∗ or (k2)
∗. This is determined by the fact
that a is a cube or not.
Lemma 3.4. If a is a cube in k∗ then z, a/z are both cubes in k∗ or in (k2)
according to 1− 4a ∈ (k∗)2 being a square or not.
If a is not a cube in k∗ then z, a/z are both noncubes in k∗ or in (k2)
∗, according
to 1− 4a ∈ (k∗)2 being a square or not.
Proof. Let us check that all situations excluded by the statement lead to W =
(1)3(3) or Wv = (1)
3(3) for some twist, in contradiction with Tables 3, 4.
Suppose q ≡ −1 (mod 3). If 1− 4a is a square then a, z, a/z are all cubes in k∗.
If 1 − 4a is not a square then a is a cube and if z, zσ are not cubes in k2 we have
θσ = ω(A/θ), with ω3 = 1, ω 6= 1, and the twist by v = (ω−1(A/x),
ay/x3) has
Wv = (1)
3(3) by Lemma 2.6.
Suppose q ≡ 1 (mod 3). If 1−4a is not a square we have z(q2−1)/3 = a(q−1)/3, so
that a is a cube in k∗ if and only if z, zσ are cubes in k∗2 . Suppose now that 1−4a is
a square. If exactly one of the two elements z, a/z is a cube we have W = (1)3(3);
thus z, a/z are both cubes or noncubes in k∗. In particular, if a is not a cube
then z, a/z are necessarily both noncubes. Finally, if a is a cube and z, a/z are
noncubes in k∗, Lemma 2.6 shows that Wv = (1)
3(3) for the twist corresponding
to v = (ηx, y). � �
For the computation of the zeta functions of the twists it is useful to detect that
some of the combinations a square/nonsquare and 1−4a square/nonsquare are not
possible.
Lemma 3.5. Suppose q ≡ 1 (mod 3).
(1) If q ≡ −1 (mod 4) then 1− 4a is not a square.
(2) If q is nonsquare then a is not a square.
(3) If q is a square then a and 1− 4a are both squares.
Proof. Let Cv be the twist of C corresponding to v(x, y) = (ηx, y).
(1) Supose 1− 4a is a square. If a is a cube we have W = (1)6 and if a is not a
cube we have Wv = (1)
6; by Table 3 we get (r, s) = (0,−2
q) in both cases.
On the other hand, Lemmas 2.5 and 2.6 applied to C⊗k k2 show in both cases that
s ≡ 1 (mod 3); thus, p ≡ 1 (mod 4).
(2) Suppose a is a square. If a is a cube (respectively a is not a cube) we
have W = (1)6 or W = (2)3 (respectively Wv = (1)
6 or Wv = (2)
3), according
to 1 − 4a being a square or not. In all cases we have (r, s) = (0,±2q) by Table
3, and a straightforward application of Lemma 2.5 and (2) of Lemma 2.6 leads to
r ≡ −1 (mod 3), which is a contradiction.
(3) In all cases in which a or 1 − 4a are nonsquares we get (r, s) = (0, q) either
for the curve C or for the curve Cv. This contradicts Corollary 3.3. � �
After these results one can apply the general strategy. The results are displayed
in Tables 11, 12, 13.
3.5. Twists of the supersingular curve C : y2 = x5+x3+ax. Recall that a is a
special value making C supersingular and a 6= 0, 1/4, 9/100. Given z ∈ k satisfying
z2 + z + a = 0 we have φ(W ) = {0, ∞, ±
a/z},
Autk(C) =
(ω2 x, ω y) | ω4 = 1
| w4 = a
Lemma 3.6. If q ≡ 1 (mod 4) then a and 1−4a are both squares or both nonsquares
in k∗. If q is a square then necessarily a and 1− 4a are both squares.
Proof. If a 6∈ (k∗)2, 1−4a ∈ (k∗)2, thenW = (1)4(2) and (r, s) = (0,−2q) by Tables
3,4; this contradicts Lemma 2.5 because |Aut(C)| = |F| = 4 and r ≡ 2 (mod 4).
Suppose now a ∈ (k∗)2, 1 − 4a 6∈ (k∗)2. If a ∈ (k∗)4 then W = (1)2(2)2
and (r, s) = (0,±2q); this contradicts Lemma 2.5 because |Aut(C)| = 8, |F| = 6
if q ≡ 1 (mod 8) and |F| = 2 or 10 if q ≡ 5 (mod 8), so that r ≡ 4 (mod 8)
in both cases. If a 6∈ (k∗)4 we get a similar contradiction for the curve Cv for
v(x, y) = (−x, iy).
If a, 1 − 4a are nonsquares, then W = (1)2(4) and the Weil polynomial of C is
x4 + q2 by Tables 3,4. If q is a square this contradicts Corollary 3.3. � �
Lemma 3.7. If q is a square then a ∈ (k∗)4 if and only if z ∈ (k∗)2.
Proof. Suppose a ∈ (k∗)4, z 6∈ (k∗)2 and let us look for a contradiction. Consider
the k-automorphisms u(x, y) = (−x, iy), v(x, y) = (w
y) of C, where w4 = a.
By Lemma 2.6, Wu = (1)
6 and Cu has Weil polynomial (x ±
q)4 by Corollary
3.3; since u2 = ι, the Weil polynomial of C is (x2 + q)2 by Proposition 2.2 and
Lemma 2.4. The quotient E := C/v is an elliptic curve defined over k and the
Frobenius endomorphism π of E must satisfy π2 = −q. Since q is a square, E has
four automorphisms and its j invariant is necessarily jE = 1728. Now, E has a
Weierstrass equation: Y 2 = (X + 2w)(X2 + 1 − 2w2), where X = (x2 + w2)x−1,
Y = y(x + w)x−2 are invariant under the action of v. The condition jE = 1728 is
equivalent to a = 0 (which was excluded from the beginning) or a = (9/14)2; in
this latter case z is a square in Fp2 and we get a contradiction.
Suppose now a 6∈ (k∗)4, z ∈ (k∗)2. We haveW = (1)6 and C has Weil polynomial
(x ± √q)4 by Corollary 3.3. By Proposition 2.2, the Weil polynomial of Cu is
(x2+q)2. For any choice of w = 4
a, the morphism f(x, y) = (x+w
x−w ,
1+2w2
(x−w)3 )
sets a k2-isomorphism between C and the model:
Cu : y
2 = (x2 − 1)(x4 + bx2 + 1), b = (12
a− 2)/(2
a+ 1),
of Cu. The quotient of this curve by the automorphism (−x, y) is the elliptic curve
E : Y 2 = (X − 1)(X2 + bX + 1). Arguing as above, E has j-invariant 1728, and
this leads to a = 0 (excluded from the beginning) or a = (9/14)2, which is a
contradiction since a would be a fourth power in Fp2 . � �
After these results one is able to determine the zeta function of all twists of C
when q is a square; the results are displayed in Table 14. In the cases where the
Weil polynomial is (x − ǫ√q)4, ǫ = ±1, the methods of section 2 are not sufficient
to determine ǫ; our computation of this sign follows from a study of the 4-torsion
of an elliptic quotient of the corresponding curve.
In order to deal with the case q nonsquare we need to discard more cases.
Lemma 3.8. Suppose q nonsquare. If q ≡ −1 (mod 4) then a and 1 − 4a cannot
be both nonsquares.
If q ≡ 1 (mod 4) and a ∈ (k∗)2 then a ∈ (k∗)4 if and only if z 6∈ (k∗)2.
Proof. If a, 1 − 4a are both nonsquares the polynomial x4 + x2 + a is irreducible
and the Weil polynomial of C is x4 + q2 by Table 3; hence, the Weil polynomial
of C ⊗k k2 is (x2 + q2)2. If q ≡ −1 (mod 4) we have a ∈ k∗ ⊆ (k∗2)4 and this
contradicts Table 14.
Suppose q ≡ 1 (mod 4) and a ∈ (k∗)2; by Lemma 3.6, 1−4a is also a square and
z ∈ k∗. If a ∈ (k∗)4 and z ∈ (k∗)2 we get W = (1)6, and (r, s) = (0,−2q) by Table
3; we get a contradiction because the Jacobian J of C is simple ([MN02, Thm. 2.9])
and C has elliptic quotients over k because the automorphisms (w2/x, (w3y)/x3)
are defined over k. If a 6∈ (k∗)4 and z 6∈ (k∗)2 we get an analogous contradiction
for the curve Cu twisted by u(x, y) = (−x, iy). � �
The results for the case q nonsquare follow now by the usual arguments and they
are displayed in Tables 15, 16.
3.6. Twists of the supersingular curve C : y2 = x6+ax4+bx2+1. Recall that
a, b ∈ k are special values satisfying (5) and making C supersingular; in particular
p > 3. The curve C has four twists because Autk(C) = Aut(C) = {(±x,±y)}
is commutative and has trivial Galois action. The Jacobian of C is k-isogenous
to the product E1 × E2 of the elliptic curves with Weierstrass equations y2 =
x3 + ax2 + bx + 1, y2 = x3 + bx2 + ax + 1, obtained as the quotient of C by the
respective automorphisms v = (−x, y), ιv = (−x,−y). For q nonsquare, these
elliptic curves have necessarily Weil polynomial x2 + q and the Weil polynomial of
C is (x2 + q)2.
Lemma 3.9. If q is a square C has Weil polynomial (x±√q)4.
Proof. By Theorem 3.2 and Proposition 2.2 C has Weil polynomial (x ± √q)4 or
(x2 − q)2. In both cases the elliptic curves E1, E2 have Weil polynomial (x±
and we claim that they are isogenous. Since E(k) ≃ (Z/(1±√q)Z)2 as an abelian
group, our elliptic curves have four rational 2-torsion points and the polynomial
Table 5. Twists of the curve y2 = x5 − 1 for p ≡ 2, 3, 4 (mod 5). The sign
ǫ = ±1 is determined by √q ≡ ǫ (mod 5). The last row provides eight inequivalent
twists corresponding to the four nontrivial values of t ∈ k∗/(k∗)5
Cv v (r, s) s.d. |Aut(Cv)|
y2 = x5 − 1 (x, y)
q ≡ ±2 (mod 5)
q ≡ −1 (mod 5)
q ≡ 1 (mod 5)
(0, 0)
(0, 2q)
(−4ǫ√q, 6q)
y2 = tx5 − 1, t 6∈ (k∗)5 (t
5 x, y) q ≡ 1 (mod 5) (ǫ√q, q) no 10
Table 6. Twists of the curve y2 = x5 − x when q ≡ −1 (mod 8)
Cv v (r, s) s.d. |Aut(Cv)|
y2 = x5 − x (x, y) (0, 2q) yes 8
y2 = x5 + x (ix, 1+i√
y) (0, 2q) yes 4
y2 = (x2 + 1)(x2 − 2tx − 1)(x2 + 2
x − 1)
t2 + 1 6∈ (k∗)2 (−
) (0,−2q) yes 24
y2 = (x2 + 1)(x4 − 4tx3 − 6x2 + 4tx + 1),
t2 + 1 6∈ (k∗)2
, i−1√
(0, 0) yes 4
y2 = x6 − (t + 3)x5 + 5( 2+t−s
)x4 + 5(s − 1)x3
+5( 2−t−s
)x2 + (t − 3)x + 1 irred., s2 + t2 = −2
2(1−i)y
(x+i)3
(0, q) no 6
x3 + ax2 + bx + 1 has three roots e1, e2, e3 ∈ k. Since e1e2e3 = 1, either one or
three of these roots are squares. If only one root is a square we have W = (1)2(2)2,
Wv = (1)
4(2) and C, Cv have both Weil polynomial (x
2 ± q)2, in contradiction
with Theorem 3.2. Hence, the three roots are squares, W = (1)6, and C has Weil
polynomial (x±√q)4 by Corollary 3.3. � �
The zeta function of the twists of C is obtained from Propositions 2.2 and 2.3.
The results are displayed in Table 17. For q square the sign of (x ± √q)4 can be
determined by analyzing the 4-torsion of the elliptic curve y2 = x3 + ax2 + bx+ 1.
Finally, there are special curves over k whose geometric model y2 = x6 + ax4 +
bx2+1 is not defined over k (cf. [Car03, Sect.1]). It is straightforward to apply the
techniques of this paper to determine their zeta function too.
4. Appendix
In this appendix we display in several tables the computation of the zeta func-
tion of the supersingular curves of genus 2 with many automorphisms. For each
curve Cv, we exhibit the number of k-automorphisms and the pair of integers (r, s)
determining the Weil polynomial fJv(x) = x
4 + rx3 + sx2 + qrx+ q2 of Cv. In the
column labelled “s.d” we indicate if C is self-dual. For the non-self-dual curves we
exhibit only one curve from the pair Cv, C
We denote by η, i ∈ k a primitive third, fourth root of unity. For n a positive
integer and x ∈ k∗ we define
νn(x) = 1 if x ∈ (k∗)n, νn(x) = −1 otherwise .
In all tables the parameters s, t take values in k∗.
Conclusion. We show that the zeta function of a supersingular curve of genus two
is almost determined by the Galois structure of a finite set easy to describe in terms
of a defining equation. For curves with many automorphisms this result is refined
to obtain a direct (non-algoritmic) computation of the zeta function in all cases. As
Table 7. Twists of the curve y2 = x5 − x when q ≡ 5 (mod 8)
Cv v p (r, s) s.d. |Aut(Cv)|
y2 = x5 − x (x, y) p > 5
p = 5
(0,−2q) yes 24
y2 = x5 − 4x (−x, iy) (0, 2q) yes 8
y2 = x5 − 2x (ix, 1+i√
y) (0, 0) yes 4
y2 = (x2 + 2)(x4 − 12x2 + 4)
, i−1√
p > 5
p = 5
(0, 2q) yes
y2 = f(t, x)f(
18+(5i−3)t
(5i+3)−2t , x)
f(t, x) = x3 − tx2 + (t − 3)x+ 1 irred.
2(1−i)y
(x+i)3
p > 5
p = 5
(0, q)
y2 = x5 − x − t, trk/F5 (t) = 1 (x + 1, y) p = 5 (
5q, 3q) no 10
y2 = x6 + tx5 + (1 − t)x + 2, irred. ( 3
x−1 ,
(x+1)3
) p = 5 (0,−q) yes 6
Table 8. Twists of the curve y2 = x5 − x when p ≡ 5, 7 (mod 8) and q is a
square. Here ǫ = (−1/√q) and ǫ′ = (−3/√q)
Cv v p (r, s) s.d. |Aut(Cv)|
y2 = x5 − x (x, y) p > 5
p = 5
(−4ǫ√q, 6q) no 48
y2 = x5 − t2x, t 6∈ (k∗)2 (−x, iy) (0, 2q) yes 8
y2 = x5 − tx, t 6∈ (k∗)2 (ix, 1+i√
y) (0, 0) no 8
y2 = (x2 − t)(x4 + 6tx2 + t2),
t 6∈ (k∗)2
, i−1√
p > 5
p = 5
(0,−2q) yes 4
y2 = (x3 − t)(x3 − (15
3 − 26)t),
t 6∈ (k∗)3
2(1−i)y
(x+i)3
p > 5
p = 5
q, 3q) no
y2 = x5 − x − t, trk/F5(t) = 1 (x+ 1, y) p = 5 (
q, q) no 10
y2 = x6 + tx5 + (1 − t)x+ 2, irred. ( 3
x−1 ,
(x+1)3
) p = 5 (0, q) no 12
Table 9. Twists of the curve y2 = x6 − 1 when q ≡ −1 (mod 3), p 6= 5. Here ǫ = (−1/p)
Cv v (r, s) s.d. |Aut(Cv)|
y2 = x6 − 1 (x, y) (0, 2q) iff ǫ = −1 6 + 2ǫ
y2 = x6 − t, t 6∈ (k∗)2 (−x,−y) (0, 2q) iff ǫ = 1 6 − 2ǫ
y2 = x(x2 − 1)(x2 − 9) ( 1
) (0,−2ǫq) yes 12
y2 = (x4 − 2stx3 + (7s + 1)x2 + 2tsx + 1)·
·(x2 − 4
x− 1), t2 + 4 ∈ k∗ \ (k∗)2, s−1 = t2 + 3 (−
) (0, 2ǫq) yes 12
y2 = x6 + 6tx5 + 15sx4 + 20tsx3 + 15s2x2+
+6ts2x + s3, s = t2 − 4 6∈ (k∗)2,
gcd(x(q+1)/3 − 1, x2 − tx + 1) = 1
) (0, ǫq) yes 6
y2 = x6 + 6x5 + 15sx4 + 20sx3 + 15s2x2+
+6s2x + s3, s = t2/(t2 + 4) 6∈ (k∗)2,
gcd(x(q+1)/3 + 1, x2 − tx − 1) = 1
) (0,−ǫq) yes 6
Table 10. Twists of the curve y2 = x6 − 1 when p ≡ −1 (mod 3), p 6= 5 and q
is a square. Here ǫ = (−3/√q)
Cv v (r, s) s.d. |Aut(Cv)|
y2 = x6 − 1 (x, y) (−4ǫ√q, 6q) no 24
y2 = x6 − t3, t 6∈ (k∗)2 (−x, y) (0,−2q) yes 12
y2 = x6 − t2, t 6∈ (k∗)3 (ηx, y) (2ǫ√q, 3q) no 12
y2 = x6 − t, t 6∈ ((k∗)2 ∪ (k∗)3) (−ηx,−y) (0, q) no 12
y2 = x(x2 + 3t)(x2 + t
), t 6∈ (k∗)2 ( 1
) (0, 2q) yes 4
y2 = x6 + 15tx4 + 15t2x2 + t3, t 6∈ (k∗)2 (− 1
) (0,−2q) yes 4
Table 11. Twists of the supersingular curve y2 = x6+x3+a, a 6= 0, 1/4,−1/50,
when q ≡ −1 (mod 3). Here ǫ = ν2(a) and A is the cubic root of a in k
Cv v (r, s) s.d. |Aut(Cv)|
y2 = x6 + x3 + a (x, y) (0, 2q) iff ǫ = −1 3 + ǫ
y2 = θ−3(x − θ)6 − g(x)3 + aθ3(x − θσ)6
g(x) min. polyn. of θ ∈ k2 \ k, Nk2/k(θ) = A
y) (0, 2ǫq) iff ǫ = −1 9 + 3ǫ
y2 = θ(x− η)6 − g(x)3 + aθ−1(x − η2)6
g(x) = x2 + x+ 1, θ ∈ k2 \ (k∗2)
3, Nk2/k(θ) = a
y) (0,−ǫq) no 6
Table 12. Twists of the supersingular curve y2 = x6+x3+a, a 6= 0, 1/4,−1/50,
when q ≡ 1 (mod 3) and q is nonsquare. Here A is a cubic root of a in k and n = 3,
if a ∈ (k∗)3, whereas A = a, n = 1, if a 6∈ (k∗)3
Cv v ν3(a) (r, s) s.d. |Aut(Cv)|
y2 = x6 + x3 + a (x, y)
(0,−2q)
(0, q)
y2 = x6 + tx3 + t2a, t 6∈ (k∗)3
y2 = x6 + ax3 + a3
3 x, y)
(0, q)
(0,−2q)
y2 = θ−n(x − θ)6 − g(x)3 + aθn(x− θσ)6
g(x) min. polyn. of θ ∈ k2 \ k, Nk2/k(θ) = A
y) (0, 2q) yes 2
Table 13. Twists of the supersingular curve y2 = x6+x3+a, a 6= 0, 1/4,−1/50,
when q is a square. Here ǫ = (−3/√q). Also, A is a cubic root of a in k and n = 3,
if a ∈ (k∗)3, whereas A = a, n = 1, if a 6∈ (k∗)3
Cv v ν3(a) (r, s) s.d. |Aut(Cv)|
y2 = x6 + x3 + a (x, y)
(−4ǫ√q, 6q)
q, 3q)
y2 = x6 + tx3 + t2a, t 6∈ (k∗)3
y2 = x6 + ax3 + a3
3 x, y)
q, 3q)
(−4ǫ√q, 6q) no
y2 = θ−n(x − θ)6 − g(x)3 + aθn(x− θσ)6
g(x) min. polyn. of θ ∈ k2 \ k, Nk2/k(θ) = A
y) (0,−2q) no 4
Table 14. Twists of the supersingular curve y2 = x5 + x3 + ax, a 6=
0, 1/4, 9/100, when q is a square. The last row provides two inequivalent twists
according to the two values of
a. Here ǫ = −(−1/√q)ν4(z) and ǫ′ =
−(−1/√q)ν4(tz), where z2 + z + a = 0
Cv v ν4(a) (r, s) s.d. |Aut(Cv)|
y2 = x5 + x3 + ax (x, y)
q, 6q)
(0, 2q)
y2 = x5 + tx3 + at2x, t 6∈ (k∗)2 (−x, t
(0, 2q)
q, 6q)
y2 = g(x)
θ2(x− θσ)4 + g(x)2+
+aθ−2(x− θ)4
, Nk2/k(θ) =
g(x) min. polyn. of θ ∈ k2 \ k
y) (0,−2q) yes 4
Table 15. Twists of the supersingular curve y2 = x5 + x3 + ax, a 6=
0, 1/4, 9/100, when q is nonsquare and a 6∈ (k∗)2
Cv v (−1/p) (r, s) s.d. |Aut(Cv)|
y2 = x5 + x3 + ax (x, y)
(0, 0)
(0, 2q)
y2 = (x2 − a)
a)4 + (x2 − a)2+
+aθ−1(x +
, θ ∈ k2, Nk2/k(θ) = a
(0, 2q)
(0, 0)
Table 16. Twists of the supersingular curve y2 = x5 + x3 + ax, a 6=
0, 1/4, 9/100, when q is nonsquare and a ∈ (k∗)2. Here ǫ = (−1/p). If
p ≡ −1 (mod 4) we assume that
a belongs to (k∗)2
Cv v ν4(a) (r, s) s.d. |Aut(Cv)|
y2 = x5 + x3 + ax (x, y)
(0, 2q)
(0,−2q)
iff ǫ = −1
6 + 2ǫ
y2 = x5 + tx3 + at2x, t 6∈ (k∗)2 (−x, t
(0,−2ǫq)
(0, 2q)
y2 = g(x)
θ2(x− θσ)4 + g(x)2+
+aθ−2(x − θ)4
, Nk2/k(θ) =
g(x) min. polyn. of θ ∈ k2 \ k
y) (0, 2q) iff ǫ = 1 6 − 2ǫ
y2 = g(x)
θ2(x− θσ)4 + g(x)2+
+aθ−2(x − θ)4
, Nk2/k(θ) = −
g(x) min. polyn. of θ ∈ k2 \ k
y) (0, 2ǫq) yes 4
Table 17. Twists of the supersingular curve y2 = x6 + ax4 + bx2 + 1 satisfying (5)
Cv v (r, s) s.d. |Aut(Cv)|
y2 = x6 + ax4 + bx2 + 1 (x, y)
q nonsq.
q square
(0, 2q)
(±4√q, 6q) no 4
y2 = x6 + atx4 + bt2x2 + t3
t 6∈ (k∗)2 (−x,−y)
q nonsq.
q square
(0, 2q)
(0,−2q) no 4
an application one gets a direct computation of the cryptographic exponent of the
Jacobian of these curves. Also, the computation of the zeta function is necessary to
determine the structure of the endomorphism ring of the Jacobian and to compute
distortion maps for the Weil and Tate pairings.
Acknowledgement. It is a pleasure to thank Christophe Ritzenthaler for his help
in finding some of the equations of the twisted curves.
References
[Car03] G. Cardona, On the number of curves of genus 2 over a finite field, Finite Fields and
Their Applications 9 (2003), 505-526.
[CQ05] G. Cardona, J. Quer, Field of moduli and field of definition for curves of genus 2, in
Computational aspects of algebraic curves (T. Shaska, ed.) pp. 71-83., Lecture Notes Series
on Computing 13 (World Scientific).
[Car06] G. Cardona, Representations of Gk-groups and the genus 2 curve y
2 = x5 − x, Journal
of Algebra 303 (2006), 707-721.
[CQ06] G. Cardona, J. Quer, Curves of genus 2 with group of automorphisms isomorphic to D8
or D12, Trans. Amer. Math. Soc. to appear.
[FR94] G. Frey, H.-G. Rück, A remark concerning m-divisibility and the discrete logarithm in the
divisor class group of curves, Mathematics of Computation 62 (1994), 865-874.
[Gal01] S. D. Galbraith, Supersingular curves in cryptography, In ASIACRYPT 2001, volume
2248 of Lecture Notes in Computer Science, 495-513. Springer-Verlag 2001.
[GPRS06] S. D. Galbraith, J. Pujolàs, C. Ritzenthaler, B. Smith, Distortion maps for genus two
curves, http://eprint.iacr.org/2006/375.
[HNR06] E.W. Howe, E. Nart, C. Ritzenthaler, Jacobians in isogeny classes of abelian surfaces
over finite fields, arXiv:math.NT/0607515.
[IKO86] T. Ibukiyama, T. Katsura, F. Oort, Supersingular curves of genus two and class numbers,
Compositio Math. 57 (1986), 127-152.
[Igu60] J.-I. Igusa, Arithmetic variety of moduli for genus two, Annals of Mathematics, 72 (1960)
612-649.
[MN02] D. Maisner, E. Nart, with an appendix by Everett W. Howe, Abelian surfaces over finite
fields as jacobians, Experimental Mathematics, 11 (2002), 321-337.
http://eprint.iacr.org/2006/375
http://arxiv.org/abs/math/0607515
[MN06] D. Maisner, E. Nart, Zeta functions of supersingular curves of genus 2, Canadian Journal
of Mathematics 59 (2007), 372-392.
[MOV93] A.J. Menezes, T. Okamoto, S.A. Vanstone, Reducing Elliptic Curve Logarithms to Log-
arithms in a Finite Field, IEEE Trans. on Information Theory 39 (1993), 1639-1646.
[RS04] K. Rubin, A. Siverberg, Supersingular abelian varieties in cryptology, In Advances in
Cryptology-Crypto’2002, volume 2442 of Lecture Notes in Computer Science, 336-353.
Springer-Verlag 2004.
[VV92] G. van der Geer, M. van der Vlugt, Supersingular curves of genus 2 over finite fields of
characteristic 2, Math. Nachrichten 159 (1992), 73-81.
[Wat69] W.C. Waterhouse, Abelian varieties over finite fields, Annales Scientifiques de l’École
Normale Supérieure (4) 2 (1969), 521-560.
[Xin96] C.P. Xing, On supersingular abelian varieties of dimension two over finite fields, Finite
Fields and Their Applications 2 (1996), 407-421.
[Yui78] N. Yui, On the Jacobian varieties of hyperelliptic curves over fields of characteristic p > 2,
Journal of Algebra 52 (1978), 378-410.
[Zhu00] H.J. Zhu, Group Structures of Elementary Supersingular Abelian Varieties over Finite
Fields, Journal of Number Theory 81 (2000), 292-309.
Dept. Ciències Matemàtiques i Informàtica, Universitat de les Illes Balears, 07122,
Palma de Mallorca, Spain
E-mail address: gabriel.cardona@uib.es
Departament de Matemàtiques, Universitat Autònoma de Barcelona, Edifici C, 08193
Bellaterra, Barcelona, Spain
E-mail address: nart@mat.uab.cat
	Introduction
	1. Zeta Function and Cryptographic Exponent
	1.1. Computation of the Zeta Function when p=2
	1.2. Computation of the Zeta Function when p is odd
	2. Zeta Function of Twists
	3. Supersingular curves with many automorphisms
	3.1. Twists of the curve C2mu-:6muplus1muy2=x5-1, for p0,1 (mod 5)
	3.2. Twists of the curve C2mu-:6muplus1muy2=x5-x, for p5,7 (mod 8)
	3.3. Twists of the curve C2mu-:6muplus1muy2=x6-1, for p-1 (mod 3), p=5
	3.4. Twists of the supersingular curve C2mu-:6muplus1muy2=x6+x3+a, for p>3
	3.5. Twists of the supersingular curve C2mu-:6muplus1muy2=x5+x3+ax
	3.6. Twists of the supersingular curve C2mu-:6muplus1muy2=x6+ax4+bx2+1
	4. Appendix
	References
