Supersingular hyperelliptic curves of genus 2 over finite fields

Abstract

In this paper we describe an elementary criterion how to determine supersingular hyperelliptic curves of genus 2, directly using only the given Weierstrass equation. A family of the hyperelliptic curve $\text{H/}\text{F}{}_{\mathrm{p}}$ of the type v²=u⁵+a and v²=u⁵+au have been studied.

Introduction

Since Koblitz suggested using the hyperelliptic curve H as a good source of public key cryptosystem, many interesting results have been explored toward hyperelliptic cryptosystem. When the genus g of the curve is large, there is a subexponential algorithm due to Adleman et al. [1] for the discrete logarithm problem in $\text{J}{}_{\mathrm{H}}\text{(}\text{F}{}_{\mathrm{q}}\text{)}$. Also, when the genus g of a curve is small but g⩾4, Gaudry's algorithm is faster than Pollard's rho algorithm [6]. Consequently, the hyperelliptic curves of genus 2, 3 can be very attractive for the cryptographic purpose.

Using the Tate-pairing, [8], Menezes et al. showed that for the supersingular elliptic curves the value k above is at most 6 and, therefore, the good upper bound of the complexity of the attack in the supersingular elliptic curve could be provided [9]. It turns out that it is not proper to use the supersingular elliptic curve for the Diffie–Hellman type cryptosystem. On the contrary, recently, Boneh and Franklin [2] suggested a constructive application of supersingular elliptic curves (supersingular curves in general [5]) to generate an identity-based cryptosystem.

However, one needs to check if a given hyperelliptic curve of genus 2 and 3 is secure under the Frey–Rück attack [8]. According to Tate-pairing, the discrete logarithm problem on the divisor class group $\text{J}{}_{\mathrm{C}}\text{(}\text{F}{}_{\mathrm{q}}\text{)}$ of a curve C over the finite field $\text{F}{}_{\mathrm{q}}$ can be reduced to that over of some extension of the base field. When k is small one can solve the discrete logarithm problem using the index calculus method over the finite field and this is called Frey–R$\text{u}\text{̈}$ck attack. Galbraith [5] showed that for supersingular curves there is an upper bound, which depends only on genus, on the values of the extension degree k, and in particular, it turns out that k can be at most 12 for the supersingular curve of genus 2 and Rubin and Silverberg improved a bound, i.e. k⩽6 for odd p.

So, it will be very useful to detect those cryptographically weak curves in advance. On the contrary, recently, Boneh and Franklin [2] suggested a constructive application of supersingular elliptic curves (supersingular curves in general [5]) to generate an identity-based cryptosystem. To determine, with known criterions, if the given curves are supersingular (see, for instance, [5], [11]), one needs to compute the number of rational points of H, for all $\text{i,}\text{1⩽i⩽g}$, or, to know the characteristic polynomial of H. Therefore, when the characteristic p of the base field of the curve is large, this procedure is not really practical.

In this paper, we show that we can check, directly using the defining equation, if a given hyperelliptic curve H of genus 2 over $\text{F}{}_{\mathrm{q}}$, with $\text{q=p}{}^{\mathrm{n}}\text{,}\text{p>2}$, is supersingular. The criterion depends only on the equation and p. Furthermore, we derive more sharp bound of k for supersingular abelian variety of genus 2 defined over $\text{F}{}_{\mathrm{p}}$.

Finally, as an example, using the above criterion, we determine all primes p where the hyperelliptic curves $\text{H/}\text{F}{}_{\mathrm{p}}$ of the type v²=u⁵+a and v²=u⁵+au are supersingular. The orders of Jacobians of the above curves are determined and, therefore, the upper bounds of k are all determined.

This paper is organized as follows. In Section 2 we introduce the usual notations and recall basic definitions of the hyperelliptic curve of genus 2. In Section 3 we derive the main criterion how to determine if the given hyperelliptic curve of genus 2 is supersingular, directly using the defining equation and the proofs of the main theorem and lemmata will be postponed until the last Section 6. Section 4 states a complete characterization of supersingular abelian varieties of dimension 2 over the prime field $\text{F}{}_{\mathrm{p}}$. In Section 5, as an application of the main criterion, we characterize all the hyperelliptic curves $\text{H/}\text{F}{}_{\mathrm{p}}$ with defining equation of the type v²=u⁵+a and $\text{v}{}^2\text{=u}{}^5\text{+au,}\text{a∈}\text{F}{}_{\mathrm{p}}{}^{\mathrm{*}}$.