## Supersingular curves in cryptography (2001)

### Cached

### Download Links

- [www.best.tuke.sk]
- [www.iacr.org]
- [www.mathmagic.cn]
- [www.exp-math.uni-essen.de]
- DBLP

### Other Repositories/Bibliography

Citations: | 92 - 8 self |

### BibTeX

@INPROCEEDINGS{Galbraith01supersingularcurves,

author = {Steven D. Galbraith},

title = {Supersingular curves in cryptography},

booktitle = {},

year = {2001},

pages = {495--513},

publisher = {Springer-Verlag}

}

### Years of Citing Articles

### OpenURL

### Abstract

Frey and Rück gave a method to map the discrete logarithm problem in the divisor class group of a curve over ¢¡ into a finite field discrete logarithm problem in some extension. The discrete logarithm problem in the divisor class group can therefore be solved as long ¥ as is small. In the elliptic curve case it is known that for supersingular curves one ¥§¦© ¨ has. In this paper curves of higher genus are studied. Bounds on the possible values ¥ for in the case of supersingular curves are given. Ways to ensure that a curve is not supersingular are also given. 1.

### Citations

1242 | Identity-based encryption from the weil pairing
- Boneh, Franklin
- 2001
(Show Context)
Citation Context ...2. Recently, beginning with the work of Joux [14], the Weil pairing has found positive applications in cryptography. In Section 3 we generalise an identitybased cryptosystem due to Boneh and Franklin =-=[2]-=-. Our scheme provides a significant improvement in bandwidth over the scheme of Boneh and Franklin. 2 The Tate pairing In this section we summarise various known results. Throughout the paper C is a n... |

898 |
The Arithmetic of Elliptic Curves
- Silverman
- 1982
(Show Context)
Citation Context ...�� �¤����� � where � ���¤� is the polynomial arising in the numerator of � the zeta function of the curve (called � the -polynomial in Stichtenoth [30] V.1.14 and ������� � called in Theorem V.2.2 of =-=[26]-=-). We can � ��� � factor over the complex numbers � ��� ����� ��� ��� � ��� ��� � � as . It turns out that the algebraic integers � have certain remarkable properties. The following result (see Sticht... |

796 |
Identity-based Cryptosystems and Signature Schemes
- Shamir
- 1984
(Show Context)
Citation Context ...e endomorphism ψ such that 〈P, ψ(P )〉 (qk −1)/l �= 1.sSupersingular Curves in Cryptography 501 3 Identity-based cryptosystems using the Tate pairing Identity based cryptography was proposed by Shamir =-=[28]-=- as a response to the problem of managing public keys. The basic principle is that it should be possible to derive a user’s public data only from their identity. It is therefore necessary to have a tr... |

365 |
Algebraic Function Fields and Codes
- Stichtenoth
- 1993
(Show Context)
Citation Context ...gree with integer coefficients. We have ��� ����������� �¤����� � where � ���¤� is the polynomial arising in the numerator of � the zeta function of the curve (called � the -polynomial in Stichtenoth =-=[30]-=- V.1.14 and ������� � called in Theorem V.2.2 of [26]). We can � ��� � factor over the complex numbers � ��� ����� ��� ��� � ��� ��� � � as . It turns out that the algebraic integers � have certain re... |

317 |
Reducing elliptic curves logarithms to logarithms in a finite field
- Menezes, Okamoto, et al.
- 1993
(Show Context)
Citation Context ... � the ������� group divides . In general, the � value of depends on both the curve and the finite field and it is usually very ������������������������� large (i.e., ). Menezes, Okamoto and Vanstone =-=[16]-=- showed that for supersingular elliptic curves � the value above is always less than or equal to 6. This is an important result as it provides a good upper bound on the complexity of the attack in the... |

282 |
A One Round Protocol for Tripartite Diffie-Hellman
- Joux
- 2000
(Show Context)
Citation Context ...ingular curves in characteristic two. As an illustration we overcome the problem encountered in [27] and provide examples of secure genus two curves over F2. Recently, beginning with the work of Joux =-=[14]-=-, the Weil pairing has found positive applications in cryptography. In Section 3 we generalise an identitybased cryptosystem due to Boneh and Franklin [2]. Our scheme provides a significant improvemen... |

207 |
A remark concerning m-divisibility and the discrete logarithm problem in the divisor class group of curves
- Frey, Ruck
- 1976
(Show Context)
Citation Context ...ralising an identity-based cryptosystem due to Boneh and Franklin. The generalised scheme provides a significant reduction in bandwidth compared with the original scheme. 1 Introduction Frey and Rück =-=[8]-=- described how the Tate pairing can be used to map the discrete logarithm problem in the divisor class group of a curve C over a finite field Fq into the multiplicative group F∗ qk of some extension o... |

169 |
Computing in the Jacobian of a hyperelliptic curve
- Cantor
- 1987
(Show Context)
Citation Context ... for which there are efficient methods for computing in the divisor class group. The main example is of course elliptic curves. One can also use hyperelliptic curves (quadratic function fields) [11], =-=[4]-=-. Recently algorithms have been given for cubic function fields (see [25], [2]) and, more generally, superelliptic curves [9] and curves which have a totally ramified point [1]. For curves of genus 2 ... |

159 |
Hyperelliptic cryptosystems
- Koblitz
- 1989
(Show Context)
Citation Context ...in the supersingular case, the curves are always vulnerable, regardless of the degree of the field extension in question. When generalising cryptography to divisor class groups of higher genus curves =-=[11]-=- it is important to be able to detect these weak cases in advance. This is particularly true when, as is usually the case, one is considering curves defined over small fields and using the zeta functi... |

153 |
J.Endomorphisms of Abelian varieties over finite fields
- Tate
- 1966
(Show Context)
Citation Context ...lliptic curve). � � � � ��� is called ‘very special’ [14]. �s6 STEVEN D. GALBRAITH An important tool in the study of abelian varieties over finite fields is the following powerful theorem due to Tate =-=[32]-=-. �����¨������� ����� � � Let ands� � � �¢¡���� �¤£ � ��� be abelian varieties over and let and be the respective characteristic polynomials of Frobenius. Thensisogenous � � subvariety of � if and onl... |

96 |
Abelian varieties over finite fields
- Waterhouse
- 1969
(Show Context)
Citation Context ...R CURVES IN CRYPTOGRAPHY 5 ��� � � ��� � ��� � � � ��� �¥¤ � ��� ¤ ¦ � ����� � ��� � ¦ � � � � � � � � � ¦ ����� � � � � � £ ������¤ ¤ � � � � � Proof. The usual proof that uses results of Waterhouse =-=[34]-=-. We will give an alternative argument in Section 7. Note that is always such that . For all points we have . In other words, which proves the second assertion. This result means that, using the Weil ... |

91 |
Theory of commutative formal groups over fields of finite characteristic
- Manin
- 1963
(Show Context)
Citation Context ... (a1/ √ q0)X 2g−1 + · · · + 1 which has roots αi/ √ q0. By Theorem 2 the coefficients of P ′ (X) are integers. The numbers αi/ √ q0 are algebraic integers which are units but, by Theorem 4.1 of Manin =-=[21]-=-, it follows that they are actually roots of unity. Therefore P ′ (X) is a product of cyclotomic polynomials. By definition of k(g) there is some k ≤ k(g) such that (αi/ √ q0) k = 1 for all i. In othe... |

88 | An algorithm for solving the discrete log problem on hyperelliptic curves. Lect
- Gaudry
(Show Context)
Citation Context ...ve case £ . We only go as far as � � £ since there are subexponential ��� algorithms for solving the discrete logarithm problem on high-genus curves. Indeed, recent experimental results (e.g., Gaudry =-=[10]-=-) suggest that curves of genus greater than 5 would need to have somewhat larger key sizes than had initially been thought. This offsets any other advantages of these systems and so they would probabl... |

86 |
Classes d’isogénie des variétés abéliennes sur un corps fini
- Tate
- 1968
(Show Context)
Citation Context ...such � ����� � � � that ��� ��� ��� ¡ � ��� is � � lcm� � � ������� � � . � � � Hence an abelian � ��� � � � �������©� � ��� � � variety ��� � � ��� with (which must � exist by the Honda-Tate theorem =-=[33]-=-) would have embedding degree 30. We observe that the above result gives the � � � exact bound in the elliptic curve case £ . We only go as far as � � £ since there are subexponential ��� algorithms f... |

86 | Counting points on hyperelliptic curves using Monsky-Washnitzer cohomology - Kedlaya |

82 |
The improbability that an elliptic curve has sub-exponential discrete log problem under the MenezesOkamoto-Vanstone algorithm
- Balasubramanian, Koblitz
- 1998
(Show Context)
Citation Context ...that the order of E(Fq) is not divisible by a large prime (one exception is the case p = 2l + 1, but these only have k = 1). This phenomenon is indicated by the results of Balasubramanian and Koblitz =-=[1]-=- and is confirmed by computer experiments. It would be extremely interesting to have a construction for non-supersingular curves with relatively small values of k. 4 Supersingular curves over finite f... |

82 | Evidence that XTR is more secure than supersingular elliptic curve cryptosystems
- Verheul
(Show Context)
Citation Context ...ment of F∗ qk is an lth power in that case. Hence to have 〈P, P 〉 nontrivial it is necessary (but not sufficient) that l|(q − 1) and so k = 1. The following result originates from the work of [2] and =-=[36]-=-. It provides a very useful technique for finding points where the pairing is non-degenerate. Lemma 1. Let E be an elliptic curve. Let P ∈ E(Fq) be a point of prime order l. Let F q k be the extension... |

65 |
Oort –Moduli of supersingular abelian varieties
- Li, F
- 1998
(Show Context)
Citation Context ...that � � � � � � In dimensions one and two it happens that every very special abelian variety is supersingular, but for dimension three or more this is no longer necessarily the case (see Li and Oort =-=[14]-=- p. 9). We note, for completeness, that an abelian variety of dimension £ � � over a finite field is said to be ‘ordinary’ if and only if £ � � � � � � � � ��� � � � � � � ��� ��� � � � . Therefore, w... |

59 | The Tate pairing and the discrete logarithm applied to elliptic curve cryptosystems - Frey, Müller, et al. - 1999 |

54 |
Frobenius maps of Abelian varieties and finding roots of unity in finite fields
- Pila
- 1990
(Show Context)
Citation Context ...t from the start. ����� ��� � ��� � � and that ��� ¦�� 3. ������� COMPUTING From a theoretical point of view, the problem of � ��� � computing for any curve has a polynomial time solution due to Pila =-=[20]-=-, however this algorithm does not seem to be suited for practical computation. Therefore we focus on some elementary methods which can be used in cases � where is fairly small. Given a � � � � curve o... |

46 |
A Family of Jacobians Suitable for Discrete Log Cryptosystems
- Koblitz
- 1988
(Show Context)
Citation Context ...� ��§�� and �s� ��§ irreducible). In these cases one also has � � odd. 10. SOME EXAMPLES OF SUPERELLIPTIC CURVES The case of hyperelliptic curves has been fairly thoroughly explored in the past [11], =-=[12]-=-, [3], [24], [27]. In particular, [3] mention cases which are guaranteed to be non-supersingular. We give the first examples of superelliptic curves with group orders suitable for cryptography. In all... |

39 | Arithmetic on superelliptic curves
- Galbraith, Paulus, et al.
(Show Context)
Citation Context ... 2 3 · · · (e.g., ϕ(6) = 2, ϕ(30) = 8, ϕ(210) = 48 etc). The values pk of k(g) relate to the ways of taking least common multiples of the m(p(X)). g k ′ (g) k(g) k(g)/g 1 6 6 6 2 12 12 6 3 18 30 = lcm=-=(6, 10)-=- 10 4 30 60 = lcm(10, 12) 15 5 22 120 = lcm(8, 10, 6) 24 6 42 210 = lcm(6,10,14) 30 7 ⋆ 420 = lcm(5,7,12) 60 8 60 840 = lcm(3,5,7,8) 105 Table 1. Values of k(g). The symbol ⋆ indicates the fact that t... |

39 |
An elliptic curve implementation of the finite field digital signature algorithm
- Koblitz
- 1998
(Show Context)
Citation Context ... E2 : y 2 = x 3 − x − 1 over F 3 l, which have characteristic polynomial of Frobenius PE1 (X) = X2 + 3X + 3 and PE2 (X) = X2 − 3X + 3 respectively. These curves are thoroughly discussed by Koblitz in =-=[18]-=-. 1 Actually, in [2] it is specified that q have 1024 bits, but 512 bits seems to be sufficient.s504 Steven D. Galbraith A convenient non-F3-rational endomorphism for these curves is ψ : (x, y) ↦→ (−α... |

35 |
Subvarieties of moduli spaces
- Oort
- 1974
(Show Context)
Citation Context ...analogue of the notion of supersingularity. We will see that the following definition is the one which is appropriate for our application. � � ¢¤£¦¥§£©¨�£ ����� ¡ � � � ¥�� � � � ��� Jac����� � (Oort =-=[17]-=-) An abelian variety over is called ‘supersingular’ if is isogenous (over ) to a product of supersingular elliptic curves. A curve over is called ‘supersingular’ if is supersingular. In fact, as can b... |

32 | Speeding up the Discrete Log Computation on Curves with Automorphisms
- Duursma, Gaudry, et al.
- 1999
(Show Context)
Citation Context ...ses the symbol � represents a generator of the multiplicative group of the field of definition. As usual, one must be careful about the use of curves such as these due to the large automorphism group =-=[6]-=-, [10]. 11. CONCLUSION We have studied the impact of the Frey-Rück attack on supersingular curves. We emphasise that even in the non-supersingular case one should be careful: Given a divisor class gro... |

31 | On the Performance of Hyperelliptic Cryptosystems
- Smart
- 1999
(Show Context)
Citation Context ...should be used in cryptography. However, this is not necessarily � � � § the conclusion one wants to draw, since � � � � � � ��§�� equations of the form give some implementation efficiency (see Smart =-=[27]-=- Section 1 and [7] Theorem 14). In the case of genus three it is possible to give ‘safe’ examples. For instance, the � � � ��§�� curve of [24] � ��� ��� � � � � � ��� � � has and the fact � � that § �... |

28 |
On the discrete logarithms in the divisor of class group of curves
- Ruck
- 1999
(Show Context)
Citation Context ...f � a curve over a ��� finite field into the multiplicative £ � group of some extension of the base field. (For � the -part one can use the ad��� ditive form of the Tate-Lichtenbaum pairing, see Rück =-=[23]-=-.) This has significant implications for cryptography as there are well-known subexponential algorithms for solving the discrete logarithm problem in a finite field. Therefore, we have a method for so... |

19 |
Lattices basis reduction, Jacobi sums and hyperelliptic cryptosystems
- Buhler, Koblitz
(Show Context)
Citation Context ...� and �s� ��§ irreducible). In these cases one also has � � odd. 10. SOME EXAMPLES OF SUPERELLIPTIC CURVES The case of hyperelliptic curves has been fairly thoroughly explored in the past [11], [12], =-=[3]-=-, [24], [27]. In particular, [3] mention cases which are guaranteed to be non-supersingular. We give the first examples of superelliptic curves with group orders suitable for cryptography. In all case... |

19 |
A Course in Computational Number Theory
- Cohen
(Show Context)
Citation Context ...method to speed this up is to compute £ � ��¤ � for ���s� ��������� £ � � � £ � � � � � � £ � � � ��� ) and test the correctness of the group order probabilistically by ��� � � � � � ¡ � � (see Cohen =-=[5]-=- Proposition 4.3.3). This naive algorithm takes time � ��� � � � �����¥¤ � for some constant ¦ , which can also be written as � ����� £ �¨§ � � . � � and then to try all values of £ ��© � � � ��� � ��... |

19 |
Secure Hyperelliptic Cryptosystems and their Performance
- Sakai, Sakurai, et al.
- 1998
(Show Context)
Citation Context ...30] we have � �¤¢ �§¦ � ��§�� . It follows � � that tion � since is odd. � ¥�� �£¢�� � � ¥ � � ��§ � � � ��§�� ¥ � �¤¢ � � which is a contradic¥�� ¥ 9. EQUATIONS OF CURVES Sakai, Sakurai and Ishizuka =-=[24]-=- suggested some hyperelliptic curves for use in cryptography. On page 172 they mention that they were unable to find any secure genus 2 curves � � over . The reason for this is that they restrict to e... |

18 | Ideal arithmetic and infrastructure in purely cubic function fields
- Scheidler
(Show Context)
Citation Context ...s group. The main example is of course elliptic curves. One can also use hyperelliptic curves (quadratic function fields) [11], [4]. Recently algorithms have been given for cubic function fields (see =-=[25]-=-, [2]) and, more generally, superelliptic curves [9] and curves which have a totally ramified point [1]. For curves of genus 2 or more it is usually the case that curves are defined over small fields ... |

16 |
The Hasse–Witt matrix of an algebraic curve
- Manin
- 1965
(Show Context)
Citation Context ...genus 2 curve � �©¨ over � ��§ � where is monic of degree 5. � Then is supersingular. of the form � � � � � � ��§ � Proof. Using Lemma 9.1 we see that � ��� � � ��� � ��� � ��� . By a result of Manin =-=[15]-=- (also see Stichtenoth [29] Satz 1) it follows that Jac����� � � � ¨ � has no points of order� . In the case of dimension 2, this condition is known (see Li and Oort [14] p. 9) to be equivalent to sup... |

15 |
Comparing real and imaginary arithmetics for divisor class groups of hyperelliptic curves
- Paulus, Stein
(Show Context)
Citation Context ...ty if if��� ��� ��§��¤��� £ � � and only ands��§�� is irreducible. The case of hyperelliptic curves with one point at infinity is favoured for simplicity but the other case is more general. See [18], =-=[19]-=- for more details. A superelliptic curve (see [9]) is a curve which has an affine equation of the � � � ��§�� form � � over ��� � ��� � ����� � where ����� ��� � ��� � � ��§ � ��� � , and � � ��§ � � ... |

15 | Abelian surfaces and Jacobian varieties over finite fields - Rück - 1990 |

15 | Explicit bounds and heuristics on class numbers in hyperelliptic function fields
- Stein, Teske
(Show Context)
Citation Context ...��� Pic� ����� � ��� �scomputations on over or over some extension . This produces a method of complexity £ �¨§ � � ������� . A variation on the above strategy is to use the method of Stein and Teske =-=[28]-=- which computes £ ��� ����� � � � � � � � Pic� £ � ��� � ��� � in time proportional to where rounding of . One computes is a suitable £ � ��� ��� ¤ fors� � ������� � £ � � and then computes £ � ����� ... |

12 |
The Extended Euclidean Algorithm on Polynomials, and the Computational Efficiency of Hyperelliptic Cryptosystems,Des
- Enge
(Show Context)
Citation Context ...ryptography. However, this is not necessarily � � � § the conclusion one wants to draw, since � � � � � � ��§�� equations of the form give some implementation efficiency (see Smart [27] Section 1 and =-=[7]-=- Theorem 14). In the case of genus three it is possible to give ‘safe’ examples. For instance, the � � � ��§�� curve of [24] � ��� ��� � � � � � ��� � � has and the fact � � that § � � ¥ ¨ � � � � is ... |

12 |
and imaginary quadratic representations of hyperelliptic function
- Paulus, Ruck, et al.
- 1999
(Show Context)
Citation Context ...infinity if if��� ��� ��§��¤��� £ � � and only ands��§�� is irreducible. The case of hyperelliptic curves with one point at infinity is favoured for simplicity but the other case is more general. See =-=[18]-=-, [19] for more details. A superelliptic curve (see [9]) is a curve which has an affine equation of the � � � ��§�� form � � over ��� � ��� � ����� � where ����� ��� � ��� � � ��§ � ��� � , and � � ��... |

5 |
On the structure of the divisor class group of a class of curves over finite
- Stichtenoth, Xing
- 1995
(Show Context)
Citation Context ...ersingular abelian varieties, due to their importance to the study of certain moduli problems (see [14]). 6. A CRITERION FOR SUPERSINGULARITY The following result is a restatement of Proposition 1 of =-=[31]-=-. It gives a simple test for whether or not an abelian variety is supersingular, once � ��� � has been computed. Due to its importance in this paper we provide a proof. �����¨������� ����� ¦ ��� � � S... |

4 |
Efficient reduction on the Jacobian variety of Picard curves
- Barreiro, Sarlabous, et al.
- 1998
(Show Context)
Citation Context ...p. The main example is of course elliptic curves. One can also use hyperelliptic curves (quadratic function fields) [11], [4]. Recently algorithms have been given for cubic function fields (see [25], =-=[2]-=-) and, more generally, superelliptic curves [9] and curves which have a totally ramified point [1]. For curves of genus 2 or more it is usually the case that curves are defined over small fields such ... |

4 | Hans-Georg Rück, Real and imaginary quadratic representations of hyperelliptic function fields
- Paulus
- 1999
(Show Context)
Citation Context ...ints at infinity if and only if deg(h(x)) = g+1 and h(x) is irreducible. The case of hyperelliptic curves with one point at infinity is favoured for simplicity but the other case is more general. See =-=[18]-=-, [19] for more details. A superelliptic curve (see [9]) is a curve which has an affine equation of the form y n = f(x) over F q where gcd(n; q) = 1, gcd(n; deg f(x)) = 1 and gcd(f(x); f 0 (x)) = 1. S... |

3 |
Rück: A remark concerning -divisibility and the discrete logarithm in the divisor class group of curves, Mathematics of Computation 62
- Frey, H-W
- 1994
(Show Context)
Citation Context ...er genus are studied. Bounds on the possible values ¥ for in the case of supersingular curves are given. Ways to ensure that a curve is not supersingular are also given. 1. INTRODUCTION Frey and Rück =-=[8]-=- described how the Tate pairing (in the form due to Lichtenbaum) can be used to map the discrete logarithm problem (prime-to-� on the part of the) divisor class group of � a curve over a ��� finite fi... |

3 |
Supersingular curves in cryptography, full version. Available at http://www.isg.rhul.ac.uk/ sdg/ss.ps.gz
- Galbraith
(Show Context)
Citation Context ...q k). Suppose that l 2 �#G (i.e., that G[l] ∼ = G/lG). Let ψ be an endomorphism of E which is not defined over Fq. If ψ(P ) �∈ E(Fq) then 〈P, ψ(P )〉 (qk −1)/l �= 1. For the proof see the full version =-=[11]-=-. We refer to the maps ψ as ‘non-Fqrational endomorphisms’ (Verheul [36] calls them ‘distortion maps’). In the case of curves of genus greater than one then this result is no longer true. On the other... |

2 |
Algorithms for computations in Jacobian group of C a;b curve and their application to discrete-log-based public key cryptosystems. in The mathematics of public key cryptography
- Arita
- 1999
(Show Context)
Citation Context ... function fields) [11], [4]. Recently algorithms have been given for cubic function fields (see [25], [2]) and, more generally, superelliptic curves [9] and curves which have a totally ramified point =-=[1]-=-. For curves of genus 2 or more it is usually the case that curves are defined over small fields such as F 2 or F 2 2 to facilitate easy point counting as discussed in Section 2. Another way to procee... |

1 |
Phys
- Long, Hautot, et al.
- 1998
(Show Context)
Citation Context ... function fields) [11], [4]. Recently algorithms have been given for cubic function fields (see [25], [2]) and, more generally, superelliptic curves [9] and curves which have a totally ramified point =-=[1]-=-. For curves of genus 2 or more it is usually the case that curves are defined over small fields such as � � or � Section 2. Another way to proceed is to consider curves over larger fields which have ... |

1 |
Arithmetic on superelliptic curves, Hewlett-Packard
- Galbraith, Paulus, et al.
- 1998
(Show Context)
Citation Context ...s. One can also use hyperelliptic curves (quadratic function fields) [11], [4]. Recently algorithms have been given for cubic function fields (see [25], [2]) and, more generally, superelliptic curves =-=[9]-=- and curves which have a totally ramified point [1]. For curves of genus 2 or more it is usually the case that curves are defined over small fields such as � � or � Section 2. Another way to proceed i... |

1 |
Abelsche varietäten niderer dimension über endlichen körpern, Habilitation Thesis
- Rück
- 1990
(Show Context)
Citation Context ...f the Newton polygon and some class field theory. One shows that, in genus 2, the only polynomials � ��� � which satisfy the condition of Lemma 9.1 also satisfy the condition of Theorem 6.1 (see Rück =-=[21]-=- for details of this approach). Note that both of these arguments rely heavily on the fact that we are in the genus 2 case. We note that £ � � � and ��� £ ����� supersingular. An example is the genus ... |

1 |
Die Hasse-Witt-invariante eines kongruenzfunktionenkörpers
- Stichtenoth
- 1980
(Show Context)
Citation Context ...��§ � where is monic of degree 5. � Then is supersingular. of the form � � � � � � ��§ � Proof. Using Lemma 9.1 we see that � ��� � � ��� � ��� � ��� . By a result of Manin [15] (also see Stichtenoth =-=[29]-=- Satz 1) it follows that Jac����� � � � ¨ � has no points of order� . In the case of dimension 2, this condition is known (see Li and Oort [14] p. 9) to be equivalent to supersingularity. An alternati... |

1 | Rump session talk, Eurocrypt - Harley - 2001 |

1 |
uck, Abelsche variet aten niderer dimension uber endlichen k orpern, Habilitation Thesis
- H-G
- 1990
(Show Context)
Citation Context ...of the Newton polygon and some class field theory. One shows that, in genus 2, the only polynomials P (X) which satisfy the condition of Lemma 9.1 also satisfy the condition of Theorem 6.1 (see R uck =-=[21]-=- for details of this approach). Note that both of these arguments rely heavily on the fact that we are in the genus 2 case. We note that #C(F 2 ) and #C(F 2 2 ) being odd does not alone imply that C i... |

1 | uck, Abelian surfaces and Jacobian varieties over finite fields - H-G - 1990 |