Computing the Characteristic Polynomials of a Class of Hyperelliptic Curves for Cryptographic Applications

Abstract

Hyperelliptic curves have been widely studied for cryptographic applications, and some special hyperelliptic curves are often considered to be used in practical cryptosystems. Computing Jacobian group orders is an important operation in constructing hyperelliptic curve cryptosystems, and the most common method used for the computation of Jacobian group orders is by computing the zeta functions or the characteristic polynomials of the related hyperelliptic curves. For the hyperelliptic curve 𝐶_𝑞: 𝑣²=𝑢^𝑝+𝑎𝑢+𝑏 over the field 𝔽_𝑞 with 𝑞 being a power of an odd prime p, Duursma and Sakurai obtained its characteristic polynomial for 𝑞=𝑝, 𝑎=−1, and 𝑏∈𝔽_𝑝. In this paper, we determine the characteristic polynomials of 𝐶_𝑞 over the finite field 𝔽_𝑝𝑛 for 𝑛=1, 2 and 𝑎, 𝑏∈F_𝑝𝑛. We also give some computational data which show that many of those curves have large prime factors in their Jacobian group orders, which are both practical and vital for the constructions of efficient and secure hyperelliptic curve cryptosystems.

1. Introduction and Main Results

1.1. Hyperelliptic Curves and Cryptosystems

A hyperelliptic curve 𝐶 of genus 𝑔 over 𝔽_𝑞 is defined by an equation of the form𝑣²+ℎ(𝑢)𝑣=𝑓(𝑢), (1.1) where ℎ(𝑢), 𝑓(𝑢)∈𝔽_𝑞[𝑢] with deg_𝑢(ℎ)≤𝑔 and deg_𝑢(𝑓)=2𝑔+1, and the equation system 𝑣²+ℎ(𝑢)𝑣=𝑓(𝑢), 2𝑣+ℎ(𝑢)=0, and ℎ^′(𝑢)𝑣−𝑓^′(𝑢)=0 has no solutions in 𝔽_𝑞×𝔽_𝑞.

For an extension 𝕂 of 𝔽_𝑞, the set 𝐶(𝕂)=𝑥,𝑦∈𝕂×𝕂∣𝑦²+ℎ(𝑥)𝑦=𝑓(𝑥)∪{∞} (1.2) is called the set of 𝕂-rational points on 𝐶. The symbol ∞ is called the point at infinity, and the other points are called finite points.

A divisor 𝐷 is defined as a finite formal sum of finite points or the infinity ∞, while the Jacobian group (or simply called Jacobian) of the curve 𝐶 over 𝕂 is an Abelian group composed of some special divisors (i.e., reduced divisors) on 𝐶. This Jacobian group is generally denoted as 𝕁_𝐶(𝕂). A hyperelliptic curve cryptosystem (HECC) is a cryptosystem constructed on the Jacobian group of the hyperelliptic curve over a finite field. For example, the hyperelliptic curve digital signature algorithm (HECDSA) is a hyperelliptic curve version of an elliptic curve digital signature algorithm (ECDSA). The security of an HECC is based on the discrete logarithm problems in the corresponding Jacobian group.

Since HECC was invented by Koblitz [1] in 1989, it has been extensively researched, and now it has been considered for practical cryptographic applications. For a certain number of classes of hyperelliptic curves with some specific parameters, the corresponding HECC can even possess lower complexities than an elliptic curve cryptosystem but with the same level of security [2].

In order to construct a secure HECC, one first has to choose a hyperelliptic curve over a finite field and then compute the order of the hyperelliptic curve Jacobian group. If the order does not have a large prime factor, then the discrete logarithm problems in this Jacobian group may not be hard enough to guarantee the security of the HECC, and so the hyperelliptic curve is not suitable for cryptographic uses and should be chosen again to ensure that the Jacobian group order has some large prime factor. But, in most cases, this computation is a very time-consuming task. Hence, the computation of Jacobian group order is a very important step for the efficient implementation of HECC.

1.2. Zeta Functions and Jacobian Group Orders

The most common method used for the computation of Jacobian group orders is by computing the numerator of the zeta functions of the related hyperelliptic curves, or by computing the characteristic polynomial of the hyperelliptic curve. The following results are due to the Weil's theorem [3, 4] and Kedlaya's algorithm [5].

Let 𝐶 be a hyperelliptic curve of (1.1) over 𝔽_𝑞. For any positive integer 𝑟, let 𝑁_𝑟 denote the number of 𝔽_𝑞𝑟-rational points on 𝐶. The zeta function of 𝐶 is defined as 𝑍(𝑡)=𝑍(𝐶;𝑡)=exp^∞_𝑟=1𝑁_𝑟𝑡^𝑟𝑟. (1.3)

Then (a)𝑍(𝑡) is a rational function over ℤ and can be written as 𝑄(𝑡)/(1−𝑡)(1−𝑞𝑡), where 𝑄(𝑡)∈ℤ[𝑡],(b)there exist complex numbers 𝜏_𝑖(𝑖=1,…,2𝑔) with |𝜏_𝑖|=√𝑞 such that 𝑄(𝑡)=^2𝑔_𝑖=11−𝜏_𝑖𝑡,𝑁_𝑟=𝑞^𝑟+1−^2𝑔_𝑖=1𝜏^𝑟_𝑖, (1.4)(c)the integer coefficient polynomial 𝑃(𝑡)=𝑡^2𝑔𝑄1𝑡=^2𝑔_𝑖=1𝑡−𝜏_𝑖 (1.5) is called the characteristic polynomial of the Frobenius endomorphism on 𝕁_𝐶(𝔽_𝑞) (it is also called the characteristic polynomial of 𝐶 over 𝔽_𝑞), and it is can be expressed as 𝑃(𝑡)=𝑡^2𝑔+𝑎₁𝑡^2𝑔−1+⋯+𝑎_𝑔𝑡^𝑔+𝑞𝑎_𝑔−1𝑡^𝑔−1+⋯+𝑞^𝑔−1𝑎₁𝑡+𝑞^𝑔, (1.6) where for 1≤𝑖≤g, 𝑖𝑎_𝑖=𝑁_𝑖−𝑞^𝑖−1+𝑁_𝑖−1−𝑞^𝑖−1−1𝑎₁+⋯+𝑁₁−𝑞−1𝑎_𝑖−1, (1.7)(d)for any positive integer 𝑛, the order of 𝕁_𝐶(𝔽_𝑞𝑛) is given as #𝕁_𝐶𝔽_𝑞𝑛=^2𝑔_𝑖=11−𝜏^𝑛_𝑖. (1.8)

Hence, for any positive integer 𝑛, the order of 𝕁_𝐶(𝔽_𝑞𝑛) can be computed if 𝑃(𝑡) is determined or if 𝑁_𝑟(1≤𝑟≤𝑔) are computed.

For a positive integer 𝑗, the quadratic character 𝜒_𝑗 of 𝔽_𝑞𝑗 is defined as 𝜒_𝑗∶𝛼⟼1if𝛼isaquadraticresiduein𝔽_𝑞𝑗,0if𝛼=0,−1if𝛼isanon-quadraticresiduein𝔽_𝑞𝑗. (1.9)

Obviously, 𝜒_𝑗(𝛼𝛽)=𝜒_𝑗(𝛼)𝜒_𝑗(𝛽) holds for any 𝛼,𝛽∈𝔽_𝑞𝑗. By using 𝜒_𝑗, we can compute 𝑁_𝑗 as𝑁_𝑗=1+𝑥,𝑦∈𝔽_𝑞𝑗×𝔽_𝑞𝑗∣𝑦²=𝑓(𝑥)=1+_{𝑥∈𝔽𝑞𝑗}𝜒_𝑗𝑓(𝑥)+1=𝑞^𝑗+1+_{𝑥∈𝔽𝑞𝑗}𝜒_𝑗𝑓(𝑥). (1.10) While for any positive integer 𝑗 and every field element 𝛼∈𝔽_𝑞𝑗, the value of the extended quadratic character 𝜒_𝑗 at 𝛼 can be computed as 𝜒_𝑗(𝛼)=𝛼^{(𝑞𝑗−1)/2} in 𝔽_𝑞.

1.3. Our Main Results

Let 𝐶_𝑞 be the curve with the equation𝐶_𝑞∶𝑣²=𝑢^𝑝+𝑎𝑢+𝑏over𝔽_𝑞, (1.11) where 𝑎≠0 and 𝑞 is a power of an odd prime 𝑝. Then 𝐶_𝑞 is a hyperelliptic curve of genus (𝑝−1)/2. In [6], Duursma and Sakurai presented 𝑄(𝑡) of 𝐶_𝑞 for 𝑞=𝑝 and 𝑎=−1. That is, the numerator of the corresponding zeta function is given as𝑄(𝑡)=^𝑝−1_𝑘=1𝑘1−𝑝𝜁^𝑘𝑝𝑡or^𝑝−1_𝑘=1𝑘1+𝑝𝜁^𝑘𝑝𝑡, (1.12) respectively, where 𝑝=(−1/𝑝)𝑝, 𝑝=−(−1/𝑝)∑^𝑝−1_𝑘=1(𝑘/𝑝)𝜁^𝑘, 𝜁 is a 𝑝-th unity root, and (𝑘/𝑝) denotes the Legendre symbol.

In this paper, we compute the characteristic polynomials of 𝐶_𝑞 with 𝑎,𝑏∈𝔽_𝑞 (𝑞=𝑝^𝑛, 𝑛=1,2) and get the following Table 1.

Table 1 

The characteristic polynomials of the curve 𝑣²=𝑢^𝑝+𝑎𝑢+𝑏 over 𝔽_𝑝𝑛.

From the characteristic polynomials of the hyperelliptic curve 𝐶_𝑝 over 𝔽_𝑝𝑛, the orders of Jacobian groups 𝕁_𝐶𝑝(𝔽_𝑝𝑛) can be easily computed as#𝕁_𝐶𝑝𝔽_𝑝𝑛=^𝑝−1_𝑖=11−𝜏^𝑛_𝑖. (1.13) For example, if 𝑎 is a primitive element modulo 𝑝, then the characteristic polynomial of 𝐶_𝑝 is 𝑃(𝑡)=𝑡^𝑝−1+𝑝^(𝑝−1)/2=_{𝜁𝑝−1=1}𝑡−𝜁𝜆√𝑝, (1.14) where 𝜆 satisfies 𝜆^𝑝−1+1=0. Hence, the order of the Jacobian group of 𝐶_𝑝 over 𝔽_𝑝𝑛 is #𝕁_𝐶𝑝𝔽_𝑝𝑛=_{𝜁𝑝−1=1}1−𝜁𝜆√𝑝^𝑛. (1.15)

If 𝑛 is an integer coprime to 𝑝−1, let 𝜂=𝜁^𝑛; then 𝜂 will also run through all these roots when 𝜁 runs through the all roots of 𝑥^𝑝−1−1=0. Hence, we have 1−𝜁𝜆√_{𝜁𝑝−1=1}𝑝^𝑛=_{𝜁𝑝−1=1}1−𝜁^𝑛𝜆√𝑝^𝑛=_{𝜂𝑝−1=1}1−𝜂𝜆√𝑝^𝑛=1−𝜆√𝑝^𝑛𝑝−1=1−𝜆^p−1𝑛√𝑝^𝑛𝑝−1=1−(−1)^𝑛√𝑝^{𝑛(𝑝−1)}=1+√𝑝^{𝑛(𝑝−1)}. (1.16)

If 𝑛 is an integer not coprime to 𝑝−1, let 𝑑 be the factor of 𝑛 such that gcd(𝑛/𝑑,𝑝−1)=1, then we have 1−𝜁𝜆√_{𝜁𝑝−1=1}𝑝^𝑛=_{𝜁𝑝−1=1}1−𝜁𝜆√𝑝^{𝑛/𝑑𝑑}=_{𝜁𝑝−1=1𝜉𝑑=1}1−𝜉𝜁𝜆√𝑝^𝑛/𝑑=_{𝜉𝑑=1𝜁𝑝−1=1}1−𝜉𝜁𝜆√𝑝^𝑛/𝑑=_{𝜉𝑑=1𝜁𝑝−1=1}1−𝜁^𝑛/𝑑𝜉^𝑑/𝑛𝜆√𝑝^𝑛/𝑑=_𝜉𝑑=11−𝜉^𝑑/𝑛𝜆√𝑝^{𝑛/𝑑𝑝−1}=_𝜉𝑑=11−𝜉^𝑝−1𝜆^{𝑛(𝑝−1)/𝑑}√𝑝^{𝑛(𝑝−1)/𝑑}=_𝜉𝑑=11−𝜆^{𝑛(𝑝−1)/𝑑}√𝑝^{𝑛(𝑝−1)/𝑑}=1−(−1)^𝑛/𝑑√𝑝^{𝑛(𝑝−1)/𝑑𝑑}. (1.17) That is, for any positive integer 𝑛, the order of the Jacobian group of the curve 𝐶_𝑝 over 𝔽_𝑝𝑛 with 𝑎 being a primitive element modulo 𝑝 can be computed as #𝕁_𝐶𝑝𝔽_𝑝𝑛=1−(−1)^𝑛/𝑑√𝑝^{𝑛(𝑝−1)/𝑑𝑑}, (1.18) where 𝑑 is the factor of 𝑛 such that gcd(𝑛/𝑑,𝑝−1)=1.

In Table 2, we give some essential parameters with which the Jacobian group order of 𝐶_𝑞 has some large prime factors, which shows that the 𝐶_𝑞 with these parameters may be used for cryptographic applications.

Table 2 

Some cases in which 𝐶_𝑞 have reducible characteristic polynomials.

2. Isomorphic Curves, Twisted Curves, and Their Characteristic Polynomials

Two hyperelliptic curves of the same genus over the field 𝔽 are called isomorphic over 𝔽 if they are isomorphic as projective varieties over 𝔽. If 𝐶₁ and 𝐶₂ are isomorphic over 𝔽, then their Jacobian groups 𝕁_𝐶1(𝔽) and 𝕁_𝐶2(𝔽) are also isomorphic [7]. Hence, the hyperelliptic curve cryptosystem based on the Jacobian group of 𝐶₁ is equivalent to that based on the Jacobian group of 𝐶₂.

From [8], we know how to the hyperelliptic curves are isomorphic. Precisely, suppose 𝐶₁ and 𝐶₂ are two hyperelliptic curves of the equation forms 𝐻_𝑖∶𝑣²+ℎ_𝑖(𝑢)𝑣=𝑓_𝑖(𝑢)(𝑖=1,2), respectively, with ℎ_𝑖(𝑢), 𝑓_𝑖(𝑢) (monic) ∈𝔽[𝑢], deg(ℎ_𝑖(𝑢))≤𝑔, and deg(𝑓_𝑖(𝑢))=2𝑔+1. Then 𝐶₁ and 𝐶₂ are isomorphic over 𝔽 if and only if there exist 𝑠∈𝔽^⋆, 𝑡∈𝔽, and 𝑟(𝑢)∈𝔽[𝑢] with deg(𝑟(𝑢))≤𝑔, such that 𝐻₁ can be transformed into 𝐻₂ through the coordinate change: (𝑢,𝑣)⟼𝑠²𝑢+𝑡,𝑠^2𝑔+1𝑣+𝑟(𝑢). (2.1)

In our case, a hyperelliptic curve 𝐶^′_𝑞 is isomorphic to the hyperelliptic curve 𝐶_𝑞 if and only if there exist 𝑠∈𝔽^∗_𝑞 and 𝑡∈𝔽_𝑞 such that 𝐶^′_𝑞 has the equation form 𝑣²=𝑢^𝑝+𝑠^2(𝑝−1)𝑎𝑢+𝑠^2𝑝𝑡^𝑝+𝑎𝑡+𝑏. (2.2)

If 𝑞=𝑝, then 𝐶^′_𝑞 has the equation form 𝑣²=𝑢^𝑝+𝑎𝑢+𝑠²((1+𝑎)𝑡+𝑏),𝑠≠0. (2.3)

By using (1.10), we can easily show that if 𝐶₁ and 𝐶₂ are isomorphic then their characteristic polynomials 𝑃₁(𝑡) and 𝑃₂(𝑡) are equal.

Theorem 2.1. Let 𝑎₀=1 and 𝐶∶𝑣²=^2𝑔+1_𝑖=0𝑎_𝑖𝑢^{2𝑔+1−𝑖} (2.4) be a hyperelliptic curve of genus 𝑔 over 𝔽_𝑞 of odd characteristic 𝑝, and 𝑃(𝑡) its characteristic polynomial. Let 𝛾 be a quadratic nonresidue in 𝔽_𝑞. Then, the hyperelliptic curve 𝐶^′∶𝑣²=^2𝑔+1_𝑖=0𝛾^𝑖𝑎_𝑖𝑢^{2𝑔+1−𝑖} (2.5) has the characteristic polynomial 𝑃′(𝑡)=𝑃(−𝑡).

Proof. Let𝑁^′_𝑗 denote the number of rational points of the hyperelliptic curve 𝐶^′ over 𝔽_𝑞𝑗 and 𝜒_𝑗 denote the extended quadratic character of 𝔽_𝑞𝑗. Then, since 𝜒_𝑗𝛾=𝛾^{((𝑞−1)/2)(𝑞𝑗−1+⋯+𝑞+1)}=𝜒₁𝛾^{𝑞𝑗−1+⋯+𝑞+1}=(−1)^𝑗, (2.6) hence, according to (1.10), we have 𝑁^′_𝑗=𝑞^𝑗+1+_{𝑥∈𝔽𝑞𝑗}𝜒_𝑗^2𝑔+1_𝑖=0𝛾^𝑖𝑎_𝑖𝑥^{2𝑔+1−𝑖}=𝑞^𝑗+1+_{𝑥∈𝔽𝑞𝑗}𝜒_𝑗^2𝑔+1_𝑖=0𝛾^𝑖𝑎_𝑖𝛾𝑥^{2𝑔+1−𝑖}=𝑞^𝑗+1+_{𝑥∈𝔽𝑞𝑗}𝜒_𝑗𝛾^2𝑔+1𝜒_𝑗^2𝑔+1_𝑖=0𝑎_𝑖𝑥^{2𝑔+1−𝑖}=𝑞^𝑗+1+_{𝑥∈𝔽𝑞𝑗}(−1)^𝑗𝜒_𝑗^2𝑔+1_𝑖=0𝑎_𝑖𝑥^{2𝑔+1−𝑖}=𝑁_𝑗2𝑞,𝑗iseven,_𝑗+1−𝑁_𝑗,𝑗isodd. (2.7) It follows 𝑃′(𝑡)=𝑃(−𝑡) from (1.6), (1.7), and (1.10).

The hyperelliptic curve 𝐶^′ is called a twisted curve of 𝐶 over 𝔽_𝑞 by 𝛾. For the curve 𝐶_𝑞, its twisted curve is a hyperelliptic curve of the equation 𝑣²=𝑢^𝑝+𝛾^𝑝−1𝑎𝑢+𝛾^𝑝𝑏 (2.8) with 𝛾 a quadratic nonresidue in 𝔽_𝑞.

In the following, we compute the characteristic polynomials of 𝐶_𝑞 over 𝔽_𝑞 with 𝑞=𝑝^𝑛.

Case 1. For the curve 𝐶_𝑝∶𝑣²=𝑢^𝑝+𝑎𝑢+𝑏 with 𝑎=−1 and 0≠𝑏∈𝔽_𝑝, 𝐶_𝑝 has (𝑝−1)/2 isomorphic curves over 𝔽_𝑝, which are 𝑣²=𝑢^𝑝−𝑢+𝑠²𝑏,𝑠=1,2,⋯,𝑝−12. (2.9) Hence, there are three isomorphism classes of hyperelliptic curves 𝐶_𝑝 over 𝔽_𝑝 which are denoted as 𝒞_𝑝(−1,0), 𝒞_𝑝(−1,+) and 𝒞_𝑝(−1,−), respectively, 𝒞_𝑝(−1,0)=𝑣²=𝑢^𝑝,𝒞−𝑢_𝑝(−1,+)=𝑣²=𝑢^𝑝−𝑢+𝑏⁺∣𝑏⁺,𝒞isaquadraticresiduemodulo𝑝_𝑝(−1,−)=𝑣²=𝑢^𝑝−𝑢+𝑏⁻∣𝑏⁻isaquadraticnonresiduemodulo𝑝. (2.10)
If 𝑣²=𝑢^𝑝−𝑢+𝑏⁺∈𝒞_𝑝(−1,+) and 𝛾 is a quadratic nonresidue modulo 𝑝, then its twisted curve 𝑣²=𝑢^𝑝−𝛾^𝑝−1𝑢+𝛾^𝑝𝑏⁺ or 𝑣²=𝑢^𝑝−𝑢+𝛾𝑏⁺ belongs to 𝒞_𝑝(−1,−).
According to [9], we know that the characteristic polynomial of the hyperelliptic curve 𝑣²=𝑢^𝑝−𝑢 over 𝔽_𝑝 is 𝑃_{𝒞𝑝(−1,0)}(𝑡)=𝑡²−𝑝^(𝑝−1)/2. (2.11)
While for all the curves in 𝒞_𝑝(−1,+) or 𝒞_𝑝(−1,−), their characteristic polynomials were proved by Duursma [9] to be ^𝑝−1_𝑘=1𝑘𝑡−𝑝𝜁^𝑘𝑝or^𝑝−1_𝑘=1𝑘𝑡+𝑝𝜁^𝑘𝑝, (2.12) respectively.

For examples, the curve 𝑣²=𝑢⁵−𝑢 over 𝔽₅ and the curve 𝑣²=𝑢⁷−𝑢 over 𝔽₇ have the characteristic polynomial (𝑡²−5)² and 𝑃(𝑡)=(𝑡²+7)³, respectively. The curves in 𝒞₅(−1,+) or 𝒞₇(−1,+) have the characteristic polynomial 𝑡⁴+5𝑡³+15𝑡²+25𝑡+25 or 𝑡⁶+7𝑡⁵+21𝑡⁴+49𝑡³+147𝑡²+343𝑡+343, respectively. The curves in 𝒞₅(−1,−) or 𝒞₇(−1,−) have the characteristic polynomial 𝑡⁴−5𝑡³+15𝑡²−25𝑡+25 or 𝑡⁶−7𝑡⁵+21𝑡⁴−49𝑡³+147𝑡²−343𝑡+343, respectively.

Case 2. Over 𝔽_𝑝2, the hyperelliptic curve 𝑣²=𝑢^𝑝+𝑢 is a quotient of the Hermitian curve 𝑣^𝑝+1=𝑢^𝑝+𝑢 which is maximal, and this leads to that over 𝔽_𝑝2, 𝑣²=𝑢^𝑝+𝑢 has the characteristic polynomial [10]

𝑃(t)=𝑡+𝑝^𝑝−1. (2.13)

Based on the following Theorem 2.6, for any 𝑏∈𝔽_𝑝, the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 is isomorphic to 𝑣²=𝑢^𝑝+𝑢. Thus, 𝑣²=𝑢^𝑝+𝑢+𝑏 over 𝔽_𝑝2 also has the characteristic polynomial (2.13). And it follows that the characteristic polynomial of 𝑣²=𝑢^𝑝+𝑢+𝑏 over 𝔽_𝑝 equals to𝑃(t)=𝑡²+𝑝^(𝑝−1)/2. (2.14)

Case 3. Suppose 𝑎≠0,±1. Then for the fixed 𝑎 and all 𝑏∈𝔽_𝑝, all the hyperelliptic curves 𝑣²=𝑢^𝑝+𝑎𝑢+𝑏 are isomorphic. Hence, each of these curves is isomorphic to its twisted curve. Thus, the coefficients of the terms of odd degrees in their corresponding characteristic polynomials are zero. In fact, we have the following Lemma 2.2.

Lemma 2.2. Suppose 𝑝 is an odd prime number, 𝑎∈𝔽_𝑝, and 𝑟 is a positive integer satisfying 1≤𝑟≤(𝑝−1)/2. Then _{𝑥∈𝔽𝑝𝑟}𝜒_𝑟𝑥^𝑝+𝑎𝑥=0 (2.15) holds if one of the following three conditions is satisfied:(1)𝑟=2 or 𝑟 is odd;(2)𝑟(>2) is even and 𝑎 is a primitive root modulo 𝑝.

Proof. Suppose 𝑟 is odd, and let 𝛾 be a quadratic nonresidue in 𝔽_𝑝. Then, we have _{𝑥∈𝔽𝑝𝑟}𝜒_𝑟𝑥^𝑝+𝑎𝑥=_{𝑥𝛾∈𝔽𝑝𝑟}𝜒_𝑟𝑥𝛾^𝑝=+𝑎𝑥𝛾_{𝑥∈𝔽𝑝𝑟}𝜒_𝑟𝛾𝜒_𝑟𝑥^𝑝+𝑎𝑥=(−1)^𝑟_{𝑥∈𝔽𝑝𝑟}𝜒_𝑟𝑥^𝑝+𝑎𝑥=−_{𝑥∈𝔽𝑝𝑟}𝜒_𝑟𝑥^𝑝+𝑎𝑥, (2.16) and it follows ∑_{𝑥∈𝔽𝑝𝑟}𝜒_𝑟(𝑥^𝑝+𝑎𝑥)=0.
Let 𝑟=2 or 𝑟 even and 𝑎 a primitive root modulo 𝑝. We first show that 𝑥^𝑝+𝑎𝑥 will run through 𝔽_𝑝𝑟 if 𝑥 runs through 𝔽_𝑝𝑟. It is equivalent to show that for any 𝑥∈𝔽_𝑝𝑟, if 𝑥≠0, then 𝑥^𝑝+𝑎𝑥≠0. That is, we have to show that the equation 𝑥^𝑝+𝑎𝑥=0 has no nonzero solution in 𝔽_𝑝𝑟.
Assume that 𝑥₀ is a nonzero root of 𝑥^𝑝+𝑎𝑥=0 in 𝔽_𝑝𝑟, that is, x^𝑝₀=−𝑎𝑥₀. Then we have 𝑥^𝑝2₀=−𝑎𝑥^𝑝₀=(−1)²𝑎²𝑥₀, and it follows 𝑥^𝑝𝑟₀=(−𝑎)^𝑟−1𝑥^𝑝₀=(−1)^𝑟𝑎^𝑟𝑥₀, that is, 𝑥₀=𝑎^𝑟𝑥₀ or 𝑥₀(1−𝑎^𝑟)=0. Thus, 𝑥₀=0 or 𝑎^𝑟=1, it is impossible. Therefore, _{𝑥∈𝔽𝑝𝑟}𝜒_𝑟𝑥^𝑝+𝑎𝑥=_{𝑥∈𝔽𝑝𝑟}𝜒_𝑟(𝑥)=0. (2.17)

Lemma 2.3. For any odd prime number 𝑝, we have _{𝑥∈𝔽𝑝𝑟}𝜒_𝑟𝑥^𝑝=()+𝑥0if𝑟isodd,−1^𝑟/2−1𝑝^𝑟/2𝑝−1if𝑟isevenandnolargerthan𝑝. (2.18)

Proof. ∑_{𝑥∈𝔽𝑝𝑟}𝜒_𝑟(𝑥^𝑝+𝑥)=0 comes directly from Lemma 2.2 if 𝑟 is odd.
Suppose 𝑟 is even and 𝑟≤𝑝−1. Let 𝑎_𝑘(0≤𝑘≤𝑝−1) be the coefficients of the characteristic polynomial (2.14); then 𝑎_𝑘=0 if 𝑘 is odd, and 𝑎_𝑘=𝑝^𝑘/2⋅𝑝−1𝑝−3⋯𝑝−𝑘+12^𝑘/2⋅(𝑘/2)! (2.19) if 𝑘 is even. Thus, from (1.7), we have 𝑘𝑎_𝑘=_{𝑥∈𝔽𝑝𝑘}𝜒_𝑘𝑥^𝑝+𝑥+𝑎_{2𝑥∈𝔽𝑝𝑘−2}𝜒_𝑘−2𝑥^𝑝+𝑥+⋯+𝑎_{𝑘−2𝑥∈𝔽𝑝2}𝜒₂𝑥^𝑝+𝑥. (2.20) From this above equation and (2.19), we can inductively show _{𝑥∈𝔽𝑝𝑟}𝜒_𝑟𝑥^𝑝+𝑥=(−1)^𝑟/2−1𝑝^𝑟/2𝑝−1. (2.21)

Theorem 2.4. Suppose 𝑝 is an odd prime number and 𝑎(≠0,±1)∈𝔽_𝑝. Let 𝑚 be the order of 𝑎 in the multiplicative group 𝔽^∗_𝑝. Then, the characteristic polynomial of the curve 𝑣²=𝑢^𝑝+𝑎𝑢+𝑏 over 𝔽_𝑝 is 𝑃(𝑡)=𝑡^𝑚+−1𝑝−𝑝^{𝑚/2(𝑝−1)/𝑚}𝑡if𝑚iseven,_2𝑚+𝑝^{𝑚(𝑝−1)/2𝑚}if𝑚isodd. (2.22)

Proof. Since 𝑣²=𝑢^𝑝+𝑎𝑢+𝑏 is isomorphic to 𝑣²=𝑢^𝑝+𝑎𝑢, we only have to consider the curve 𝑣²=𝑢^𝑝+𝑎𝑢 over 𝔽_𝑝.
Let 𝑝−1=𝑚𝑙, then 𝑎^𝑚𝑘=1 for 𝑘=1,2,…,𝑙. For any even positive integer 𝑟 not divided by 𝑚, since 𝑎^𝑟≠1, the mapping 𝑥↦𝑥^𝑝+𝑎𝑥 is a one-to-one mapping in 𝔽_𝑝𝑟, hence, we have _{𝑥∈𝔽𝑝𝑟}𝜒_𝑟𝑥^𝑝+𝑎𝑥=_{𝑥∈𝔽𝑝𝑟}𝜒_𝑟(𝑥)=0. (2.23) It follows that 𝑎_𝑟=0 based on (1.7) and Lemma 2.2. Thus, for all positive integer 𝑟 satisfying 𝑟∤𝑚, the coefficients 𝑎_𝑟 of 𝑣²=𝑢^𝑝+𝑎𝑢's characteristic polynomial are equal to 0.
Let 𝜃 be a generator of the cyclic multiplicative group 𝔽^∗_𝑝𝑚, then there exists an integer 𝑘(1<𝑘<(𝑝^𝑚−1)/2) such that (𝑝^𝑚−1)/𝑚∣𝑘 and 𝑎=𝜃^𝑘, and it follows that there exists an integer 𝑟 satisfying 1≤𝑟≤𝑚−1, (𝑟,𝑚)=1 and 𝜃^{𝑟(∑𝑚−1𝑖=0𝑝𝑖/𝑚)𝑝−1}=𝑎. (2.24) Let 𝑐=𝜃^{𝑟(∑𝑚−1𝑖=0𝑝𝑖/𝑚)}; then 𝑐^𝑝−1=𝑎 and 𝜒_𝑚𝑐^𝑝=𝑐^{𝑝(𝑝𝑚−1)/2}=𝑐^{𝑝−1(𝑝𝑚−1+𝑝𝑚−2+⋯+𝑝+1)/2}=𝑎^{(𝑝𝑚−1+𝑝𝑚−2+⋯+𝑝+1)/2}. (2.25) From 𝑝−1=𝑚𝑙 or 𝑝=𝑚𝑙+1, we know that there exist integers 𝑠_𝑘 such that 𝑝^𝑘=𝑚²𝑙²𝑠_𝑘+𝑘𝑚𝑙+1, (2.26) and it follow that there exists an integer 𝑠 such that ^𝑚−1_𝑘=0𝑝^𝑘=𝑚²𝑙²𝑚()𝑠+𝑚−12⋅𝑚𝑙+𝑚. (2.27) If 𝑚 is even, then we have 𝑝^𝑚−1+𝑝^𝑚−2+⋯+𝑝+12≡𝑚²(𝑚−1)𝑙4+𝑚2mod𝑚. (2.28) Hence,𝜒_𝑚𝑐^𝑝=𝑎^{∑𝑚−1𝑘=0𝑝𝑘/2}=𝑎^{𝑚/2(𝑚−1)𝑚𝑙/2+1}=(−1)^{(𝑚−1)𝑚𝑙/2+1}=(−1)^𝑚𝑙/2+1=(−1)^(𝑝+1)/2. (2.29) Thus, from (2.21), we have _{𝑥∈𝔽𝑝𝑚}𝜒_𝑚𝑥^𝑝+𝑎𝑥=_{𝑥∈𝔽𝑝𝑚}𝜒_𝑚𝑐^𝑝𝑥𝑐^𝑝+𝑎𝑐^𝑝−1⋅𝑥𝑐=𝜒_𝑚𝑐^𝑝_{𝑥∈𝔽𝑝𝑚}𝜒_𝑚𝑥𝑐^𝑝+𝑥𝑐=𝜒_𝑚𝑐^𝑝_{𝑥∈𝔽𝑝𝑚}𝜒_𝑚𝑥^𝑝+𝑥=(−1)^{(𝑝+𝑚−1)/2}𝑝^𝑚/2𝑝−1. (2.30)
In addition, for any positive integer 𝑘, we have 𝜒_𝑚𝑘𝑐^𝑝=𝑐^{𝑝(𝑝𝑚𝑘−1)/2}=(−1)^{(𝑝+1)𝑘/2}. (2.31) And so for 𝑘≤(𝑝−1)/𝑚, based on (2.21), we have _{𝑥∈𝔽𝑝𝑚𝑘}𝜒_𝑚𝑘𝑥^𝑝+𝑎𝑥=_{𝑥∈𝔽𝑝𝑚𝑘}𝜒_𝑚𝑘𝑐^𝑝𝑥𝑐^𝑝+𝑎𝑐^𝑝−1⋅𝑥𝑐=𝜒_𝑚𝑘𝑐^𝑝_{𝑥∈𝔽𝑝𝑚𝑘}𝜒_𝑚𝑘𝑥𝑐^𝑝+𝑥𝑐=𝜒_𝑚𝑘𝑐^𝑝_{𝑥∈𝔽𝑝𝑚𝑘}𝜒_𝑚𝑘𝑥^𝑝+𝑥=(−1)^{(𝑝+1+𝑚)𝑘/(2−1)}𝑝^𝑚𝑘/2𝑝−1. (2.32)
Therefore, for 𝑘=1,…,⌊(𝑝−1)/2𝑚⌋, we have the coefficients 𝑎_𝑚𝑘 of the corresponding characteristic polynomial 𝑃(𝑡) as follows: 𝑎_𝑚𝑘=−1𝑝^𝑘𝑘𝑝−1/𝑚(−𝑝)^𝑚𝑘/2. (2.33) Hence, the characteristic polynomial for even 𝑚 is 𝑃(𝑡)=𝑡^𝑚+−1𝑝−𝑝^{𝑚/2(𝑝−1)/𝑚}. (2.34) Especially, if 𝑎 is a primitive element modulo 𝑝, we have 𝑃(𝑡)=𝑡^𝑝−1+𝑝^(𝑝−1)/2. (2.35)
Suppose 𝑚 is odd. Then 2𝑚∣(𝑝−1) and 2𝑚 is the smallest even positive integer satisfying 𝑎^2𝑚=1. According to the equalities (2.25) and (2.27), we have 𝜒_2𝑚𝑐^𝑝=𝑐^{𝑝(𝑝2𝑚−1)/2}=𝑐^{𝑝−1𝑝∑2𝑚−1𝑖=0𝑝𝑖/2}=𝑎^{𝑚∑2𝑚−1𝑖=0𝑝𝑖/2𝑚}=1, (2.36) where 𝑐=𝜃^{𝑟1(∑2𝑚−1𝑖=0𝑝𝑖/2𝑚)} for some integer 𝑟₁. And it follows that 𝜒_2𝑚𝑘(𝑐^𝑝)=1 holds for any positive integer 𝑘.
Since for any odd integer 𝑘, we have 𝑎_𝑚𝑘=0. Hence, similar to the proof of the formula (2.21), for any positive integer 𝑘(1≤𝑘≤⌊(𝑝−1)/4𝑚⌋), we have _{𝑥∈𝔽𝑝2𝑚𝑘}𝜒_2𝑚𝑘𝑥^𝑝+𝑎𝑥=(−1)^𝑘−1𝑝^𝑚𝑘𝑝−1. (2.37) Hence, the corresponding characteristic polynomial coefficient 𝑎_2𝑚𝑘 for 1≤𝑘≤⌊(𝑝−1)/4𝑚⌋ equals to 𝑘𝑝𝑝−1/2𝑚_𝑚𝑘. (2.38) Thus, the corresponding characteristic polynomial is 𝑃(𝑡)=^{𝑝−1/2𝑚}_𝑘=0𝑘𝑝𝑝−1/2𝑚_𝑚𝑘𝑡^{(𝑝−1)−2𝑚𝑘}=𝑡^2𝑚+𝑝^{𝑚(𝑝−1)/2𝑚}. (2.39)

For example, let 𝑝=13, then 𝑎=5 is not a primitive root of modulo 𝑝=13. In fact, we have 5⁴≡1mod13, and the characteristic polynomial of the curve 𝑣²=𝑢¹³+5𝑢 over 𝔽₁₃ is (𝑡⁴+169)³.

Case 4. Now we consider the curves 𝑣²=𝑢^𝑝+𝑎𝑢+𝑏 over 𝔽_𝑝2.

Theorem 2.5. Suppose 𝑝 is an odd prime number. (1)The curve 𝑣²=𝑢^𝑝−𝑢 over 𝔽_𝑝2 has the characteristic polynomial 𝑡−𝑝^𝑝−1. (2.40)(2)For any nonzero element 𝑏∈𝔽_𝑝2, the all roots of the equation 𝑥^𝑝−𝑥+𝑏−2⁻¹𝑏+𝑏^𝑝=0 (2.41) are in 𝔽_𝑝2. Therefore, for every nonzero element 𝑏∈𝔽_𝑝2, the hyperelliptic curve 𝑣²=𝑢^𝑝−𝑢+𝑏 over 𝔽_𝑝2 has the characteristic polynomial 𝑡−𝜁𝑝_{𝜁𝑝=1,𝜁≠1}. (2.42)

Proof. (1) If 𝑥^𝑝−𝑥≠0 for 𝑥∈𝔽_𝑝2, then we have 𝑥^𝑝−𝑥^{(𝑝2−1)/2}=𝑥^𝑝−𝑥^𝑝𝑥^𝑝−𝑥^{−1(𝑝+1)/2}=(−1)^(𝑝+1)/2=−−1𝑝. (2.43) Hence, _{𝑥∈𝔽𝑝2}𝜒₂𝑥^𝑝−𝑥=𝑝²−𝑝−−1𝑝. (2.44) It follows that if 𝛼_𝑖(𝑖=1,…,𝑝−1) are the all roots of the characteristic polynomial of 𝑣²=𝑢^𝑝−𝑢 over 𝔽_𝑝2, then ^𝑝−1_𝑖=1𝛼_𝑖=𝑝²−𝑝−1𝑝=𝑝−1−1𝑝𝑝, (2.45) and so we have ^𝑝−1/2_𝑖=1𝛼_𝑖+𝛼_𝑖−2−1𝑝𝑝=0,𝛼_𝑖𝛼_𝑖=𝑝². (2.46) It follows 𝛼_𝑖=(−1/𝑝)𝑝=𝑝 for 𝑖=1,2,…,(𝑝−1)/2. Hence, the characteristic polynomial of the curve 𝑣²=𝑢^𝑝−𝑢 over 𝔽_𝑝2 is 𝑡−𝑝^𝑝−1. (2.47)
(2) Let 𝛽 be a root of 𝑥^𝑝−𝑥+𝑏−2⁻¹(𝑏+𝑏^𝑝)=0, then 𝛽^𝑝=𝛽−𝑏+2⁻¹(𝑏+𝑏^𝑝), and it follows 𝛽^𝑝2=𝛽, which means 𝛽∈𝔽_𝑝2.
For any element 𝑏(≠0) in 𝔽_𝑝2, let 𝑠 be a root of the equation 𝑥²=2(𝑏+𝑏^𝑝)⁻¹ in 𝔽_𝑝2 and 𝑡 a root of 𝑥^𝑝−𝑥+𝑏−2⁻¹(𝑏+𝑏^𝑝)=0. Then 𝑠,𝑡∈𝔽_𝑝2, and so the curve 𝑣²=𝑢^𝑝−𝑢+𝑏 is isomorphic to 𝑣²=𝑢^𝑝−𝑢+1. Hence, for any nonzero element 𝑏∈𝔽_𝑝2, all the curve 𝑣²=𝑢^𝑝−𝑢+𝑏 has the characteristic polynomial 𝑡−𝜁𝑝_{𝜁𝑝=1,𝜁≠1}. (2.48)

For example, let 𝜈 be a root of 𝑢²+𝑢+2=0mod5, then the curve 𝐶_−1,𝜈: 𝑣²=𝑢⁵−𝑢+𝜈 over 𝔽₅² has the characteristic polynomial 𝑃(𝑡)=_{𝜁𝑝=1,𝜁≠1}𝑡−𝜁−155=𝑡⁴+5𝑡³+25𝑡²+125𝑡+625. (2.49) Since 𝜈 is a quadratic nonresidue in 𝔽₅², the curve 𝐶^′_−1,𝜈: 𝑣²=𝑢⁵−𝜈⁴𝑢+𝜈⁶or𝑣²=𝑢⁵−(2+3𝜈)𝑢+2 (2.50) is one twisted curve of 𝐶_−1,𝜈. Hence, 𝐶^′_−1,𝜈's characteristic polynomial is 𝑃^′(𝑡)=𝑡⁴−5𝑡³+25𝑡²−125𝑡+625. (2.51)

Suppose 𝜉 is a root of 𝑥²+𝑥+3=0mod7. Then the curve 𝐶_−1,𝜉: 𝑣²=𝑢⁷−𝑢+𝜉 over 𝔽₇² has the characteristic polynomial 𝑃(𝑡)=𝑡⁶−7𝑡⁵+49𝑡⁴−343𝑡³+2401𝑡²−16807𝑡+117649. (2.52) Since 𝜉 is a quadratic nonresidue in 𝔽₇², the curve 𝐶′_−1,𝜉: 𝑣²=𝑢⁷−(4+5𝜉)𝑢+3over𝔽₇² (2.53) is one twisted curve of 𝐶_−1,𝜉. 𝐶′_−1,𝜉 has the characteristic polynomial 𝑃^′(𝑡)=𝑡⁶+7𝑡⁵+49𝑡⁴+343𝑡³+2401𝑡²+16807𝑡+117649. (2.54)

Theorem 2.6. Suppose 𝑝 is an odd prime number. Then, (1)the equation 𝑥^𝑝+𝑥+𝑏=0 (2.55) has roots in 𝔽_𝑝2 if and only if 𝑏∈𝔽_𝑝.
For any 𝑏∈𝔽_𝑝2, the curve 𝑣²=𝑢^𝑝+𝑢+𝑏=0 is isomorphic to the curve 𝑣²=𝑢^𝑝+𝑢 over 𝔽_𝑝2 if and only if 𝑏∈𝔽_𝑝.
(2) For any 𝑏,𝑐∈𝔽_𝑝2⧵𝔽_𝑝, the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 is isomorphic to the curve 𝑣²=𝑢^𝑝+𝑢+𝑐 over 𝔽_𝑝2.

Proof. (1) Suppose 𝑏∈𝔽_𝑝 and 𝑥₀∈𝔽_𝑝2𝑝 is a root of 𝑢^𝑝+𝑢+𝑏=0. Then, 𝑥^𝑝₀=−𝑥₀−𝑏 and it follows 𝑥^𝑝2₀=𝑥₀, which implies 𝑥₀∈𝔽_𝑝2. On the other hand, if 𝑥₀ is a root of 𝑢^𝑝+𝑢+𝑏=0 in 𝔽_𝑝2, then 𝑏−𝑏^𝑝=0, which implies 𝑏∈𝔽_𝑝.
Let 𝑥₀ be a root of 𝑣²=𝑢^𝑝+𝑢+𝑏=0 in 𝔽_𝑝2𝑝, then 𝑥₀∈𝔽_𝑝2, and over 𝔽_𝑝2, the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 is isomorphic to the curve 𝑣²=𝑢^𝑝+𝑢+(𝑥^𝑝₀+𝑥₀+𝑏), that is, 𝑣²=𝑢^𝑝+𝑢.
(2) Suppose 𝑏 and 𝑐 are two different elements in 𝔽_𝑝2⧵𝔽_𝑝. Then, obviously, (𝑐−𝑐^𝑝)(𝑏−𝑏^𝑝)⁻¹∈𝔽_𝑝. Let 𝑠 be a square root of (𝑐−𝑐^𝑝)(𝑏−𝑏^𝑝)⁻¹ in 𝔽_𝑝2, and let 𝑏̃=b−𝑐𝑠⁻². Then, 𝑏̃=(𝑐𝑏^𝑝−𝑏𝑐^𝑝)(𝑐−𝑐^𝑝)⁻¹∈𝔽_𝑝.
According to (1), the equation 𝑥^𝑝+𝑥+𝑏̃=0 has roots in 𝔽_𝑝2. Let 𝑡∈𝔽_𝑝2 be a root of 𝑥^𝑝+𝑥+𝑏̃=0; then, over 𝔽_𝑝2, the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 is isomorphic to the curve 𝑣²=𝑢^𝑝+𝑠^2(𝑝−1)𝑢+𝑠^2𝑝𝑡^𝑝+𝑡+𝑏. (2.56) That is, 𝑣²=𝑢^𝑝+𝑢+𝑏 is isomorphic to 𝑣²=𝑢^𝑝+𝑢+𝑐 over 𝔽_𝑝2 since we have 𝑠^2(𝑝−1)=1,𝑠^2𝑝𝑡^𝑝+𝑡+𝑏=𝑠²−𝑏̃+𝑏=𝑠²𝑐𝑠⁻²=𝑐. (2.57)

For any 𝑏∈𝔽_𝑝2⧵𝔽_𝑝, the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 has the same characteristic polynomial.

Theorem 2.7. Suppose 𝑝 is an odd prime number and 𝑏∈𝔽_𝑝2⧵𝔽_𝑝. If 𝑝≡1mod4, then for every 𝑏∈𝔽_𝑝2⧵𝔽_𝑝, the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 is a twisted curve of some curve of the form 𝑣²=𝑢^𝑝−𝑢+𝑏^′ with 𝑏^′∈𝔽_𝑝2. If 𝑝≡−1mod4, then for every 𝑏∈𝔽_𝑝2⧵𝔽_𝑝, the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 is isomorphic to the curve 𝑣²=𝑢^𝑝−𝑢+1 over 𝔽_𝑝2.
Hence, over 𝔽_𝑝2, the characteristic polynomial of the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 with 𝑏∈𝔽_𝑝2⧵𝔽_𝑝 is 𝑡+𝜁𝑝._{𝜁𝑝=1,𝜁≠1} (2.58)

Proof. Let 𝜃 be a generator of the cyclic multiplicative group 𝔽^∗_𝑝2.
(1) Assume 𝑝≡1mod4. Set 𝛾=𝜃^(𝑝+1)/2; then 𝛾^𝑝−1=𝜃^{(𝑝+1)/2𝑝−1}=−1,𝛾^𝑝=−𝛾,𝜒𝛾=𝜃^{(𝑝2−1)/2(𝑝+1)/2}=(−1)^(𝑝+1)/2=−1. (2.59) It follows that 𝛾 is a quadratic nonresidue in 𝔽_𝑝2, and the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 is a twist of the curve 𝑣²=𝑢^𝑝−𝑢−𝜃^{(2𝑝−3)(𝑝+1)/2}𝑏. Hence, due to Theorems 2.1 and 2.5, the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 has the characteristic polynomial −𝑡−𝜁𝑝_{𝜁𝑝=1,𝜁≠1}or_{𝜁𝑝=1,𝜁≠1}𝑡+𝜁𝑝. (2.60)
(2) Assume 𝑝≡−1mod4. Let 𝑠=𝜃^{(𝑝−2)(𝑝+1)/4}, 𝑡=0, and 𝑏=𝜃^(𝑝+1)/2. Then, 𝑠,𝑏∈𝔽_𝑝2⧵𝔽_𝑝, and the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 is isomorphic to the curve 𝑣²=𝑢^𝑝+𝑠^2(𝑝−1)𝑢+𝑠^2𝑝𝑏. (2.61) It follows that 𝑣²=𝑢^𝑝+𝑢+𝑏 is isomorphic to the curve 𝑣²=𝑢^𝑝−𝑢+1 since 𝑠^2(𝑝−1)=−1 and 𝑠^2𝑝𝑏=𝜃^{−(𝑝+1)/2}𝑏=1. Therefore, for every 𝑏∈𝔽_𝑝2⧵𝔽_𝑝, the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 has the same characteristic polynomial as the curve 𝑣²=𝑢^𝑝−𝑢+1 over 𝔽_𝑝2, that is, 𝑡−𝜁𝑝_{𝜁𝑝=1,𝜁≠1}. (2.62) In a word, for any odd prime number, the characteristic polynomial of the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 is _{𝜁𝑝=1,𝜁≠1}𝑡+−1𝑝𝜁𝑝or_{𝜁𝑝=1,𝜁≠1}𝑡+𝜁𝑝. (2.63)

Theorem 2.8. Suppose 𝑝 is an odd prime number, 𝑎,𝑏∈𝔽_𝑝2, and 𝑎≠0,±1. Let 𝑚 be the order of 𝑎 in 𝔽^∗_𝑝 if 𝑎∈𝔽_𝑝, that is, 𝑚=ord_𝔽^∗_𝑝(𝑎). And let 𝑚=ord_𝔽^∗_𝑝2(𝑎) and 𝑒(>1) be the smallest positive integer such that 𝑚∣𝑒(𝑝+1) if 𝑎∈𝔽_𝑝2⧵𝔽_𝑝. (1)Suppose 𝑎^𝑝+1=1. Then 𝑎∈𝔽_𝑝2⧵𝔽_𝑝, and the characteristic polynomial is 𝑃(𝑡)=𝑡+𝑎^(𝑝+1)/2𝑝^𝑝−1𝑖𝑓𝑏≠0,𝑎=𝑏^1−𝑝,𝑜𝑟𝑏=0,_{𝜁𝑝=1,𝜁≠1}𝑡+𝜁𝑝𝑖𝑓𝑎≠𝑏^1−𝑝. (2.64)(2)Suppose 𝑎^𝑝+1≠1; then the characteristic polynomial of the curve 𝑣²=𝑢^𝑝+𝑎𝑢+𝑏 over 𝔽_𝑝2 is 𝑃(𝑡)=𝑡^(𝑝−1)/2+𝑝^{(𝑝−1)/22}𝑖𝑓𝑎∈𝔽_𝑝𝑡,𝑚=𝑝−1,_𝑚/2+−1𝑝−𝑝^{𝑚/22(𝑝−1)/𝑚}𝑖𝑓𝑎∈𝔽_𝑝𝑡,𝑚<𝑝−1,𝑚𝑖𝑠𝑒𝑣𝑒𝑛,_𝑚+𝑝^{𝑚(𝑝−1)/𝑚}𝑖𝑓𝑎∈𝔽_𝑝𝑡,𝑚<𝑝−1,𝑚𝑖𝑠𝑜𝑑𝑑,_𝑒+(−1)^{𝑒(𝑝+1)/𝑚+𝑒−1}𝑝^{𝑒(𝑝−1)/𝑒}𝑖𝑓𝑎∈𝔽_𝑝2⧵𝔽_𝑝. (2.65)

Proof. (1) If 𝑎^𝑝+1=1, then 𝑎∉𝔽_𝑝 since 𝑎²≠1. Let 𝜃 be a generator of the cyclic multiplicative group 𝔽_𝑝2. Then, there exists an integer 𝑒 satisfying 1≤𝑒≤𝑝, 𝑒≠(𝑝+1)/2, and 𝑎=𝜃^{𝑒(𝑝−1)}.
If 𝑎^(𝑝+1)/2=−1, then 𝑒 is odd. Let 𝛾=𝜃^{𝑝+1−𝑒}, then 𝛾^{(𝑝2−1)/2}=𝜃^{(𝑝+1−𝑒)(𝑝2−1)/2}=𝜃^{−𝑒(𝑝2−1)/2}=𝜃^{(𝑝2−1)/2−𝑒}=(−1)^𝑒=−1; (2.66) it means that 𝛾 is a quadratic nonresidue in 𝔽_𝑝2. Hence, the curve 𝑣²=𝑢^𝑝+𝑎𝑢+𝑏 has a twisted curve defined by the equation 𝑣²=𝑢^𝑝+𝛾^𝑝−1𝑎𝑢+𝛾^𝑝𝑏,thatis,𝑣²=𝑢^𝑝+𝑢+𝜃^{𝑝+1−𝑒𝑝}𝑏. (2.67) If 𝜃^{𝑝+1−𝑒𝑝}𝑏∈𝔽_𝑝, then 𝑏=0, or 𝑏≠0 and (𝜃^{𝑝+1−𝑒𝑝}𝑏)^𝑝−1=1 which means 𝑎=𝑏^1−𝑝. Hence, the curve 𝑣²=𝑢^𝑝+𝑢+𝜃^{𝑝+1−𝑒𝑝}𝑏 is isomorphic to the curve 𝑣²=𝑢^𝑝+𝑢. Thus, over 𝔽_𝑝2, the curve 𝑣²=𝑢^𝑝+𝑎𝑢+𝑏 has the characteristic polynomial (−𝑡+𝑝)^𝑝−1, that is, (𝑡−𝑝)^𝑝−1.
If 𝜃^{𝑝+1−𝑒p}𝑏∉𝔽_𝑝, that is, 𝑏≠0 and 𝑎≠𝑏^1−𝑝, then according to Theorem 2.7, 𝑣²=𝑢^𝑝+𝑢+𝜃^{𝑝+1−𝑒𝑝}𝑏 has the characteristic polynomial ∏_𝜁^𝑝_=1,𝜁≠1(𝑡+𝜁𝑝).
If 𝑎^(𝑝+1)/2=1, then 𝑒 is even. Let 𝑠=𝜃^𝑒/2 and 𝑡=0, then the curve 𝑣²=𝑢^𝑝+𝑎𝑢+𝑏, that is, 𝑣²=𝑢^𝑝+𝑠^2(𝑝−1)𝑢+𝑠^2𝑝𝑡^𝑝+𝑡+𝑏₁ (2.68) is an isomorphic curve of the curve 𝑣²=𝑢^𝑝+𝑢+𝑏₁with𝑏₁=𝑠^−2𝑝𝑏=𝜃^−𝑒𝑝𝑏. (2.69)
It is clear that 𝑏₁=𝜃^−𝑒𝑝𝑏∈𝔽_𝑝 if and only if 𝑎=𝑏^1−𝑝. Hence, based on Theorems 2.6 and 2.7, the curve 𝑣²=𝑢^𝑝+𝑎𝑢+𝑏 has the characteristic polynomial 𝑡+𝑝^𝑝−1for𝑎=𝑏^1−𝑝or_{𝜁𝑝=1,𝜁≠1}𝑡+𝜁𝑝for𝑎≠𝑏^1−𝑝. (2.70)
For 𝑏=0, we can also show our result as follows.
Set 𝛼_𝑘=𝜃^{𝑒+(𝑝+1)(2𝑘+1)/2} with 0≤𝑘≤𝑝−2. Then, 𝛼_𝑘 are the 𝑝−1 different nonzero roots of 𝑥^𝑝+𝑎𝑥=0 in 𝔽_𝑝2. Hence, if 𝑥 is a nonzero root of 𝑥^𝑝+𝑎𝑥=0 in 𝔽_𝑝2, we have 𝜒^∗₁𝑥^𝑝+𝑎𝑥=𝑥^𝑝+𝑎𝑥^{(𝑝2−1)/2}=𝑥^𝑝+𝑎𝑥^𝑝𝑥^𝑝+𝑎𝑥^{−1(𝑝+1)/2}=𝑎^𝑝𝑎𝑥+𝑥^𝑝𝑥^𝑝+𝑎𝑥^{−1(𝑝+1)/2}=𝑎^{(𝑝+1)/2𝑝}=𝑎^(𝑝+1)/2. (2.71) Thus, according to (1.4) and (1.10), each root of the corresponding characteristic polynomial equals to −𝑎^(𝑝+1)/2𝑝. It follows that the corresponding characteristic polynomial is 𝑃(𝑡)=𝑡+𝑎^(𝑝+1)/2𝑝^𝑝−1. (2.72)
(2) If 𝑎^𝑝+1≠1, then (1−𝑎^𝑝+1)⁻¹(𝑎^𝑝𝑏−𝑏^𝑝) is a root of 𝑢^𝑝+𝑎𝑢+𝑏=0. Set 𝑠=1 and 𝑡=(1−𝑎^𝑝+1)⁻¹(𝑎^𝑝𝑏−𝑏^𝑝), then, over the field 𝔽_𝑝2, 𝑣²=𝑢^𝑝+𝑎𝑢+𝑏 is isomorphic to 𝑣²=𝑢^𝑝+𝑠^2(𝑝−1)𝑎𝑢+𝑠^2𝑝(𝑡^𝑝+𝑎𝑡+𝑏), that is, 𝑣²=𝑢^𝑝+𝑎𝑢. Hence, we only have to compute the characteristic polynomial of the curve 𝑣²=𝑢^𝑝+𝑎𝑢 over 𝔽_𝑝2.
(i) If 𝑎∈𝔽_𝑝, then 𝑎^𝑝+1≠1 means 𝑎≠±1. Suppose 𝑎 is a primitive root of 𝑝; then the equation 𝑥^𝑝+𝑎𝑥=0 has only zero root in 𝔽_𝑝2𝑟 for any positive integer 𝑟∶1≤1≤(𝑝−3)/2, and it follows that the 𝑟-th coefficient 𝑎_𝑟 of the characteristic polynomial of 𝑣²=𝑢^𝑝+𝑎𝑢 is 0.
Now we compute the (𝑝−1)/2-th coefficient 𝑎_(𝑝−1)/2. Let 𝜃 be a generator of the cyclic multiplicative group 𝔽^∗_{(𝑝2)(𝑝−1)/2}; then there exists an integer 𝑟 satisfying 1≤𝑟≤𝑝−2, (𝑟,𝑝−1)=1, and (𝜃^{𝑟(∑𝑝−2𝑖=0𝑝𝑖/𝑝−1)})^𝑝−1=𝑎.
Set 𝑐=𝜃^{𝑟(∑𝑝−2𝑖=0𝑝𝑖/(𝑝−1))}; then 𝑐∈𝔽^∗_𝑝𝑝−1, 𝑐^𝑝−1=𝑎, and 𝜒^∗_(𝑝−1)/2(𝑐^𝑝)=𝜒_𝑝−1(𝑐^𝑝)=(−1)^(𝑝+1)/2. Hence, based on Lemma 2.3, we have _{𝑥∈𝔽2)(𝑝(𝑝−1)/2}𝜒^∗_𝑝−1/2𝑥^𝑝+𝑎𝑥=_{𝑥∈𝔽2)(𝑝(𝑝−1)/2}𝜒^∗_𝑝−1/2𝑐^𝑝𝑥𝑐^𝑝+𝑎𝑐^𝑝−1⋅𝑥𝑐=𝜒_𝑝−1𝑐^𝑝_{𝑥∈𝔽𝑝𝑝−1}𝜒_𝑝−1𝑥^𝑝+𝑥=(−1)^(𝑝+1)/2(−1)𝑝^(𝑝−1)/2𝑝−1=𝑝^(𝑝−1)/2𝑝−1, (2.73) where 𝜒^∗_𝑘 denotes the extended quadratic character of the degree 𝑘 extension of 𝔽_𝑝2(i.e., 𝔽_𝑝2𝑘), which is equivalent to 𝜒_2𝑘, the extended quadratic character of the degree 2𝑘 extension of 𝔽_𝑝. Thus, 𝑎_(𝑝−1)/2=1𝑝−1/2⋅𝑝^(𝑝−1)/2𝑝−1=2𝑝^(𝑝−1)/2. (2.74) Therefore, the corresponding characteristic polynomial is 𝑃(𝑡)=𝑡^𝑝−1+2𝑝^(𝑝−1)/2𝑡^(𝑝−1)/2+𝑝^{2(𝑝−1)/2}=𝑡^(𝑝−1)/2+𝑝^{(𝑝−1)/22}. (2.75)
(ii) Suppose 𝑎∈𝔽_𝑝 and 𝑚<𝑝−1; then similar to the proof of Theorem 2.4, we have the corresponding characteristic polynomial coefficients as the the following if 𝑚 is even: 𝑎_𝑚𝑘/2=(−1)^{(𝑝−1)𝑘/2}−𝑝^𝑚𝑘/22𝑘𝑝−1/𝑚 (2.76) for 1≤𝑘≤(𝑝−1)/𝑚, while the other coefficients are equal to zero. Hence, the corresponding characteristic polynomial is 𝑡^𝑚/2+−1𝑝−𝑝^{𝑚/22(𝑝−1)/𝑚}. (2.77)
By the same way, we can show that if 𝑚 is odd, the corresponding characteristic polynomial is (𝑡^𝑚+𝑝^𝑚)^{(𝑝−1)/𝑚}.
(iii) Suppose 𝑎∈𝔽_𝑝2⧵𝔽_𝑝, then 𝑚∤(𝑝+1). If an integer 𝑘 satisfies 1≤𝑘≤(𝑝−1)/2 and 𝑚∤𝑘(𝑝+1), then the corresponding characteristic polynomial is 𝑡^𝑝−1+𝑝^𝑝−1.
Now suppose 𝑒 is the smallest integer such that 2≤𝑒≤(𝑝−1)/2 and 𝑚∣𝑒(𝑝+1). Then 𝑒∣(𝑝−1). Otherwise, let 𝑝−1=𝑑𝑒+𝑒₁ with 𝑑 being an integer and 1≤𝑒₁<𝑒. Then, (𝑝+1)(𝑝−1)=𝑑𝑒(𝑝+1)+𝑒₁(𝑝+1), and it follows 𝑚∣𝑒₁(𝑝+1), which contradicts 𝑒 being the smallest integer satisfying 𝑚∣𝑒(𝑝+1). Set 𝑝−1=𝑒𝑙, 𝑒(𝑝+1)=𝑚𝑡. Clearly, (𝑒,𝑡)=1.
For any positive integer 𝑘 satisfying 𝑒∤𝑘, since 𝑥^𝑝+𝑎𝑥=0 has no nonzero root in 𝔽_𝑝2𝑘, we have _{𝑥∈𝔽2)𝑘(𝑝}𝜒^∗_𝑘𝑥^𝑝+𝑎𝑥=_{𝑥∈𝔽𝑝2𝑘}𝜒^∗_𝑘(𝑥)=_{𝑥∈𝔽𝑝2𝑘}𝜒_2𝑘(𝑥)=0, (2.78) which implies the corresponding characteristic polynomial coefficient 𝑎_𝑘=0.
Hence, we only have to compute the characteristic polynomial coefficients 𝑎_𝑒𝑟 for 𝑟=1,…,⌊𝑙/2⌋.
Let 𝜃 be a generator of the cyclic multiplicative group 𝔽^∗_(𝑝2)^𝑒 or 𝔽^∗_𝑝2𝑒. Then there exists an integer 𝑘(1≤𝑘≤𝑝²−2) such that 𝑎=𝜃^{𝑘∑𝑒−1𝑖=0𝑝2𝑖}. Since 𝑎^𝑒(𝑝+1)=1, we have 1=𝜃^{𝑘∑𝑒−1𝑖=0𝑝2𝑖𝑒(𝑝+1)}=𝜃^{𝑘𝑒(𝑝+1)∑𝑒−1𝑖=0𝑝2𝑖}=𝜃^{(𝑘/𝑙)(𝑝−1)(𝑝+1)∑𝑒−1𝑖=0𝑝2𝑖}=𝜃^{(𝑘/𝑙)(𝑝2𝑒−1)}, (2.79) and it follows that 𝑘/𝑙 must be a positive integer. Set 𝑘=𝑙𝑘′, where 𝑘′ is some positive integer satisfying (𝑒,𝑘′)=1 due to the smallest of 𝑒.
From 𝑝−1=𝑒𝑙 or 𝑝=𝑒𝑙+1, we can deduce that there exists a positive integer 𝑛 such that ^𝑒−1_𝑖=0𝑝^2𝑖=𝑒²𝑙²𝑛+𝑒²(𝑒−1)𝑙+𝑒. (2.80) Hence, we have 𝑎=𝜃^{𝑙𝑘′(𝑒2𝑙2𝑛+𝑒2(𝑒−1)𝑙+𝑒)}=𝜃^{(𝑒𝑙)𝑘′(𝑒𝑙2𝑛+𝑒(𝑒−1)𝑙+1)}=𝜃^{(𝑝−1)𝑘′(𝑒𝑙2𝑛+𝑒(𝑒−1)𝑙+1)}. (2.81) Let 𝛿=𝜃^{𝑘′(𝑒𝑙2𝑛+𝑒(𝑒−1)𝑙+1)}; then 𝑎=𝛿^𝑝−1, and for every integer 𝑟∶2≤𝑟≤⌊𝑙/2⌋, we have 𝜒^∗_𝑟𝑒𝛿^𝑝=𝜒_2𝑟𝑒𝛿^𝑝=𝛿^{𝑝(𝑝2𝑟𝑒−1)/2}=𝛿^{𝑝((𝑝2𝑒−1)/2)∑𝑟−1𝑖=0𝑝2𝑒𝑖}=𝛿^{𝑝(𝑝2𝑒−1)/2∑𝑟−1𝑖=0𝑝2𝑒𝑖}=(−1)^{𝑒(𝑝+1)/𝑚∑𝑟−1𝑖=0𝑝2𝑒𝑖}=(−1)^{𝑟𝑒(𝑝+1)/𝑚}. (2.82) And according to (2.21), we obtain _{𝑥∈𝔽2)(𝑝𝑟𝑒}𝜒^∗_𝑟𝑒𝑥^𝑝+𝑎𝑥=_{𝑥∈𝔽𝑝2𝑟𝑒}𝜒_2𝑟𝑒𝑥^𝑝+𝑎𝑥=_{𝑥∈𝔽𝑝2𝑟𝑒}𝜒_2𝑟𝑒𝛿^𝑝𝑥𝛿^𝑝+𝑎𝛿^𝑝−1⋅𝑥𝛿=𝜒_2𝑟𝑒𝛿^𝑝_{𝑥∈𝔽𝑝2𝑟𝑒}𝜒_2𝑟𝑒𝑥^𝑝+𝑥=(−1)^{𝑟(𝑒(𝑝+1)/𝑚+𝑒)−1}𝑝^𝑟𝑒𝑝−1. (2.83) Therefore, the corresponding characteristic polynomial coefficient 𝑎_𝑟𝑒 can be computed as follows: 𝑎_𝑟𝑒=1𝑟𝑒^𝑟−1_{𝑖=0𝑥∈𝔽2)(𝑝(𝑟−𝑖)𝑒}𝜒^∗_{()𝑒𝑟−𝑖}𝑥^𝑝+𝑎𝑥𝑎_𝑖𝑒=1𝑟𝑒^𝑟−1_𝑖=0(−1)^{(𝑟−𝑖)(𝑒(𝑝+1)/𝑚+𝑒)−1}𝑝^{(𝑟−𝑖)𝑒}𝑝−1𝑎_𝑖𝑒=(−1)^{𝑒(𝑝+1)/𝑚+𝑒−1}𝑝^𝑒𝑟𝑟,𝑝−1/𝑒 (2.84) and it follows that the corresponding characteristic polynomial is 𝑃(𝑡)=𝑡^𝑒+(−1)^{𝑒(𝑝+1)/𝑚+𝑒−1}𝑝^{𝑒(𝑝−1)/𝑒}. (2.85)

3. Some Hyperelliptic Curves 𝐶_𝑞 Suitable for Cryptographic Applications

Due to the Pollard's rho algorithm, Index-calculus algorithm or their modified versions [11–14], the order of the Jacobian group should have a large prime factor or an almost large prime factor (i.e., the order should be a large prime times a small integer, and the hyperelliptic curves of genus greater than 3 may not be secure for cryptographic applications). Otherwise, the discrete logarithm problems on the Jacobian group may probably be solved in a subexponential time complexity or even in a polynomial time complexity. Hence, the characteristic polynomial of 𝐶_𝑞 should be irreducible over the rational number field, and the field characteristic 𝑝 should be no larger than 7 when the curve 𝐶_𝑞 is considered for cryptographic uses. The following Table 2 lists some values of (𝑛,𝑎,𝑏) with which 𝐶_𝑞 have reducible characteristic polynomials in rational number field and so they are not secure for cryptographic applications.

According to the Theorem 1 in [15], the curve 𝑣²=𝑢^𝑝+𝑢+𝑏 over 𝔽_𝑝 is supersingular and thus the parameters (the characteristic 𝑝 and the extension degree of 𝔽_𝑝) have to be chosen carefully to defend against an MOV-type attack where the group is embedded in the multiplicative group of a finite field. Furthermore, the curves have a large automorphism group [16], and the size of the Jacobian should be large enough to defend against a parallelized Pollard rho-type attack.

If the characteristic polynomial 𝑃(𝑡) of a hyperelliptic curve 𝐶_𝑞 over 𝔽_𝑞 is determined, then for any positive integer 𝑚, the Jacobian group order #𝕁_𝐶(𝔽_𝑞𝑚) can be computed as (1.8).

But if finding the roots of 𝑃(𝑡) is of some high computational complexity, then one can obtain the Jacobian group order by computing the determinant of the (2𝑔×2𝑔)-matrix 𝐴^𝑚−𝐼, where 𝐴 is the companion matrix of 𝑃(𝑡), that is, 𝐴=010⋯0001⋯0⋯⋯000⋯1−𝑞^𝑔𝑞^𝑔−1𝑎₁𝑞^𝑔−2𝑎₂⋯𝑎₁. (3.1)

For a positive integer 𝑚, by taking 𝑡^𝑚−1 modulo 𝑃(𝑡) in the polynomial ring ℤ[𝑡] and setting 𝜉(𝑡)=𝑡^𝑚−1mod𝑃(𝑡), then we get that 𝜉(𝑡) is a monic polynomial of degree no larger than 2𝑔−1 and #𝕁_𝐶𝔽_𝑞𝑚=^2𝑔_𝑖=11−𝜏^𝑚_𝑖=^2𝑔_𝑖=1𝜉𝜏_𝑖, (3.2) which may be another more efficient method for the computation of the Jacobian group order if the field extension degree 𝑚 is very large. For 𝐶_𝑞 with 𝑞=𝑝, 𝑎=−1, and 𝑏(≠0)∈𝔽_𝑝, Duursma and Sakurai gave a table about the bit-sizes of the large prime factors of the orders of the Jacobian groups #𝕁_𝐶𝑞(𝔽_𝑞𝑚) for some parameters (𝑝,𝑚) in [6]. In Table 3, we list some parameters (𝑞,𝑎,𝑏,𝑚) with which the Jacobian group orders #𝕁_𝐶𝑞(𝔽_𝑞𝑚) have large prime factors, together with the corresponding characteristic polynomials, the largest prime factors, and their bit sizes. Where “Bits" in Table 3 denotes the bit-sizes of the largest prime factors of the corresponding Jacobian group orders, 𝜈 is a root of 𝑢²+𝑢+2=0mod5 and 𝜉 is a root of 𝑥²+𝑥+3=0mod7.

Table 3 

Some parameters for 𝐶_𝑞 whose Jacobian group orders have large prime factors.

For the listed parameters (𝑞,𝑎,𝑏,𝑚) in Table 3, the corresponding Jacobian group orders are almost large primes, and so these hyperelliptic curves 𝐶_𝑞 are suitable for secure hyperelliptic curve cryptographic applications.

4. Conclusion

The computation of hyperelliptic curve Jacobian group orders is an essential step during constructing HECC. At the present, the most common method used for the computation of Jacobian group orders is by computing the zeta functions or the characteristic polynomials of the related hyperelliptic curves. Hence, computing the characteristic polynomials of hyperelliptic curves is a very useful work, and it is often a challenging work.

In this paper, we determine the characteristic polynomials of 𝐶_𝑞 over the finite field 𝔽_𝑝𝑛 for 𝑛=1,2 and 𝑎,𝑏∈𝔽_𝑝𝑛. By using the characteristic polynomials one can easily compute out the Jacobian group orders. And we also describe some parameters with which the Jacobian group orders of 𝐶_𝑞 have large prime factors.

The hyperelliptic curves of genus larger than 3 are not secure for cryptographic applications since the corresponding hyperelliptic curve discrete logarithm problems can be solved by the Index-calculus algorithm or its modified versions in some subexponential time. Hence, we should be careful when the curve 𝐶_𝑞 with 𝑝>11 is used for practical cryptosystems. If the implementation speed is the first consideration in the construction of HECC, while the security is not in high demand, then one may choose the curve 𝐶_𝑞 with some high genus or with the Jacobian group order not having so much large prime factor. Besides, some special hyperelliptic curves having fast arithmetic over finite fields can be found efficient applications in pairing-based cryptosystems or identity-based cryptosystems ([15, 17]).

Since the (divisor) scalar multiplication computation is the most extremely time-consuming operation, we will employ the characteristic polynomials of 𝐶_𝑞 obtained here to develop some efficient scalar multiplication algorithms on 𝐶_𝑞 in our future work.

Acknowledgments

The authors would like to thank Professor Shuhong Gao for his comments which greatly improved this paper. The authors would also like to thank the anonymous referee for the careful review and the valuable comments. This research is supported by the Zhejiang Natural Science Foundation of Outstanding Youth Team Project (no. R1090138), the National Science Foundation of China (no. 60763009), and the Science and Technology Key Project of the Ministry of Education of China (no. 207089).