Mathematical Problems in Engineering

Volume 2011 (2011), Article ID 437541, 25 pages

http://dx.doi.org/10.1155/2011/437541

## Computing the Characteristic Polynomials of a Class of Hyperelliptic Curves for Cryptographic Applications

^{1}College of Communication Engineering, Hangzhou Dianzi University, Hangzhou 310018, China^{2}College of Engineering and Science, Clemson University, Clemson, SC 29631, USA^{3}School of Mathematical Sciences, Xiamen University, Xiamen 361005, China

Received 12 November 2010; Accepted 21 March 2011

Academic Editor: J. Rodellar

Copyright © 2011 Lin You et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

#### Abstract

Hyperelliptic curves have been widely studied for cryptographic applications, and some special
hyperelliptic curves are often considered to be used in practical cryptosystems. Computing Jacobian group orders is an important operation in constructing hyperelliptic curve cryptosystems,
and the most common method used for the computation of Jacobian group orders is by computing
the zeta functions or the characteristic polynomials of the related hyperelliptic curves. For the
hyperelliptic curve : over the field with being a power of an odd prime *p*, Duursma and Sakurai obtained its characteristic polynomial for , and . In
this paper, we determine the characteristic polynomials of over the finite field for , 2 and , . We also give some computational data which show that many of those curves
have large prime factors in their Jacobian group orders, which are both practical and vital for the
constructions of efficient and secure hyperelliptic curve cryptosystems.

#### 1. Introduction and Main Results

##### 1.1. Hyperelliptic Curves and Cryptosystems

A hyperelliptic curve of genus over is defined by an equation of the form where , with and , and the equation system , , and has no solutions in .

For an extension of , the set is called the set of -rational points on . The symbol is called the point at infinity, and the other points are called finite points.

A* divisor * is defined as a finite formal sum of finite points or the infinity , while the * Jacobian group* (or simply called* Jacobian*) of the curve over is an Abelian group composed of some special divisors (i.e., reduced divisors) on . This Jacobian group is generally denoted as . A hyperelliptic curve cryptosystem (HECC) is a cryptosystem constructed on the Jacobian group of the hyperelliptic curve over a finite field. For example, the hyperelliptic curve digital signature algorithm (HECDSA) is a hyperelliptic curve version of an elliptic curve digital signature algorithm (ECDSA). The security of an HECC is based on the discrete logarithm problems in the corresponding Jacobian group.

Since HECC was invented by Koblitz [1] in 1989, it has been extensively researched, and now it has been considered for practical cryptographic applications. For a certain number of classes of hyperelliptic curves with some specific parameters, the corresponding HECC can even possess lower complexities than an elliptic curve cryptosystem but with the same level of security [2].

In order to construct a secure HECC, one first has to choose a hyperelliptic curve over a finite field and then compute the order of the hyperelliptic curve Jacobian group. If the order does not have a large prime factor, then the discrete logarithm problems in this Jacobian group may not be hard enough to guarantee the security of the HECC, and so the hyperelliptic curve is not suitable for cryptographic uses and should be chosen again to ensure that the Jacobian group order has some large prime factor. But, in most cases, this computation is a very time-consuming task. Hence, the computation of Jacobian group order is a very important step for the efficient implementation of HECC.

##### 1.2. Zeta Functions and Jacobian Group Orders

The most common method used for the computation of Jacobian group orders is by computing the numerator of the zeta functions of the related hyperelliptic curves, or by computing the characteristic polynomial of the hyperelliptic curve. The following results are due to the Weil's theorem [3, 4] and Kedlaya's algorithm [5].

Let be a hyperelliptic curve of (1.1) over . For any positive integer , let denote the number of -rational points on . The zeta function of is defined as

Then (a) is a rational function over and can be written as , where ,(b)there exist complex numbers with such that (c)the integer coefficient polynomial is called the characteristic polynomial of the Frobenius endomorphism on (it is also called the characteristic polynomial of over ), and it is can be expressed as where for , (d)for any positive integer , the order of is given as

Hence, for any positive integer , the order of can be computed if is determined or if ) are computed.

For a positive integer , the quadratic character of is defined as

Obviously, holds for any . By using , we can compute as While for any positive integer and every field element , the value of the extended quadratic character at can be computed as in .

##### 1.3. Our Main Results

Let be the curve with the equation where and is a power of an odd prime . Then is a hyperelliptic curve of genus . In [6], Duursma and Sakurai presented of for and . That is, the numerator of the corresponding zeta function is given as respectively, where , , is a -th unity root, and denotes the Legendre symbol.

In this paper, we compute the characteristic polynomials of with (, ) and get the following Table 1.

From the characteristic polynomials of the hyperelliptic curve over , the orders of Jacobian groups can be easily computed as For example, if is a primitive element modulo , then the characteristic polynomial of is where satisfies . Hence, the order of the Jacobian group of over is

If is an integer coprime to , let ; then will also run through all these roots when runs through the all roots of . Hence, we have

If is an integer not coprime to , let be the factor of such that , then we have That is, for any positive integer , the order of the Jacobian group of the curve over with being a primitive element modulo can be computed as where is the factor of such that .

In Table 2, we give some essential parameters with which the Jacobian group order of has some large prime factors, which shows that the with these parameters may be used for cryptographic applications.

#### 2. Isomorphic Curves, Twisted Curves, and Their Characteristic Polynomials

Two hyperelliptic curves of the same genus over the field are called isomorphic over if they are isomorphic as projective varieties over . If and are isomorphic over , then their Jacobian groups and are also isomorphic [7]. Hence, the hyperelliptic curve cryptosystem based on the Jacobian group of is equivalent to that based on the Jacobian group of .

From [8], we know how to the hyperelliptic curves are isomorphic. Precisely, suppose and are two hyperelliptic curves of the equation forms , respectively, with , (monic) , , and . Then and are isomorphic over if and only if there exist , , and with , such that can be transformed into through the coordinate change:

In our case, a hyperelliptic curve is isomorphic to the hyperelliptic curve if and only if there exist and such that has the equation form

If , then has the equation form

By using (1.10), we can easily show that if and are isomorphic then their characteristic polynomials and are equal.

Theorem 2.1. * Let and
**
be a hyperelliptic curve of genus over of odd characteristic , and its characteristic polynomial. Let be a quadratic nonresidue in . Then, the hyperelliptic curve
**
has the characteristic polynomial . *

*Proof. *Let denote the number of rational points of the hyperelliptic curve over and denote the extended quadratic character of . Then, since
hence, according to (1.10), we have
It follows from (1.6), (1.7), and (1.10).

The hyperelliptic curve is called a* twisted curve* of over by . For the curve , its twisted curve is a hyperelliptic curve of the equation
with a quadratic nonresidue in .

In the following, we compute the characteristic polynomials of over with .

*Case 1. *For the curve with and , has isomorphic curves over , which are
Hence, there are three isomorphism classes of hyperelliptic curves over which are denoted as , and , respectively,

If and is a quadratic nonresidue modulo , then its twisted curve or belongs to .

According to [9], we know that the characteristic polynomial of the hyperelliptic curve over is

While for all the curves in or , their characteristic polynomials were proved by Duursma [9] to be
respectively.

For examples, the curve over and the curve over have the characteristic polynomial and , respectively. The curves in or have the characteristic polynomial or , respectively. The curves in or have the characteristic polynomial or , respectively.

*Case 2. *Over , the hyperelliptic curve is a quotient of the Hermitian curve which is maximal, and this leads to that over , has the characteristic polynomial [10]

Based on the following Theorem 2.6, for any , the curve is isomorphic to . Thus, over also has the characteristic polynomial (2.13). And it follows that the characteristic polynomial of over equals to

*Case 3. *Suppose . Then for the fixed and all , all the hyperelliptic curves are isomorphic. Hence, each of these curves is isomorphic to its twisted curve. Thus, the coefficients of the terms of odd degrees in their corresponding characteristic polynomials are zero. In fact, we have the following Lemma 2.2.

Lemma 2.2. *Suppose is an odd prime number, , and is a positive integer satisfying . Then
**
holds if one of the following three conditions is satisfied:*(1)* or is odd;*(2)* is even and is a primitive root modulo .*

*Proof. *Suppose is odd, and let be a quadratic nonresidue in . Then, we have
and it follows .

Let or even and a primitive root modulo . We first show that will run through if runs through . It is equivalent to show that for any , if , then . That is, we have to show that the equation has no nonzero solution in .

Assume that is a nonzero root of in , that is, . Then we have , and it follows , that is, or . Thus, or , it is impossible. Therefore,

Lemma 2.3. *For any odd prime number , we have
*

*Proof. * comes directly from Lemma 2.2 if is odd.

Suppose is even and . Let be the coefficients of the characteristic polynomial (2.14); then if is odd, and
if is even. Thus, from (1.7), we have
From this above equation and (2.19), we can inductively show

Theorem 2.4. *Suppose is an odd prime number and . Let be the order of in the multiplicative group . Then, the characteristic polynomial of the curve over is
*

*Proof. *Since is isomorphic to , we only have to consider the curve over .

Let , then for . For any even positive integer not divided by , since , the mapping is a one-to-one mapping in , hence, we have
It follows that based on (1.7) and Lemma 2.2. Thus, for all positive integer satisfying , the coefficients of 's characteristic polynomial are equal to 0.

Let be a generator of the cyclic multiplicative group , then there exists an integer such that and , and it follows that there exists an integer satisfying , and
Let ; then and
From or , we know that there exist integers such that
and it follow that there exists an integer such that
If is even, then we have
Hence,
Thus, from (2.21), we have

In addition, for any positive integer , we have
And so for , based on (2.21), we have

Therefore, for , we have the coefficients of the corresponding characteristic polynomial as follows:
Hence, the characteristic polynomial for even is
Especially, if is a primitive element modulo , we have

Suppose is odd. Then and is the smallest even positive integer satisfying . According to the equalities (2.25) and (2.27), we have
where for some integer . And it follows that holds for any positive integer .

Since for any odd integer , we have . Hence, similar to the proof of the formula (2.21), for any positive integer , we have
Hence, the corresponding characteristic polynomial coefficient for equals to
Thus, the corresponding characteristic polynomial is

For example, let , then is not a primitive root of modulo . In fact, we have , and the characteristic polynomial of the curve over is .

*Case 4. *Now we consider the curves over .

Theorem 2.5. *Suppose is an odd prime number. *(1)*The curve over has the characteristic polynomial
*(2)*For any nonzero element , the all roots of the equation
are in . Therefore, for every nonzero element , the hyperelliptic curve over has the characteristic polynomial
*

*Proof. *(1) If for , then we have
Hence,
It follows that if are the all roots of the characteristic polynomial of over , then
and so we have
It follows for . Hence, the characteristic polynomial of the curve over is

(2) Let be a root of , then , and it follows , which means .

For any element in , let be a root of the equation in and a root of . Then , and so the curve is isomorphic to . Hence, for any nonzero element , all the curve has the characteristic polynomial

For example, let be a root of , then the curve : over has the characteristic polynomial Since is a quadratic nonresidue in , the curve : is one twisted curve of . Hence, 's characteristic polynomial is

Suppose is a root of . Then the curve : over has the characteristic polynomial Since is a quadratic nonresidue in , the curve : is one twisted curve of . has the characteristic polynomial

Theorem 2.6. *Suppose is an odd prime number. Then, *(1)*the equation
has roots in if and only if . **For any , the curve is isomorphic to the curve over if and only if .**(2) For any , the curve is isomorphic to the curve over .*

*Proof. *(1) Suppose and is a root of . Then, and it follows , which implies . On the other hand, if is a root of in , then , which implies .

Let be a root of in , then , and over , the curve is isomorphic to the curve , that is, .

(2) Suppose and are two different elements in . Then, obviously, . Let be a square root of in , and let . Then, .

According to (1), the equation has roots in . Let be a root of ; then, over , the curve is isomorphic to the curve
That is, is isomorphic to over since we have

For any , the curve has the same characteristic polynomial.

Theorem 2.7. *Suppose is an odd prime number and . If , then for every , the curve is a twisted curve of some curve of the form with . If , then for every , the curve is isomorphic to the curve over .**Hence, over , the characteristic polynomial of the curve with is
*

*Proof. *Let be a generator of the cyclic multiplicative group .

(1) Assume . Set ; then
It follows that is a quadratic nonresidue in , and the curve is a twist of the curve . Hence, due to Theorems 2.1 and 2.5, the curve has the characteristic polynomial

(2) Assume . Let , , and . Then, , and the curve is isomorphic to the curve
It follows that is isomorphic to the curve since and . Therefore, for every , the curve has the same characteristic polynomial as the curve over , that is,
In a word, for any odd prime number, the characteristic polynomial of the curve is

Theorem 2.8. *Suppose is an odd prime number, , and . Let be the order of in if , that is, . And let and be the smallest positive integer such that if . *(1)*Suppose . Then , and the characteristic polynomial is
*(2)*Suppose ; then the characteristic polynomial of the curve over is
*

*Proof. *(1) If , then since . Let be a generator of the cyclic multiplicative group . Then, there exists an integer satisfying , , and .

If , then is odd. Let , then
it means that is a quadratic nonresidue in . Hence, the curve has a twisted curve defined by the equation
If , then , or and which means . Hence, the curve is isomorphic to the curve . Thus, over , the curve has the characteristic polynomial , that is, .

If , that is, and , then according to Theorem 2.7, has the characteristic polynomial

If , then is even. Let and , then the curve , that is,
is an isomorphic curve of the curve

It is clear that if and only if . Hence, based on Theorems 2.6 and 2.7, the curve has the characteristic polynomial

For , we can also show our result as follows.

Set with . Then, are the different nonzero roots of in . Hence, if is a nonzero root of in , we have
Thus, according to (1.4) and (1.10), each root of the corresponding characteristic polynomial equals to . It follows that the corresponding characteristic polynomial is

(2) If , then is a root of . Set and , then, over the field , is isomorphic to , that is, . Hence, we only have to compute the characteristic polynomial of the curve over .

(i) If , then means . Suppose is a primitive root of ; then the equation has only zero root in for any positive integer , and it follows that the -th coefficient of the characteristic polynomial of is 0.

Now we compute the -th coefficient . Let be a generator of the cyclic multiplicative group ; then there exists an integer satisfying , , and .

Set ; then , , and . Hence, based on Lemma 2.3, we have
where denotes the extended quadratic character of the degree extension of (i.e., ), which is equivalent to , the extended quadratic character of the degree extension of . Thus,
Therefore, the corresponding characteristic polynomial is

(ii) Suppose and ; then similar to the proof of Theorem 2.4, we have the corresponding characteristic polynomial coefficients as the the following if is even:
for , while the other coefficients are equal to zero. Hence, the corresponding characteristic polynomial is

By the same way, we can show that if is odd, the corresponding characteristic polynomial is .

(iii) Suppose , then . If an integer satisfies and , then the corresponding characteristic polynomial is .

Now suppose