Chapter 10 Hyperelliptic Curves This is a chapter from version 2.0 of the book “Mathematics of Public Key Cryptography” by Steven Galbraith, available from http://www.math.auckland.ac.nz/˜sgal018/crypto- book/crypto-book.html The copyright for this chapter is held by Steven Galbraith. This book was published by Cambridge University Press in early 2012. This is the extended and corrected version. Some of the Theorem/Lemma/Exercise numbers may be different in the published version. Please send an email to
[email protected] if youfind any mistakes. Hyperelliptic curves are a natural generalisation of elliptic curves, and it was suggested by Koblitz [346] that they might be useful for public key cryptography. Note that there is not a group law on the points of a hyperelliptic curve; instead we use the divisor class group of the curve. The main goals of this chapter are to explain the geometry of hyperelliptic curves, to describe Cantor’s algorithm [118] (and variants) to compute in the divisor class group of hyperelliptic curves, and then to state some basic properties of the divisor class group. Definition 10.0.1. Letk be a perfectfield. LetH(x),F(x) k[x] (we stress that H(x) andF(x) are not assumed to be monic). An affine algebraic∈ set of the formC: y2 +H(x)y=F(x) is called a hyperelliptic equation. The hyperelliptic involution ι:C C is defined byι(x, y)=(x, y H(x)). → − − Exercise 10.0.2. LetC be a hyperelliptic equation overk. Show that ifP C(k) then ι(P) C(k).