Real hyperelliptic curve

There are two types of hyperelliptic curves, a class of algebraic curves: real hyperelliptic curves and imaginary hyperelliptic curves which differ by the number of points at infinity. Hyperelliptic curves exist for every genus ${\displaystyle g\geq 1}$. The general formula of Hyperelliptic curve over a finite field ${\displaystyle K}$ is given by

$${\displaystyle C:y^{2}+h(x)y=f(x)\in K[x,y]}$$

where ${\displaystyle h(x),f(x)\in K}$ satisfy certain conditions. In this page, we describe more about real hyperelliptic curves, these are curves having two points at infinity while imaginary hyperelliptic curves have one point at infinity.

Definition

A real hyperelliptic curve of genus g over K is defined by an equation of the form ${\displaystyle C:y^{2}+h(x)y=f(x)}$ where ${\displaystyle h(x)\in K}$ has degree not larger than g+1 while ${\displaystyle f(x)\in K}$ must have degree 2g+1 or 2g+2. This curve is a non singular curve where no point ${\displaystyle (x,y)}$ in the algebraic closure of ${\displaystyle K}$ satisfies the curve equation ${\displaystyle y^{2}+h(x)y=f(x)}$ and both partial derivative equations: ${\displaystyle 2y+h(x)=0}$ and ${\displaystyle h'(x)y=f'(x)}$. The set of (finite) ${\displaystyle K}$–rational points on C is given by

$${\displaystyle C(K)=\left\{(a,b)\in K^{2}\mid b^{2}+h(a)b=f(a)\right\}\cup S}$$

where ${\displaystyle S}$ is the set of points at infinity. For real hyperelliptic curves, there are two points at infinity, ${\displaystyle \infty _{1}}$ and ${\displaystyle \infty _{2}}$. For any point ${\displaystyle P(a,b)\in C(K)}$, the opposite point of ${\displaystyle P}$ is given by ${\displaystyle {\overline {P}}=(a,-b-h)}$; it is the other point with x-coordinate a that also lies on the curve.

Example

Let ${\displaystyle C:y^{2}=f(x)}$ where

$${\displaystyle f(x)=x^{6}+3x^{5}-5x^{4}-15x^{3}+4x^{2}+12x=x(x-1)(x-2)(x+1)(x+2)(x+3)}$$

over ${\displaystyle R}$. Since ${\displaystyle \deg f(x)=2g+2}$ and ${\displaystyle f(x)}$ has degree 6, thus ${\displaystyle C}$ is a curve of genus g = 2.

The homogeneous version of the curve equation is given by

$${\displaystyle Y^{2}Z^{4}=X^{6}+3X^{5}Z-5X^{4}Z^{2}-15X^{3}Z^{3}+4X^{2}Z^{4}+12XZ^{5}.}$$

It has a single point at infinity given by (0:1:0) but this point is singular. The blowup of ${\displaystyle C}$ has 2 different points at infinity, which we denote ${\displaystyle \infty _{1}}$ and ${\displaystyle \infty _{2}}$. Hence this curve is an example of a real hyperelliptic curve.

In general, every curve given by an equation where f has even degree has two points at infinity and is a real hyperelliptic curve while those where f has odd degree have only a single point in the blowup over (0:1:0) and are thus imaginary hyperelliptic curves. In both cases this assumes that the affine part of the curve is non-singular (see the conditions on the derivatives above)

Arithmetic in a real hyperelliptic curve

In real hyperelliptic curve, addition is no longer defined on points as in elliptic curves but on divisors and the Jacobian. Let ${\displaystyle C}$ be a hyperelliptic curve of genus g over a finite field K. A divisor ${\displaystyle D}$ on ${\displaystyle C}$ is a formal finite sum of points ${\displaystyle P}$ on ${\displaystyle C}$. We write

$${\displaystyle D=\sum _{P\in C}{n_{P}P}}$$

where ${\displaystyle n_{P}\in \mathbb {Z} }$ and ${\displaystyle n_{p}=0}$ for almost all ${\displaystyle P}$.

The degree of ${\textstyle D=\sum _{P\in C}{n_{P}P}}$ is defined by

$${\displaystyle \deg(D)=\sum _{P\in C}{n_{P}}.}$$

${\displaystyle D}$ is said to be defined over ${\displaystyle K}$ if ${\textstyle D^{\sigma }=\sum _{P\in C}n_{P}P^{\sigma }=D}$ for all automorphisms σ of ${\displaystyle {\overline {K}}}$ over ${\displaystyle K}$. The set ${\displaystyle Div(K)}$ of divisors of ${\displaystyle C}$ defined over ${\displaystyle K}$ forms an additive abelian group under the addition rule

$${\displaystyle \sum a_{P}P+\sum b_{P}P=\sum {(a_{P}+b_{P})P}.}$$

The set ${\displaystyle Div^{0}(K)}$ of all degree zero divisors of ${\displaystyle C}$ defined over ${\displaystyle K}$ is a subgroup of ${\displaystyle Div(K)}$.

We take an example:

Let ${\displaystyle D_{1}=6P_{1}+4P_{2}}$ and ${\displaystyle D_{2}=1P_{1}+5P_{2}}$. If we add them then ${\displaystyle D_{1}+D_{2}=7P_{1}+9P_{2}}$. The degree of ${\displaystyle D_{1}}$ is ${\displaystyle \deg(D_{1})=6+4=10}$ and the degree of ${\displaystyle D_{2}}$ is ${\displaystyle \deg(D_{2})=1+5=6}$. Then, ${\displaystyle \deg(D_{1}+D_{2})=\deg(D_{1})+\deg(D_{2})=16.}$

For polynomials ${\displaystyle G\in K[C]}$, the divisor of ${\displaystyle G}$ is defined by

$${\displaystyle \mathrm {div} (G)=\sum _{P\in C}{\mathrm {ord} }_{P}(G)P.}$$

If the function ${\displaystyle G}$ has a pole at a point ${\displaystyle P}$ then ${\displaystyle -{\mathrm {ord} }_{P}(G)}$ is the order of vanishing of ${\displaystyle G}$ at ${\displaystyle P}$. Assume ${\displaystyle G,H}$ are polynomials in ${\displaystyle K[C]}$; the divisor of the rational function ${\displaystyle F=G/H}$ is called a principal divisor and is defined by ${\displaystyle \mathrm {div} (F)=\mathrm {div} (G)-\mathrm {div} (H)}$. We denote the group of principal divisors by ${\displaystyle P(K)}$, i.e., ${\displaystyle P(K)=\{\mathrm {div} (F)\mid F\in K(C)\}}$. The Jacobian of ${\displaystyle C}$ over ${\displaystyle K}$ is defined by ${\displaystyle J=Div^{0}/P}$. The factor group ${\displaystyle J}$ is also called the divisor class group of ${\displaystyle C}$. The elements which are defined over ${\displaystyle K}$ form the group ${\displaystyle J(K)}$. We denote by ${\displaystyle {\overline {D}}\in J(K)}$ the class of ${\displaystyle D}$ in ${\displaystyle Div^{0}(K)/P(K)}$.

There are two canonical ways of representing divisor classes for real hyperelliptic curves ${\displaystyle C}$ which have two points infinity ${\displaystyle S=\{\infty _{1},\infty _{2}\}}$. The first one is to represent a degree zero divisor by ${\displaystyle {\bar {D}}}$ such that ${\textstyle D=\sum _{i=1}^{r}P_{i}-r\infty _{2}}$, where ${\displaystyle P_{i}\in C({\bar {\mathbb {F} }}_{q})}$,${\displaystyle P_{i}\not =\infty _{2}}$, and ${\displaystyle P_{i}\not ={\bar {P_{j}}}}$ if ${\displaystyle i\neq j}$ The representative ${\displaystyle D}$ of ${\displaystyle {\bar {D}}}$ is then called semi reduced. If ${\displaystyle D}$ satisfies the additional condition ${\displaystyle r\leq g}$ then the representative ${\displaystyle D}$ is called reduced. ^[1] Notice that ${\displaystyle P_{i}=\infty _{1}}$ is allowed for some i. It follows that every degree 0 divisor class contain a unique representative ${\displaystyle {\bar {D}}}$ with

$${\displaystyle D=D_{x}-\deg(D_{x})\infty _{2}+v_{1}(D)(\infty _{1}-\infty _{2}),}$$

where ${\displaystyle D_{x}}$ is divisor that is coprime with both ${\displaystyle \infty _{1}}$ and ${\displaystyle \infty _{2}}$, and ${\displaystyle 0\leq \deg(D_{x})+v_{1}(D)\leq g}$.

The other representation is balanced at infinity. Let ${\displaystyle D_{\infty }=\infty _{1}+\infty _{2}}$, note that this divisor is ${\displaystyle K}$-rational even if the points ${\displaystyle \infty _{1}}$ and ${\displaystyle \infty _{2}}$ are not independently so. Write the representative of the class ${\displaystyle {\bar {D}}}$ as ${\displaystyle D=D_{1}+D_{\infty }}$, where ${\displaystyle D_{1}}$ is called the affine part and does not contain ${\displaystyle \infty _{1}}$ and ${\displaystyle \infty _{2}}$, and let ${\displaystyle d=\deg(D_{1})}$. If ${\displaystyle d}$ is even then

$${\displaystyle D_{\infty }={\frac {d}{2}}(\infty _{1}+\infty _{2}).}$$

If ${\displaystyle d}$ is odd then

$${\displaystyle D_{\infty }={\frac {d+1}{2}}\infty _{1}+{\frac {d-1}{2}}\infty _{2}.}$$

For example, let the affine parts of two divisors be given by

${\displaystyle D_{1}=6P_{1}+4P_{2}}$ and ${\displaystyle D_{2}=1P_{1}+5P_{2}}$

then the balanced divisors are

${\displaystyle D_{1}=6P_{1}+4P_{2}-5D_{\infty _{1}}-5D_{\infty _{2}}}$ and ${\displaystyle D_{2}=1P_{1}+5P_{2}-3D_{\infty _{1}}-3D_{\infty _{2}}}$

Transformation from real hyperelliptic curve to imaginary hyperelliptic curve

Let ${\displaystyle C}$ be a real quadratic curve over a field ${\displaystyle K}$. If there exists a ramified prime divisor of degree 1 in ${\displaystyle K}$ then we are able to perform a birational transformation to an imaginary quadratic curve. A (finite or infinite) point is said to be ramified if it is equal to its own opposite. It means that ${\displaystyle P=(a,b)={\overline {P}}=(a,-b-h(a))}$, i.e. that ${\displaystyle h(a)+2b=0}$. If ${\displaystyle P}$ is ramified then ${\displaystyle D=P-\infty _{1}}$ is a ramified prime divisor. ^[2]

The real hyperelliptic curve ${\displaystyle C:y^{2}+h(x)y=f(x)}$ of genus ${\displaystyle g}$ with a ramified ${\displaystyle K}$-rational finite point ${\displaystyle P=(a,b)}$ is birationally equivalent to an imaginary model ${\displaystyle C':y'^{2}+{\bar {h}}(x')y'={\bar {f}}(x')}$ of genus ${\displaystyle g}$, i.e. ${\displaystyle \deg({\bar {f}})=2g+1}$ and the function fields are equal ${\displaystyle K(C)=K(C')}$. ^[3] Here:

${\displaystyle x'={\frac {1}{x-a}}}$ and ${\displaystyle y'={\frac {y+b}{(x-a)^{g+1}}}}$

(i)

In our example ${\displaystyle C:y^{2}=f(x)}$ where ${\displaystyle f(x)=x^{6}+3x^{5}-5x^{4}-15x^{3}+4x^{2}+12x}$, h(x) is equal to 0. For any point ${\displaystyle P=(a,b)}$, ${\displaystyle h(a)}$ is equal to 0 and so the requirement for P to be ramified becomes ${\displaystyle b=0}$. Substituting ${\displaystyle h(a)}$ and ${\displaystyle b}$, we obtain ${\displaystyle f(a)=0}$, where ${\displaystyle f(a)=a(a-1)(a-2)(a+1)(a+2)(a+3)}$, i.e., ${\displaystyle a\in \{0,1,2,-1,-2,-3\}}$.

From ( i ), we obtain ${\textstyle x={\frac {ax'+1}{x'}}}$ and ${\textstyle y={\frac {y'}{x'^{g+1}}}}$. For g = 2, we have ${\textstyle y={\frac {y'}{x'^{3}}}}$.

For example, let ${\displaystyle a=1}$ then ${\textstyle x={\frac {x'+1}{x'}}}$ and ${\textstyle y={\frac {y'}{x'^{3}}}}$, we obtain

$${\displaystyle \left({\frac {y'}{x'^{3}}}\right)^{2}={\frac {x'+1}{x'}}\left({\frac {x'+1}{x'}}+1\right)\left({\frac {x'+1}{x'}}+2\right)\left({\frac {x'+1}{x'}}+3\right)\left({\frac {x'+1}{x'}}-1\right)\left({\frac {x'+1}{x'}}-2\right).}$$

To remove the denominators this expression is multiplied by ${\displaystyle x^{6}}$, then:

$${\displaystyle y'^{2}=(x'+1)(2x'+1)(3x'+1)(4x'+1)(1)(1-x')}$$

giving the curve

$${\displaystyle C':y'^{2}={\bar {f}}(x')}$$

where

$${\displaystyle {\bar {f}}(x')=(x'+1)(2x'+1)(3x'+1)(4x'+1)(1)(1-x')=-24x'^{5}-26x'^{4}+15x'^{3}+25x'^{2}+9x'+1.}$$

${\displaystyle C'}$ is an imaginary quadratic curve since ${\displaystyle {\bar {f}}(x')}$ has degree ${\displaystyle 2g+1}$.

References

1. Erickson, Michael; J. Jacobson Jr.; Ning Shang; Shuo Shen; Andreas Stein. "Explicit formulas for real hyperelliptic curves of genus 2 in affine representation".^{[ dead link ]}
2. M. J. Jacobson Jr; R. Scheidler; A. Stein (12 December 2018). "Cryptographic Aspects of Real Hyperelliptic Curves" – via ePrint IACR.
3. D. Galbraith; Xibin Lin; David J. Mireles Morales. "Pairings on Hyperelliptic Curves with a Real Model".