Simple geometrically split abelian surfaces over finite fields

Kuo-Ming James Chou and Ernst Kani

1 Introduction

In the search to find curves which are suitable for cryptography, several authors have studied genus 2 curves C/𝔽_{q} whose Jacobians have the property of the title of this paper, i.e. the Jacobian J_{C} of C/𝔽_{q} is 𝔽_{q}-simple but J_{C} ⊗ \overline{𝔽}_{q} is isogenous to a product surface, where \overline{𝔽}_{q} denotes the algebraic closure of 𝔽_{q}. For example, Satoh[10] considered the Legendre curves y^{2} = x^{5} + ux^{3} + vx which generalize those studied by Furukawa, Kawazoe and Takahashi[4] (where u = 0).

A natural question in this connection is to try to classify all abelian surfaces A/𝔽_{q} which are simple but geometrically split. This is answered by the following result.

Theorem 1. Let A/𝔽_{q} be a simple, non-supersingular abelian surface. Then A ⊗ 𝔽_{q^{n}} splits for some n > 1 if and only if A is ordinary and there is an integer c such that

(1)  tr_{A}^{2} = c(s_{A} − cq + 2q) with 0 ≤ c ≤ 3,

where s_{A} is the coefficient of the X^{2}-term of the characteristic polynomial h_{A}(X) of A/𝔽_{q} and tr_{A} is the trace of A. If this is the case, then A⊗𝔽_{q^{n}} ∼ E_{n}^{2} for some elliptic curve E/𝔽_{q^{n}}, where n = c + 2 for c < 3 and n = 6 for c = 3. Moreover, n is minimal in the sense that A ⊗ 𝔽_{q^{m}} is simple for all m|n, m ≠ n.

Except for the compact formulation of condition (1), this theorem was proved by Maisner and Nart[7] and by Howe and Zhu[6] in the ordinary case. Since the proof of [7] is not entirely self-contained (cf. Remark 4), we present here a more direct proof in section 2.

To actually prove the existence of simple, geometrically split abelian surfaces, further work is necessary. To this end we prove in section 3:

Theorem 2. (a) Let s ∈ ℤ. Then there is a simple, ordinary abelian surface A/𝔽_{q} with s_{A} = s such that A ⊗ 𝔽_{q^{2}} splits if and only if

(2)  |s| ≤ 2q, gcd(s, q) = 1 and 2q − s ≠ x^{2}, ∀x ∈ ℤ.

If these conditions hold, then we have h_{A}(X) = X^{4} + sX^{2} + q^{2}.

(b) Let n = 3, 4 or 6 and put c = [\frac{n}{2}]. If t ∈ ℤ, then there is a simple, ordinary abelian surface A/𝔽_{q} with tr_{A} = t such that A ⊗ 𝔽_{q^{n}} splits (but A ⊗ 𝔽_{q^{m}} is simple for m|n, m ≠ n) if and only if

(3)  t^{2} ≤ 4cq, gcd(t, q) = 1, c|t, and 4cq − t^{2} ≠ εx^{2}, ∀x ∈ ℤ,

where ε = 1 if n = 4 and ε = 3 otherwise. If these conditions hold, then h_{A}(X) = X^{4} − tX^{3} + (\frac{t^{2}}{c} − (c − 2)q) X^{2} − tqX + q^{2}.

(c) If A/𝔽_{q} is any simple, non-supersingular abelian surface which is geometrically split, then it is one of the surfaces listed in parts (a) and (b).

Note that (3) shows that the case n = 4 cannot occur when q = 2^{r} and that n = 6 and q = 7 cannot occur when q = 3^{r}; cf. Remark 19(a). However, in all other cases there exists a simple ordinary abelian surface A/𝔽_{q} such that A ⊗ 𝔽_{q^{n}} is minimally split; cf. Proposition 18.

A related existence question is the following: for which ordinary elliptic curves E/𝔽_{q^{n}} (where n ∈ {2, 3, 4, 6}) is there a simple abelian surface A/𝔽_{q} such that A ⊗ 𝔽_{q^{n}} ∼ E^{2}? This question is answered in section 3 (cf. Theorem 20 and Proposition 30), and is closely related to the structure of the Weil restriction of E/𝔽_{q^{n}} with respect to 𝔽_{q^{n}}/𝔽_{q}. This relation is explained in section 4 (cf. Propositions 21 and 26) and is used to determine all abelian surfaces B/𝔽_{q} such that B ⊗ 𝔽_{q^{n}} ∼ E^{2}; cf. Proposition 29.

In the last section we apply our results to the Jacobians J_{u,v}/𝔽_{q} defined by the genus 2 curves

C_{u,v}/𝔽_{q} : y^{2} = x^{5} + ux^{3} + vx

which were studied by Legendre (1832) and Satoh[10]. As Satoh showed, we have that J_{u,v} ⊗ 𝔽_{q^{4}} ∼ E^{2}, for some (explicit) elliptic curve E/𝔽_{q^{4}}, and in Theorem 31 we use our previous results to determine when J_{u,v} splits already over 𝔽_{q^{2}}. This allows us to simplify Satoh’s algorithm for determining (the largest prime factor of) |J_{u,v}(𝔽_{q})|; cf. Algorithm 37. As a result, the algorithm now runs in deterministic polynomial time in place of Satoh’s probabilistic polynomial time. Moreover, in place of considering Satoh’s 26 possibilities for the group order, we only have to consider 2 possibilities.

This research was supported by an OGS grant held by the first author and by a Discovery Grant from the Natural Sciences and Engineering Research Council of Canada (NSERC) held by the second author.

2 Classification theorems

In this section we classify the simple abelian surfaces A/𝔽_{q} which are geometrically split. As was indicated in the introduction, this classification will be given in terms of properties of the coefficients tr_{A} and s_{A} of the characteristic polynomial h_{A}(X) ∈ ℤ[X] of (the Frobenius endomorphism π_{A} of) A/𝔽_{q}. A first step towards this classification is the following result.

Theorem 3. Let A/𝔽_{q} be a simple, non-supersingular abelian surface such that

A ⊗_{𝔽_{q}} 𝔽_{q^{n}} ∼ E_{1} × E_{2},

for some integer n > 1 and some elliptic curves E_{i}/𝔽_{q^{n}}, where i = 1, 2. Then

(a) A, E_{1}, and E_{2} are ordinary, and E_{1} ∼ E_{2}.

(b) h_{A}(X) is irreducible over ℚ, and K := ℚ[X]/(h_{A}(X)) is biquadratic extension of ℚ, i.e. K/ℚ is Galois with Gal(K/ℚ) ≃ ℤ/2ℤ × ℤ/2ℤ.

(c) If n is minimal, then n = 2, 3, 4 or 6.

Remark 4. Most of this theorem can already be found in the literature. Specifically, the fact that A has to be ordinary (Theorem 3(a)) follows from Corollary 2.17 of [7] and part (c) is part of Theorem 6 of [6]. However, we feel that our proof of part (a) is more direct than that of [7] which relies on previous work (due to Rück and Xing; see [7]). Indeed, we only use basic facts of abelian varieties as given in Mumford[8] and Waterhouse [11]. For example, we shall use the following well-known fact about simple ordinary abelian varieties A/𝔽_{q}.

Lemma 5. If A/𝔽_{q} is a simple, ordinary abelian variety, then h_{A}(X) is irreducible over ℚ and End^{0}(A) ≃ ℚ[X]/(h_{A}(X)). In particular, End^{0}(A) is a CM-field of degree 2 dim(A).

Proof. Since A/𝔽_{q} is simple, we know by Theorem 8 of [11] that h_{A}(X) = f(X)^{d}, where f(X) ∈ ℚ[X] is some irreducible polynomial and d is determined by [D : Z(D)] = d^{2}, where D := End^{0}(A) and Z(D) denotes the centre of D. Now the first part of Theorem 7.2 of [11] asserts that D is commutative, and so d = 1, and hence h_{A}(X) = f(X) is irreducible. Moreover, since Z(D) = ℚ(π_{A}) (cf. Theorem 3 (a) on page 256 of [8]), it thus follows that D = Z(D) = ℚ(π_{A}) ≃ ℚ[X]/(h_{A}(X)). In particular, e := [Z(D) : ℚ] = deg(h_{A}) = 2 dim(A), and so it follows from the classification theory of skewfields with a positive involution ([8], p. 201) and the restrictions on e (cf. [8], p. 202) that we are in Case IV of [8], p. 201, and so D = Z(D) is a CM-field, i.e. D is a totally imaginary field which contains a totally real subfield of index 2.

Remark 6. In connection with the above-quoted Theorem 7.2 of Waterhouse[11], we note that the second part of that theorem is incorrect as stated: it is not true that if A/𝔽_{q} is simple and ordinary, then End^{0}(A) = End^{0}(A ⊗ \overline{𝔽}_{q}), where \overline{𝔽}_{q} denotes the algebraic closure of 𝔽_{q}. (This incorrect statement is repeated in [12].) Indeed, if this were true, then A would be absolutely simple, and the above Theorem 3 would be vacuous. However, the examples of [4], [10] (and Example 36 below) provide explicit counterexamples to this assertion.

Corollary 7. If A/𝔽_{q} is an ordinary abelian surface, then the characteristic polynomial of A has the form

(4) h_{A}(X) = (X −α_{1})(X −α_{2}) (X − \frac{q}{α_{1}} ) (X − \frac{q}{α_{2}} ) = X^{4} −tX^{3} +sX^{2} −tqX +q^{2}

where α_{1}, α_{2} ∈ ℂ with α_{i} ≠ \frac{q}{α_{i}} = \overline{α}_{i}, for i = 1, 2, and t, s ∈ ℤ with (s, q) = 1. Moreover, A is simple if and only if Δ_{A} := t^{2} − 4s + 8q is not a square in ℤ. If this is the case, then K_{0} = ℚ(\sqrt{Δ_{A}}) is the maximal real subfield of ℚ(π_{A}) ≃ ℚ[X]/(h_{A}).

Proof. The assertions of the first sentence follow from Proposition 3.4 of [5]. Next, suppose that A is not simple, so A ∼ E_{1} × E_{2}, where E_{i}/𝔽_{q} are two elliptic curves. Then h_{A}(X) = h_{E_{1}×E_{2}}(X) = (X^{2} − t_{1}X + q)(X^{2} − t_{2}X + q), where t_{i} = tr_{E_{i}}, and so

(5)  tr_{A} = t_{1} + t_{2}, s_{A} = t_{1}t_{2} + 2q and Δ_{A} = (t_{1} − t_{2})^{2}.

Thus, Δ_{A} is a square if A is not simple.

Conversely, suppose that A is simple. Then by Lemma 5 we know that h_{A}(X) is irreducible and that K := ℚ(α_{1}) ≃ End^{0}(A) is a quartic CM field. Thus, if K_{0} ⊂ K denotes the maximal real subfield of K, then [K_{0} : ℚ] = 2.

Since \overline{α_{1}} = \frac{q}{α_{1}} , we see that α_{1} + \frac{q}{a_{1}} ∈ K ∩ ℝ = K_{0}. But since α_{1} satisfies the polynomial X^{2} − (a_{1} + \frac{q}{a_{1}} )X + q ∈ K_{0}[X], we see that [K : ℚ(a_{1} + \frac{q}{a_{1}} )] ≤ 2, and so K_{0} = ℚ(a_{1} + \frac{q}{a_{2}} ). Next we note that

(6) g(X) := X^{2} − tX + (s − 2q) = (X − (α_{1} + \frac{q}{α_{1}} )) (X − (α_{2} + \frac{q}{α_{2}} ))

because by multiplying out the factorization (4) we see that t = (α_{1} + \frac{q}{α_{1}} ) + (α_{2} + \frac{q}{α_{2}} ) and s = 2q + α_{1}α_{2} + α_{1} \frac{q}{α_{2}} + α_{2} \frac{q}{α_{1}} + \frac{q^{2}}{α_{1}α_{2}} , from which (6) follows readily. Thus, g(X) ∈ ℤ[X] has α_{1} + \frac{q}{α_{1}} as a root, and so it follows that g(X) is irreducible over ℚ. Thus, its discriminant disc(g) = t^{2} − 4(s − 2q) = Δ_{A} is not a square in ℚ, and so K_{0} = ℚ(\sqrt{Δ_{A}}).

Remark 8. If A/𝔽_{q} is an abelian variety, then its trace tr_{A} = tr(π_{A}) ∈ ℤ is the trace of its Frobenius endomorphism π_{A} (cf. [8], p. 182), i.e. − tr_{A} is the coefficient of X^{2g−1} in the characteristic polynomial h_{A}(X) of π_{A}, where g = dim(A). Thus, if A/𝔽_{q} is an ordinary surface, then tr_{A} = t in the notation of (4), and hence (4) shows that h_{A}(X) (and also the isogeny class of A/𝔽_{q}) is uniquely determined by the pair of integers (tr_{A}, s_{A}), where s_{A} denotes the coefficient of X^{2} in h_{A}(X).

In fact, if A/𝔽_{q} is any abelian surface, then its characteristic polynomial h_{A}(X) has the form (4), as is easy to see by considering the simple and split cases separately. (This fact is used without proof in [7].) Thus, the pair (tr_{A}, s_{A}) characterizes the isogeny class of the abelian surface A/𝔽_{q}.

Proof of Theorem 3. (a) We will show that the following 3 cases are impossible. \underline{Case 1:} E_{1}/𝔽_{q^{n}} and E_{2}/𝔽_{q^{n}} are supersingular. Here we have by page 259 of [8] that \overline{E} := E_{1} ⊗\overline{𝔽}_{q^{n}} ∼ E_{2} ⊗\overline{𝔽}_{q^{n}}, where \overline{𝔽}_{q^{n}} denotes the algebraic closure of 𝔽_{q^{n}}. It follows that A ⊗ \overline{𝔽}_{q^{n}} ∼ \overline{E}^{2} is supersingular, which implies that A/𝔽_{q} is supersingular as well, contrary to the hypothesis. Thus, this case cannot occur. \underline{Case 2:} E_{1}/𝔽_{q^{n}} and E_{2}/𝔽_{q^{n}} are ordinary but E_{1}/𝔽_{q^{n}} ≁ E_{2}/𝔽_{q^{n}}. Since both E_{1} and E_{2} are ordinary, A_{n} := A⊗_{𝔽_{q}} 𝔽_{q^{n}} ∼ E_{1} ×E_{2} is also ordinary, which implies that A/𝔽_{q} is ordinary. We thus have by Lemma 5 that that End^{0}(A) is a field of degree 2 dim(A) = 4 over ℚ. However,

End^{0}(A) ⊂ End^{0}(A_{n}) ≃ End^{0}(E_{1}) × End^{0}(E_{2})

because E_{1} and E_{2} are not isogenous. Since End^{0}(E_{1}) and End^{0}(E_{2}) are imaginary quadratic fields, it follows by comparing dimensions that

End^{0}(A) ≃ End^{0}(E_{1}) × End^{0}(E_{2}).

Since the right hand side is not a field, we have a contradiction, and so this case is impossible as well. \underline{Case 3:} E_{1}/𝔽_{q^{n}} supersingular and E_{2}/𝔽_{q^{n}} ordinary. Here we shall derive a contradiction after establishing the following claims. \underline{Claim 3.1:} h_{A}(X) is irreducible over ℚ and End^{0}(A) is a field. Suppose h_{A}(X) were reducible over ℚ. Since A/𝔽_{q} is simple, we know by Theorem 8 of [12] that h_{A}(X) = f(X)^{d} for some d ∈ ℕ and some f(X) ∈ ℤ[X]. If deg(f(X)) = 1, then Theorem 3 (d) on page 256 of [8] shows that A is 𝔽_{q}-isogenous to a power of a supersingular elliptic curve, which is contrary to the hypothesis that A is nonsupersingular. Thus, we must have that h_{A}(X) = f(X)^{2}, where deg(f(X)) = 2, and so by Theorem 8 of [12], we know that End^{0}(A) is a skewfield of degree [End^{0}(A) : ℚ] = 2^{2} deg(f(X)) = 8. On the other hand, since E_{1} ≁ E_{2}, we have that

End^{0}(A) ⊂ End^{0}(A_{n}) ≃ End^{0}(E_{1}) × End^{0}(E_{2}) ⊆ End^{0}(\overline{E}_{1}) × End^{0}(\overline{E}_{2}) = Q × F,

where \overline{E}_{i} := E_{i} ⊗_{𝔽_{q}} \overline{𝔽}_{q^{n}}, for i = 1, 2, and Q is a quaternion algebra, and F is an imaginary quadratic field. By comparing dimensions, we have that End^{0}(A) ≃ Q×F, which is a contradiction because Q × F is not a skewfield. Thus, h_{A}(X) must be irreducible over ℚ, and hence has no repeated roots. By Theorem 3 (a) (c) on page 256 of [8], it follows that End^{0}(A) ≃ ℚ(π_{A}) is a field. This concludes Claim 3.1. \underline{Claim 3.2:} π_{E_{1}} = [±q^{\frac{n}{2}} ] Since E_{1} is supersingular, we know that End^{0}(\overline{E}_{1}) = Q is a quaternion algebra, where \overline{E}_{1} := E_{1} ⊗_{𝔽_{q}} \overline{𝔽}_{q^{n}}. First we show that End^{0}(E_{1}) = Q. If not, then End^{0}(E_{1}) is a skewfield which is properly contained in Q, and so End^{0}(E_{1}) ≤ 2. Thus, since A_{n} := A ⊗ 𝔽_{q^{n}} ∼ E_{1} × E_{2}, where E_{1} ≁ E_{2}, we have End^{0}(A_{n}) ≃ End^{0}(E_{1}) × End^{0}(E_{2}) = End^{0}(E_{1}) × F, where F is an imaginary quadratic field. Thus [End^{0}(A_{n}) : ℚ] ≤ 4, and so End^{0}(A) = End^{0}(A_{n}) ≃ End^{0}(E_{1}) × F by comparing degrees. This, however, is impossible since the latter is not a field.

We thus have that End^{0}(E_{1}) = Q, i.e. all endomorphisms of Ē_{1} are defined over 𝔽_{q^{n}}. It then follows from Theorem 3 (d) on page 256 of [8] that h_{E_{1}}(X) = (X −a)^{2} for some a ∈ ℚ. This implies that a^{2} = q^{n}, which means that a = ±q^{\frac{n}{2}} is the eigenvalue of π_{E_{1}}. Thus, π_{E_{1}} = [±q^{\frac{n}{2}} ], which verifies Claim 3.2. \underline{Claim 3.3:} The minimal polynomial m_{A_{n}}(X) of π_{A_{n}} over ℚ has degree 3. By Claim 3.2, we know that the minimal polynomial of π_{E_{1}} is m_{E_{1}}(X) = X ± q^{\frac{n}{2}} . On the other hand, since E_{2} is ordinary we know that the minimal polynomial of π_{E_{2}} is irreducible over ℚ of degree 2. Thus, the minimal polynomial of π_{E_{1}×E_{2}} is

m_{E_{1}×E_{2}}(X) = lcm(m_{E_{1}}(X), m_{E_{2}}(X)) = m_{E_{1}}(X)m_{E_{2}}(X),

which has degree 3. Since m_{A_{n}}(X) = m_{E_{1}×E_{2}}(X), we have deg(m_{A_{n}}(X)) = 3 as claimed.

We now combine Claims 3.1 and 3.3 to derive a contradiction. Since End^{0}(A) is a field of degree 4 over ℚ by Claim 3.1, the minimal polynomials of the elements in End^{0}(A) over ℚ must have degree either 1, 2, or 4. However, π_{A_{n}} = π_{A}^{n} ∈ End^{0}(A), so this contradicts the result of Claim 3.3. Hence, we conclude that Case 3 cannot occur either.

Since Cases 1, 2 and 3 cannot occur, we conclude that the only possibility is A_{n} = A ⊗_{𝔽_{q}} 𝔽_{q^{n}} ∼ E^{2} where E/𝔽_{q^{n}} is ordinary. Note that this implies that A is ordinary.

(b) Since A is ordinary by part (a), it follows from Lemma 5 that h_{A}(X) is irreducible and that K := End^{0}(A) ≃ ℚ[X]/(h_{A}(X)) is a CM-field of degree 4. Thus, K contains the real quadratic subfield K_{0} = ℚ(\sqrt{Δ_{A}}); cf. Corollary 7.

Put A_{n} := A ⊗_{𝔽_{q}} 𝔽_{q^{n}}. Since π_{A_{n}} = π_{A}^{n} and A_{n} ∼ E^{2} by part (a), it follows that

(7)  h_{A_{n}}(X) = (X − α_{1}^{n}) (X − α_{2}^{n}) (X − \frac{q^{n}}{α_{1}^{n}} ) (X − \frac{q^{n}}{α_{2}^{n}} ) = h_{E}(X)^{2},

where h_{E}(X) is the characteristic polynomial of E/𝔽_{q^{n}}. Thus, α_{1}^{n} is a root of h_{E}(X), and so K_{E} := ℚ(α_{1}^{n}) is an imaginary quadratic field because K_{E} is the splitting field of h_{E}(X) where E is ordinary. But K_{E} ⊂ ℚ(α_{1}) ≃ K, so K has two distinct quadratic subfields. Since [K : ℚ] = 4, we see that K = K_{0}K_{E}, and so K/ℚ is a biquadratic field, as claimed.

(c) From (7) and the fact that α_{i}^{n} ≠ \frac{q^{n}}{α_{i}} for i = 1, 2 (cf. Corollary 4), we see that either α_{1}^{n} = α_{2}^{n} or that α_{1}^{n} = \frac{q^{n}}{α_{2}^{n}}. Thus, after renaming \frac{q}{α_{2}} as α_{2} if necessary, we may assume that α_{1}^{n} = α_{2}^{n}. Thus, α_{1} = ζ_{n}α_{2}, for some nth root of unity.

Now if n ∈ ℕ is the minimal value such that A_{n} splits, then ζ_{n} is a primitive nth root. To see this, suppose that ζ_{n}^{d} = 1 for some d|n and d ≠ n. Then α_{1}^{d} = α_{2}^{d}, so by the first equation of (7) (with n replaced by d) we see that h_{A_{d}} has repeated roots, and so A_{d} cannot be simple by Lemma 5. This contradicts the minimality of n, and so ζ_{n} is a primtive nth root.

By part (b) we know that K/ℚ is abelian. If η ∈ Gal(K/ℚ) denotes the automorphism induced by complex conjugation, then its fixed field is K^{η} = K_{0}. Let σ ∈ Gal(K/ℚ) be the unique automorphism such that σ(α_{1}) = α_{2}. Then σ(α_{1}^{n}) = α_{2}^{n} = α_{1}^{n}, so K_{E} = K^{σ}, and hence the third quadratic subfield is K^{ση}. Now ζ_{n} = \frac{α_{1}}{α_{2}} ∈ K^{ση} because η(\frac{α_{1}}{α_{2}} ) = \frac{q/α_{1}}{q/α_{2}} = \frac{α_{2}}{α_{1}} = σ(\frac{α_{1}}{α_{2}} ). Thus ϕ(n) = [ℚ(ζ_{n}) : ℚ] ≤ [K^{ση} : ℚ] = 2, and this implies that n = 2, 3, 4 or 6, as claimed.

Remark 9. If A/𝔽_{q} is as in Theorem 3, then by part (b) we know that the quartic field K = ℚ[X]/(h_{A}(X)) has three quadratic subfields. As was mentioned in the above proof, one is the real quadratic field K_{0} = K^{η}, where η ∈ Gal(K/ℚ) denotes complex conjugation, and the other is the imaginary quadratic subfield K_{E} = End^{0}(E) = ℚ(\sqrt{tr_{E}^{2} −4q^{n}}), the splitting field of h_{E}(X). In terms of the roots α_{1}, α_{2} of h_{A}(X) (which were chosen such that α_{1} = ζ_{n}α_{2}, for some primitive nth root of unity ζ_{n} ∈ ℂ), we have

(8) K_{E} = ℚ(α_{1}^{n}) = K^{σ} and K_{0} = ℚ (α_{1} + \frac{q}{α_{1}} ) = ℚ (α_{2} + \frac{q}{α_{2}} ) = ℚ(\sqrt{Δ_{A}}) = K^{η},

where σ ∈ Gal(K/ℚ) satisfies σ(α_{1}) = α_{2} and Δ_{A} is as in Corollary 7. Moreover, from the proof of Theorem 3(c) we see that if n ≠ 2, then the third subfield of K is

K^{ση} = ℚ(ζ_{n}), provided that n ≠ 2.

From this we see that if n = 3 or n = 6, then we must have that K_{E} ≠ ℚ(ζ_{3}), or equivalently, that E is not isogenous to any curve E_{0} with j(E_{0}) = 0. Similarly, if n = 4, then we must have that K_{E} ≠ ℚ(i), or equivalently, that E is not isogenous to any curve E′_{0} with j(E′_{0}) = 1728.

We now investigate the structure of the characteristic polynomials h_{A}(X) of a simple, geometrically split abelian surface A/𝔽_{q} in more detail. For this we shall make use of the following result which will also be needed in the next section.

Proposition 10. If h(X) is a quartic polynomial of the form

(9)  h(X) = X^{4} − tX^{3} + sX^{2} − tqX + q^{2}

where s, t, q ∈ ℤ and q ≠ 0, then there are α_{1}, α_{2} ∈ ℂ such that

(10)  h(X) = (X − α_{1})(X − α_{2}) (X − \frac{q}{α_{1}} ) (X − \frac{q}{α_{2}} ) .

Furthermore, let n ≥ 1 and put

(11)  h_{(n)}(X) := (X − α_{1}^{n})(X − α_{2}^{n}) (X − \frac{q^{n}}{α_{1}^{n}} ) (X − \frac{q^{n}}{α_{2}^{n}} ) .

Then we have

(12)  h_{(n)}(X) = X^{4} − t_{n}X^{3} + s_{n}X^{2} − t_{n}q^{n}X + q^{2n}

where t_{n} = α_{1}^{n} + α_{2}^{n} + \frac{q^{n}}{α_{1}^{n}} + \frac{q^{n}}{α_{2}^{n}} and s_{n} = \frac{1}{2}(t_{n}^{2} − t_{2n}) are integers. Thus, if we put

(13)  r_{n} := t^{2} − n(s − (n − 2)q) and Δ_{n} := t_{n}^{2} − 4s_{n} + 8q^{n},

then we have

(14)  \begin{aligned}t_{2} & = & r_{2} & = & t^{2} − 2s, & s_{2} & = & s^{2} − 2t^{2}q + 2q^{2} \\ t_{3} & = & r_{3}t & = & t^{3} − 3st + 3tq, & s_{3} & = & s^{3} − 3q^{2}s − 3qt^{2}s + 6q^{2}t^{2}, \end{aligned}

and hence

(15) Δ_{2} = t^{2}Δ_{1} = r_{0}Δ_{1}, Δ_{3} = r_{1}^{2}Δ_{1}, Δ_{4} = r_{0}r_{2}^{2}Δ_{1}, and Δ_{6} = r_{0}r_{1}^{2}r_{3}^{2}Δ_{1}.

Remark 11. If A/𝔽_{q} is an abelian surface, then by Remark 6 we know that its characteristic polynomial h_{A}(X) has the form (9), and so it follows as in the proof of Theorem 3(a) that the characteristic polynomial of A_{n} := A ⊗ 𝔽_{q^{n}} is

(16)  h_{A_{n}}(X) = (h_{A})_{(n)}(X) and that hence Δ_{A_{n}} = Δ_{n}.

Thus, the above proposition describes in particular how the coefficients of h_{A_{n}}(X) are related to those of h_{A}(X) and hence contains Lemma 2.13 of [7] (which is stated there without proof). Note that this more general version of Proposition 10 is needed in the the proof of Proposition 15.

Proof of Proposition 10. We first note that h(X) satisfies the functional equation

(17)  X^{4}h (\frac{q}{X} ) = q^{2}h(X)

because X^{4}h (\frac{q}{X} ) = q^{4}−tq^{3}X +sq^{2}X^{2}−tq(qX^{3})+q^{2}X^{4} = q^{2}h(X). Thus, if a is a root of h(X), then so is \frac{q}{a}. (Note that a ≠ 0 because q ≠ 0.) To verify that (10) holds, let α_{1} be a root of h(X). Suppose first that α_{1} ≠ \frac{q}{α_{1}} . Then g_{1}(X) := (X −α_{1})(X − \frac{q}{α_{1}} )|h(X), so h(X) = g_{1}(X)g_{2}(X). Since X^{2}g_{1}(\frac{q}{X}) = qg_{1}(X), it follows from (17) that g_{2}(X) has the same property, and so g_{2}(X) = (x − α_{2})(X − \frac{q}{α_{2}} ), where a_{2} is a root of g_{2}(X). Thus (10) holds in this case.

We are left with the case that α_{i} = \frac{q}{α_{i}} for all roots α_{i} of h(X). Thus α_{i}^{2} = q, so we have at most two distinct roots. If all roots are the same, then clearly (10) holds with α_{1} = α_{2}, so assume that α_{1} ≠ α_{2}. Then α_{2} = −α_{1}, so h(X) = (x − α_{1})^{m_{1}}(X + α_{1})^{m_{2}}, which has constant term (−1)^{m_{1}}α_{1}^{4} = (−1)^{m_{1}}q^{2}. Since h(0) = q^{2}, we see that m_{1} is even and hence m_{1} = m_{2} = 2, and so h(X) = (x − α_{1})^{2}(x + α_{1})^{2}. Thus (10) holds in this case as well.

To show that equation (12) holds, write α_{3} := \frac{q}{α_{1}} and α_{4} := \frac{q}{α_{2}} , and put

t_{n} := α_{1}^{n} + α_{2}^{n} + α_{3}^{n} + α_{4}^{n}
s′_{n} := α_{1}^{n}α_{2}^{n} + α_{1}^{n}α_{3}^{n} + α_{1}^{n}α_{4}^{n} + α_{2}^{n}α_{3}^{n} + α_{2}^{n}α_{4}^{n} + α_{3}^{n}α_{4}^{n}
t′_{n} := α_{1}^{n}α_{2}^{n}α_{3}^{n} + α_{1}^{n}α_{2}^{n}α_{4}^{n} + α_{1}^{n}α_{3}^{n}α_{4}^{n} + α_{2}^{n}α_{3}^{n}α_{4}^{n}.

Expanding the right hand side of (11), we see that the coefficients of X^{3}, X^{2}, and X are −t_{n}, s′_{n} and −t′_{n}, respectively. Since t_{n}^{2}−t_{2n} = (α_{1}^{n}+…+α_{4}^{n})^{2}−(α_{1}^{2n}+…+α_{4}^{2n}) = 2(α_{1}^{n}α_{2}^{n}+α_{1}^{n}α_{3}^{n}+α_{1}^{n}α_{4}^{n}+α_{2}^{n}α_{3}^{n}+α_{2}^{n}α_{4}^{n}+α_{3}^{n}α_{4}^{n}) = 2s′_{n}, we have that s_{n} = s′_{n}. Moreover, since α_{1}α_{3} = α_{2}α_{4} = q, we see that t′_{n} = q^{n}α_{2}^{n} + α_{1}^{n}q^{n} + q^{n}α_{4}^{n} + q^{n}α_{3}^{n} = q^{n}t_{n}, and so (12) holds because h_{(n)}(X) is clearly monic with constant term q^{2n}.

Note that Newton’s recursive formulae (cf. [2], page 161) show that t_{n} and s_{n} can be expressed in terms of polynomials in s, t, and q^{2}, for we have

(18)  t_{n} = −nc_{n} − (c_{1}t_{n−1} + … + c_{n−1}t_{1}),

where c_{1} := −t, c_{2} := s, c_{3} := −tq, c_{4} = q^{2} and c_{n} = 0 if n > 4. Hence, since s, t, q^{2} ∈ ℤ, it follows that t_{n} ∈ ℤ for n ≥ 1 and that s_{n} ∈ ℚ. Since s_{n} = s′_{n} ∈ ℚ is also an algebraic integer (because the α_{i}’s are algebraic integers), we see that s_{n} ∈ ℤ.

From (18) we have that t_{2} = −2c_{2} − c_{1}t_{1} = t^{2} − 2s = r_{2}, and similarly one obtains that

(19)  \begin{aligned}t_{3} & = & t^{3} + 3tq − 3st = t(t^{2} − 3(s + q)) = tr_{3} \\ t_{4} & = & −4q^{2} + s^{4} + 4s^{2}q − 4ts^{2} + 2t^{2} \\ t_{5} & = & −5sq^{2} + s^{5} + 5s^{3}q − 5s^{3}q − 5ts^{3} + 5st^{2} − 5stq \\ t_{6} & = & −3s^{2}q^{2} + s^{6} + 6s^{4}q − 6ts^{4} + 9t^{2}s^{2} + 6tq^{2} − 2t^{3} − 12s^{2}tq. \end{aligned}

From these it follows that s_{2} = \frac{1}{2}(t_{2}^{2} −t_{4}) = \frac{1}{2}((t^{2} −2s)^{2} +4q^{2} −t^{4} −4t^{2}q+4st^{2} −2s^{2}) = s^{2} − 2t^{2}q + 2q^{2}, and similarly s_{3} = \frac{1}{2}(t_{3}^{2} − t_{6}) = s^{3} − 3q^{2}s − 3qt^{2}s + 6q^{2}t^{2}, as claimed.

Substituting the above expressions for t_{2} and s_{2} in Δ_{2} yields Δ_{2} = (t^{2} − 2s)^{2} − 4(s^{2} − 2t^{2}q + 2q^{2}) + 8q^{2} = t^{2}(t^{2} − 4s + 8q) = t^{2}Δ_{1} = r_{0}Δ_{1}, and similarly Δ_{3} = r_{1}^{2}Δ_{1}. Now since h_{(4)}(X) = (h_{(2)})_{(2)}(X), it follows from what was just proved that Δ_{4} = t_{2}^{2}Δ_{2} = r_{2}^{2}Δ_{2} = r_{2}^{2}r_{0}Δ_{1}. Similarly, since h_{(6)}(X) = (h_{(3)})_{(2)}(X), we have Δ_{6} = t_{3}^{2}Δ_{3} = t^{2}r_{3}^{2}Δ_{3} = r_{0}r_{3}^{2}r_{1}^{2}Δ_{1}, which proves (15).

The following result characterizes the simple, geometrically split abelian surfaces A/𝔽_{q} in terms of relations satisfied by the coefficients tr_{A} and s_{A} of the characteristic polynomial h_{A}(X). Except for its compact formulation, this result is originally due to Howe and Zhu[6].

Theorem 12. Let 𝔸/𝔽_{q} be a simple ordinary abelian surface. Then A is not absolutely simple if and only if there exists an integer c ∈ ℤ such that

(20)  tr_{A}^{2} = c(s_{A} + cq − 2q) and 0 ≤ c ≤ 3.

Proof. Suppose first that (20) holds, i.e. that r_{c} = 0 in the notation (13) (with t = tr_{A} and s = s_{A}) for some c ∈ {0, 1, 2, 3}. Then by (15) and (16) we have that Δ_{A_{n}} = Δ_{n} = 0 for some n ∈ {2, 3, 4, 6}, and hence A_{n} is split by Corollary 7.

Conversely, suppose that A_{n} is split, and assume that n is minimal with this property. Then by Theorem 3 we have that n ∈ {2, 3, 4, 6} and that A_{n} ∼ E^{2}, for some elliptic curve E/𝔽_{q^{n}}. By (5) we thus have that Δ_{A_{n}} = 0, and so from (15) we see that r_{c} = 0 for some c ∈ ℤ with 0 ≤ c ≤ 3, and so (20) holds.

By combining Theorem 3 with Theorem 12 we obtain the following result.

Corollary 13. Let A/𝔽_{q} be a simple abelian surface. Then A is absolutely simple if and only if A is either non-ordinary and non-supersingular or A is ordinary and relation (20) does not hold for A.

Proof. Suppose first that A is absolutely simple. Then A cannot be supersingular (because then A ⊗ \overline{𝔽}_{q} ∼ \overline{E}^{2}, where \overline{E} is supersingular), so either A is non-ordinary and non-supersingular or A is ordinary and condition (20) does not hold by Theorem 12. Conversely, if A non-ordinary and non-supersingular, then A is absolutely simple by Theorem 3(a), and if A is ordinary and (20) does not hold, then A is absolutely simple by Theorem 12.

Proof of Theorem 1. The first assertion is contained in Corollary 13. By Theorem 3 we know that if A_{n} is (minimally) split, then A_{n} ∼ E_{n}^{2} for n ∈ {2, 3, 4, 6} and some elliptic curve E_{n}/𝔽_{q^{n}}, and by the proof of Theorem 12 we know that n is related to c as stated in Theorem 1.

For later reference, we note that we have also proved the following result.

Corollary 14. In the situation of Theorem 1, the isogeny class of E = E^{(n)}/𝔽_{q^{n}} is determined by the formula

(21)  − tr_{E^{(n)}} = \{ \begin{matrix}s_{A}, & if n = 2 \\ tr_{A}^{3} −3q tr_{A}, & if n = 3 \\ (\frac{tr_{A}^{2}}{2} − 2q)^{2} − 2q^{2}, & if n = 4 \\ (\frac{tr_{A}^{2}}{3} − 2q)^{3} − 3q^{2}(\frac{tr_{A}^{2}}{3} − 2q), & if n = 6. \end{matrix}

Proof. From (5) and Remark 11 we know that 2 tr_{E^{(n)}} = tr_{A_{n}} = t_{n}, where t_{n} is as in Proposition 10. If n = 2, then 2 tr_{E^{(2)}} = t_{2} = t^{2} − 2s = −2s by (14) and (20) (with c = 0), so (21) holds for n = 2. Similarly, for n = 3 we obtain by from (14) and (20) (with c = 1) that 2 tr_{E^{(3)}} = t_{3} = t(t^{2} + 3q − 3s) = t(t^{2} + 3q − 3(t^{2} − q)) = t(6q − 2t^{2}), and so (21) holds for n = 3. The cases n = 4 and 6 are proved similarly by using (19) in place of (14).

3 Existence theorems

In the previous section we had classified the simple ordinary abelian surfaces A/𝔽_{q} which are geometrically split in terms of the relation (20) satisfied by h_{A}(X). We now refine this by determining precisely which polynomials h(X) of the form (9) actually belong to an abelian surface of this type. For this, we first prove the following result.

Proposition 15. For n ∈ {2, 3, 4, 6}, define s, t, u_{n} by the following rules. If n = 2, then put

(22)  t = 0, u_{2} = s, where s ∈ ℤ is arbitrary,

and if n = 3, 4 or 6, then let t ∈ ℤ be arbitrary and define s and u_{n} by

(23) s = \frac{t^{2}}{c} + (c − 2)q and u_{n} = Tn^{\frac{n}{k}} − \frac{n}{k}q^{k}T_{n}^{\frac{n}{k} −2}, where T_{n} = \frac{t^{k}}{c} − 2(k − 1)q,

and where c = [\frac{n}{2}] and k = [\frac{n+2}{3}], i.e. s and u_{n} are given by the following table:

(24)  \begin{matrix}n & s & u_{n} \\ 3 & t^{2} − q & t^{3} − 3qt \\ 4 & \frac{t^{2}}{2} & \frac{1}{4}t^{4} − 2qt^{2} + 2q^{2} \\ 6 & \frac{t^{2}}{3} + q & \frac{1}{27}t^{6} − \frac{2}{3}qt^{4} + 3q^{2}t^{2} − 2q^{3}. \end{matrix}

Then there exists an ordinary abelian surface A/𝔽_{q} such that

(25)  tr_{A} = t, s_{A} = s and A ⊗ 𝔽_{q^{n}} ∼ E^{2},

for some elliptic curve E/𝔽_{q^{n}}, if and only if

(26)  s ∈ ℤ, |u_{n}| ≤ 2\sqrt{q^{n}} and gcd(u_{n}, q) = 1.

If this is the case, then tr_{E} = −u_{n} and A is simple if and only if Δ_{A} = t^{2} − 4s + 8q = (4 − c)(4q − \frac{t^{2}}{c}) is not a square in ℤ.

Proof. Let s and t be as in (22) and (23). Define h(X) by (9), and let t_{n} and s_{n} be defined as in Proposition 10. We then claim that we have that

(27) −2u_{n} = t_{n}, u_{n}^{2}+2q^{n} = s_{n}, or, equivalently, that h_{(n)}(X) = (X^{2}+u_{n}X +q^{n})^{2}.

To verify this, suppose first that n = 2. Substituting t = 0 and s = u_{2} into the formulae (14) for t_{2} and s_{2} yields t_{2} = (0)^{2} −2u_{2} = −2u_{2} and s_{2} = u_{2}^{2} −2(0)^{2}q +2q^{2} = u_{2}^{2} + 2q^{2}, and so (27) holds for n = 2. Thus we have shown:

(28)  h(X) = X^{4} + uX^{2} + q^{2} ⇒ h_{(2)}(X) = (X^{2} + uX + q^{2})^{2}.

Similarly, if n = 3, then we substitute t and s = t^{2} − q into the formulae (14) of s_{3}, t_{3} to get t_{3} = t^{3} − 3(t^{2} − q)t + 3tq = −2u_{3} and s_{3} = (t^{2} − q)^{3} − 3q^{2}(t^{2} − q) − 3qt^{2}(t^{2} − q) + 6q^{2}t^{2} = (t^{3} − 3tq)^{2} + 2q^{3} = u_{3}^{2} + 2q^{3}, which verifies (27) for n = 3.

If n = 4, then we substitute t and s = \frac{t^{2}}{2} into the formulae (14) of t_{2} and s_{2} to

obtain t_{2} = t^{2}−2 (\frac{t^{2}}{2} ) = 0 and s_{2} = \frac{t^{4}}{4} −2t^{2}q+2q^{2} = u_{4}, so h_{(2)}(X) = X^{4}+u_{4}X^{2}+q^{4}. Thus, by (28) applied to h_{(2)}(X) in place of h(X) (and q^{2} in place of q), we see that h_{(4)}(X) = (h_{(2)})_{(2)}(X) = (X^{2} + u_{4}X + q^{4})^{2}, and so (27) holds for n = 4.

Finally, if n = 6, then s = \frac{t^{2}}{3} +q and so by the formulae (14) for t_{3} and s_{3} we obtain

t_{3} = t^{3} − 3 (\frac{t^{2}}{3} + q) t + 3tq = 0 and s_{3} = (\frac{t^{2}}{3} + q)^{3} − 3q^{2} (\frac{t^{2}}{3} + q) − 3qt^{2} (\frac{t^{2}}{3} + q) + 6q^{2}t^{2} = \frac{1}{27}t^{6} − \frac{2}{3}t^{4}q + 3q^{2}t^{2} − 2q^{3} = u_{6}. Thus, applying (28) to h_{(3)}(X) (in place of h(X)), we obtain that h_{(6)}(X) = (h_{(3)})_{(2)}(X) = (X^{2} + u_{6} + q^{6})^{2}, and so (27) holds for n = 6. This proves (27) in all cases.

We next prove the equivalence of conditions (25) and (26). Suppose first that A/𝔽_{q} and E/𝔽_{q^{n}} satisfying (25) exist. Since h(X) = h_{A}(X) ∈ ℤ[X], it follows that t ∈ ℤ. Moreover, since A_{n} ∼ E^{2}, we know by Remark 11 that h_{(n)}(X) = h_{A_{n}}(X) = h_{E}(X)^{2}. Comparing this to (27), we see that h_{E}(X) = X^{2} + u_{n}X + q^{n} and so tr_{E} = −u_{n}. Thus, by Hasse’s bound we have |u_{n}| ≤ 2\sqrt{q^{n}}. Moreover, since A and hence E are ordinary, we have that (u_{n}, q^{n}) = 1. Thus (26) holds.

Conversely, suppose that (26) holds. Then u_{n}^{2} − 4q^{n} < 0, so the roots of f(X) := X^{2}+u_{n}X+q^{n} are complex conjugates of each other and hence both have absolute value q^{n/2}. From this it follows that h(X) is a q-Weil polynomial, i.e. that h(X) ∈ ℤ[X] and that |α_{i}| = \sqrt{q} for all roots α_{i} of h(X). Indeed, since s, t ∈ ℤ, we see that h(X) ∈ ℤ[X]. Moreover, if α_{i} ∈ ℂ is a root of h(X), then by definition and (27) we know that α_{i}^{n} is a root of h_{(n)}(X) = f(X)^{2}, and hence it is also a root of f(X). Thus, |α_{i}^{n}| = q^{n/2} and so |α_{i}| = \sqrt{q}. Thus, h(X) is a q-Weil polynomial.

Moreover, h(X) is also an ordinary q-Weil polynomial in the sense of [5], i.e. (s, q) = 1. Indeed, for n = 2 this is clear from (26) because s = u_{2}. For n ≠ 2 we see that the formulae for u_{n} imply that (t, q) = 1 and hence also that (s, q) = 1. Thus, h(X) is an ordinary q-Weil polynomial, and so by the Honda-Tate theorem (Theorem 3.3. of [5]), there exists an ordinary abelian surface A/𝔽_{q} such that h_{A}(X) = h(X).

Moreover, it follows from (27) that A_{n} = A⊗𝔽_{q^{n}} splits because by Remark 11 we have that h_{A_{n}}(X) = (h_{A})_{(n)}(X) = h_{(n)}(X) = f(X)^{2} is not irreducible. Thus A_{n} ∼ E^{2}, where h_{E}(X) = f(X).

This proves the equivalence of conditions (25) and (26) and the fact that tr_{E} = −u_{n}. The last assertion follows directly from Corollary 7.

We will now use the above proposition to prove the Existence Theorem (Theorem 2) stated in the introduction. For this, we first observe the following simple fact.

Lemma 16. Let a, b ∈ ℝ with b ≥ 0. Then we have

(29)  (a^{2} − 2b)^{2} ≤ 4b^{2} ⇔ a^{2} ≤ 4b ⇔ (a^{3} − 3ab)^{2} ≤ 4b^{3}.

Proof. Since (a^{2} − 2b)^{2} − 4b^{2} = a^{2}(a^{2} − 4b), the first assertion is clear if a ≠ 0. But if a = 0, then the first two inequalities are trivially true, so the first assertion holds.

Similarly, since (a^{3} − 3ab)^{2} − 4b^{3} = (a^{2} − 4b)(a^{2} − b)^{2}, the second equivalence is clear if a^{2} ≠ b. But if a^{2} = b, then the last two inequalities hold, and so (29) follows.

Corollary 17. In the situation of Proposition 15 suppose that n ≠ 2. Then

(30)  |u_{n}| ≤ 2\sqrt{q^{n}} ⇔ T_{n}^{2} ≤ 4q^{k} ⇔ t^{2} ≤ 4cq.

Proof. If n = 3, then c = 1, k = 1 and u_{3} = T_{3}^{3} −3qT_{3}, so (30) follows from the second equivalence of (29) by taking a = T_{3} = t and b = q.

If n = 4, then u_{4} = T_{4}^{2} − 2q^{2}, so the first equivalence of (30) follows from the first equivalence of (29) by taking a = T_{4} and b = q^{2} = q^{k}. Moreover, since T_{4} = \frac{t^{2}}{2} − 2q, we see that T_{4}^{2} ≤ 4q^{2} ⇔ \frac{t^{4}}{4} − 2qt^{2} ≤ 0 ⇔ t^{2} ≤ 8q = 4cq, and so (30) holds for n = 4.

Finally, if n = 6, then u_{6} = T_{6}^{2} − 3q^{2}T_{6}, so the first equivalence of (30) follows from the second equivalence of (29) by taking a = T_{6} and b = q^{2} = q^{k}. Moreover, since T_{6} = \frac{t^{2}}{3} − 2q, we see that T^{6} ≤ 4q^{2} ⇔ \frac{t^{4}}{9} − \frac{4}{3}qt^{2} ≤ 0 ⇔ t^{2} ≤ 12q = 4cq, which proves (30).

Proof of Theorem 2. (a) If A/𝔽_{q} is simple and ordinary but A ⊗ 𝔽_{q^{2}} splits, then tr_{A} = 0 by Theorem 1, and so it follows from Proposition 15 that |s_{A}| = |u_{2}| ≤ 2q and that Δ_{A} = 8q − 4s_{A} is not square, and hence (2) holds. Conversely, if (2) holds, then it follows from Proposition 15 that there is a simple, ordinary abelian surface A/𝔽_{q} with s_{A} = s such that A ⊗ 𝔽_{q^{2}} splits.

(b) We first observe that condition (3) is equivalent to condition (26) together with the condition that Δ = t^{2} − 4s + 8q ∉ ℤ^{2} (when s = \frac{t^{2}}{c} + (c − 2)q). Indeed, by (30) we know that t^{2} ≤ 4cq ⇔ |u_{n}| ≤ 2\sqrt{q^{n}}, and clearly s ∈ ℤ ⇔ c|t^{2} ⇔ c|t (because c = 1, 2 or 3). Moreover, under the hypothesis that c|t, it is clear from (24) that (u_{n}, q) = 1 ⇔ (t, q) = 1. Finally, we show that Δ ∈ ℤ^{2} ⇔ ∃x ∈ ℤ : 4cq − t^{2} = εx^{2} by distinguishing cases: (i) if n = 3, then Δ = 12q − 3t^{2}, so Δ ∈ ℤ^{2} ⇔ ∃x ∈ ℤ with 12q − 3t^{2} = (3x)^{2} ⇔ 4q − t^{2} = 3x^{2} = εx^{2}; (ii) if n = 4, then Δ = 8q − t^{2}, so Δ ∈ ℤ^{2} ⇔ ∃x ∈ ℤ with 8q − t^{2} = x^{2} = εx^{2}; (iii) if n = 6, then Δ = 4q − \frac{t^{2}}{3} (and 3|t), so Δ ∈ ℤ^{2} ⇔ ∃x ∈ ℤ with 12q − t^{2} = 3x^{2} = εx^{2}.

From this observation we see that if (3) holds, then it follows from Proposition 15 that there is a simple, ordinary abelian surface A/𝔽_{q} with tr_{A} = t such that A ⊗ 𝔽_{q^{n}} splits (and A ⊗ 𝔽_{q^{m}} is simple, for all m|n, m ≠ n). Conversely, suppose that there is an abelian surface A/𝔽_{q} with these properties. Then by Theorem 1 we know that (1) holds with c = n − 2 for n = 3, 4 and c = 3 for n = 6 or, equivalently, for c = [\frac{n}{2}], for n = 3, 4 or 6. Thus s_{A} = \frac{tr_{A}^{2}}{c} + (c − 2)q, and so it follows that condition (24) holds. By Proposition 15 this means that (25) holds and that Δ_{A} ∉ ℤ^{2}, and by the above observation we obtain that (3) holds, as claimed.

(c) If A/𝔽_{q} is such an abelian surface, then by Theorem 1 there is an integer c with 0 ≤ c ≤ 3 such that (1) holds. Thus A ⊗ 𝔽_{q^{n}} splits minimally for n = c + 2, if c < 3 and for n = 6, if c = 3. If c = 0, then we are in the situation of part (a), and if c > 0, then c = [\frac{n}{2}] and so we are in the situation of part (b).

We can use Theorem 2 to prove the following existence result.

Proposition 18. Let n ∈ {2, 3, 4, 6} and suppose that n ≠ 4 if q = 2^{r} and that n ≠ 6 if q = 3^{r} or q = 7. Then there exists a simple ordinary abelian surface A/𝔽_{q} such that A ⊗ 𝔽_{q^{n}} is minimally split, i.e. A ⊗ 𝔽_{q^{n}} is split, but A ⊗ 𝔽_{q^{m}} is simple, for all m|n, m ≠ n.

Proof. Here we shall use repeatedly the following obvious fact:

(31)  x_{1} > x_{2} > 0, x_{i} ∈ ℤ ⇒ x_{1}^{2} − x_{2}^{2} ≥ 2x_{2} + 1 ≥ 3.

From this we see that at least one of s = ±1 satisfies (2), for if 2q + 1 = x_{1}^{2} and 2q − 1 = x_{2}^{2} are both square, then 2 = x_{1}^{2} − x_{2}^{2}, which contradicts (31). Thus, by Theorem 2(a), there is a simple, ordinary abelian surface A/𝔽_{q} with s_{A} ∈ {±1} such that A ⊗ 𝔽_{q^{n}} splits, and hence the assertion is true for n = 2.

Now suppose that n > 2. Then by Theorem 2(b) it is enough to find a t ∈ ℤ satisfying condition (3). For this, we distinguish the following cases.

Suppose first that n = 3. If q = 2^{r}, then every odd t with t^{2} ≤ 4q satisfies (3) because 4q − t^{2} ≡ −1 (mod 8), whereas 3x^{2} ≡ 3 (mod 8), if x is odd, so 4q − t^{2} ≠ 3x^{2}, ∀x ∈ ℤ. On the other hand, if q ≠ 2^{r}, then at least one t ∈ {1, 2} satisfies (3), for otherwise there exist x_{1} > x_{2} > 0 such that 4q − 1 = 3x_{1}^{2} and 4q − 4 = 3x_{2}^{2}, and then 3 = 3(x_{1}^{2} − x_{2}^{2}), which contradicts (31).

Next suppose that n = 4, so q is odd by hypothesis. Here at least one t ∈ {2, 4} satisfies (3), for otherwise there exist integers x_{1} > x_{2} > 0 such that 8q − 4 = (2x_{1})^{2} and 8q − 16 = (2x_{2})^{2}, and then 3 = x_{1}^{2} − x_{2}^{2} ≥ 2x_{2} + 1 by (31), so x_{2} = 1 and 8q = 20, contradiction.

Finally, suppose that n = 6, so q ≠ 3^{r}, 7 by hypothesis. If q = 2^{r} or q ≡ 2 (mod 3), then every t = ±3t_{1} with t^{2} ≤ 12q and (t, q) = 1 satisfies (3). Indeed, in the former case (i.e. if q = 2^{r}) we have 12q − t^{2} ≡ −1 (mod 8), whereas 3x^{2} ≡ 3 (mod 8), and in the latter case we have 4q − 3t_{1}^{2} ≡ 2 (mod 3), whereas x^{2} ≡ 1 (mod 3). In particular,

(3) holds for t = ±3 in these cases.

Now assume that q ≡ 1 (mod 3) and that q ≠ 7 is odd. Here at least one t ∈ {3, 6} satisfies (3). If not, then there exist integers x_{1} > x_{2} > 0 such that 12q − 9 = 3x_{1}^{2} and 12q −36 = 3x_{2}^{2}, and then 18 = x_{1}^{2} −x_{2}^{2} ≥ 2x_{2} +1 by (31), so x_{2} ≤ 8 and 4q ≤ 8^{2} +9, or q ≤ 20. Thus q = 13 or q = 19. But then (3) holds for t = 6 and t = 3, respectively, because 4 · 13 − 12 = 40 and 4 · 19 − 3 = 73 are non-squares.

Remark 19. (a) It is clear that the case n = 4 cannot occur if q = 2^{r} because in this case there is no integer t such that 2|t and (t, q) = 1, and so there is no t ∈ ℤ which satisfies condition (3). Similarly, the case n = 6 cannot occur if q = 3^{r}. Finally, if q = 7, then the case n = 6 cannot not occur because (12 · 7 − (3t_{1})^{2})/3 ∈ {7^{2}, 5^{2}, 1^{2}} is a square for t_{1} = ±1, ±2, ±3.

(b) Note that if q is large, then there are only very few exceptional t’s which satisfy the first conditions of (3) but fail the last condition. Indeed, if q = 2^{r}, then then there are no exceptions (as the above proof of Proposition 18 showed), and if q = p^{r} is odd, then the equations 2q = t_{1}^{2} + t_{2}^{2} and 4q = t_{1}^{2} + 3t_{2}^{2} have at most 4(r + 1) and 6(r + 1) integer solutions (t_{1}, t_{2}), respectively, and so there are at most 6(r + 1) such exceptional t’s.

It is useful to observe that condition (3) implies that there exists an elliptic curve E_{0}/𝔽_{q^{k}} such that E_{0} ⊗_{𝔽_{q^{k}}} 𝔽_{q^{n}} ∼ E^{χ}, where E^{χ} denotes the (unique) nontrivial quadratic twist of E = E_{n}. This observation leads to the following “descent result”.

Theorem 20. (a) If E/𝔽_{q^{2}} is an ordinary elliptic curve, then there exists an abelian surface A/𝔽_{q} such that A ⊗_{𝔽_{q}} 𝔽_{q^{2}} ∼ E^{2}. Moreover, A is simple if and only if 2q + tr_{E} is not a square or, equivalently, if E_{1} ⊗ 𝔽_{q^{n}} ≁ E, for any elliptic curve E_{1}/𝔽_{q}.

(b) Let n = 3, 4 or 6 and put c = [\frac{n}{2}] and k = [\frac{n+2}{3}]. If E/𝔽_{q^{n}} is an ordinary elliptic curve, then the following conditions are equivalent:

(i) There is an abelian surface A/𝔽_{q} with A ⊗ 𝔽_{q^{n}} ∼ E^{2} such that A ⊗ 𝔽_{q^{m}} is simple for all m|n, m ≠ n;

(ii) there is an integer t ∈ ℤ such that (4 − c)(4q − \frac{t^{2}}{c}) is not a square in ℤ and

such that − tr_{E} = t0^{\frac{n}{k}} − \frac{n}{k}q^{k}t_{0}^{\frac{n}{k} −2}, where t_{0} = \frac{t^{k}}{c} − 2(k − 1)q.

(iii) there is an elliptic curve E_{0}/𝔽_{q^{k}} with E_{0} ⊗ 𝔽_{q^{n}} ∼ E^{χ} and an integer t ∈ ℤ such that tr_{E_{0}} = \frac{t^{k}}{c} − 2(k − 1)q but (4 − c)(4q − \frac{t^{2}}{c}) is not a square in ℤ.

Proof. (a) Put s = u_{2} = − tr_{E} and t = 0. Then (u_{2}, q) = 1 because E is ordinary and |u_{2}| ≤ 2\sqrt{q^{2}} by Hasse’s bound. Thus (25) holds for n = 2 and so by Proposition 15 there is an abelian surface A/𝔽_{q} with A ⊗ 𝔽_{q^{2}} ∼ E_{2}^{2} for some elliptic curve E_{2}/𝔽_{q^{2}} with tr_{E_{2}} = −u_{2}. Thus tr_{E_{2}} = tr_{E}, and hence E_{2} ∼ E by Tate. By Corollary 7 we have that A is simple if and only if Δ_{A} = t^{2} − 4s + 8q = 4(2q + tr_{E}) is not a square. If this is the case, then E ≁ E_{1} ⊗ 𝔽_{q^{2}}, for otherwise tr_{E} = tr_{E_{1}}^{2} −2q. Conversely, if 2q + tr_{E} = t_{1}^{2} is a square, then t_{1}^{2} ≤ 2q + | tr_{E} | ≤ 4q (by Hasse’s bound) and (t_{1}^{2}, q) = (tr_{E}, q) = 1, so by the Tate-Honda Theorem ([11], Theorem 4.1(1)), there exists an elliptic curve E_{1}/𝔽_{q} such that tr_{E_{1}} = t_{1}, and then tr_{E_{1}⊗𝔽_{q^{2}}} = t_{1}^{2} − 2q = tr_{E}, so E_{1} ⊗ 𝔽_{q^{2}} ∼ E by Tate’s Theorem.

(b) (i) ⇒ (ii): Let A/𝔽_{q} be given, and put t = tr_{A} and s = s_{A}. Then by Theorem 1 we know that s = \frac{t^{2}}{c} + (c − 2)q and by Corollary 14 we have − tr_{E} = t0^{\frac{n}{k}} − \frac{n}{k}q^{k}t_{0}^{\frac{n}{k} −2}, where t_{0} := \frac{t^{k}}{c} − 2(k − 1)q. Moreover, Δ_{A} = t^{2} − 4s + 8q = (4 − c)(4q − \frac{t^{2}}{c}) is not a square by Corollary 7, so (ii) holds.

(ii) ⇒ (iii): By hypothesis, tr_{E} = −u_{n} and t_{0} = T_{n} where u_{n} and T_{n} are as in (23). Thus, since | tr_{E} | ≤ 2\sqrt{q^{n}} by Hasse’s Theorem, we see that t_{0}^{2} = T_{n}^{2} ≤ 4q^{k} by (30). Moreover, (t_{0}, q) = 1, for otherwise (tr_{E}, q) > 1, contradiction. It thus follows from the Tate-Honda Theorem ([11], Theorem 4.1(1)) that there is an elliptic curve E_{0}/𝔽_{q^{k}} such that tr_{E_{0}} = t_{0}. Since tr_{E_{0}⊗𝔽_{q^{n}}} = t0^{\frac{n}{k}} − \frac{n}{k}q^{k}t_{0}^{\frac{n}{k} −2} = − tr_{E} = tr_{E^{χ}}, it follows by Tate that E_{0} ⊗ 𝔽_{q^{n}} ∼ E^{χ}, and so (iii) follows.

(iii) ⇒ (i): Put t_{0} = tr_{E_{0}}, so by hypothesis there is a t ∈ ℤ such that t_{0} =

\frac{t^{k}}{c} − 2(k − 1)q. Moreover, since E_{0} ⊗ 𝔽_{q^{n}} ∼ E^{χ}, we have t0^{\frac{n}{k}} − \frac{n}{k}q^{k}t_{0}^{\frac{n}{k} −2} = tr_{E^{χ}} = − tr_{E},

and so we have tr_{E} = −u_{n}, where u_{n} is as defined in (23). By Hasse’s bound we thus have |u_{n}| = | tr_{E} | ≤ 2\sqrt{q^{n}}, and so (26) holds. Thus, by Proposition 15 there is an abelian surface A/𝔽_{q} and an elliptic curve E_{1}/𝔽_{q^{n}} with A ⊗ 𝔽_{q^{n}} ∼ E_{1}^{2} such that tr_{A} = t, s_{A} = \frac{t^{2}}{c} + (c − 2)q. Moreover, since tr_{E_{1}} = −u_{n} = tr_{E}, we have that E ∼ E_{1} by Tate, and hence A ⊗ 𝔽_{q^{n}} ∼ E^{2}. Furthermore, since Δ_{A} = (4 − c)(4q − \frac{t^{2}}{c}) is not a square by hypothesis, we also know that A is simple. Now since s_{A} = \frac{t^{2}}{c} + (c − 2)q and t = tr_{A}, we see that (1) holds and so it follows from Theorem 1 that A ⊗ 𝔽_{q^{m}} is simple, for all m|n with m ≠ n.

4 Connection with the Weil restriction

In order to further analyze the abelian surfaces whose existence is asserted in Theorem 20, we observe that there is a close connection between A and the Weil restriction Res_{𝔽_{q^{n}}/𝔽_{q}}(E) of E with respect to the field extension 𝔽_{q^{n}}/𝔽_{q}.

Proposition 21. Let A/𝔽_{q} be an abelian surface with A ⊗ 𝔽_{q^{n}} ∼ E^{2}, where E/𝔽_{q^{n}} is an elliptic curve. If A is simple, then A is isogenous to a factor of Res_{𝔽_{q^{n}}/𝔽_{q}}(E). Otherwise, A has a factor E_{1}/𝔽_{q} with E_{1} ⊗ 𝔽_{q^{n}} ∼ E which is isogenous to a factor of Res_{𝔽_{q^{n}}/𝔽_{q}}(E).

Proof. Recall (cf. [1]) that the Weil restriction satisfies the following universal property: for any abelian variety B/𝔽_{q}, there is an isomorphism (of abelian groups)

(32)  Hom(B, Res_{𝔽_{q^{n}}/𝔽_{q}}(E)) →^{∼} Hom(B ⊗ 𝔽_{q^{n}}, E).

Applying this to B = A we see that Hom(A, R) ≃ Hom(A ⊗ 𝔽_{q^{n}}, E), where R := Res_{𝔽_{q^{n}}/𝔽_{q}}(E). Since A⊗𝔽_{q^{n}} ∼ E^{2}, we have Hom(A⊗𝔽_{q^{n}}, E)⊗ℚ ≃ Hom(E^{2}, E)⊗ℚ ≠ 0. Thus Hom(A, R) ≠ 0 and so there exists a non-zero homomorphism h : A → R.

If A is simple, then it follows that Ker(h) is finite, and so h : A → h(A) is an isogeny onto the abelian subvariety h(A) of R, which proves the first assertion.

Now suppose that A is not simple, i.e. A ∼ E_{1} × E_{2}, where E_{i} are two elliptic curves on A. Note that E_{i} ⊗ 𝔽_{q^{n}} ∼ E, for i = 1, 2, because A ⊗ 𝔽_{q^{n}} ∼ E^{2}. Now since Ker(h) ≠ A, there is at least one i = 1, 2, such that E_{i} ⊄ Ker(h). Renumbering if necessary, we may assume that i = 1. Then h_{|E_{1}} : E_{1} → h(E_{1}) is an isogeny, and so the second assertion follows.

Remark 22. Note that if E/𝔽_{q^{n}} is an elliptic curve, then we have

Res_{𝔽_{q^{n}}/𝔽_{q}}(E) ⊗ 𝔽_{q^{n}} ∼ E^{n}.

This follows from the fact that Res_{𝔽_{q^{n}}/𝔽_{q}}(E)⊗𝔽_{q^{n}} ≃ ∏_{σ∈G} E^{σ}, where G = Gal(𝔽_{q^{n}}/𝔽_{q}) and the fact that each Galois conjugate E^{σ} is isogenous to E because E^{σ} and E have the same number of 𝔽_{q^{n}}-rational points.

Corollary 23. Let E/𝔽_{q^{2}} be an elliptic curve and let Res(E) = Res_{𝔽_{q^{2}}/𝔽_{q}}(E) be its Weil restriction. Then the following conditions are equivalent:

(i) Every abelian surface A/𝔽_{q} with A ⊗ 𝔽_{q^{2}} ∼ E^{2} is split;

(ii) there is a split abelian surface A/𝔽_{q} with A ⊗ 𝔽_{q^{2}} ∼ E^{2};

(iii) Res(E) is not simple;

(iv) Res(E) ∼ E_{1} × E_{1}^{χ}, for some elliptic curve E_{1}/𝔽_{q};

(v) E ∼ E_{1} ⊗ 𝔽_{q^{2}}, for some elliptic curve E_{1}/𝔽_{q}.

In particular, there is a simple abelian surface A/𝔽_{q} with A ⊗ 𝔽_{q^{2}} ∼ E^{2} if and only if Res(E) is simple. If this is the case, then every such A is isogenous to Res(E) and h_{A}(X) = h_{E}(X^{2}).

Proof. (i) ⇒ (v): By Remark 22, A = Res(E) is a surface over 𝔽_{q} with A ⊗ 𝔽_{q^{2}} ∼ E^{2}. Since A is split by hypothesis, we have A ∼ E_{1} × E_{2} for some elliptic curves E_{i}/𝔽_{q}, and so E_{i} ⊗ 𝔽_{q^{2}} ∼ E because A ⊗ 𝔽_{q^{2}} ∼ E^{2}.

(v) ⇒ (iv): Since Hom(E_{1}, Res(E)) ≃ Hom(E_{1} ⊗ 𝔽_{q^{2}}, E) ≠ 0, we see that E_{1} is a factor of Res(E), and so Res(E) ∼ E_{1}×E_{2} is split. Note that since Res(E)⊗𝔽_{q^{2}} ∼ E^{2}, it follows that E_{2}⊗𝔽_{q^{2}} ∼ E and so tr_{E_{2}} = ± tr_{E_{1}}. Now since E_{1}^{χ}⊗𝔽_{q^{2}} ∼ E_{1}⊗𝔽_{q^{2}} ∼ E, we see that E_{1}^{χ} is also a factor of Res(E). If tr_{E_{1}} ≠ 0, then E_{1}^{χ} ≁ E_{1}, and so E_{1}^{χ} ∼ E_{2}, and (iv) follows. If tr_{E_{1}} = 0, then tr_{E_{1}^{χ}} = − tr_{E_{1}} = ± tr_{E_{2}} are all 0, so E_{1}^{χ} ∼ E_{1} ∼ E_{2} and hence (iv) holds in this case as well.

(iv) ⇒ (iii): Trivial.

(iii) ⇒ (ii): By Remark 22 we can take A = Res(E).

(ii) ⇒ (i): Let A/𝔽_{q} satisfy condition (ii). If (i) is false, then there is a simple B/𝔽_{q} with B ⊗ 𝔽_{q^{2}} ∼ E^{2}, and then B ∼ Res(E) by Proposition 21 because dim(B) = dim(Res(E)) = 2. Thus Res(E) is simple and so Proposition 21 shows that A ∼ Res(E) because A ⊗ 𝔽_{q^{2}} ∼ E^{2}.

This proves the equivalence of conditions (i) – (v), and so by the equivalence of (i) and (iii) we see that there is a simple A/𝔽_{q} with A ⊗ 𝔽_{q^{2}} ∼ E^{2} if and only if Res(E) is simple. If this is the case, then by Proposition 21 we know that A is isogenous to a factor of Res(E), and so A ∼ Res(E) because dim(A) = dim(Res(E)) = 2. Thus h_{A}(X) = h_{Res(A)}(X) = h_{E}(X^{2}).

Remark 24. If the equivalent conditions (i)–(iv) of Corollary 23 hold, then there are (at most) 3 possibilities for the isogeny class of an abelian surface A/𝔽_{q} with A ⊗ 𝔽_{q^{2}} ∼ E^{2}: either A ∼ Res(E) or A ∼ E_{1}^{2} or A ∼ (E_{1}^{χ})^{2}, where E_{1}/𝔽_{q} is as in (v). Thus

(33)  h_{A}(X) = h_{E}(X^{2}) or h_{A}(X) = h_{E_{1}}(X)^{2} or h_{A}(X) = h_{E_{1}^{χ}}(X)^{2}.

Corollary 25. Let A/𝔽_{q} be an abelian surface such that A ⊗ 𝔽_{q^{n}} ∼ E^{2}, for some elliptic curve E/𝔽_{q^{n}}. If n = 2m is even, then A ⊗ 𝔽_{q^{m}} splits if and only if there is an elliptic curve E_{1}/𝔽_{q^{m}} with E_{1} ⊗ 𝔽_{q^{n}} ∼ E.

Proof. Put A′ = A ⊗ 𝔽_{q^{m}}. Since A′ ⊗ 𝔽_{q^{n}} ∼ E^{2}, the assertion follows from Corollary 23 (applied to A′/𝔽_{q^{m}}).

By using the above proposition, we can analyze the isogeny structure of Res(E). For this, it is useful to introduce the following notation which partially generalizes the notation E^{χ} for elliptic curves which was introduced earlier.

Notation. If A/𝔽_{q} is an abelian variety, then let A^{χ}/𝔽_{q} denote any abelian variety such that h_{A^{χ}}(X) = h_{A}(−X). (Note that A^{χ} exists by Honda-Tate.) Thus, tr_{A^{χ}} = − tr_{A} and so if dim A = 2 then A^{χ} ∼ A if and only if tr_{A} = 0. Moreover, we note that A^{χ} ⊗ 𝔽_{q^{2}} ∼ A ⊗ 𝔽_{q^{2}}, so A^{χ} is isogenous to a quadratic twist of A.

Proposition 26. Let E/𝔽_{q^{n}} be an elliptic curve and suppose there is a simple abelian surface A/𝔽_{q} with A ⊗ 𝔽_{q^{n}} ∼ E^{2}. Then the Weil restriction Res(E) = Res_{𝔽_{q^{n}}/𝔽_{q}}(E) of E has the following structure.

(a) If n = 2, then Res(E) ∼ A ∼ A^{χ}.

(b) If n = 3, then Res(E) ∼ A × E_{0}, where E_{1}/𝔽_{q} is an elliptic curve whose isogeny class is uniquely determined by the condition that E_{1} ⊗ 𝔽_{q^{3}} ∼ E.

(c) If n = 4 and A^{χ} ≁ A, then Res(E) ∼ A × A^{χ}.

(c) If n = 6 and A^{χ} ≁ A, then Res(E) ∼ A × A^{χ} × Res_{𝔽_{q^{2}}/𝔽_{q}}(E_{1}), where E_{1}/𝔽_{q^{2}} is an elliptic curve with E_{1} ⊗ 𝔽_{q^{6}} ∼ E.

Proof.(a) By Corollary 23 we know that A ∼ Res(E). Moreover, since A^{χ} is also simple, and since A^{χ} ⊗ 𝔽_{q^{2}} ∼ A ⊗ 𝔽_{q^{2}} ∼ E^{2}, it also follows that A^{χ} ∼ Res(E).

(b) By Proposition 21 (and Poincaré’s Complete Reducibility Theorem) we know that Res(E) ∼ A×A′, for some abelian variety A′/𝔽_{q}. Since dim A′ = dim(Res(E))− dim A = 1, we see that A′ = E_{1} is an elliptic curve. Thus 0 ≠ Hom(E_{1}, Res(E)) ≃ Hom(E_{1} ⊗ 𝔽_{q^{3}}, E) by (32), and hence E_{1} ⊗ 𝔽_{q^{3}} ∼ E. Note that if E′/𝔽_{q} is any elliptic curve with E′ ⊗ 𝔽_{q^{3}} ∼ E, then by reversing this argument we see that E′ is a factor of Res(E) ∼ E_{1} × A and hence E′ ∼ E_{1} because A is simple.

(c) Since A^{χ} ⊗ 𝔽_{q^{4}} ∼ A ⊗ 𝔽_{q^{4}} ∼ E^{2} it follows from Proposition 21 that Res(E) has two abelian subvarieties B and B′ with B ∼ A and B′ ∼ A^{χ}. Since B ≁ B′ and B is simple, we see that dim(B + B′) = 4. Thus Res(E) = B + B′ ∼ A × A^{χ}.

(d) Put R = Res_{𝔽_{q^{6}}/𝔽_{q^{2}}}(E). Then Res_{𝔽_{q^{2}}/𝔽_{q}}(R) = Res(E), so Hom(A ⊗ 𝔽_{q^{2}}, R) ≃ Hom(A, Res(E)) ≃ Hom(A ⊗ 𝔽_{q^{6}}, E) ≠ 0. Thus R is not simple, and hence R ∼ A′ × E_{1}, for some elliptic curve E_{1}/𝔽_{q^{2}} and some (possibly split) abelian surface A′/𝔽_{q^{2}}. Note that by the same argument as in (b) we have that E_{1} ⊗ 𝔽_{q^{6}} ∼ E.

Thus, Res(E) ∼ A_{0} × R_{0}, where A_{0} := Res_{𝔽_{q^{2}}/𝔽_{q}}(A′) and R_{0} := Res_{𝔽_{q^{2}}/𝔽_{q}}(E_{1}). We claim that Hom(A, R_{0}) = 0. If not, then A ∼ R_{0} because A is simple and then A ⊗ 𝔽_{q^{2}} ∼ R_{0} ⊗ 𝔽_{q^{2}} ∼ E_{1}^{2}, the latter by Remark 22. But then by part (a) we have A ∼ A^{χ}, contradiction. Thus, Hom(A, R_{0}) = 0 and hence A is a factor of A_{0} because A is a (simple) factor of Res(E) by Proposition 21. Similarly, A^{χ} is a factor of A_{0}. Since A and A^{χ} are non-isogenous and simple, it follows that A_{0} ∼ A × A^{χ} and hence Res(E) has the asserted form.

Corollary 27. Let A_{1} and A_{2}/𝔽_{q} be two simple abelian surfaces with A_{i} ⊗ 𝔽_{q^{n}} ∼ E^{2}. If n = 2 or n = 3, then A_{1} ∼ A_{2}. If n = 4 or n = 6 and if A_{i}^{χ} ≁ A_{i} for i = 1, 2, then A_{2} ∼ A_{1} or A_{2} ∼ A_{1}^{χ}.

Proof. If n = 2, then Proposition 26(a) applied to A_{i} gives A_{i} ∼ Res(E) and so A_{1} ∼ A_{2}. For n = 3 we have by Proposition 26(b) that A_{i} × E_{i} ∼ Res(E) for some elliptic curves E_{1}, E_{2} and so A_{1} ∼ A_{2} and E_{1} ∼ E_{2}. For n = 4 we have by Proposition 26(c) that A_{i} × A_{i}^{χ} ∼ Res(E) and so either A_{1} ∼ A_{2} or A_{1} ∼ A_{2}^{χ}. Finally, for n = 6 we obtain from Proposition 26(d) that A_{i} × A_{i}^{χ} × R_{i} ∼ Res(E), where R_{i} = Res_{𝔽_{q^{2}}/𝔽_{q}}(E_{i}) for some elliptic curve E_{i}/𝔽_{q^{2}}. Now by the same argument as in the proof of Proposition 26(d) we see that Hom(A_{2}, R_{1}) = 0, so A_{2} ∼ A_{1} or A_{2} ∼ A_{1}^{χ}.

Note that the above results also apply in the case that E is supersingular. However, if we impose the extra condition that E is ordinary, then we can use the results of the previous section to say more. We begin with the following observation.

Proposition 28. If A/𝔽_{q} is a simple ordinary abelian surface, then A ⊗ 𝔽_{q^{2}} splits if and only if A^{χ} ∼ A.

Proof. As was mentioned above, we have that A^{χ} ∼ A if and only if tr_{A} = 0. By Theorem 1 this is equivalent to the condition that A ⊗ 𝔽_{q^{2}} splits.

We can use the above results to classify the abelian varieties B/𝔽_{q} with B ⊗𝔽_{q^{n}} ∼ E^{2} when E is as in Theorem 20(b).

Proposition 29. Let E/𝔽_{q^{n}} be an ordinary elliptic curve, where n = 3, 4 or 6. If E satisfies the equivalent conditions of Theorem 20(b), then there are [\frac{n+1}{2}] isogeny classes of abelian surfaces B/𝔽_{q} such that B ⊗ 𝔽_{q^{n}} ∼ E^{2}. More precisely, if A/𝔽_{q} and E_{0}/𝔽_{q^{k}} satisfy the conditions (i) and (iii) of Theorem 20(b), respectively, and if t_{0} = tr_{E_{0}} and t are as in Theorem 20(b), and if E_{1} = E_{0}^{χ}, then these isogeny classes are given by the following table:

n B ∼  (tr_{B}, s_{B})  condition
3 A, E_{1}^{2}  (t, t^{2} − q), (−2t, t^{2} + 2q) t_{0}^{3} − 3qt_{0} = − tr_{E}, t = t_{0}
4 A, A^{χ} (±t, \frac{1}{2}t^{2}) t_{0}^{2} − 2q^{2} = − tr_{E}, t^{2} = 4q + 2t_{0}
6 A, A^{χ}, Res(E_{1}) (±t, \frac{t^{2}}{3} + q), (0, t_{0})  t_{0}^{3} − 3q^{2}t_{0} = − tr_{E}, t^{2} = 12q + 6t_{0}

Furthermore, B is simple except in the case that n = 3 and B ∼ E_{1}^{2}.

Proof. Suppose first that n = 3. Since E_{0} ⊗ 𝔽_{q^{3}} ∼ E^{χ}, we know that t = t_{0} = tr_{E_{0}} satisfies t^{3} − 3qt = − tr_{E} and that E_{1} ⊗ 𝔽_{q^{3}} ∼ E. We observe that t is the unique rational root of g_{3}(X) := X^{3} −3qX +tr_{E} because g_{3}(X) = (X −t)(X^{2} +tX +t^{2} −3q) and the discriminant of X^{2} + tX + t^{2} − 3q is t^{2} − 4(t^{2} − 3q) = 3(4q − t^{2}), which is not a square by condition (ii) of Theorem 20. Moreover, by the proof of (iii) ⇒ (i) we know that there is a simple abelian surface A_{0}/𝔽_{q} with tr_{A_{0}} = t and s_{A_{0}} = t^{2} − q such that A_{0} ⊗ 𝔽_{q^{3}} ∼ E^{2}.

Now if B/𝔽_{q} is simple, then B ∼ A_{0} by Corollary 27; in particular, A ∼ A_{0}. If B splits, then B ∼ E′_{1}×E′_{2} for some E′_{i}/𝔽_{q} with E′_{i}⊗𝔽_{q^{3}} ∼ E. Then by Proposition 26(b) we know that E′_{1} ∼ E′_{2} ∼ E_{1}, so B ∼ E_{1}^{2}. Thus h_{B}(X) = h_{E_{1}}(X)^{2} = (X^{2} + tX + q)^{2}, and so tr_{B} = −2t and s_{B} = t^{2} + 2q.

Next, consider the case that n = 4. Since A ⊗ 𝔽_{q^{2}} is simple by condition (i), we have that A^{χ} ≁ A by Proposition 28, and so Res(E) = A × A^{χ} by Proposition 26(c). It thus follows from Proposition 21 that B ∼ A or B ∼ A^{χ}. Moreover, by the proof of (iii) ⇒ (i) of Theorem 20 we know that s_{A} = \frac{t^{2}}{2} , where t = tr_{A} satisfies (\frac{t^{2}}{2} − 2q)^{2} − 2q^{2} = − tr_{E}. Note that this property characterizes t uniquely up to sign, for we have that g_{4}(X) := (X^{2} − 4q)^{2} + 4 tr_{E} = (X^{2} − t^{2})(X^{2} − (8q − t^{2})), and 8q − t^{2} is not a square by condition (ii).

Finally, suppose that n = 6. Since A_{3} := A ⊗ 𝔽_{q^{3}} is simple by condition (i), it follows from Corollary 23 that B_{3} = B ⊗ 𝔽_{q^{3}} is also simple, and hence B is simple as well. Moreover, since A_{2} := A ⊗ 𝔽_{q^{2}} satisfies condition (i) for n = 3 (with q replaced by q^{2}), it follows from what was proved above that t_{0} = tr_{E_{0}} is the unique rational root of g̃_{3}(X) = X^{3} − 3q^{2}X + tr_{E}, and that B_{2} := B ⊗ 𝔽_{q^{2}} is isogenous to A_{2} or to E_{1}^{2}. In the latter case we have by Theorem 1 and Corollary 14 that tr_{B} = 0 and s_{B} = − tr_{E_{1}} = t_{0}. In the former case we have that B ≁ B^{χ} by Proposition 28, and so it follows from Corollary 27 that B ∼ A or B ∼ A^{χ}. By Theorem 1 and Corollary 14 it follows that s_{B} = \frac{tr_{B}^{2}}{3} + q where t_{1} := \frac{tr_{B}^{2}}{3} − 2q satisfies t_{1}^{3} − 3q^{2}t_{1} = − tr_{E}. By the above uniqueness result for t_{0} we have that t_{1} = t_{0}, and so the assertion follows.

We observe that the conditions of Theorem 20(b) can also be expressed in the following way.

Proposition 30. Let E/𝔽_{q^{n}} be an ordinary elliptic curve, where n = 3, 4 or 6. Then the equivalent conditions (i)–(iii) of Theorem 20(b) are equivalent to condition (iv)_{n} which is given by

(iv)_{3} End^{0}(E) ≄ ℚ(\sqrt{−3}) and E ∼ E_{1} ⊗ 𝔽_{q^{3}}, for some elliptic curve E_{1}/𝔽_{q}; (iv)_{4} End^{0}(E) ≄ ℚ(i), E^{χ} ∼ E_{0} ⊗ 𝔽_{q^{4}}, for some elliptic curve E_{0}/𝔽_{q^{2}}, and E^{2} ∼

A ⊗ 𝔽_{q^{4}}, for some abelian surface A/𝔽_{q};

(iv)_{6} End^{0}(E) ≄ ℚ(\sqrt{−3}), E ∼ E_{1} ⊗ 𝔽_{q^{6}}, for some an elliptic curve E_{1}/𝔽_{q^{2}} but E ≁ E′_{1} ⊗ 𝔽_{q^{6}}, for any elliptic curve E′_{1}/𝔽_{q^{3}}, and E^{2} ∼ A ⊗ 𝔽_{q^{4}}, for some abelian surface A/𝔽_{q} with tr_{A} ≠ 0.

Proof. (i) ⇒ (iv)_{n}: By Remark 9 we know that End^{0}(E) ≄ ℚ(ζ_{n}). In view of this, (iv)_{3} is a special case of (iii) and (iv)_{4} follows from (i) and (iii). Finally, the existence of E_{1}/𝔽_{q^{2}} in (iv)_{6} follows from (iii) and the existence of A follows from (i). Note that in the latter case we have tr_{A} ≠ 0 for otherwise A splits over 𝔽_{q^{2}} by Theorem 1. Moreover, since A_{3} := A ⊗ 𝔽_{q^{3}} is simple and A_{3} ⊗ 𝔽_{q^{6}} ∼ E^{2}, it follows from Corollary 23 that E ≁ E′_{1} ⊗ 𝔽_{6}, for any E′_{1}/𝔽_{q^{3}}. Thus (iv)_{6} holds.

(iv)_{3} ⇒ (iii): Put E_{0} = E_{1}^{χ}, so E_{0} ⊗ 𝔽_{q^{3}} ∼ E^{χ} and End^{0}(E_{0}) ≃ End^{0}(E_{1}) = End^{0}(E) because E is ordinary. Put t = tr_{E_{0}}. If 3(4q − t^{2}) = t_{1}^{2} were a square, then End^{0}(E) ≃ End^{0}(E_{0}) = ℚ(\sqrt{t^{2} − 4q}) = ℚ(\sqrt{−3}), contradiction. Thus (iii) holds.

(iv)_{4} ⇒ (i): Put t_{0} = tr_{E_{0}}. Then (as in the proof of (ii) ⇒ (i) of Theorem 20) we have that 2q^{2} − tr_{E} = t_{0}^{2}. Now if A ⊗ 𝔽_{q^{2}} were split, then by Theorem 20(a) (with q replaced by q^{2}) we would have 2q^{2}+tr_{E} = t_{1}^{2}, for some t_{1} ∈ ℤ. Thus 4q^{4}−tr_{E}^{2} = (t_{0}t_{1})^{2}, and so End^{0}(E) = ℚ(\sqrt{tr_{E}^{2} −4q^{4}}) = ℚ(i), contradiction. Thus A ⊗ 𝔽_{q^{2}} is simple, and hence condition (i) holds.

(iv)_{6} ⇒ (i): First note that the third hypothesis of (iv)_{6} implies that A_{3} := A ⊗ 𝔽_{q^{3}} is simple; cf. Corollary 23. In particular, A is simple. Moreover, the first two hypotheses of (iv)_{6} imply that (iv)_{3} holds (with q replaced by q^{2}), and so, by what was shown above, we see that (i) holds for E and n = 3. Thus, by Proposition 29 we know that either A_{2} := A⊗𝔽_{q^{2}} is simple or that A_{2} ∼ E_{1}^{2}. However, in the latter case tr_{A} = 0 by Theorem 1, contradiction. Thus A_{2} is also simple and hence (i) holds.

5 Application to the Legendre/Satoh Jacobians

In his recent paper, Satoh[10] proposed to study genus 2 curves of the form

(34)  C_{u,v} : y^{2} = x^{5} + ux^{3} + vx,

where u, v ∈ 𝔽_{q}; these curves generalize those of [4], where it is assumed that u = 0. (Here, as in [10], we assume that (q, 2) = 1.) Note that C_{u,v} is a genus 2 curve if and only if x^{5} + ux^{3} + vx has five distinct roots over \overline{𝔽}_{q}; this is the case if and only if v ≠ 0 and u^{2} − 4v ≠ 0, which we assume henceforth. Note also that

C_{u′,v′} ≃ C_{u,v}, if u′ = c^{4}u and v′ = c^{8}v, for some c ∈ 𝔽_{q}^{×},

because the substitution x′ = c^{2}x and y′ = c^{5}y transforms C_{u,v} into C_{u′,v′}. It is interesting to observe that if u = −(1 + v), then C_{u,v} has the form

C_{v} := C_{−1−v,v} : y^{2} = x(x^{2} − 1)(x^{2} − v)

which is precisely the family of curves which were studied by Legendre in 1832: these were the first known examples of curves whose Jacobians are split (over the ground field ℂ); cf. Krazer[9], p. 477. Note that the family of curves C_{v} is geometrically the same as the family C_{u,v} because we have

C_{u,v} ⊗ 𝔽_{q^{8}} ≃ C_{c^{8}v}, where c ∈ 𝔽_{q^{8}} satisfies c^{8}v + c^{4}u + 1 = 0.

We thus refer to the curves C_{u,v} as Legendre/Satoh curves.

Fix σ ∈ 𝔽_{q^{4}}^{×} such that σ^{4} = v, and (as in [10]) let

x^{4} + ux^{2} + v = (x^{2} − α^{2})(x^{2} − β^{2})

be the factorization of x^{4} + ux^{2} + v in 𝔽_{q^{4}}, so α^{2} + β^{2} = −u and (αβ)^{2} = v. Thus σ^{2} = ±αβ, and so by replacing β by −β if necessary, we can assume that σ^{2} = αβ. Put

(35)  γ = 2\frac{u − 6σ^{2}}{u + 2σ^{2}} ∈ 𝔽_{q^{2}} and χ = −\frac{(α − β)^{2}}{64σ^{3}} = \frac{u + 2σ^{2}}{64σ^{3}} ∈ 𝔽_{q^{4}},

and consider the elliptic curves

E_{u,v}/𝔽_{q^{2}} : y^{2} = (x − 1)(x^{2} − γx + 1) and E_{χ}/𝔽_{q^{4}} : y^{2} = χ(x − 1)(x^{2} − γx + 1).

Note that these are indeed elliptic curves because γ ≠ ±2 (for otherwise v = 0 or u = 2σ^{2}, so u^{2} = 4v). In addition, we note that E_{χ} is a quadratic twist of E_{u,v} ⊗ 𝔽_{q^{4}} because if we let c ∈ 𝔽_{q^{8}} be such that c^{2} = χ, then the map (x, y) ↦ (x, cy) defines an isomorphism between E_{χ} ⊗ 𝔽_{q^{8}} and E_{u,v} ⊗ 𝔽_{q^{8}}. We also remark that a somewhat tedious computation shows that the j-invariant of E_{u,v} (and hence also of E_{χ}) is

(36)  j(E_{u,v}) = j(E_{χ}) = 256\frac{(γ + 1)^{3}}{γ + 2} ,

but we don’t need this fact.

Let J_{u,v} = J_{C_{u,v}} denote the Jacobian of C_{u,v}/𝔽_{q}. By combining the above results with those of Satoh[10], we obtain the following result.

Theorem 31. (a) The Jacobian J_{u,v} of C_{u,v} splits over a degree 4 extension of 𝔽_{q}; more precisely, we have

J_{u,v} ⊗ 𝔽_{q^{4}} ∼ E_{χ}^{2}.

(b) If q ≡ 3 (mod 4) or if v is a square in 𝔽_{q}^{×} or if End^{0}(E_{u,v} ⊗ \overline{𝔽}_{q}) ≃ ℚ(i), then J_{u,v} splits over 𝔽_{q^{2}}. Moreover, the converse holds if E_{u,v} is ordinary.

(c) Suppose that q ≡ 1 (mod 4) and that v is not a square in 𝔽_{q}^{×}, and that E := E_{u,v} is ordinary. Then J_{u,v} ⊗ 𝔽_{q^{2}} is simple if and only if precisely one of 4q ± 2 tr_{E} is a square in ℤ. If this is the case and if t ∈ ℤ and ε = ±1 are such that 4q +2ε tr_{E} = t^{2}, then

h_{J_{u,v}}(X) = X^{4} ± tX^{3} + \frac{t^{2}}{2} X^{2} ± tqX + q^{2}.

Proof. (a) This is proven in Satoh[10], p. 541. More precisely, Satoh shows that the rules

(37) φ_{1}(x, y) = ((\frac{x + σ}{x − σ} )^{2} , \frac{y}{(x − σ)^{3}} ) , φ_{2}(x, y) = ((\frac{x − σ}{x + σ} )^{2} , \frac{y}{(x + σ)^{3}} )

define morphisms φ_{i} : C_{u,v} ⊗ 𝔽_{q^{4}} → E_{i}, where E_{1} = E_{χ} and E_{2} = E_{−χ} is the quadratic twist of E_{χ} by (−1). In addition, he shows that the induced homomorphism φ_{1}^{∗} + φ_{2}^{∗} : E_{1} × E_{2} → J_{u,v} ⊗ 𝔽_{q^{4}} is an isogeny.

(b) We first observe that

(38)  χ ∈ (𝔽_{q^{4}}^{×})^{2} ⇔ σ ∈ (𝔽_{q^{4}}^{×})^{2} ⇔ q ≡ 3 (mod 4) or v ∈ (𝔽_{q}^{×})^{2}.

Indeed, the first equivalence is clear from the definition (35) of χ because −1 ∈ (𝔽_{q^{4}}^{×})^{2}. To prove the second, note that σ is a square in 𝔽_{q^{4}} if and only if its norm N(σ) = N_{𝔽_{q^{4}}/𝔽_{q}}(σ) = σ^{1+q+q^{2}+q^{3}} is a square in 𝔽_{q}^{×}. Since 1 + q + q^{2} + q^{3} ≡ 1 + q + 1 + q ≡ 2 + 2q (mod 8), we can write 1 + q + q^{2} + q^{3} = 4k with k ∈ ℕ and so N(σ) = v^{k}. Furthermore, k is even if and only if q ≡ 3 (mod 4) and so N(σ) is always a square in this case. If q ≡ 1 (mod 4), then k is odd, and so in this case N(σ) ∈ (F_{q}^{×})^{2} if and only if v ∈ (𝔽_{q}^{×})^{2}. This proves (38).

We thus see that the first two hypotheses of (b) imply that χ ∈ (𝔽_{q^{4}}^{×})^{2}, and so E_{χ} ≃ E_{u,v} ⊗ 𝔽_{q^{4}}. Thus, by part (a) we see that E_{0} = E_{u,v} satisfies the hypothesis of Corollary 25 for m = 2 and so J_{u,v} ⊗ 𝔽_{q^{2}} is split.

Next, suppose that End^{0}(E_{u,v} ⊗ \overline{𝔽}_{q}) ≃ ℚ(i). Then E_{u,v} and hence E_{χ} is ordinary and End^{0}(E_{χ}) ≃ End^{0}(E_{u,v}) ≃ ℚ(i). Thus condition (iv)_{4} of Proposition 30 does not hold for E = E_{χ}, and so it follows from that proposition together with part (a) that J_{u,v} ⊗ 𝔽_{q^{2}} is split.

Now suppose that E_{u,v} is ordinary and that J_{u,v} ⊗ 𝔽_{q^{2}} is split. If none of the three conditions of (b) hold, then χ ∉ (𝔽_{q^{4}}^{×})^{2} by (38), so E_{χ} ∼ (E_{u,v} ⊗ 𝔽_{q^{4}})^{χ}, and hence (E_{χ})^{χ} ∼ E_{u,v} ⊗ 𝔽_{q^{4}}. Thus, the condition (iv)_{4} of Proposition 30 holds for E = E_{χ}, and so by Proposition 30 (and Corollary 23) we have that J_{u,v} ⊗ 𝔽_{q^{2}} is simple, contradiction. This proves the converse.

(c) Here χ ∉ (𝔽_{q^{4}}^{×})^{2} by (38), so E_{χ} ∼ (E ⊗ 𝔽_{q^{4}})^{χ}, and hence (E_{χ})^{χ} ∼ E ⊗ 𝔽_{q^{4}}. Suppose first that 4q + 2 tr_{E} is a square in ℤ but 4q − 2 tr_{E} is not. Then in view of

part(a) we see that E_{0} := E satisfies condition (iii) of Theorem 20(b), and so it follows from that theorem together with Corollary 23 that J_{u,v} ⊗ 𝔽_{q^{2}} is simple. Similarly, if 4q − 2 tr_{E} is a square in ℤ but 4q + 2 tr_{E} is not, then E_{0} := E^{χ} satisfies condition (iii) of Theorem 20(b) (because E^{χ} ⊗ 𝔽_{q^{4}} ∼ E ⊗ 𝔽_{q^{4}} and tr_{E^{χ}} = − tr_{E}) and so J_{u,v} ⊗ 𝔽_{q^{2}} is simple in this case as well.

Conversely, suppose that J_{u,v} ⊗ 𝔽_{q^{2}} is simple. Then by part (a) we have that condition (i) of Theorem 20(b) holds for E_{χ} and so by that theorem there is an elliptic curve E_{0}/𝔽_{q^{2}} such that E_{0} ⊗ 𝔽_{q^{4}} ∼ (E_{χ})^{χ} with 4q + 2 tr_{E_{0}} a square and 4q − 2 tr_{E_{0}} a non-square. Now since (E_{χ})^{χ} ∼ E ⊗ 𝔽_{q^{2}}, we see that either E_{0} ∼ E or E_{0} ∼ E^{χ}, and so it follows that precisely one of 4q ± 2 tr_{E} is a square.

The last assertion follows directly from Proposition 29.

In the following corollary we further analyze some of the cases of Theorem 31(b).

Corollary 32. (a) If v ∈ (𝔽_{q}^{×})^{4}, then γ, χ ∈ 𝔽_{q} and J_{u,v} ∼ E_{χ}^{0} × E_{−χ}^{0}, where E_{±χ}^{0}/𝔽_{q} is defined by the equation y^{2} = ±χ(x − 1)(x^{2} − γx + 1). Thus h_{J_{u,v}}(X) = h_{E_{χ}^{0}}(X)h_{E_{χ}^{0}}((−1)^{\frac{q−1}{2}} X).

(b) If v ∈ (𝔽_{q}^{×})^{2} \ (𝔽_{q}^{×})^{4}, then γ ∈ 𝔽_{q} and J_{u,v} ⊗ 𝔽_{q^{2}} ∼ ((E′ ⊗ 𝔽_{q^{2}})^{χ})^{2}, where E′/𝔽_{q} is the elliptic curve defined by the equation y^{2} = (x−1)(x^{2}−γx+1). If E′ is ordinary, then J_{u,v} is simple if and only if 4q − tr_{E′}^{2} is not a square in ℤ or, equivalently, if and only if End^{0}(E′) ≄ ℚ(i). If this is the case, then h_{J_{u,v}}(X) = x^{4} + (tr_{E′}^{2} −2q)X^{2} + q^{2}.

Proof. (a) Since v ∈ (𝔽_{q}^{×})^{4}, then we can choose σ ∈ 𝔽_{q} and so also χ ∈ 𝔽_{q}^{×}. It thus follows as in the proof of Theorem 31(a) that the rule (37) defines morphisms φ_{i}^{0} : C_{u,v} → E_{i}^{0}, where E_{1}^{0} = E_{χ}^{0} and E_{2}^{0} = E_{−χ}^{0}, and that J_{u,v} ∼ E_{1}^{0} × E_{2}^{0}. Thus h_{J_{u,v}}(X) = h_{E_{1}^{0}}(X)h_{E_{2}^{0}}(X). If q ≡ 1 mod 4, then −1 ∈ (𝔽_{q}^{×})^{2} and so E_{1}^{0} ≃ E_{2}^{0}. If q ≡ 3 mod 4, then −1 ∉ (𝔽_{q}^{×})^{2}, and so E_{2}^{0} is the nontrivial quadratic twist of E_{1}^{0}, and hence h_{E_{2}^{0}}(X) = h_{E_{1}^{0}}(−X). This proves (a).

(b) Here σ^{2} ∈ 𝔽_{q} and so it follows from their definitions that γ ∈ 𝔽_{q}^{×} and χ ∈ 𝔽_{q^{2}}^{×}. Thus, the equation y^{2} = ±χ(x − 1)(x^{2} − γx + 1) defines an elliptic curve E′_{±χ}/𝔽_{q^{2}}. Similar to part (a), we thus see that the rule (37) defines morphisms φ′_{i} : C_{u,v} ⊗𝔽_{q^{2}} → E′_{i}, where E′_{1} = E′_{χ} and E′_{2} = E′_{−χ}, and E′_{±χ}/𝔽_{q^{2}}, and that hence J_{u,v} ⊗𝔽_{q^{2}} ∼ E′_{1} ×E′_{2}. But since q^{2} ≡ 1 mod 4, we see that −1 is a square in 𝔽_{q^{2}}, and so E_{1}^{0} ≃ E_{2}^{0}. Thus J_{u,v} ⊗ 𝔽_{q^{2}} ∼ (E′_{χ})^{2}. Now the hypothesis on v implies that σ and hence χ ∉ (𝔽_{q^{2}}^{×})^{2}, and so E′_{χ} ∼ (E′ ⊗ 𝔽_{q^{2}})^{χ}. This proves the first assertion. In addition, we have that tr_{E′_{χ}} = − tr_{E′⊗𝔽_{q^{2}}} = −(tr_{E′}^{2} −2q) = 2q − tr_{E′}^{2}, and so from Theorem 20(a) we see that if E′ is ordinary, then J_{u,v} is simple if and only if 2q + tr_{E′_{χ}} = 4q − tr_{E′}^{2} is not a square. This latter condition is equivalent to the fact that End^{0}(E′) ≄ ℚ(i) because End^{0}(E′) ≃ ℚ(\sqrt{tr_{E′}^{2} −4q}). If this is the case, then the formula for h_{J_{u,v}}(X) follows from Corollary 23 (with E = E′_{χ}).

We can use the above theorem to obtain an “almost-deterministic” polynomialtime algorithm for computing the order |J_{u,v}(𝔽_{q})| = h_{J_{u,v}}(1) of the group J_{u,v}(𝔽_{q}) of 𝔽_{q}-rational points of the Jacobian of C_{u,v}. Here “almost-deterministic” means that we can compute two numbers {m, n} such that either |J_{u,v}(𝔽_{q})| = m or |J_{u,v}(𝔽_{q})| = n (and the other number is the order of J_{u,v}^{χ}(𝔽_{q}), where J_{u,v}^{χ} is the quadratic twist of J_{u,v}). Unfortunately, this algorithm cannot decide (without further information) which of the two numbers equals the order of J_{u,v}(𝔽_{q}).

Algorithm 33 (Non-degenerate Case). Input: u, v ∈ 𝔽_{q} with v, u^{2} − 4v ≠ 0. Output: The unordered pair J^{∗} := {|J_{u,v}(𝔽_{q})|, |J_{u,v}^{χ}(𝔽_{q})|}, if J_{u,v} ⊗ 𝔽_{q^{2}} is simple and ordinary, and “Fail” otherwise. Steps: 1. If either q ≡ 3 (mod 4) or v is a square in 𝔽_{q}^{×}, then return “Fail”.

2. Let θ be a root of X^{2} − v in 𝔽_{q^{2}}, and put γ = 2\frac{u−6θ}{u+2θ} = 2\frac{u^{2}+12v−8uθ}{u^{2}−4v}. Apply a point counting algorithm (e.g. the SEA-algorithm) to the elliptic curve E/𝔽_{q^{2}} defined by the equation y^{2} = (x − 1)(x^{2} − γx + 1) to find t_{0} := tr_{E}. If (q, t_{0}) ≠ 1, then return “Fail”.

3. If 4q ± 2t_{0} are both squares in ℤ or if neither is a square, then return “Fail”.

4. Find t ∈ ℤ and ε = ±1 such that 4q + εt_{0} = t^{2} and return

J^{∗} = \{1 − t + \frac{t^{2}}{2} − tq + q^{2}, 1 + t + \frac{t^{2}}{2} + tq + q^{2}\}.

Remark 34. (a) It is easy to see that J_{u,v}^{χ} is isogenous to the Jacobian of the quadratic twist C_{u,v}^{χ} of C_{u,v}. (Indeed, since tr_{J_{u,v}} = 1 + q − |C_{u,v}(𝔽_{q})|, this follows from the fact that |C_{u,v}(𝔽_{q})| + |C_{u,v}^{χ}(𝔽_{q})| = 2q + 2.) Thus, if v ∉ (𝔽_{q}^{×})^{2}, then C_{u,v}^{χ} is given by the equation y^{2} = v^{−1}(x^{5} + ux^{3} + vx), and so C_{u,v}^{χ} ≃ C_{uv^{2},v^{5}} and J_{u,v}^{χ} ∼ J_{uv^{2},v^{5}}.

(b) If the above algorithm “fails”, then either J_{u,v} is supersingular or J_{u,v} ⊗ 𝔽_{q^{2}} splits. In both these cases the curve C_{u,v} is considered to be cryptographically insecure by some authors (cf. [4]), but opinions differ. We shall consider the degenerate case below (cf. Algorithm 35).

(c) The most laborious step in the above algorithm is the point-counting algorithm (SEA-algorithm) applied to E_{u,v}/𝔽_{q^{2}}. Since this is a polynomial time algorithm, we see that Algorithm 33 is also of polynomial time.

In the degenerate case (cf. Corollary 32) we can compute the order of J_{u,v}(𝔽_{q}) exactly.

Algorithm 35 (Degenerate Case). Input: u, v = w^{2} ∈ 𝔽_{q} with w ≠ 0 and u ≠ ±2w. Output: |J_{u,v}(𝔽_{q})|, if J_{u,v} is simple and ordinary, and “Fail” otherwise. Steps: 1. If either q ≡ 3 (mod 4) or w is a square in 𝔽_{q}^{×}, return “Fail”.

2. Put γ = 2\frac{u−6w}{u+2w}. Apply a point counting algorithm (e.g. the SEA-algorithm) to the elliptic curve E/𝔽_{q} defined by the equation y^{2} = (x − 1)(x^{2} − γx + 1) to find t_{0} := tr_{E}. If (q, t_{0}) ≠ 1, then return “Fail”.

3. If 4q − t_{0}^{2} is a square in ℤ, then End^{0}(E) ≃ ℚ(i) and J_{u,v} splits, so return “Fail”. Otherwise, J_{u,v} is simple and return |J_{u,v}(𝔽_{q})| = (1 − q)^{2} + t_{0}^{2}.

Here we present some small numerical examples.

Example 36. (a) C_{1,2}/𝔽_{29}. Here u = 1, v = 2 and q = p = 29. Note that C_{1,2}/𝔽_{29} is a genus 2 curve because u^{2} − 4v ≡ −7 (mod 29).

Since p = 29 ≡ 1 (mod 4) and (\frac{v}{p}) = −1, we pass step 1 of Algorithm 33. Thus 𝔽_{p^{2}} = 𝔽_{29}(θ), where θ^{2} = v = 2 and γ = 2\frac{1+12(2)−8θ}{−7} = −3 − 6θ, so E_{u,v} is given by y^{2} = (x − 1)(x^{2} + (3 + 6θ)x + 1). Applying a point counting algorithm to E_{u,v}/𝔽_{p^{2}}, we obtain that t_{0} := tr_{E_{u,v}} = 8, which is coprime to 29. Since 4p − 2t_{0} = 100 = (±10)^{2} and 4p + 2t_{0} = 132, we pass step 3 and hence we can take t = 10 and ε = −1 in step 4. Thus, we obtain that J^{∗} = {592, 1192}. In fact, a naive point count shows that |C_{1,2}(𝔽_{29})| = 1 + 29 − 10 = 20, so tr_{J_{1,2}} = 10 and hence |J_{1,2}(𝔽_{29})| = 1192.

(b) C_{1,2}/𝔽_{37}. Again u^{3}−4v ≡ −7 (mod 37), so C_{1,2}/𝔽_{37} is a genus 2 curve. Since p = 37 ≡ 1 (mod 4) and (\frac{v}{p}) = −1, we pass step 1. Here γ = 2\frac{1+12(2)−8θ}{−7} = 14 − 3θ, and a point counting algorithm yields that t_{0} := tr_{E_{u,v}} = −24. Since (t_{0}, p) = 1, we pass step 2. But 4p + 2t_{0} = 100 = 10^{2} and 4p − 2t_{0} = 196 = 14^{2} are both squares, so step 3 fails, and we conclude that J_{1,2} ⊗ 𝔽_{37^{2}} splits. Thus, the algorithm returns “Fail”.

(c) C_{1,9}/𝔽_{41}.

Here u = 1 and v = w^{2} with w = 3, so we can apply Algorithm 35. Note that u ≢ ±6 ≡ ±2w (mod 41), so this is a genus 2 curve.

Since p = 41 ≡ 1 (mod 4) and (\frac{3}{41}) = −1, we pass step 1. Here γ = 2\frac{u−6w}{u+2w} ≡ 1 (mod 41), and so E/𝔽_{41} is y^{2} = (x − 1)(x^{2} − x + 1). A point counting algorithm gives tr_{E} = −6. Since (6, 41) = 1 and 4p − tr_{E}^{2} = 128 is not a square, we see that J_{1,9}/𝔽_{41} is simple and that |J_{1,9}(𝔽_{41})| = (−40)^{2} + (−6)^{2} = 1636 = 2^{2}409.

(d) Satoh’s example[10]: C_{3,7}/𝔽_{509}. Here u^{2} − 4v ≡ −19 (mod 509), so C_{3,7}/𝔽_{509} is a genus 2 curve.

Since q = p = 509 ≡ 1 (mod 4) and (\frac{7}{509}) = −1, we pass step 1. Thus 𝔽_{p^{2}} = 𝔽_{p}(θ), where θ^{2} = 7 ∈ 𝔽_{p}, and γ = 2\frac{3^{2}+12(7)−8(3)θ}{−19} = 17 − 185θ. Applying a point counting algorithm to E_{u,v}/𝔽_{p^{2}} yields tr_{E_{u,v}} = −626, which is coprime to 509, so we pass step 2. Since 4p+2 tr_{E_{u,v}} = 4·509+2(−626) = (±28)^{2} and 4p+2 tr_{E_{u,v}} = 4·509−2(−626) = 3288 ∉ ℤ^{2}, we pass step 3. Thus t = 28 and ε := 1 and so the algorithm returns J^{∗} = {245194, 273754}.

Note that this agrees with two of the 4 values that are considered by Satoh[10] in his example on p. 546. More precisely, by applying the SEA algorithm to E_{χ}/𝔽_{p^{4}}, Satoh obtains (by his algorithm) that |J_{3,7}(𝔽_{509})| ∈ {274538, 273754, 245978, 245194}. He discards the first three numbers because they do not have a sufficiently large prime divisor. He is thus left with 245194 = 2·122597, which he accepts because by a random point check he found a point P ∈ J_{3,7}(𝔽_{509}) of order 122597.

We can use the above Algorithm 33 to obtain the following deterministic polynomial time variant of Satoh’s probabilistic polynomial time algorithm.

Algorithm 37 (Variant of Satoh’s Algorithm). Input: (i) u, v ∈ 𝔽_{q} with v, u^{2} − 4v ≠ 0;

(ii) a cofactor bound M < (\sqrt{q} − 1)^{2};

(iii) a subset D of J(𝔽_{q}) which generates a subgroup of order > M. Output: The largest prime factor r of |J_{u,v}(𝔽_{q})|, if r > |J_{u,v}(𝔽_{q})|/M, and if J_{u,v} ⊗𝔽_{q^{2}} is simple and ordinary, and “Fail” otherwise. Steps: 1.–4. See Algorithm 33.

5. Write J^{∗} = {n_{1}, n_{2}}. For i = 1, 2, determine the largest divisor d_{i}|n_{i} with d_{i} ≤ M. Put n′_{i} = n_{i}/d_{i}. If n′_{i} is prime and if there is a point P ∈ ⟨D⟩ such that d_{i}P ≠ 0, then return n′_{i}, otherwise return “Fail”.

Remark 38. (a) The above algorithm is slightly more restrictive than that of Satoh[10] because we exclude here the cryptographically uninteresting cases that J_{u,v} is supersingular or that J_{u,v} ⊗ 𝔽_{q^{2}} splits; cf. Remark 34(b). However, if these cases are of interest, then we can easily include them by using Algorithm 35. Note that the condition on M automatically excludes the case that J_{u,v} splits (cf. [10], p. 537).

(b) By the proof of Theorem 1 of Satoh[10], we see that the above algorithm computes the largest prime factor of J_{u,v}(𝔽_{q}) subject to the given conditions. We observe that the steps of Satoh’s original algorithm which led to probabilistic polynomial time have been eliminated, and so we now have a deterministic polynomial time algorithm. Here we use the fact (due to Agrawal, Kayal and Saxena) that we can test the primality of n′_{i} in deterministic polynomial time.

References

[1] S. Bosch, W. Lütkebohmert, M. Raynaud, Néron Models. Springer-Verlag, Berlin, 1990.

[2] H. Cohen, A course in computational algebraic number theory. Springer-Verlag, New York, 1993.

[3] P. Deligne, Variétés abéliennes ordinaires sur un corps fini. Invent. Math. 6 (1969), 238-243.

[4] E. Furukawa, M. Kawazoe, T. Takahashi, Counting points for hyperelliptic curves of type y^{2} = x^{5} + ax over finite prime fields. In: SAC 2003 (Matsui, M., Zuccherato, R. J., eds.), LNCS, vol. 3006, pp 26-41. Springer, Heidelberg, 2004.

[5] E. W. Howe, Principally polarized ordinary abelian varieties over finite fields. Trans. Amer. Math. Soc. 347 (1995), 2361-2401.

[6] E. W. Howe, H. J. Zhu, On the existence of absolutely simple abelian varieties of a given dimension over an arbitrary field. J. Number Theory 92 (2002), 139–163.

[7] D. Maisner, E. Nart, Abelian surfaces over finite fields as Jacobians (with an appendix by E.W. Howe). Experim. Math. 11 (2002), 321–337.

[8] D. Mumford, Abelian varieties, Second Edition. Oxford University Press, Bombay, 1970.

[9] A. Krazer, Lehrbuch der Thetafunktionen. Leipzig, 1903; Chelsea Reprint, New York, 1970.

[10] T. Satoh, Generating genus two hyperelliptic curves over large characteristic finite fields. EUROCRYPT 2009, Lect. Notes in Comput. Sci., vol. 5479, pp. 536-553, Springer, 2009.

[11] W. C. Waterhouse, Abelian varieties over finite fields, Ann. Sci. École Norm. Sup. (4), 2 (1969), 521-560.

[12] W. C. Waterhouse and J. S. Milne, Abelian varieties over finite fields. In: 1969 Number Theory Institute Proc. Sympos. Pure Math., Vol. XX, State Univ. New York, Stony Brook, N.Y., Amer. Math. Soc., Providence, RI, 1971, page 53-64.