here - Sites personnels de TELECOM ParisTech - Télécom ParisTech

3.2. Algebraic curves 105It should be noted that H(∆) can be computed from the value of the classical class numberof (the maximal order of) K using the following proposition.Theorem 3.2.12 ([160, 61, 144, 54]). Let O be the order of conductor f in K 12 , an imaginaryquadratic extension of Q, O K the maximal order of K and ∆ K the discriminant of (the maximalorder of) K. Then(where·p)is the Kronecker symbol.h(O) = fh(O K)[O ∗ K : O∗ ]∏p|f(1 −(∆Kp) 1p),Denoting the conductor of Z[α] by f, H(∆) can then be written asH(∆) = h(O K ) ∑ d ∏( ( )∆K 1[O ∗ d|f K : 1 −O∗ ]p p)p|d.We now give specific results to even characteristic. First, E is supersingular if and only if itsj-invariant is 0. Second, if E is ordinary, then its Weierstraß equation can be chosen to be of theformE : y 2 + xy = x 3 + bx 2 + a ,where a ∈ F ∗ q and b ∈ F q , its j-invariant is then 1/a; moreover, its first division polynomials aregiven by [154, 18]f 1 (x) = 1, f 2 (x) = x, f 3 (x) = x 4 + x 3 + a, f 4 (x) = x 6 + ax 2 .The quadratic twist of E is an elliptic curve with the same j-invariant as E, so isomorphic overthe algebraic closure F q of F q , but not over F q (in fact it becomes so over F q 2). It is unique upto rational isomorphism and we denote it by Ẽ. It is given by the Weierstraß equationẼ : y 2 + xy = x 3 + ˜bx 2 + a ,where ˜b(˜b)is any element of F q such that Tr m 1 = 1 − Tr m 1 (b) [82]. The trace of its Frobeniusendomorphism is given by the opposite of the trace of the Frobenius endomorphism of E, so thattheir number of rational points are closely related [82, 18]:3.2.3 Hyperelliptic curves#E + #Ẽ = 2q + 2 .The theory of hyperelliptic curves, with a cryptographic point of view, can be found for example inthe classical treatments of Menezes and different coauthors [141, 194] or more recent textbooks [110,56, 107]. We can define a hyperelliptic curve rather generally and abstractly as follows.Definition 3.2.13 (Hyperelliptic curve). A hyperelliptic curve H is a smooth projective algebraiccurve which is a degree 2 covering 13 of the projective line.12 The study of orders in imaginary quadratic field is conducted in Subsection 5.2.2. The definition of theconductor is given there in Proposition 5.2.17. For the impatient reader, it is sufficient to know that the order Oof conductor f can be explicitly described as O = Z + fO K where O K is the ring of integers of K.13 The remark of Footnote 3 applies here as well.