Paper 2026/2522

Superspecial points on Humbert surfaces and the probability of (N,N)-splitting

Tanush Shaska, Oakland University
Abstract

Let $p\equiv3\pmod4$ be a prime and let $N\geq2$ be an integer. We determine, to first order in $1/p$ and with an explicit error bound, the proportion of superspecial principally polarized abelian surfaces over $\overline{\mathbb{F}}_p$ that are optimally $(N,N)$-split. The surfaces are weighted by the reciprocals of their automorphism orders, which is the stationary measure of the Richelot random walk. The main theorem states that for $p\nmid N$ the expected number of optimal $(N,N)$-splittings of a surface is exactly $5NJ_2(N)(p-1)/(p^2+1)$, where $J_2$ is Jordan's totient; that for $p>2N^2$ the second factorial moment is $c_N/(p^2+1)$ with $c_N$ independent of $p$; and consequently that, for fixed $N$, the proportion of split surfaces is $5NJ_2(N)/p+O_N(p^{-2})$. The constants $c_N$ are determined explicitly for $2\leq N\leq7$. This proportion is the stationary target density of the splitting-detection attack on the superspecial isogeny problem in dimension two. It was previously known only from experiments or from a one-sided bound. The method is to show that the superspecial surfaces sample the genus of their refined Humbert invariants with Siegel's weights, which makes Siegel's theorem on genus averages available. The same method gives the first moment of primitive representations of every discriminant prime to $p$, mixed moments for several levels, an exact probability at level $2$, and a proof that the geometric upper bound of earlier work has the correct leading term. All results are proved; the enumerations enter only through the values of $c_N$, and every formula was additionally confirmed by exact computation at twelve primes.

Metadata
Available format(s)
PDF
Category
Attacks and cryptanalysis
Publication info
Preprint.
Keywords
isogeny-based cryptographysuperspecial isogeny problemsplitting detectionHumbert surfacesSiegel mass formula
Contact author(s)
shaska @ oakland edu
History
2026-10-17: approved
2026-10-17: received
See all versions
Short URL
https://ia.cr/2026/2522
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2026/2522,
      author = {Tanush Shaska},
      title = {Superspecial points on Humbert surfaces and the probability of (N,N)-splitting},
      howpublished = {Cryptology {ePrint} Archive, Paper 2026/2522},
      year = {2026},
      url = {https://eprint.iacr.org/2026/2522}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.