Efﬁcient Search for Superspecial Hyperelliptic Curves of Genus Four with Automorphism Group Containing C 6

In arithmetic and algebraic geometry, superspecial (s.sp. for short) curves are one of the most important objects to be studied, with applications to cryptography and coding theory. If g ≥ 4, it is not even known whether there exists such a curve of genus g in general characteristic p > 0, and in the case of g = 4, several computational approaches to search for those curves have been proposed. In the genus-4 hyperelliptic case, Kudo-Harashita proposed a generic algorithm to enumerate all s.sp. curves, and recently Ohashi-Kudo-Harashita presented an algorithm speciﬁc to the case where automorphism group contains the Klein 4-group as a subgroup. In this paper, we propose an algorithm with complexity ˜ O ( p 4 ) in theory but ˜ O ( p 3 ) in practice to enumerate s.sp. hyperelliptic curves of genus 4 with automorphism group containing the cyclic group of order 6. By executing the algorithm over Magma, we enumerate those curves for p up to 1000. We also succeeded in ﬁnding a s.sp. hyperelliptic curve of genus 4 in every p with p ≡ 2 ( mod 3 ) .


Introduction
Throughout, all the complexities are measured by the number of arithmetic operations in F p 2 for a prime p, unless otherwise noted.Soft-O notation Õ omits logarithmic factors, namely we write f (n) = Õ(g(n)) if f (n) = g(n)log k n for some k.A curve means a non-singular projective variety of dimension one.Let K be a field of characteristic p > 0, and K its algebraic closure.A curve C of genus g over K is said to be superspecial (s.sp.for short) if its Jacobian variety is isomorphic to a product of supersingular elliptic curves.S.sp.curves are of course important objects in theory, but also in practical applications such as cryptography using algebraic curves, see e.g., [4], where s.sp.genus-2 curves are used to construct Hash function.
Given a pair (g, p), only finite s.sp.curves of genus g over F p exist, and the problem of finding or enumerating them is known to be classically important.For the field of definition, the most important case is F p 2 , since any s.sp.curve over K is K -isomorphic to one over F p 2 , see the proof of [7,Theorem 1.1].For g ≤ 3, the problem is solved for all p > 0, based on the theory of principally polarized abelian varieties.Specifically, for g = 1 (resp.2 and 3), Deuring [5] (resp.Ibukiyama-Katsura-Oort [16,Theorem 2.10]) showed that the number of F p -isomorphism classes of s.sp.curves is determined by computing the class numbers of a quaternion algebra (resp.quaternion hermitian lattices).These class numbers were computed in [6] (resp.[15], [14]) for g = 1 (resp.2, 3).
On the other hand, the problem for g ≥ 4 has not been solved in all primes, but in recent years, Kudo-Harashita developed several algorithms to count genus-4 or 5 s.sp.curves [19], [20], [22].In particular, an algorithm for enumerating s.sp.hyperelliptic curves of genus 4 was proposed in [20] and [21], but is practical only for small p (in fact p ≤ 23), due to the cost of solving multivariate systems (cf.Sect.2.4 below).Recently, Ohashi-Kudo-Harashita [32] (resp.Kudo-Harashita-Howe [23]) presented an algorithm for enumerating s.sp.hyperelliptic (resp.non-hyperelliptic) curves of genus 4 with automorphism group containing a subgroup isomorphic to the Klein 4-group V 4 = C 2 × C 2 , with complexity Õ( p 3 ) (resp.Õ( p 4 )), where C n denotes the cyclic group of order n.They also succeeded in enumerating such s.sp.curves for every prime p up to 200.
This paper proposes a more efficient algorithm than [20] to produce s.sp.hyperelliptic curves of genus 4, which is practical for p extremely larger than some number mentioned in [20].For this, we focus on a family of hyperelliptic curves given by H a,b : y 2 = f a,b (x):=x 10 + x 7 + ax 4 + bx, where a, b ∈ F p 2 .This kind of a curve appears as a s.sp.curve over F 17 2 enumerated in [20] (see also Table 2 in Sect.2.4 below), and it tends to be s.sp.from our preliminary computation; by exhaustive search for (a, b), we confirmed that there exists (resp.does not exist) (a, b) such that H a,b is s.sp.for any 17 ≤ p < 100 with p ≡ 2 mod 3 (resp.p ≡ 1 mod 3).We also note that the full (resp.reduced) automorphism group of H a,b contains a subgroup isomorphic to C 6 (resp.C 3 ), see Theorem 2.1.5for a complete classification of reduced and full automorphism groups of hyperelliptic curves of genus 4. Note that the proof of Theorem 2.1.5 is given in the appendix of the preprint version of this paper [24].With this classification, we see that our family H a,b is included in the cases 3, 7, and 9 of Table 1, while Ohashi-Kudo-Harashita's recent work [32] treats the cases 2-1, 4-1, 5, 6, 8, and 10 of the table.A relationship between H a,b and the family C A,B : y 2 = x 10 + Ax 7 + Bx 4 + x in the cases 3, 7, and 9 of Table 1 will be described in Sect.3.1 below.
Here, main results of this paper are summarized in Theorems A and B below.
Theorem A There exists an algorithm (Main Algorithm in Theorem 4.1.1)with complexity Õ( p 4 ) to enumerate the F p -isomorphism classes of all s.sp.H a,b 's with a, b ∈ F p 2 .Assuming the gcd of resultants appearing in the algorithm has degree O( p), the complexity becomes Õ( p 3 ).
While the outline of our algorithm is same as that of our previous algorithm in [20], we shall develop various computational techniques specific to our family H a,b .Specifically, we prove in Lemma 3.2.1 that the Cartier-Manin matrix M a,b of H a,b with parameters a and b can be computed very efficiently, in O( p 3 ), only with linear algebra.We then solve the equation M a,b = 0 in Õ( p 4 ) with bivariate resultants, where the complexity becomes Õ( p 3 ) assuming the gcd of computed resultants has degree O( p); we see from our computational results that this assumption is practical.To make isomorphism classification of s.sp.H a,b 's obtained as above efficient, we also present some criteria.For instance, it will be proved in Lemma 3. By implementing and executing our algorithm on Magma [1], we succeeded in enumerating s.sp.H a,b 's with a, b ∈ F p 2 up to isomorphisms over F p for every prime p between 17 and 1000.More precisely, we obtain the following computational results: Theorem B For every prime p with 17 ≤ p < 1000, the number of F p -isomorphism classes of s.sp.H a,b 's with a, b ∈ F p 2 are summarized in Table 3 below.In particular, for each 17 ≤ p < 1000 with p ≡ 2 mod 3 (resp.p ≡ 1 mod 3), there exists (resp.does not exist) (a, b) ∈ F 2 p 2 such that H a,b is a s.sp.hyperelliptic curve.
The upper bound on p in Theorem B is much larger than those of [20] and [21], and it can be increased easily; for instance, on a PC with macOS Monterey 12.0.1, at 2.6 GHz CPU 6 Core (Intel Core i7) and 16GB memory, it took 6,300 s (about 1.75 h) in total for computing the F p -isomorphicm classes of s.sp.H a,b 's with a, b ∈ F p 2 for all 17 ≤ p < 1000, and the execution time for p = 997 was only 195 seconds.
The rest of this paper is organized as follows.Section 2 is devoted to preliminaries, where we review some known facts on hyperelliptic curves and their automorphisms, Cartier-Manin matrices, and enumeration results in [20], [21] on s.sp.hyperelliptic curves.Section 3 studies our parametric family H a,b : y 2 = x 10 + x 7 + ax 4 + bx.In Sect.4, we present the main algorithm and computational results.Section 5 is conclusion.

Preliminaries
This section reviews some known facts on hyperelliptic curves and their automorphisms, and recalls the definition of Cartier-Manin matrices and the superspeciality of curves.In particular, a classification of hyperelliptic curves of genus 4 in terms of automorphism groups will be recalled in Sect.2.1.In Sect.2.2, we will describe a method to compute the Cartier-Manin matrix of a hyperelliptic curve.Section 2.3 briefly reviews Elkin's results [8] on the rank of the Cartier operator of a cyclic cover.In Sect.2.4, we also review Kudo-Harashita's algorithm [20], [21] to enumerate superspecial hyperelliptic curves, and their enumeration results.
Let K be a field of characteristic p with p = 2, and k = K its algebraic closure.For n ≥ 2, we denote respectively by C n , D n , A n , V 4 , and Q 8 the cyclic group of order n, the dihedral group of order 2n, the alternating group of order n!/2, the Klein 4-group C 2 × C 2 , and the quaternion group.

Hyperelliptic Curves and Their Isomorphisms
For a curve C of genus g ≥ 2 over K , let Aut K (C) denote the automorphism group of C over K , and Aut k (C) is denoted simply by Aut(C).It is well-known that Aut(C) is finite for an arbitrary C, and has size ≤ 16g 4  unless C is a Hermitian curve [36].If the characteristic of K exceeds g + 1, we have a quite more strong bound Aut(C) ≤ 84(g − 1), see [33].A hyperelliptic curve H over K is a curve H over K admitting a degree-2 morphism over K from H to the projective line P 1 k .Let ι be the hyperelliptic involution of H , that is, the unique involution over k on C such that the quotient curve C/ ι is rational.We call the quotient group Aut(H ):=Aut(H )/ ι the reduced automorphism group of H , while Aut(H ) and Aut K (H ) are often called full automorphism groups.
A typical way to represent a hyperelliptic curve H explicitly is realizing it as the desingularization of the projective closure of an affine plane curve y 2 = f (x), where f (x) ∈ k[x] is a separable polynomial of degree 2g + 1 or 2g + 2. In this situation, we simply write H : y 2 = f (x), and call the equation y 2 = f (x) a (hyperelliptic) equation of H .We can also write down an equation of H in terms of a field K of definition for H : Lemma 2.1.1 ( [20, Lemma 2]) Let H be a hyperelliptic curve of genus g over K .Assume that p and 2g + 2 are coprime, and let ε ∈ K × (K × ) 2 .Then H is birational to the projective closure of where a i ∈ K for 0 ≤ i ≤ 2g − 1, and where b = 0, 1, ε and c = 1, ε.
The following lemma gives a criterion to test whether two hyperelliptic curves over K are K -isomorphic to each other, or not: Lemma 2.1.2( [25, Section 1.2] or [20, Lemma 1]) Let H i : c i y 2 = f i (x) be hyperelliptic curves of genus g over K for i = 1 and 2, where c i y 2 = f i (x) is of the form (2.1.1).For any K -isomorphism σ : H 1 → H 2 , there exists for all (x, y) on H 1 .The representation of σ is unique up to the equivalence (P, λ) ∼ (μP, μ g+1 λ) for μ ∈ K × .Remark 2.1.3Considering a hyperelliptic curve H : y 2 = f (x) over an algebraically closed field k, we may assume that the coefficients of the highest and lowest degree terms in f (x) are 1.Indeed, writing f (x) = d i=s a i x i with d = 2g + 1, 2g + 2, s = 0, 1, a d = 0, and a s = 0, an isomorphism (x, y) → αx δ , y δ g+1 transforms y 2 = f (x) into y 2 = d i=s a i α i δ 2 g+2−i x i choosing α and δ so that a d α d δ 2 g+2−d = 1 and a s α s δ 2 g+2−s = 1, as desired.
As a particular case of Lemma 2.1.2,any K -automorphism of a hyperelliptic curve H of genus g over K can be represented by (P, λ) ∈ GL 2 (K )× K × as in the lemma.Based on this, we can compute automorphisms of a given H by e.g., the Gröbner basis computation with help of computer calculation (cf.[29] and [21,Section 4]).For instance, the computer algebra system Magma [1] has the function AutomorphismsOfHyperellipticCurve implemented by Lercier-Sijsling-Ritzenthaler [29].Once all K -automorphisms of H are computed, the group structure of Aut K (H ) can be also determined.
When K is algebraically closed, namely k = K , possible finite groups isomorphic to Aut(H ) can be determined from ones isomorphic to the reduced automorhism group Aut(H ), which is canonically embedded into the projective linear group PGL 2 (k) (see e.g., [30,Section 2.2] for an explicit description).Indeed, in the case of characteristic zero, Shaska [34], [35] applied a classification of finite subgroups of PGL 2 to determining possible types of Aut(H ), and then he also found an equation (in reduced form) defining H for each type and the structure of Aut(H ), with the action of elements in Aut(H ) as matrices.His idea can be applied to the positive characteristic case, with carefully considering some exceptional cases depending on p and g such as the existence of p-subgroups of PGL 2 .For the case of genus 2, 3, and 4, explicit classifications in characteristic p are given in [17] (and [16]), [28,Table 2], and [24, Table 3] respectively.
We here recall the classification in the case where g = 4.A key ingredient for the classification is the fact (this is noted in [11,Section 2] without proof) that any automorphism σ of a hyperelliptic curve is represented by diag(μ, 1) ∈ GL 2 (k) for a primitive -th root μ of unity with = ord(σ ) (the order of σ as an element of Aut(H )), if is coprime to the characteristic of k.An explicit proof of this fact is given in [30], and we here state assertions only: Proposition 2.1.4( [30, Proposition 2.2.2])Let H be a hyperelliptic curve of genus g over an algebraically closed field k, and a positive integer coprime to char(k).Assume that σ has order in the reduced automorphism group of H . Then there exists a hyperelliptic curve H : y 2 = f (x) over k and an isomorphism ρ : H → H such that the automorphism ρ −1 σρ of H is represented by (diag(μ, 1), μ ) ∈ GL 2 (k) × k × , where μ is a primitive -th root of 1, and where μ is an element satisfying (μ ) = 1 or −1.We also have μ Moreover, σ is the hyperelliptic involution (i.e., = 1) if and only if μ = 1.
Based on this proposition together with the classification of subgroups of PGL 2 (k), we can determine possible finite groups isomorphic to the reduced automorphism groups of hyperelliptic curves over k of given genus g.In the case where g = 4, we can prove the following theorem:  In particular, the reduced automorphism group contains a subgroup isomorphic to C 3 (or equivalently Aut(H ) contains a subgroup isomorphic to C 6 ), then it is isomorphic to C 3 , C 9 or A 4 .Moreover, in each case, H is isomorphic to y 2 = f (x) given as follows:

Cartier-Manin Matrices and Superspeciality
In this section, we review how to compute the Cartier-Manin matrix of a hyperelliptic curve.
We start with recalling the definition of the Cartier operator and the Cartier-Manin matrix for a general curve which admits an affine plane model.Assume for simplicity that C is birational to an affine plane (possibly singular) curve F(x, y) = 0 in the affine plane A 2 over k with coordinate ring R:=k[x, y]/ F , where F is an irreducible polynomial over k in x and y.We can take x as a separating element, i.e., x is transcendental over K , and the function field k(C) is a finite separable extension of K (x).We may identify k(C) and the field of fractions K :=k(x, y) for R.Under this identification, every regular differential form ω ∈ H 0 (C, 1  C ) is uniquely written as ω = dφ+η p x p−1 dx for φ, η ∈ k(C).Here we define a map by C (ω):=ηdx, and call it the (modified) Cartier operator on H 0 (C, 1 C ).Moreover, the matrix representing C with respect to a basis A for the g-dimensional space H 0 (C, 1  C ) is called the Cartier-Manin matrix of C (with respect to the basis A).We here also recall Nygaard's criterion for superspeciality in terms of the Cartier operator: Theorem 2.2.1 ( [31,Theorem 4.1]) With notation as above, the Jacobian variety J (C) of a curve C is isomorphic to a product of supersingular elliptic curves if and only if C vanishes.
In the case where C is hyperelliptic, we have a well-known explicit formula (Lemma 2.2.2 below) by Yui [39] to compute the Cartier-Manin matrix of C, and so recall it here.As in the previous subsection, assume that C is a hyperelliptic curve of genus g over k defined by y 2 = f (x), where f (x) is a polynomial in k[x] of degree 2g + 1 or 2g + 2 with no multiple root.First, it is well-known that a basis of H 0 (C, 1  C ) is given by by the definition of the Cartier operator described above, and hence we have the following lemma: Lemma 2.2.2 ( [39, Section 2]) With notation as above, the Cartier-Manin matrix of C is the g × g matrix whose More strongly, it is proved in [37] that Lemma 2.2.2 reduces the computation of the Cartier-Manin matrix of C : y 2 = f (x) into that of g 2 (particular) coefficients in the power f ( p−1)/2 .In the case where all the coefficients of f belong to a finite field (there is no parameter in the coefficients), several efficient algorithms to compute the coefficients have been proposed by Bostan-Gaudry-Schost [2], Komoto-Kozaki-Matsuo [18], and Harvey-Sutherland [12], [13].These algorithms commonly use a linear recurrence by Flajolet-Salvy [10] (described also in e.g., [2, Section 4]) which is used in the general method to compute the power of a given univariate polynomial.
We here recall the recurrence since it will be required to analyze the complexity of our main algorithm.Let h(x) be a univariate polynomial of degree d, and let dh dx denote its derivative with respect to x.We also denote by h i its Let n be a positive integer, and we consider to compute the power h n .For each l with 0 ≤ l ≤ (n + 1)d, it follows from h n+1 = hh n that where Thus, if both h 0 and l are not equal to zero in the coefficient ring of h, the coefficient and hence where we set Note that blank entries in A( ) mean zero.Therefore, the coefficients (h n ) l for all 1 ≤ l ≤ m can be obtained by recursively computing the vectors U l with (2.2.5), starting from l = 1 up to m, for the initial value in the coefficient ring of h.Therefore, this recursive computation is always valid for the characteristic 0 case, but it may not be applied directly in the positive characteristic case since the value of k can be zero in the coefficient ring of h: One solution is lifting to characteristic 0 such as This method (with lifting to characteristic zero if necessary) can be applied to computing the Cartier-Manin matrix of the hyperelliptic curve C : y 2 = f (x) as follows: If f 0 = 0, simply put n = ( p − 1)/2 and h = f , and then the (i p − j)-th coefficients ( f n ) i p− j with 1 ≤ i, j ≤ g are computed as entries of U l for 1 ≤ l ≤ gp − 1.
Otherwise, putting f = xh(x), it follows from Bostan-Gaudry-Schost [2] constructed an efficient algorithm to compute the Cartier-Manin matrix of C over F p r , by using the above recurrences with lifting to the unramified extension of Q p of degree r .Remark 2.2.4 Unlike (2.2.4), each coefficient (h n ) l can be represented as a linear combination of d higher-degree coefficients (h n ) l+1 , . . ., (h n ) l+d .More precisely, it follows from (2.2.3) that Replacing l by l + d, one has for −d ≤ l ≤ nd.Therefore, we can compute (h n ) l from (h n ) l+1 , . . ., (h n ) l+d as in (2.2.4) unless nd − l = 0, and can consider a recursive computation as in (2.2.5) starting from

Cyclic Covers of the Projective Line and Their Cartier Operators
In this subsection, we briefly review Elkin's results [8] on the rank of the Cartier operator for a cyclic cover, since they will be applied in Sect.3.2 below to our family of hyperelliptic curves H a,b having order-6 automorphisms.
Let C be a (non-singular) curve of genus g over an algebraically closed field k of characteristic p > 2. Assume that there exists a ramified Galois cover π : C → P 1 of degree n, and let r be the number of ramification points in P 1 of π , where n is coprime to p.In this case, for each ramification point P i in P 1 of π , its preimage π −1 ({P i }) consists of n/v i branched points in C with the same ramification index v i with 2 ≤ v i ≤ n dividing n.By Hurwitz's formula, we have and C is birational to the homogenization of for some mutually distinct elements a 1 , . . ., a r ∈ k, and some integers n i with 1 ≤ n i < n, v i = n/gcd(n, n i ), gcd(n, n 1 , . . ., n r ) = 1, and r i=1 n i ≡ 0 (mod n).In this case, we say that C → P 1 (or C simply) is a cyclic cover of type (n; n 1 , . . ., n r ).
The group of n-th roots of unity in k acts on H 0 (C, 1 C ).More precisely, let ζ n be a primitive n-th root of unity in k, and δ the automorphism on C defined by (X, Y ) → (X, ζ −1 n Y ) (namely δ is a generator of Aut(C)).Then δ induces an automorphism δ * of the linear space H 0 (C, 1  C ). Denoting by D i the ζ i n -eigenspace of δ * , we decompose where the dimension d i of D i is given as By the p −1 -linearity of the Cartier operator C , we have C (λ pi ω) = λ i C (ω) for any differential ω, and thus By the decomposition (2.3.2),we have each term of which satisfies the following: ) With notation as above, we have the following inequalities: where • denotes the floor function, and where σ is the inverse of a permutation map on the set {0, 1, . . ., n − 1} given by i → pi mod n.
Therefore, it follows from (2.3.5) that we obtain: .

Kudo-Harashita's Enumeration of Superspecial Hyperelliptic Curves
Based on Lemmas 2.1.1,2.1.2,and 2.2.2, an algorithm for enumerating superspecial hyperelliptic curves over K = F q with q = p or p 2 was proposed by Kudo-Harashita [20], [21], and it consists of the following three steps: 1. Regarding unknown coefficients in (2.1.1)as variables, compute the Cartier-Manin matrix of H given in Lemma 2.2.2. 2. Fixed constants b and c in (2.1.1),compute the roots over F q of the multivariate system "the Cartier-Manin matrix is zero" with 2g variables a 2 g−1 , . . ., a 0 by the hybrid approach [3] mixing Gröbner basis computation and exhaustive search.3. Classify the collected curves corresponding to the roots of the system into isomorphism classes, by Lemma 2.1.2.
Kudo-Harashita implemented the algorithm on Magma [1], and executed it for the case g = 4 with q = 11 2 , 13 2 , 17 2 , 19 2 , 23.According to [21, Section 3.1], they succeeded in finishing required computation within a day in total.The main results in [20] and [21]   As examples, the F p -isomorphism classes of superspecial hyperelliptic curves of genus 4 defined over the prime field F p are summarized in Table 2 below.Note that the reduced automorphism group of every superspecial curve in Table 2 is non-trivial.
While Kudo-Harashita succeeded in enumerating superspecial hyperelliptic curves for concrete p, the complexity of their algorithm has not been investigated, due to the difficulty of estimating the cost of Gröbner basis computation.In fact, it might be exponential with respect to p, since the multivariate system to be solved in Step 2 has the maximal total-degree ( p − 1)/2.Moreover, Step 3 might also be costly, due to the growth of the number of solutions found in Step 2.

Hyperelliptic Curves of Genus Four with Automorphism Group Containing C 6
Let K be a field of characteristic p with p ≥ 7, and k = K its algebraic closure.Assume that K contains F p 2 .In this section, we study hyperelliptic curves of genus 4 over K with automorphism group containing the cyclic group of order 6, namely the cases 3, 7, and 9 of Table 1 in Theorem 2.1.5.In particular, we focus on the following parametric family of hyperelliptic curves of genus 4: It is also straightforward that there exists a degree-3 map H a,b → H a,b / σ 3 , where the quotient curve H a,b / σ 3 is a genus-one curve given by Y 2 = X (X 3 + X 2 + a X + b).We start with describing a relationship between H a,b and C A,B : y 2 = x 10 + Ax 7 + Bx 4 + x in Table 1, in particular a merit to use H a,b , not C A,B , in our enumeration of superspecial curves.Recall from Theorem 2.1.5that any hyperelliptic curve H of genus 4 over K with Aut(H ) ⊃ C 6 is k-isomorphic to C A,B for some A, B ∈ k.Note that A or B not necessarily belongs to K , but it follows from the proof of Proposition 2.1.4that they belong to a finite extension K of K , and we can take K so that it does not depend on a nor b but only on g and K .For the central topic of this paper, we can use the family C A,B by restricting ourselves to the case where A, B ∈ F p 2 .However, different choices of a and b lead to isomorphic curves, which causes that the isomorphism classification might be inefficient.(This kind of question also motivates the notion of "representative family", see [26] for the case of genus 3.) For example, over F 29 2 , the extension of F 29 defined by t 2 + 24t + 1, the curves y 2 = x 10 + 11x 7 + 7x 4 + x and y 2 = x 10 + (9t + 1)x 7 + (18t + 24)x 4 + x are isomorphic to each other, where the authors learned this example from one of the reviewers.
On the other hand, the curve x whose coefficients of x 4 and x belong to K by δ 3 ∈ K .Although the family H a,b for a, b ∈ K (as well as C A,B for A, B ∈ K ) does not represents all curves over K whose automorphism group contains C 6 , we can see by the following lemma that it is better behaved with respect to isomorphism classes than C A,B : Since τ also has order 3 in Aut(H ), and since C 9 has a unique subgroup of order 3, we have that τ is given by (x, y) → (ζ i x, ±ζ 2i y) for i = 1 or 2. Thus, comparing the matrices corresponding to the both sides of τ = ρ −1 σρ, we obtain an equation If δ = 0, then μ = 1, β = γ = 0, and i = 1.In this case, ρ is (x, y) → (αδ −1 x, δ −5 λy), and thus y 2 = f a,b (x) is transformed into λ 2 y 2 = α 10 x 10 + α 7 δ 3 x 7 + aα 4 δ 6 x 4 + bαδ 9 x = λ 2 f a ,b (x).Therefore, α 10 = α 7 δ 3 = λ 2 , and hence α = ζ j δ for some j.Since ζ j δ 10 = λ 2 , it follows also from aζ j δ 10 = a λ 2 and bζ j δ 10 = b λ 2 that a = a and b = b .Suppose δ = 0; then μ = ζ , α = 0, and i = 2.In this case, ρ is (x, y) → ( β γ x , λy γ 5 x 5 ), and thus In this case, by considering elements in SL 2 (F 3 ), there exists an order-2 element in Aut(H a,b ) whose order in Aut(H a,b ) is 4. Any two of such H a,b 's are isomorphic to y 2 = x(x 4 − 1)(x 4 + 2 √ −3x 2 + 1), and one of them is detected by Lemma 3.1.3below; more generally, we have the following lemma, whose proof is essentially same as that of [30, Theorem 3.1.1]:Lemma 3.1.2Let H : y 2 = f (x) be a hyperelliptic curve of genus g over an algebraically closed field k, where f (x) is a separable polynomial over k of degree 2g + 2.Then, the following are equivalent: (1) Aut(H ) has an element σ of order 2 which has order 4 as an element in Aut(H ).
(2) There exist roots a 1 and a 2 in k of f such that where a 3 , . . ., a 2g+2 are the other roots in k of f .
As for the form of a matrix representing ρ, we may assume from the proof of [30, Theorem 3.1.1]that it is either of the following: where a 1 , a 2 , b 1 ∈ k.The case (B) is impossible since ρ does not send the point at infinity to itself.In the case (A), the inverse map ρ −1 is represented by For a ramification point (α, 0) of H with a root α of f , its image in H by ρ −1 is − α−a 2 α−a 1 , 0 .Since H has 0 and ∞ as ramification points, we have that a 1 and a 2 are (mutually different) roots of f .The condition τ ∈ Aut(H ) implies the assertion (2).
Conversely, if (2) holds, then we define ρ as in (A) with roots a 1 and a 2 of f , and then the domain of ρ is a hyperelliptic curve H with ramification points ∞, (0, 0), and (±b j , 0) for some b j ∈ k × with 1 ≤ j ≤ g.Therefore H has an automorphism (x, y) → (−x, √ −1y), as desired.
As a particular case of Lemma 3.1.2,we have the following: (1 and hence the rank of M a,b is equal to or smaller than 3.

Remark 3.2.2
We can also determine the form of the Cartier-Manin matrix M a,b (with respect to a basis different from A) constructed by Elkin's method reviewed in Sect.2.3.Similarly to M a,b as in Lemma 3.2.1,there are many zero entries in M a,b , but a transformation between these two matrices is not explicitly given, and also a relation between the entries of M a,b and the coefficients of f is not clear.In the following, we describe how to apply Elkin's method.
Note that, however, since any explicit birational map between H a,b and (3.2.1) is not given, we cannot compute the change-of-basis matrix between A and B.

Algorithm and Computational Results
As in the previous sections, let k be an algebraically closed field of characteristic p with p ≥ 7.In this section, we shall present an algorithm to efficiently produce superspecial hyperelliptic curves of genus    We remark that d and the number of roots (a 0 , b 0 ) are both O( p) in practice, see tables in a pdf (named as NKT_table.pdf)available at [40].From this, the complexities of Steps 2 and 3 are expected to be Õ( p 3 ) and O( p), and in this case the total complexity of Main Algorithm is Õ( p 3 ).Proof Recall from Lemma 2.2.2 that each (i, j)-entry of M a,b is the x i p− j -coefficient of f n with f := f a,b and n:=( p − 1)/2.Putting g = x 9 + x 6 + ax 3 + b, it follows from f n = x n g n that x i p− j -coefficient of f n is equal to the x l -coefficient of g n for l = (2i−1) p+(2 j−1)
Remark 4.1.3Here, we list possible variants of Main Algorithm with q:= p 2 , and provide upper-bounds of their complexities; Our bounds for Main Algorithm in Theorem 4.1.1does not exceed each of the bounds below: 1. Brute force on (a, b) ∈ F 2 q .For each (a, b) ∈ F 2 q , test gcd( f, f ) = 1 or not in constant time.If gcd( f, f ) = 1, compute M a,b in time Õ( √ p) (cf.[2]).The total complexity is Õ(q 2 √ p).[40] for the source code "NKT_enum4.txt").Executing the implemented algorithm, we obtain Theorem B in Sect. 1.Our computational results are summarized in Table 3.For any p with 17 ≤ p < 1000 and p ≡ 1 (mod 3), there is no (a, b) ∈ F 2 p 2 such that H a,b is a s.sp.hyperelliptic curve, and hence we write the computational results only for p with p ≡ 2 (mod 3) in the table.As for the timings, the degrees of the gcds computed in Step 2, and other detailed information, we summarize them in a separated pdf (named as NKT_table.pdf)which is available at [40].
We can easily increase the upper bound on p in Theorem B. For example, on the PC described above, computing the F p -isomorphicm classes of s.sp.
1.1 that two curves H a,b and H a ,b with reduced automorphism groups C 3 or C 9 are isomorphic, then (a, b) = (a , b ).These criteria reduce the cost of isomorphism classification from O( p 4 ) to O( p 2 ) (in practice O( p)).

Lemma 3 . 1 . 1
Let a and b be elements in k.If two hyperelliptic curves H a,b and H a ,b with reduced automorphism groups C 3 or C 9 are isomorphic, then (a, b) = (a , b ).Proof Assume that there exists an isomorphism ρ : H a,b → H a ,b .Then ρ is represented by (P, λ) ∈ GL 2 (k)×k × as in Lemma 2.1.2.Let ζ : ζ 3 be a primitive 3rd root of unity in k.For an order-3 automorphism σ 3 : (x, y) → (ζ x, ζ 2 y) on H a,b represented by A:=diag(ζ, 1), we set σ := σ 3 and τ :=ρ −1 σρ; H a,b σ This is a contradiction since f a ,b has degree 10.Thanks to the above lemma, we need not conduct the isomorphism classification on H a,b 's with Aut(H a,b ) ∼ = C 3 or C 9 collected in Step 2 of the main algorithm provided in Sect. 4 below.If Aut(H a,b ) is not isomorphic to C 3 nor C 9 , recall from Sect.2.1 that Aut(H a,b ) ∼ = A 4 and Aut(H a,b ) ∼ = SL 2 (F 3 ).

Lemma 3 . 1 . 3 .Lemma 3 . 2 . 1
Aut(H a,b ) ∼ = A 4 if and only if there exist roots a 1 and a 2 of f a,b satisfying the condition (2) of Lemma 3.1.2for f = f a,b and g = 4. 21 3.2 Cartier-Manin Matrices In this subsection, we determine the form of the Cartier-Manin matrix M a,b of H a,b : y 2 = f a,b (x) with respect to the basis A:={ 1 y dx, x y dx, x 2 y dx, x 3 y dx} of H 0 (H a,b , 1 H a,b ) given in Sect.2.2.For each l with 0 ≤ l ≤ 5( p − 1), we denote by c l the x l -coefficient of f ( p−1)/2 a,b With notation as above, the Cartier-Manin matrix M a,b of H a,b is given as follows: a straightforward computation shows that the ramification points in H a,b / σ • ι of the degree-6 cyclic cover π : H a,b → H a,b / σ • ι (x : y : z) → (x 3 : x 2 y 2 : z) are (0 : 0 : 1), (0 : 1 : 0), and (A i : 0 : 1) for 1 ≤ i ≤ 3, whose ramification indexes are 6, 3, and 2 respectively.Hence, H a,b is birational to an affine plane curve of the form (2.3.1) with n = 6 and r = 5, so that we can take (n 1 , n 2 , n 3 , n 4 , n 5 ) = (1, 2, 3, 3, 3).Letting ζ 6 be a primitive 6-th root of unity in k, we decomposeH 0 (H a,b , 1 H a,b ) = 5 i=0 D i as in Sect.2.3, where D i is the ζ i 6 -eigenspace.The dimensions d i of D i for 1 ≤ i ≤ 5 are computed by (2.3.3), say d 0 = 0, d 1 = 1, d 2 = 0, d 3 = 1, d 4 = 0 and d 5 = 2. Choosing a basis B = {w

2 }
are bases of D 1 , D 3 and D 5 respectively, it follows form (2.3.4) that we have the following:
).Since the degree of each non-zero entry of M a,b is O( p) (both in a and b), the resultants are computed in Õ( p 3 ) [38], and their gcd in (2) is computed in Õ( p 2 ).Letting the degree of the gcd be d = O( p 2 ), one can compute its roots in F p 2 with complexity Õ(d 2 ).For each root b 0 (O(d) possible choices), evaluate it to b of M a,b in time O( p), and compute the gcd of non-zero entries of M a,b 0 in time Õ( p).The roots in F p 2 of the second gcd are also computed in Õ( p 2 ).Step 2-2 is clearly done in constant time.Thus, the complexity of Step 2 is upper-bounded by Õ( p 3 + d 2 + dp 2 ).Note that the number of roots (a 0 , b 0 ) is O( p 2 ).As for Step 3, checking the condition in Lemma 3.1.3is done in constant time for each root (a 0 , b 0 ), so that the complexity of Step 3 is O( p 2 ).

Lemma 4 . 1 . 2
The Cartier-Manin matrix M a,b in Step 1 is computed in time O( p 3 ).

2 .
For each a ∈ F q , compute M a,b in time O( p 2 ) keeping b as a parameter.Then brute force on b:Test gcd( f, f ) = 1 or not in constant time.If gcd( f, f ) = 1, evaluate it to M a,b in time O( p).The total complexity is O(q 2 q). 3.For each a ∈ F q , computeM a,b in time O( p 2 ) keeping b as a parameter.Compute the gcd of non-zero entries of M a,b in time Õ( p).Compute the roots of the gcd in time Õ( p 2 ).For each root b, test gcd( f, f ) = 1 or not in constant time.The total complexity is Õ(qp 2 ). 4. Compute M a,b in time O( p 3 ) keeping a and b as parameters.Then brute force on (a, b): Test gcd( f, f ) = 1 or not in constant time.If gcd( f, f ) = 1, evaluate it to M a,b in time O( p).The total complexity is O( p 3 + q 2 p). 5. Compute M a,b in time O( p 3 ) keeping a and b as parameters.Then brute force on a: Evaluate it to M a,b in time O( p), and compute the gcd of non-zero entries of M a,b in time Õ( p).Compute the roots of the gcd in time Õ( p 2 ).For each root b, test gcd( f, f ) = 1 or not in constant time.The total complexity is Õ( p 3 + qp 2 ).
H a,b 's with a, b ∈ F p 2 for all 17 ≤ p < 1000 took 6,300 s (about 1.75 h) in total, and the execution for p = 997 took only 195 seconds.The degree of the gcd of the resultants computed in Step 2 and the number of isomorphism classes of obtained H a,b 's might follow O( p), which implies that the complexity of Step 2 is Õ( p 3 ) in practice, see Theorem 4.1.1.Most of time is spent at Step 2. We see from tables in a pdf (named as NKT_table.pdf)available at [40] that Steps 1 and 2 might follow our estimations O( p 3 ) and Õ( p 3 ) respectively.As for Step 3, our estimation in the proof of Theorem 4.1.1 is O( p 2 ), but it might be O( p) in practice since the number of (a, b) for which H a,b is a s.sp.hyperelliptic curve would be O( p).

Remark 4 . 2 . 1
When p ≡ 1 (mod 3), the non-superspeciality of H a,b for some (a, b) with b = 0 is deduced from that of E a,b : Y 2 = X (X 3 + X 2 +a X +b), which is a quotient curve of H a,b by the order-3 automorphism σ 3 defined

Table 1
Possible finite groups isomorphic to Aut(H ) for hyperelliptic curves H of genus 4 over an algebraically closed field k of characteristic p ≥ 7, and hyperelliptic equations y 2 There exist precisely 5 (resp.25) superspecial hyperelliptic curves of genus 4 over F 17 (resp.F 17 2 ) up to isomorphism over F 17 (resp.F 17 2 ).Moreover, there exist precisely 2 superspecial hyperelliptic curves of genus 4 over F 17 up to isomorphism.

Table 2
The F p -isomorphism classes of all superspecial hyperelliptic curves H of genus 4 over the prime field F p for p = 17, 19, and 23 There exist precisely 14 superspecial hyperelliptic curves of genus 4 over F 23 up to isomorphism over F 23 .Moreover, there exist precisely 4 superspecial hyperelliptic curves of genus 4 over F 23 up to isomorphism over F 23 .
4, by focusing on the family H a,b : y 2 = x 10 + x7+ ax4+ bx with a, b ∈ k as in (3.0.1).4.1 Main Algorithm and Its Complexity Now, we construct an algorithm to enumerate superspecial hyperelliptic curves H a,b .For the efficiency, let us here restrict ourselves to the case where a and b belong to F p 2 .Main Algorithm below outputs the k-isomorphism classes of all s.sp.hyperelliptic curves of the form (3.0.1) with a, b ∈ F p 2 in time Õ( p 4 ).Moreover, if the gcd of resultants of non-zero entries of the Cartier-Manin matrix of H a,b has degree O( p), the complexity becomes Õ( p 3 ).Main Algorithm.For a prime p ≥ 7 as the input, conduct the following: 1. Regarding a and b as variables, compute the Cartier-Manin matrix M a,b of H a,b .2. Collect all (a, b) ∈ F 2 p 2 such that H a,b is a s.sp.hyperelliptic curve, as follows:

3 .
For each of H a,b 's collected in Step 2, check the condition of Lemma 3.1.3todecide whether Aut(H a,b ) ∼ = A 4 or not.Output one H a,b with Aut(H a,b ) ∼ = A 4 (if exists) and all of H a,b 's such that Aut(H a,b ) is not isomorphic to A 4 .Proof The correctness follows from Lemmas 2.2.2, 3.1.1,3.1.3,andTheorem 2.1.5.The complexity of Step 1 is estimated as O( p 3 ) by Lemma 4.1.2below.The most generic and efficient method for Step 2-1 is the following resultant-based method: (1) Compute resultants of non-zero entries of M a,b with respect to a (or b).(2) Compute the gcd in F p 2 [b] of the resultants and its roots in F p 2 .(3)For each root b 0 , evaluate it to b in M a,b , and then compute the gcd in F p 2 [a] of non-zero entries of M a,b 0 and its roots in F p 2 .We here note that, for a given univariate polynomial h(t) of degree D ≤ p 2 over mathbbF p 2 , one can compute its roots in F p 2 with complexity Õ( p 2 + D 2 ).Indeed, the gcd of h(t) and t p 2 − t is computed in Õ( p 2 ) with fast gcd algorithm, and it is a separable polynomial of degree ≤ D. Hence, computing the roots of the gcd is done just by equal-degree factorization, and its complexity is estimated as tildeO(D 2

Table 3
Computational results for 17 ≤ p < 1000 obtained by the execution of Main Algorithm in Theorem 4.1.1."Num. of H a,b " denotes the number of F p -isomorphism classes of obtained H a,b 's Implementation and Computational Results We implemented Main Algorithm on Magma V2.26-10 on a PC with macOS Monterey 12.0.1, at 2.6 GHz CPU 6 Core (Intel Core i7) and 16GB memory (cf.