This page lists zeta functions of various genus 2 and genus 3 hyperelliptic curves with cryptographically interesting Jacobians or trace zero varieties. Before starting the tour, you may want to check out the page of definitions and notation.

Most of the curves in our gallery have small coefficients and are defined over fields F_{p} where
*p* is a prime of the form 2^{n}-k (near Mersenne). Such curves are convenient to work with (and to type into a web-page). The algorithm
used to find all the curves listed here is generic and does not depend on either the coefficients or the particular finite field used (we have some random examples in our collection as well).

Questions, commments, and corrections are welcomed at drew@math.mit.edu.

Our first example is also our most recent addition. This genus 2 curve has L-polynomial
P(*z*) = *p*^{2}*z*^{4} + *apz*^{3}+ *bz*^{2}+ *az* + 1 with coefficients

The order of the Jacobian is the 188-bit value

The 182-bit prime factor is the largest in our collection of genus 2 Jacobians over prime fields (its binary logarithm is 181.2186..., I call it a 182-bit number for the same reason I call 23 a 2-digit number).

To verify this result, one may use Magma, Sage, or any system that implements the Jacobian group operation for genus 2 hyperelliptic curves. For near-prime Jacobian orders N=*cp'*, it suffices to find
an element α in J(C) for which α^{N} is the identity, but α^{c} is not. This will be true of almost every element in the group, so a random α suffices. This test
demonstrates that *p'* is a divisor of #J(C). For large *p'*, there is exactly one multiuple of *p'* in the Weil interval, namely N, which must be #J(C).

This proves the value #J(C) is correct, but is not sufficient to verify the zeta function. One can additionally check that P(-1) = #J(C'), where C' is the quadratic twist, and/or
test the values of #J_{k}(C) given by summing P(*z*) over the *k*th roots of unity. The attached Magma transcript demonstrates
this for the curve above.

Another curve in the same family, also with a near-prime order Jacobian. The L-polynomial coefficients are

The Jacobian is a cyclic group of order

The large prime factor contains just over 179 bits.

This curve was formerly our genus 2 champion over a prime field. The mersenne prime and sparse coefficients make it particularly convenient to work with. The L-polynomial coefficients are

The order of the Jacobian is the 178-bit value

This is a cyclic group. The large prime factor contains 171 bits.

This is a genus 3 curve. Its L-polynomial has the form

with coefficients

The order of the Jacobian is the 183-bit value

The Jacobian is not a cyclic, rather it is the product of two cyclic groups of order 2 and a cyclic group of order #J(C)/4 (the 2-rank is three, the 3-rank is one). The 160-bit prime factor is the largest in our collection of genus 3 Jacobians over prime fields.

The L-polynomial of this genus 3 curve has coefficients

The order of the Jacobian is the 150-bit prime

This is a genus 2 curve with a trace zero variety of prime order. The L-polynomial coefficients are

The trace zero variety over F

Here ω is a principle cube-root of unity. Since #J(C)=P(1) is not divisible by 3, J

The Mersenne prime *p* = 2^{61}-1 fits conveniently in a 64-bit word, enabling very fast group operations on a 64-bit platform. This curve was found
during a scan of curves of the form *x*^{5} + *x* + *t*. The coefficients of P(z)
are

This curve has the distinction that #J

#J

Since #J(C)=P(1) and #J(C')=P(-1) are not divisible by 3, the two groups J

This is a similar example with random coefficients. The coefficients of the L-polynomial are

Like the curve above, the trace zero varieties of both C and C' over F

#J

As above, neither P(1) nor P(-1) are divisible by 3.