Curves in characteristic 2 with non-trivial 2-torsion

Cais, Ellenberg and Zureick-Brown recently observed that over finite fields of characteristic two, all sufficiently general smooth plane projective curves of a given odd degree admit a non-trivial rational 2-torsion point on their Jacobian. We extend their observation to curves given by Laurent polynomials with a fixed Newton polygon, provided that the polygon satisfies a certain combinatorial property. We also show that in each of these cases, the sufficiently general condition is implied by being ordinary. Our treatment includes many classical families, such as hyperelliptic curves of odd genus and C_{a,b} curves. In the hyperelliptic case, we provide alternative proofs using an explicit description of the 2-torsion subgroup.


Introduction
The starting point of this note is a recent theorem by Cais, Ellenberg and Zureick-Brown [CEZB,Thm. 4.2], asserting that over a finite field k of characteristic 2, almost all smooth plane projective curves of a given odd degree d ≥ 3 have a non-trivial krational 2-torsion point on their Jacobian. Here, 'almost all' means that the corresponding proportion converges to 1 as #k and/or d tend to infinity. The underlying observation is that such curves admit • a 'geometric' k-rational half-canonical divisor Θ geom : the canonical class of a smooth plane projective curve of degree d equals (d − 3)H, where H is the class of hyperplane sections; if d is odd then 1 2 (d − 3)H is half-canonical, • an 'arithmetic' k-rational half-canonical divisor Θ arith (whose class is sometimes called the canonical theta characteristic), related to the fact that over a perfect field of characteristic 2, the derivative of a Laurent series is always a square [Mum,p. 191]. The difference Θ geom − Θ arith maps to a k-rational 2-torsion point on the Jacobian. The proof of [CEZB,Thm. 4.2] then amounts to showing that, quite remarkably, this point is generically non-trivial.
There exist many classical families of curves admitting such a 'geometric' half-canonical divisor. Examples include hyperelliptic curves of odd genus g, whose canonical class is given by (g − 1)g 1 2 (where g 1 2 denotes the hyperelliptic pencil), and smooth projective curves in P 1 k × P 1 k of even bidegree (a, b) (both a and b even, that is), where the canonical class reads (a − 2)R 1 + (b − 2)R 2 (here R 1 , R 2 are the two rulings of P 1 k × P 1 k ). The families mentioned so far are parameterized by sufficiently generic polynomials that are supported on the polygons respectively. The following lemma, which is an easy consequence of the theory of toric surfaces (see Section 2), gives a purely combinatorial reason for the existence of a halfcanonical divisor in these cases.
Lemma 1. Let k be a perfect field and let ∆ be a two-dimensional lattice polygon. For each edge τ ⊂ ∆, let a τ X + b τ Y = c τ be its supporting line, where gcd(a τ , b τ ) = 1. Suppose that the system of congruences admits a solution in Z 2 . Then any sufficiently general Laurent polynomial f ∈ k[x ±1 , y ±1 ] that is supported on ∆ defines a curve carrying a k-rational half-canonical divisor on its non-singular complete model.
In the proof of Lemma 1 below, where we describe this half-canonical divisor explicitly, we will be more precise on the meaning of 'sufficiently general'.
Here again, when specializing to characteristic 2, there is, in addition, an arithmetic k-rational half-canonical divisor. So it is natural to wonder whether the proof of [CEZB,Thm. 4.2] still applies in these cases. We will show that it usually does.
Theorem 2. Let ∆ be a lattice polygon satisfying the conditions of Lemma 1, where in addition we assume that ∆ is not unimodularly equivalent to 1 3 (3, 1) with k even and ℓ odd.
Then there exists a non-empty Zariski open subset S ∆ /F 2 of the space of Laurent polynomials that are supported on ∆ having the following property. For every perfect field k of characteristic 2 and every f ∈ S ∆ (k), the Jacobian of the non-singular complete model of the curve defined by f has a non-trivial k-rational 2-torsion point.
Right before the proof of Theorem 2 we will define the set S ∆ explicitly. As a consequence, if k is a finite field of characteristic 2, then the proportion of Laurent polynomials that are supported on ∆, which define a curve whose Jacobian has a non-trivial k-rational 2-torsion point, tends to 1 as #k → ∞. (See the end of Section 3, where we also discuss asymptotics for increasing dilations of ∆, i.e. the analogue of d → ∞ in the smooth plane curve case.) This observation seems new even for hyperelliptic curves of odd genus. 1 In this case we can give an alternative proof yielding sufficient conditions having a more arithmetic flavor (such as being ordinary); see Section 4. Another interesting class of examples is given by the polygons a b 0 1 In view of the asymptotic consequences discussed in Section 3, this observation shows that [CFHS,Principle 3] can fail for g > 2.
where a and b are not both even. The case a = b corresponds to the smooth plane curves of odd degree considered in [CEZB]. The case gcd(a, b) = 1 corresponds to so-called C a,b curves. The case b = 2, a = 2g + 1 (a subcase of the latter) corresponds to hyperelliptic curves having a prescribed k-rational Weierstrass point P . Note that in this case g 1 2 ∼ 2P , so there is indeed always a k-rational half-canonical divisor, regardless of the parity of g. Finally, the case b = 3, a ≥ 4 corresponds to trigonal curves having maximal Maroni invariant (that is trigonal curves for which the series (h 0 (ng 1 3 )) n∈Z ≥0 starts increasing by steps of 3 as late as the Riemann-Roch theorem allows it to do); if a = 6, these are exactly the genus-4 curves having a unique g 1 3 .
Remark 3. This explains why Denef and Vercauteren had to allow a factor 2 while generating cryptographic hyperelliptic and C a,b curves in characteristic 2; see Sections 6 of [DV1,DV2].

Half-canonical divisors from toric geometry
Let k be a perfect field and let f = (i,j)∈Z 2 c i,j x i y j ∈ k[x ±1 , y ±1 ] be an absolutely irreducible Laurent polynomial. Let be the Newton polygon of f , which we assume to be two-dimensional. We say that f is non-degenerate with respect to its Newton polygon if for every face τ ⊂ ∆(f ) (vertex, edge, or ∆(f ) itself) the system has no solutions over an algebraic closure of k. For a given Newton polygon ∆ = ∆(f ), the condition of non-degeneracy is generically satisfied, in the sense that it is characterized by the non-vanishing of (where Res ∆ is the sparse resultant; ρ ∆ does not vanish identically in any characteristic [CV,§2]). Let C f be the curve in T 2 k = Spec k[x ±1 , y ±1 ] cut out by f and let Tor k (∆(f )) be the toric surface corresponding to ∆(f ); it is a compactification of T 2 k to which the selfaction of T 2 k extends algebraically. There is a natural dimension-preserving bijection between the orbits of this extended action and the faces of ∆(f ); for each face τ , write O(τ ) for the corresponding orbit. Then geometrically, the condition of non-degeneracy means that C f is a non-singular curve in T 2 k = O(∆(f )) compactifying to a curve C ′ f in Tor k (∆(f )) that does not contain any of the zero-dimensional O(τ )'s and that intersects the one-dimensional O(τ )'s transversally.
In particular, since Tor k (∆(f )) is normal, non-degeneracy implies that C ′ f is a nonsingular complete model of C f . See [CDV,§2] for a more detailed description of this construction.
f is a degree-d polynomial with non-zero coefficients at 1, x d , y d . In this case Tor k (∆(f )) is just the projective plane, and the toric orbits are T 2 k = O(∆(f )), the three coordinate points (1 : 0 : 0), (0 : 1 : 0) and (0 : 0 : 1) (which are the orbits of the form O(vertex)), and the three coordinate axes from which the coordinate points are removed (these are the orbits of the form O(edge)). Then f is non-degenerate with respect to its Newton polygon if and only if C f compactifies to a non-singular projective plane curve that is non-tangent to any of the coordinate axes, and that does not contain any of the coordinate points.
Example 5. Let g ≥ 2 be an integer, and consider and Tor k (∆(f )) is the weighted projective plane P k (1 : g + 1 : 1). Here again, f is nondegenerate with respect to its Newton polygon if and only if C ′ f is a non-singular curve that is non-tangent to the coordinate axes and does not contain any coordinate points. In this case C ′ f is a hyperelliptic curve of genus g (cf. Remark 8). Now for each edge τ ⊂ ∆(f ) let ν τ ∈ Z 2 be the inward pointing primitive normal vector to τ , let p τ be any element of τ ∩ Z 2 , and let D τ be the k-rational divisor on C ′ f cut out by O(τ ). If f is non-degenerate with respect to its Newton polygon, then one can show Here ·, · is the standard inner product on R 2 . See [CDV,Cor. 3] for an elementary but elaborate proof of (2). It is possible to give a more conceptual proof using adjunction theory.
Remark 6. Using the theory of sparse resultants, one can show that ∂f /∂y does not vanish identically, so that the left-hand side of (2) makes sense. Note also that df = ∂f ∂x dx + ∂f ∂y dy = 0, so we could as well have written Proof of Lemma 1. Assume that f is such that ∆(f ) = ∆ and that it is non-degenerate with respect to its Newton polygon (which, as mentioned above, is a non-empty Zariski open condition). Let (i 0 , j 0 ) ∈ Z 2 be a solution to the given system of congruences. Then the translated polygon (−i 0 , −j 0 ) + ∆ is such that all corresponding ν τ , p τ 's are odd. So by applying the above to Then the condition of nondegeneracy restricts our attention to smooth plane curves of degree d that do not contain the coordinate points and that intersect the coordinate axes transversally. But of course any smooth plane curve of degree d carries a k-rational half-canonical divisor. This shows that the non-degeneracy condition, even though it is generically satisfied, is sometimes a bit stronger than needed. 2 In general, the according weaker condition reads that C f compactifies to a non-singular curve in Tor k (∆). Here we have to revisit Remark 6, however: there do exist instances of absolutely irreducible Laurent polynomials f ∈ k[x ±1 , y ±1 ] for which C f compactifies to a non-singular curve in Tor k (∆(f )), yet for which ∂f /∂y does vanish identically (example: f = 1 + x 2 y 2 + x 3 y 2 ). For these instances of f the left-hand side of (2) does not make sense. But in that case ∂f /∂x does not vanish identically (otherwise C f would have singularities), and one can prove that (2) holds with the left-hand side replaced by (3).
Remark 8. We mention two other well-known features of non-degenerate Laurent polynomials, that can be seen as consequences to (2); see for instance [CV] and the references therein: • the geometric genus of

Proof of the main result
Lemma 9. Let ∆ be a two-dimensional lattice polygon and suppose as in Lemma 1 that (1) admits a solution in Z 2 . If ∆ is not among the polygons excluded in the hypothesis of Theorem 2, then there is a solution of (1) contained in ∆ ∩ Z 2 .
Proof. Let us first classify all two-dimensional lattice polygons ∆ for which the reductionmodulo-2 map π ∆ : ∆ ∩ Z 2 → (Z/(2)) 2 is not surjective. If the interior lattice points of ∆ lie on a line, then surjectivity fails if and only if ∆ is among 2 The reader might want to note that there always exists an automorphism of P 2 k that puts our smooth plane curve in a non-degenerate position (at least if #k is sufficiently large). But for more general instances of ∆, the automorphism group of Tor k (∆) may be much smaller (e.g. the only automorphisms may be the ones coming from the T 2 k -action), in which case it might be impossible to resolve tangency to the one-dimensional toric orbits. (2, 0), (up to unimodular equivalence). This assertion follows from Koelman's classification; see [Koe,Ch. 4] or [Cas,Thm. 10]. As a consequence, any two-dimensional ∆ for which π ∆ is not surjective must contain one of the polygons (a-d) as an 'onion skin', i.e. as a lattice polygon obtained by subsequently taking the convex hull of the interior lattice points. But using the criterion from [HS, one sees that the only polygons in (a-d) that can appear as convex hull of the interior lattice points of a strictly bigger lattice polygon Γ are the polygons (a) with k = 1 or k = 2, the polygon (b) and the polygon (c). The only corresponding instance of Γ for which π Γ is not surjective is which, again by [HS,, is an onion skin only of itself. This ends the classification. Now let ∆ be a two-dimensional lattice polygon and suppose that (1) admits a solution in Z 2 . If π ∆ is surjective, then it clearly also admits a solution in ∆ ∩ Z 2 . So we may assume that ∆ is among (a-e). Then the lemma follows by noting that cases (b), (c) and (d) with ℓ even admit the solution (1, 1) ∈ ∆ ∩ Z 2 , and that cases (a), (e) and (d) with ℓ odd were excluded in theénoncé.
Remark 10. Because of Remark 8, the excluded polygons correspond to certain classes of smooth plane quartics, rational curves, and hyperelliptic curves, respectively.
We can now define the variety S ∆ mentioned in the statement of Theorem 2. Namely, we will prove the existence of a non-trivial k-rational 2-torsion point under the assumption that • ∆(f ) = ∆ and f is non-degenerate with respect to its Newton polygon (i.e. the genericity assumption from Lemma 1), and • for at least one solution (i 0 , j 0 ) ∈ ∆ ∩ Z 2 to the system of congruences (1), the corresponding coefficient c i 0 ,j 0 is non-zero. So we can let S ∆ be defined by c i 0 ,j 0 ρ ∆ = 0.

.2].
Proof of Theorem 2. By replacing f with x −i 0 y −j 0 f if needed, we assume that (0, 0) ∈ ∆ is a solution to the system of congruences (1) and that the constant term of f is non-zero. As explained in [Mum,p. 191], C ′ f comes equipped with a k-rational divisor Θ arith such that 2Θ arith = div dx. (Recall that the derivative of a Laurent series over k is always a square, so the order of dx at a point of C ′ f is indeed even.) On the other hand, Lemma 1 and its proof provide us with a k-rational divisor Θ geom such that 2Θ geom = div dx xy ∂f ∂y .
In order to prove that Θ geom ∼ Θ arith (and hence that Jac(C ′ f ) has a non-trivial k-rational 2-torsion point), we need to show that xy ∂f ∂y is a non-square when considered as an element of the function field k(C f ). If it were a square, then there would exist Laurent polynomials α, G, H such that where f ∤ H. Taking derivatives with respect to y yields which together with (4) results in Since f is irreducible, it follows that f | (α + H 2 x) or f | G 2 . Using (4) and f ∤ H, the latter implies that f | ∂f ∂y , which is a contradiction (by the theory of sparse resultants, see Remark 6; one can alternatively repeat the argument using (3) if wanted). So we know that f | (α + H 2 x). Along with (4) we conclude that there exists a Laurent polynomial β ∈ k[x ±1 , y ±1 ] such that Taking derivatives with respect to x yields Since f has a non-zero constant term, the large factor between brackets is non-zero. On the other hand, since f ∤ H, it must be a multiple of f 2 . Note that ∆(f 2 ) = 2∆(f ), while ∆(f + · · · + xy∂ 2 f /(∂x∂y)) ⊂ ∆(f ). This is a contradiction.
We end this section by discussing some asymptotic consequences to Theorem 2.
Growing field size. Let ∆ be a two-dimensional lattice polygon satisfying the conditions of Theorem 2. Let k be a finite field of characteristic 2. Because non-degeneracy is characterized by the non-vanishing of ρ ∆ , the proportion of Laurent polynomials f ∈ k[x ±1 , y ±1 ] that are non-degenerate with respect to their Newton polygon ∆(f ) = ∆ (amongst all Laurent polynomials that are supported on ∆) converges to 1 as #k → ∞. Then Theorem 2 implies: ] is non-degenerate with respect to its Newton polygon ∆(f ) = ∆ = 1.
In the table below we denote by i the square [0, i] 2 (for i = 2, 3, 4), by H g the hyperelliptic polygon conv{(0, 0), (2g + 2, 0), (0, 2)} (for g = 7, 8), and by E the exceptional polygon conv{(1, 0), (3, 1), (0, 3)} from the statement of Theorem 2. Each entry corresponds to a sample of 10 4 uniformly randomly chosen Laurent polynomials f ∈ k[x ±1 , y ±1 ] that are supported on 2 , 3 , . . . The table presents the proportion of f 's for which Jac(C ′ f ) has a non-trivial k-rational 2-torsion point, among those f 's that are non-degenerate with respect to their Newton polygon ∆(f ) = 2 , 3 , . . . An entry '-' means that we did not do the computation because it would take too long. The computations were carried out using Magma [BCP].  Note that the conditions of Theorem 2 are satisfied for 2 , 4 and H 7 . So here we proved that the proportion converges to 1. In the case of H 8 , by the material in Section 4 (see Corollary 16) we know that the proportion converges to 8 9 . In the other two cases 4 and E we have no clue, so our best guess is that these follow the GL g (F 2 )-model.
Growing polygon. Let k be a finite field of characteristic 2. If ∆ is a two-dimensional lattice polygon satisfying the conditions of Lemma 1, then the same holds for each odd Minkowski multiple (2n + 1)∆. It seems reasonable to assume that the proportion of Laurent polynomials f ∈ k[x ±1 , y ±1 ] that are non-degenerate with respect to their Newton polygon ∆(f ) = (2n + 1)∆ (amongst all Laurent polynomials that are supported on (2n + 1)∆) converges to a certain strictly positive constant.
If Tor k (∆) is smooth then this is certainly true for the larger proportion of Laurent polynomials f satisfying the weaker condition from Remark 7, namely that C f compactifies to a non-singular curve in Tor k ((2n + 1)∆). Indeed, using [Poo2, Thm. 1.1] one can show that this proportion converges to as n → ∞; here Z Tor k (∆) is the Hasse-Weil Zeta function of Tor k (∆), and r(∆) is the number of vertices of ∆.
On the other hand, the number of solutions to (1) inside (2n + 1)∆ ∩ Z 2 tends to infinity. So the assumption would allow one to conclude: ] is non-degenerate with respect to its Newton polygon ∆(f ) = (2n + 1)∆ = 1. This is again deviating statistical behavior: in view of Cohen-Lenstra type heuristics, one naively expects a probability of about see [CEZB] for some additional comments.

Hyperelliptic curves of odd genus
Let C be a hyperelliptic curve of genus g over a perfect field k. Then C has a smooth weighted projective plane model where H and F in k[X, Z] are homogeneous of degrees g + 1 and 2g + 2 respectively. The Newton polygon of (the defining polynomial of) the corresponding affine model y 2 + H(x, 1)y − F (x, 1) = 0 is contained in a triangle with vertices (0, 0), (2g + 2, 0) and (0, 2), and is generically equal to this triangle. In particular, Theorem 2 implies that if the characteristic of k is 2 and C is sufficiently general of odd genus, then its Jacobian has a non-trivial k-rational 2-torsion point. The purpose of this section is to show that we can replace 'sufficiently general' by 'ordinary' in this case (Corollary 14), and to give explicit examples of the rational halfcanonical divisors from the proof of Theorem 2.
Theorem 12. Let C/k be a hyperelliptic curve over a perfect field k of characteristic 2 given by a smooth model (5). The Jacobian of C has no rational point of order 2 if and only if H(X, Z) is a power of an irreducible odd-degree polynomial in k[X, Z].
Corollary 13. Let C/k be a hyperelliptic curve of odd 2-rank over a perfect field k of characteristic 2. Then the Jacobian of C has a k-rational point of order 2.
Corollary 14. Let C/k be an ordinary hyperelliptic curve of odd genus over a perfect field k of characteristic 2. Then the Jacobian of C has a k-rational point of order 2.
Corollary 15. Let C/k be a hyperelliptic curve of genus 2 m − 1 over a perfect field k of characteristic 2, for some integer m ≥ 2. If the Jacobian of C has no k-rational point of order 2, then it has 2-rank zero, but it is not supersingular.
Finally, for integers g, r ≥ 1, let c g,r be the proportion of equations (5) over F 2 r that define a curve of genus g whose Jacobian has at least one rational point of order 2.
Corollary 16. The limit lim r→∞ c g,r exists and we have lim r→∞ c g,r = 1 if g is odd, g/(g + 1) if g is even.
Proof of Theorem 12. All we need to do is describe the two-torsion of the Jacobian Jac(C) of C. Since we were not able to find a ready-to-use statement in the literature, we give a stand-alone treatment, even though what follows is undoubtedly known to several experts in the field; for instance, it is implicitly contained in [EP]. Let k be an algebraic closure of k. Note that C has a unique point Q (a:b) = (a : F (a, b) . This gives n points, where n ∈ {1, . . . , g + 1} is the number of distinct roots of H. Let D be the divisor of zeroes of a vertical line, so D is effective of degree 2. All such divisors D are linearly equivalent, and are linearly equivalent to 2Q (a:b) for each (a : b). In particular, if we let then we have a homomorphism In fact, this map is an isomorphism. Indeed, it is injective because if the divisor of a function is invariant under the hyperelliptic involution, then so is the function itself, i.e. it is contained in k(x). But at the points Q (a:b) such functions can only admit poles or zeroes having an even order. Surjectivity follows from the fact that Jac(C)(k)[2] is generated by divisors that are supported on the Weierstrass locus of C. This can be seen using Cantor's algorithm [Kob,, for the application of which one needs to transform the curve to a so-called imaginary model; this is always possible over k. Alternatively, surjectivity follows from the injectivity and the fact that #Jac(C)(k)[2] = 2 n−1 by [EP,Thm. 1.3]. Then in particular, the rational 2-torsion subgroup Jac(C)(k)[2] is isomorphic to the subgroup of elements of A that are invariant under Gal(k/k), that is, to where the sum is taken over the irreducible factors P of H.
The only way for A k to be trivial is for H to be the power of an irreducible factor P of odd degree.
Proof of Corollary 13. Let n be the degree of the radical R of H. The 2-rank of C equals n − 1 (as in the proof of Theorem 12; see e.g. [EP,Thm. 1.3]). So if the 2-rank is odd, then R has even degree, which implies that H is not a power of an odd-degree polynomial. In particular, Theorem 12 implies that C has a non-trivial k-rational 2-torsion point.
Proof of Corollary 14. This is a special case of Corollary 13 since in characteristic 2, the 2-rank of an ordinary abelian variety equals its dimension.
Proof of Corollary 15. If there is no rational point of order 2, then H is a power of a polynomial of odd degree dividing deg(H) = g + 1 = 2 m . In other words, it is a power of a linear polynomial and hence the 2 rank of C is zero. There are no supersingular hyperelliptic curves of genus 2 m − 1 in characteristic 2 by [SZ,Thm. 1.2].
Proof of Corollary 16. As r → ∞, the proportion of equations (5) for which H is not separable becomes negligible. By Theorem 12 it therefore suffices to prove the corresponding limit for the proportion of degree g + 1 polynomials that are not irreducible of odd degree. If g is odd then this proportion is clearly 1. If g is even then this is the same as the proportion of reducible polynomials of degree g + 1, which converges to 1 − (g + 1) −1 .
Remark 17. In Corollary 16, instead of working with the proportion of equations (5), we can work with the corresponding proportion of F 2 r -isomorphism classes of hyperelliptic curves of genus g. This is because the subset of equations (5) that define a hyperelliptic curve of genus g whose only non-trivial geometric automorphism is the hyperelliptic involution (inside the affine space of all equations of this form) is non-empty [Poo1], open, and defined over F 2 (being invariant under the Gal(F 2 , F 2 )-action). See also [Zhu].
Theorem 2 proves Corollary 14 for sufficiently general curves. We finish by showing that the 2-torsion points from both proofs are equal. The proof of Theorem 2 provides Θ arith and Θ geom with 2Θ arith ∼ 2Θ geom , hence the class of T = Θ arith − Θ geom is twotorsion. We have 2Θ arith = div dx. To compute 2Θ geom , we need to take an appropriate model as in the proof of Lemma 1. The bivariate polynomial y 2 + H(x, 1)y + F (x, 1) gives an affine model of our hyperelliptic curve C, and if g is odd, then the system from Lemma 1 admits the solution (1, 1). By the proof of that lemma, we should then look at the toric model C ′ f where f = x −1 (y + H(x, 1) + y −1 F (x, 1)).
We find T = Θ arith − Θ geom = 1 2 div xy ∂f ∂y = 1 2 div H(x, 1), where div H(x, 1) is twice the sum of all points P (a:b) as (a : b) ranges over the roots of H(X, Z) in P 1 k (with multiplicity), minus (g + 1) times the divisor D of degree 2 at infinity. So both proofs give the same 2-torsion point in cases where they both apply.