Logarithmic Density of Rank $\geq 1$ and Rank $\geq 2$ Genus-2 Jacobians and Applications to Hyperelliptic Curve Cryptography

Technical Summary: Logarithmic Density of Rank $\ge 1$ and Rank $\ge 2$ Genus-2 Jacobians and Applications to Hyperelliptic Curve Cryptography

Problem Statement
The paper addresses the quantitative distribution of Mordell–Weil ranks for Jacobians of genus-2 curves defined over $\mathbb{Q}$. While the Mordell–Weil theorem guarantees that the group of rational points on a Jacobian decomposes into a finite torsion subgroup and a free abelian group of rank $r$, understanding the frequency of curves with $r \ge 1$ or $r \ge 2$ within families ordered by arithmetic size remains a central challenge in arithmetic geometry. Specifically, the authors investigate these distributions for hyperelliptic curves ordered by the naive height of their integral Weierstrass models. A secondary objective is to analyze the rank distribution within families of quadratic and biquadratic twists, particularly for curves with split Jacobians, to assess their utility in the context of Regev's quantum algorithm for the discrete logarithm problem (DLP).

Methodology
The authors employ a combination of geometric, analytic, and computational techniques:

1. Geometric Framework and Universal Sections: The study utilizes the parameter space of integral Weierstrass models $y^2 + h(x)y = f(x)$. The authors define a universal section $\alpha_{\text{univ}} = [\infty_+ - \infty_-]$ on the universal Jacobian, corresponding to the difference of the two points at infinity. They prove that this section is not torsion in the generic fiber.
2. Torsion Loci and Height Bounds: By establishing that the locus of parameters where $\alpha_{\text{univ}}$ specializes to a torsion point is a Zariski-closed subset of lower dimension, and by bounding the size of torsion subgroups in terms of the curve's height (using Faltings height and $\theta$-height comparisons), the authors show that the proportion of curves where this section is torsion tends to zero as the height bound $X \to \infty$.
3. Néron Specialization: To establish rank $\ge 2$, the authors construct explicit two-parameter subfamilies where two independent sections (one being $\alpha_{\text{univ}}$ and another constructed via a specific specialization) are generically independent. They apply Néron's specialization theorem to show that for almost all specializations, the rank is at least 2.
4. Split Jacobian Constructions: For curves with split Jacobians (isogenous to products of elliptic curves), the authors utilize gluing constructions (following Gajovi'c–Park and [33]) to relate the rank of the genus-2 Jacobian to the ranks of the constituent elliptic curves. They analyze quadratic and biquadratic twist families of these split curves.
5. Computational Verification: The theoretical results are supported by explicit searches in databases (LMFDB) and custom scripts (available in a GitHub repository) to verify independence of sections and compute ranks for specific families, including CM curves and split-Jacobian curves used in cryptography.

Key Contributions and Results

• Logarithmic Density for Rank $\ge 1$: The authors prove that the subset of genus-2 curves with two rational points at infinity (ensuring the existence of the section $\alpha_{\text{univ}}$) has a logarithmic density of at least $13/14$ with respect to the family of integral models ordered by height. Since the section is non-torsion for almost all such models, this yields an unconditional lower bound of logarithmic density $13/14$ for curves with Jacobian rank $r \ge 1$.
• Logarithmic Density for Rank $\ge 2$:
  • By constructing an explicit subfamily with two independent rational sections, the authors demonstrate an unconditional logarithmic density of at least $5/7$ for curves with rank $r \ge 2$.
  • They also identify a subfamily of curves with split Jacobians and rank $r \ge 2$, yielding a logarithmic density of at least $2/21$.
• Twist Families:
  • For genus-2 curves with split Jacobians isogenous to $E_1 \times E_2$ (where $E_1, E_2$ have full rational 2-torsion), assuming the Birch–Swinnerton-Dyer (BSD) conjecture, the authors show that the family of double quadratic twists contains a positive proportion ($1/4$) of curves with rank $\ge 2$.
  • For curves with Jacobians isogenous to $E^2$ where $E$ admits a rational 3-isogeny, they prove unconditionally that the family of quadratic twists contains a positive proportion of curves with rank $\ge 2$.
• Cryptographic Implications: The paper analyzes the "High Rank Curve Problem" and the "High Rank Twist Problem" in the context of Regev's quantum algorithm. Regev's algorithm for DLP in Jacobians benefits from a parameter $d = r + 2$, where $r$ is the rank of a rational lift or compatible twist. The results imply that finding curves (or twists) with high rank is significantly more efficient than a naive brute-force search, with the complexity reduced from $O(X^7)$ to $O(X^{1/2})$ for rank $\ge 1$ and $O(X^2)$ for rank $\ge 2$ in the relevant height ordering. The authors provide explicit examples of high-rank twists for curves used in hyperelliptic curve cryptography (HECC), such as $y^2 = x^5 + a$ and split-Jacobian families, demonstrating that rank-6 to rank-8 twists exist within computationally feasible search spaces.

Significance
The paper provides the first unconditional lower bounds on the logarithmic density of genus-2 curves with positive Mordell–Weil rank and rank at least 2, ordered by naive height. It moves beyond heuristic predictions (such as those from random matrix models) to rigorous geometric proofs.

The significance is twofold:

1. Arithmetic Geometry: It resolves the existence and density of high-rank curves in a quantitative manner, showing that "thin" sets of high-rank curves are actually much denser (in a logarithmic sense) than previously quantified. The construction of explicit subfamilies with rank $\ge 2$ offers a concrete source of such curves.
2. Cryptanalysis: The results directly impact the security analysis of hyperelliptic curve cryptography against Regev's quantum algorithm. By quantifying the abundance of high-rank twists and lifts, the paper suggests that the "preprocessing" step required to supply the necessary Mordell–Weil generators for Regev's algorithm is computationally feasible for a wide range of curve families, including those with split Jacobians. This implies that for curves where such high-rank structures exist, the effective security against this specific quantum attack may be lower than anticipated, as the parameter $d$ can be increased, reducing the quantum circuit size.

The authors maintain a modest tone regarding the cryptographic implications, clarifying that their work identifies curves suitable as inputs for the Regev-style attack or experimental preprocessing, rather than recommending them for secure curve selection. They emphasize that while these structures facilitate the high-rank preprocessing, they do not currently imply a faster discrete logarithm algorithm for general genus-2 Jacobians compared to existing methods, but rather make the specific quantum attack more viable.