Riccardo Salvati Manni

Sorina Ionica

Avinash Kulkarni

Yue Ren

Mahsa Sayyary

Yara Elias

Burçin Güneş

Rachel Newton

Ekin Ozman

Rachel Pries

Lara Thomas

Before anything else, I would like to thank my advisor Sylvain Duquesne for his enlightening advice and providing opportunities for the research direction in cryptography.

Second, I am deeply thankful to my co-advisor Christophe Ritzenthaler. He has introduced the beauties of computational aspects of algebraic geometry and number theory to me. Under no circumstances, he has never preserved

Conclusion Bibliography

Introduction (en Français)

Les courbes algébriques sont des objets centraux de la géométrie algébrique qui apparaissent dans la géométrie arithmétique et également dans diverses applications. Parmi elles, on peut citer par exemple la cryptographie ou encore la physique théorique. Dans cette thèse, nous les étudions sous ces différents aspects.

Calcul des Constantes Thêta

Une façon de comprendre une courbe algébrique est d'étudier la structure de groupe appelé jacobienne associé à la courbe. Les constantes thêta jouent un rôle important pour comprendre la relation entre une courbe et sa jacobienne.

Les calculs explicites des constantes thêta sont étroitement liés à un problème classique qui demande quelles variétés abéliennes complexes principalement polarisées apparaissait comme des variétés jacobiennes de courbes. Le problème est appelé le problème de Schottky et remonte à Riemann [START_REF] Riemann | Theorie der Abel'schen Functionen[END_REF][START_REF] Riemann | Über das Verschwinden der ϑ-Functionen[END_REF]. Le domaine a été amélioré par un large éventail des mathématiciens jusqu'à présent (voir [START_REF] Farkas | An explicit solution to the weak Schottky problem[END_REF] pour un historique bien écrit du sujet.). Une autre question connexe est d'essayer de récupérer explicitement la courbe à partir de sa jacobienne (voir [START_REF] Rosenhain | Abhandlung über die Functionen zweier Variabler mit vier Perioden[END_REF] pour le cas g = 2, [START_REF] Takase | A generalization of Rosenhain's normal form for hyperelliptic curves with an application[END_REF][START_REF] Koizumi | Remarks on Takase's paper "a generalization of Rosenhain's normal form with an application[END_REF] pour le cas hyperelliptique général, et [START_REF] Weber | Theorie der Abel'schen Funktionen vom Geschlecht[END_REF][START_REF] Guàrdia | On the Torelli problem and Jacobian Nullwerte in genus three[END_REF] pour le cas non-hyperelliptique lorsque g = 3). En outre, le sujet a de nombreuses applications dans différents domaines tels que la physique théorique [START_REF] Enolski | Thomae type formulae for singular Z N curves[END_REF] via des systèmes intégrables et la cryptographie [START_REF] Weng | Constructing hyperelliptic curves of genus 2 suitable for cryptography[END_REF] via des algorithmes de comptage de points de type AGM [START_REF] Ritzenthaler | Point counting on genus 3 non hyperelliptic curves[END_REF] et plus récemment la cryptographie basée sur les isogénies [START_REF] Lubicz | Arithmetic on abelian and Kummer varieties[END_REF].

Soit g ≥ 0 un entier. Notons M g l'espace de modules sur C des courbes de genre g et A g l'espace de modules des variétés abéliennes complexes principalement polarisées de dimension g. L'application de Torelli j : M g → A g [START_REF] Achter | Monodromy of the p-rank strata of the moduli space of curves[END_REF] fait correspondre à la classe d'isomorphisme d'une courbe à la classe d'isomorphisme de sa jacobienne avec sa polarisation canonique. Le problème de Schottky est de caractériser l'image de l'application j. L'approche classique du problème consiste à plonger A g dans un espace projectif et d'essayer de trouver l'idéal définissant l'image. Soit

H g = {τ ∈ GL g (C) | t τ = τ, Imτ > 0}
le demi-espace supérieur de Siegel constitué des matrices complexes g × g avec une partie imaginaire définie positive.

Pour τ ∈ H g , z = (z 1 , . . . , z g ) ∈ C g et

[q] = ε ε ′ ∈ Z g ⊕ Z g , la fonction thêta avec caractéristique [q] est ϑ[q](z, τ ) = n∈Z g exp πi(n + ε/2)τ t (n + ε/2) + 2πi(n + ε/2) t (z + ε ′ /2) .
L'évaluation de cette fonction en z = 0, qui est ϑ[q](τ ) = ϑ[q](0, τ ), est dite une constante thêta (Thetanullwerte) . La caractéristique [q] est dite paire (resp. impaire) si le produit scalaire habituel ε • ε ′ est paire (resp. impaire). La constante thêta ϑ[q](τ ) est dite paire (resp. impaire) si la caractéristique [q] est paire (resp. impaire). Notez que la constante thêta ϑ[q](τ ) est identiquement nulle pour tout τ ∈ H g si et seulement si la caractéristique [q] est impaire. D'autre part, tout τ ∈ H g définit une variété complexe abélienne principalement polarisée C g /(Z g +τ Z g ). Le groupe symplectique Sp(2g, Z) agit sur H g . Le quotient H g /Sp(2g, Z) est l'espace de modules A g . Il y a un revêtement fini A ′ g → A g où A ′ g est le quotient de H g par un certain sous-groupe (spécifiquement le sous-groupe Γ g (4, 8)) de Sp(2g, Z). Les caractéristiques thêta paires fournissent un application Φ : A ′ g → P 2 g-1 (2 g +1) , τ → (ϑ[q](τ )) q qui est une plongement lorsque q parcourt l'ensemble des caractéristiques thêta paires. L'étude pour déterminer toutes les relations entre les caractéristiques thêta paires revient alors à comprendre l'image de A g par l'application Φ (voir [START_REF] Manni | Modular varieties with level 2 theta structure[END_REF]). Dans le Chapitre 1, nous donnons un algorithme pour calculer la quatrième puissance du quotient de une donnée deux constantes thêta paires correspondant à une matrice de période dans H g d'une courbe non-hyperelliptique de toute genre g ≥ 3 dans le cas où une structure complète de niveau 2 est donnée. Soit C une courbe projective, lisse, nonhyperelliptique de genre g sur un corps k ⊆ C. Nous définissons le Jacobien de C comme C g /(Z g + τ Z g ) par rapport à un matrice de période normalisée τ dans H g . Elle sera notèe Jac(C). Une structure complète de niveau 2 est représentée par les équations définissant de C sous le plongement canonique et certains diviseurs sur la courbe avec un étiquetage approprié comme suit. De tels diviseurs sont appelés diviseurs thêta caractéristiques. Il existe deux types de diviseurs thêta caractéristiques, pair et impair, qui dépendent de la dimension des espaces de Riemann-Roch associés. Notez que les diviseurs thêta caractéristiques impairs correspondent à certains objets géométriques appelé multitangentes sur la courbe. Par exemple, ces objets sont dits bitangentes quand g = 3 et tritangentes quand g = 4.

(a) Bitangentes sur la courbe Trott [START_REF] Rocchini | Claudio Rocchini's Home Page[END_REF].

(b) Une tritangente d'une courbe avec trois ovals [START_REF] Kulkarni | Real space sextics and their tritangents[END_REF].

D'un autre côté, il existe une correspondance canonique entre les diviseurs thêta caractéristiques sur C et les formes quadratiques sur Jac [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF](C) sur F 2 , où Jac [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF](C) dénote les points de 2-torsion Jac(C). Les formes quadratiques sont étiquetées à travers une donnée combinatoire qui s'appelle une base d'Aronhold. La Section 1.1 rappelle une partie des prérequis mathématiques nécessaires pour l'algorithme.

Le calcul de ce quotient est bien connu et donné par une formule fermée pour une courbe de g ≤ 3 et des courbes hyperelliptiques de n'importe quel genre, (voir [START_REF] Thomae | Beitrag zur Bestimmung von ϑ(0, 0, ...0) durch die Klassenmoduln algebraischer Funktionen[END_REF][START_REF] Weber | Theorie der Abel'schen Funktionen vom Geschlecht[END_REF]). Ces formules peuvent être vues comme une description explicite de l'application de Torelli. En effet, une variété abélienne principalement polarisée peut être écrite comme une intersection de quadriques explicites dans un espace projectif [START_REF] Mumford | On the equations defining abelian varieties[END_REF]. Les coefficients de ces quadriques sont déterminés par des constantes thêta. Ces formules expriment des constantes thêta en termes de géométrie de la courbe. Dans le cas d'une courbe hyperelliptique donnée par y 2 = 2g+2 i=1 (xα i ), nous avons

ϑ[q](τ ) 4 = (2iπ) -2g • det(Ω 1 ) 2 • i,j∈U (α i -α j ),
où Ω 1 est la première moitié d'une matrice de période et U est un ensemble d'indices dépendant du caractéristique [q] [94, Page 218]. Cette formule, que nous appelons la formule de Thomae absolue, a ensuite été reprise par [START_REF] Fuchs | Über die Form der Argumente der Thetafunction und über die Bestimmung von ϑ(0, 0...0) als Function der Klassenmoduln[END_REF][START_REF] Bolza | The partial differential equations for the hyperelliptic θ-and σ-functions[END_REF][START_REF] Fay | On the Riemann-Jacobi Formula[END_REF] en utilisant la méthode variationnelle. Une version plus simple exprimant le quotient ϑ[q](τ ) 8 /ϑ[q ′ ](τ ) 8 , que nous appelons la formule de Thomae relative, a été établi dans [START_REF] Zariski | On hyperelliptic ϑ-functions with rational characteristics[END_REF][START_REF] Mumford | Tata Lectures on Theta II[END_REF][START_REF] Eisenmann | An elementary proof of Thomae's formulae[END_REF] en utilisant des arguments élémentaires. Notez que cette formule, qui implique seulement les racines α i , est généralement suffisante pour récupérer la jacobienne [START_REF] Shepherd-Barron | Thomae's formulae for non-hyperelliptic curves and spinorial square roots of theta-constants on the moduli space of curves[END_REF].

Pour une courbe non hyperelliptique C de g = 3, et pour deux caractéristiques thêta paires p 1 , p 2 nous avons est exprimé comme quotient des déterminants des sections régulières associées à certains fibrés sur C. Pour les calculs explicites, nous traduisons cette expression algébrique en un quotient formé par des fonctions dans certains espaces de Riemann-Roch. Nous montrons le théorème suivant et donc obtenons l'algorithme.

ϑ[p 1 ](τ ) ϑ[p 2 ](τ ) 4 = (-1) n • [β 1 , β 2 , β 3 ] • [β 1 , β
Théorème. Soit Qr i et Qs i les quotients des formes quadratiques ternaires, et A i 's (resp. B i ) des représentants fixes pour les points de contact de C avec une multitangente spécifique β A (resp. β B ) pour i = 1, ..., g -1. Pour deux caractéristiques thêta impaires p1, p2, nous avons

(-1) n • ϑ[p 1 ](0) 4 ϑ[p 2 ](0) 4 = d 1 Qs 1 (B 1 ) • • • Qs g-1 (B 1 ) . . . . . . Qs 1 (B g-1 ) • • • Qs g-1 (B g-1 ) 2 Qr 1 (A 1 ) • • • Qs g-1 (A 1 ) . . . . . . Qr 1 (A g-1 ) • • • Qr g-1 (A g-1 ) 2 d 2 Qr 1 (B 1 ) • • • Qr g-1 (B 1 ) . . . . . . Qr 1 (B g-1 ) • • • Qr g-1 (B g-1 ) 2 Qs 1 (A 1 ) • • • Qs g-1 (A 1 ) . . . . . . Qs 1 (A g-1 ) • • • Qs g-1 (A g-1 )
2 , où d 1 , d 2 sont les valeurs des produits de formes linéaires définissant β A , β B aux points A i et B i 's et n = 0, 1 est donné uniquement en termes de p 1 , p 2 . (Pour l'énoncé complète, voir Théorème 1.2.4.)

Pour appliquer cet algorithme, il faut donc une structure complète de niveau 2 de genre g. Dans un premier temps, nous avons appliqué l'algorithme sur un exemple de courbe non-hyperelliptique du genre 3. Dans ce cas, une base d'Aronhold est suffisante pour la procédure de l'algorithme. En effet, cette base donne un modèle (modèle de Riemann [START_REF] Dolgachev | Classical Algebraic Geometry: A Modern View[END_REF]Chapitre 6]) pour la courbe, toutes les équations des 28 bitangentes de la courbe et un étiquetage élégant pour les diviseur thêta caractéristiques, c.-à-d. une structure complète de niveau 2. De plus, j'ai pu vérifier l'algorithme en composant le résultat avec la formule (⋆).

En genre supérieur, nous nous concentrons sur le cas g = 4. Nous avons étudié tout d'abord la courbe de Bring. Bien que nous disposions des équations de toutes les 120 tritangentes, nous ne pouvions pas surmonter efficacement le problème de l'étiquetage en général. Nous nous sommes donc concentrés sur une famille de courbes issues des surfaces de del Pezzo. Nous avons ainsi pu obtenir une structure complète de niveau 2 de genre 4. Dans la seconde partie du Chapitre 1, avec la motivation d'illustrer l'algorithme, nous expliquons brièvement la structure géométrique des surfaces de del Pezzo et montrons comment obtenir une structure complète de niveau 2 pour une courbe non-hyperelliptique de genre 4. Soit S une surface de del Pezzo de degré 1. La surface S est l'éclatement de huit points en position générale dans P 2 . Si κ S est le diviseur canonique, alors le système linéaire | -2κ S | donne un revêtement double de S sur un cône quadratique dans P 3 , et la courbe de branchement définit une courbe C du genre 4. Le point positif est qu'il y a une correspondance 2-1 entre les diviseurs exceptionnels de S et les diviseurs thêta caractéristiques impairs de C [START_REF] Yu | Del Pezzo surfaces of degree 1 and Jacobians[END_REF]. Nous calculons avec Magma les équations de toutes les tritangentes de C en calculant l'équation de la surface en partant de 8 points de P 2 en position générale et les courbes exceptionnelles de S. Dans ce cas, notez que les bases d'Aronhold viennent naturellement via la configuration de diviseurs exceptionnels sur S. En effet, si ρ : Pic S → Pic C designe l'homomorphisme de restriction du groupe de Picard de S sur le groupe de Picard de C, alors nous montrons la proposition suivante après quelques observations sur la structure de les points de 2-torsion Pic(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF] de Pic(C).

Proposition. Supposons que E 1 , . . . , E 8 sont les diviseurs exceptionnels correspondant aux huit points sur l'éclatement. Soient v i = ρ(E i + κ S ) pour i = 1, . . . ,

8 et v 9 = v 1 + • • • + v 8 .
Pour tout diviseur thêta caractéristique D de C, l'ensemble {D + v i + v 9 | i = 1, . . . , 9} est une base d'Aronhold.

Ce résultat est obtenue par une proposition dans le contexte des formes quadratiques (voir Proposition 1.1.5). Cela nous permet d'avoir un étiquetage pour tous les diviseurs thêta caractéristiques. Puis nous obtenons une structure complète de niveau 2 de C. La Section 1.2.2 est une introduction aux surfaces de del Pezzo de degré d puis plus spécifiquement de degré 1. La Section 1.2.3 relie la configuration des diviseurs exceptionnels de S avec les diviseurs thêta caractéristiques de C en se concentrant sur la façon de trouver une base d'Aronhold.

Cryptographie sur les Courbes Hyperelliptiques

Les fonctions thêta apparaissent également dans la cryptographie sur les courbes hyperelliptiques (CCHE) [START_REF] Cohen | Handbook of Elliptic and Hyperelliptic Curve Cryptography[END_REF]). À partir des remarques dans [START_REF] Chudnovsky | Sequences of numbers generated by addition in formal groups and new primality and factorization tests[END_REF], Gaudry montre que la multiplication scalaire peut être accélérée en travaillant sur la variété de Kummer plutôt que sur la jacobienne d'une courbe de genre 2 [START_REF] Gaudry | Fast genus 2 arithmetic based on Theta functions[END_REF]. Soit A une variété abélienne, la variété de Kummer associée à A est le quotient K A = A/(-1) par l'automorphisme (-1) agissant sur A. Considérons la jacobienne Jac(C) d'une courbe C de genre 2. Notons K C la variété de Kummer associée à Jac(C). Il est possible d'avoir un modèle de K C dans P 3 par quatre fonctions thêta avec certaines caractéristiques, appelons-les fonctions thêta fondamentales. La structure de groupe de Jac(C) induit une structure de pseudo-groupe sur K C . Cette structure de pseudo-groupe ainsi que certaines identités parmi les fonctions thêta fondamentales nous permet de faire de l'arithmétique sur K C grâce à des formules explicites [START_REF] Gaudry | Fast genus 2 arithmetic based on Theta functions[END_REF][START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF]. Dans la première partie du Chapitre 2, nous donnons une présentation courte, compact et autonome pour CCHE et Kummer basée CCHE (KCCHE) en le genre 2 en faisant un état de l'art du sujet afin de constituer un arrière-plan mathématique. La cryptographie asymétrique (voir [25, Chapitre 1]) est un système cryptographique qui utilise des paires de clés publiques et privées. Les clés publiques peuvent être distribuées et les clés privées sont seulement connues par le propriétaire. Le concept de la cryptographie asymétrique est apparu avec Diffie et Helman [START_REF] Diffie | New directions in cryptography[END_REF] en 1976. La cryptographie sur les courbes elliptiques (CCE) est devenue une approche courante et standard pour la cryptographie asymétrique. Les jacobiennes de courbes hyperelliptiques ont également été considérées pour des objectifs cryptographiques comme une alternative aux courbes elliptiques dans la cryptographie asymétrique. En effet, CCHE nécessite des corps finis plus petits que CCE à un niveau de sécurité similaire. Cependant, le nombre d'opérations sur le corp est plus important que dans CCHE. La comparaison CCE avec CCHE dépend donc non seulement des paramètres de la courbe, de l'optimisation de l'algorithme mais aussi de la manière de l'implémenter. En d'autres termes, en dehors de la complexité temporelle et de la sécurité mathématique des algorithmes. Par conséquent, il est également important de les analyser en les implémentant sur des plates-formes matérielles telles que des field programmable gate arrays (FPGAs [START_REF] Cohen | Handbook of Elliptic and Hyperelliptic Curve Cryptography[END_REF]). KCCHE fournit des résultats prometteurs pour les implémentations de logiciels embarqués [START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF]. Les architectures matérielles pour KCCHE basées sur [START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF] pour la multiplication scalaire et leurs implémentations FPGA sont présentées dans [START_REF] Gallin | Architecture level optimizations for Kummer based HECC on FPGAs[END_REF] qui est un travail commun avec Gabriel Gallin et Arnaud Tisserand dans un projet Hardware and Arithmetic for Hyperelliptic Curves Cryptography Project (HAH) [START_REF] Labex | Hardware and arithmetic for hyperelliptic curves cryptography[END_REF]. Je suis en effet un membre du projet HAH et j'avais mission de fournir les éléments mathématiques à l'implémentation de KCCHE. Le travail conjoint étudie et évalue l'impact de divers paramètres d'architecture sur le coût et les performances tels que le type, la taille et le nombre d'unités (arithmétique, mémoire, communications internes) ; topologie de l'architecture ; l'exploitation du parallélisme interne. Les architectures sont conçues pour F p avec un nombre premier générique p et implémentées sur différents FPGA. Dans la deuxième partie du Chapitre 2, nous présentons les résultats de ces implémentations FPGA et les comparons avec des travaux similaires pour CCHE et CCE dans la littérature après avoir donné une courte description de [START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF]. La partie principale du travail, c'est-à-dire l'ingénierie, est réalisée par l'équipe d'informatique. J'ai écarté de ce travail les prérequis informatiques hors de ma spécialisation.

Calculs de p-rang

Il s'agit d'une collaboration avec Yara Elias, Burçin Güneş, Rachel Newton, Ekin Ozman, Rachel Pries et Lara Thomas, qui a débuté au Women in Numbers Europe 2 workshop au Centre Lorentz, Leiden [START_REF] Celik | Non-ordinary curves with a Prym variety of low p-rank[END_REF].

Soit p un nombre premier et soit k un corps algébriquement clos de caractéristique p. Soit A une variété abélienne de dimension g définie sur k. Le p-rang de A est l'entier f défini par #A[p](k) = p f . On sait que 0 ≤ f ≤ g. Quand f = g, on dit que A (ou X) est ordinaire. Soit X une courbe connexe projective lisse de genre g définie sur k. Alors le p-rang de X est le p-rang de sa jacobienne.

Exemple. Supposons que X est une courbe hyperelliptique lisse du genre g, donné par

y 2 = f (x) pour un polynôme f (x) ∈ k[x] ayant un degré 2g + 1 ou 2g + 2 qui a des racines distinctes. Soit c s le coefficient de x s dans le développement f (x) p-1 2 . Pour 0 ≤ l ≤ g -1, soit M l la matrice g × g dont l'entrée i, j est (c ip-j ) p l . Le p-rang de X est le rang de g-1 i=0 M g-1-i .
Le p-rang est un invariant pour les variétés abéliennes qui joue un rôle pour comprendre la structure de l'espace de modules A g de variétés abéliennes principalement polarisées de dimension g définies sur un corps algébriquement clos k de caractéristique p > 0. Il induit des stratifications importantes de A g . Si l'on considère l'espace des modules M g des courbes lisses, irréductibles, projectives du genre g alors l'application de Torelli j : M g → A g , nous permet de définir les stratifications analogues sur M g par les sous-structures M f g de M g où chaque point correspond à des courbes de genre g et p-rang f (voir [START_REF] Achter | Monodromy of the p-rank strata of the moduli space of curves[END_REF] et [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF], pour la stratification de l'espace de modules des courbes hyperelliptiques du genre g par le p-rang). Pour des raisons de dimension, cela donne beaucoup d'informations quand 1 ≤ g ≤ 3 et peu d'informations quand g ≥ 4. Dans le Chapitre 3, nous nous considérons le probléme analogue sur l'espace de modules R g des revêtements doubles non-ramifiés π : Y → X où X est une courbe lisse du genre g en étudiant la strate R (f,f ′ ) g pour laquelle X est de p-rang f et la variété de Prym P π est de p-rang f ′ .

Plus précisément, considérons une revêtement double non-ramifié

π : Y -→ X.
Alors Jac(Y ) est isogène à Jac(X)⊕P π où P π est la variété de Prym de π. Dans ce contexte, P π est une variété abélienne principalement polarisée de dimension g -1. Le p-rang f ′ de

P π satisfait 0 ≤ f ′ ≤ g -1. Puisque le p-rang est un invariant d'isogénie, le p-rang de Y est égal à f + f ′ .
Maintenant, la question suivante se pose naturellement.

Question. Supposons que p est un nombre premier impair et g, f, f ′ sont des entiers tels que

g ≥ 2, 0 ≤ f ≤ g, et 0 ≤ f ′ ≤ g -1 Existe-t-il
-quand g ≥ 3 et f ′ = g -2 (avec f ≥ 2 quand p = 3), par [79, Théorème 7.1] ; -quand p ≥ 5 et g ≥ 4 et g 2 -1 ≤ f ′ ≤ g -3, par [79, Corollaire 7.3].
Nous étudions le premier cas ouvert de la question, qui se produit lorsque X a genre g = 3 et P π a p-rang 0. Nous nous concentrons sur le cas où X est un quartique plane lisse ou, de façon équivalente, que X n'est pas hyperelliptique. En tant qu'application, nous vérifions que la réponse à la question est oui quand g = 3 et 3 ≤ p ≤ 19.

Étant donné une courbe Z :

z 2 = D de genre 2 où D ∈ k[x]
, il est possible de décrire toutes les quartiques planes lisses X ayant une revêtement double non-ramifié π : Y → X dont la variété de Prym P π est isomorphe à Jac(Z). Plus précisément, la variété de Kummer K = Jac(Z)/ -1 de Jac(Z) est une surface quartique dans P 3 . Chaque plane lisse quartique X ayant une revêtement double non-ramifié π : Y → X tel que P π ≃ Jac(Z), provient de l'intersection V ∩ K, pour un plan V ⊂ P 3 [START_REF] Mumford | Tata Lectures on Theta II[END_REF][START_REF] Verra | The fibre of the Prym map in genus three[END_REF][START_REF] Cassels | Prolegomena to a Middlebrow Arithmetic of Curves of Genus 2[END_REF]. En se basant sur le travail de Kudo et Harashita [START_REF] Kudo | Superspecial curves of genus 4 in small characteristic[END_REF], nous fournissons une méthode pour déterminer la matrice de Hasse-Witt de X à partir de V et Z dans la Proposition 3.4.3.

Supposons que π : Y → X est une revêtement double non-ramifié avec P π ≃ Jac(Z) comme dans le paragraphe précédent. Dans la Section 3.5, nous choisissons d'abord Z : z 2 = x 6 -1 et vérifions dans la Proposition 3.5.2 que la réponse à la question est oui quand (g, f, f ′ ) = (3, 3, 0) et p ≡ 5 mod 6.

Dans la seconde partie de la Section 3.5, pour une courbe lisse arbitraire Z du genre 2, nous utilisons l'algèbre commutative pour analyser la condition suivant X est non-ordinaire et Z est de p-rang 0.

(⋆⋆)

Dans la Proposition 3.5.7, nous démontrons cette condition (⋆⋆) est équivalente à l'annulation de 4 polynômes homogènes de degré (p + 1)(p -1)/2 dans les coefficients de D et l'annulation d'un polynôme homogène de degré 6(p -1) dans les coefficients de D et V . Comme application, quand p = 3, on donne une caractérisation explicite des courbes Z et des plans V pour lesquels π : Y → X vérifie la condition (*), voir la Section 3.5.6. Par souci d'exhaustivité, nous présentons tous les résultats suivants de [START_REF] Celik | Non-ordinary curves with a Prym variety of low p-rank[END_REF] sans leurs preuves dans la dernière partie du Chapitre 3. C'est une application des résultats décrits ci-dessus pour les courbes de genre 3 en petite caractéristique pour étudier les p-rangs de variétés de Prym de courbes lisses de genre arbitraire g ≥ 3. Pour cela, une méthode inductive développée dans [START_REF] Achter | Monodromy of the p-rank strata of the moduli space of curves[END_REF] est utilisée. Ceci donne le Corollaire 3.7.7, qui étend [79, Corollary 7.3] pour de petites valeurs de p et donne l'application suivante.

Corollaire. Soit 3 ≤ p ≤ 19. La réponse à la question est oui, pour tout g ≥ 2, sous les conditions suivantes sur (f, f ′ ),

1. Si g = 3r et (f, f ′ ) est tel que 2r ≤ f ≤ g et r -1 ≤ f ′ ≤ g -1 ; 2. Si g = 3r + 2 et (f, f ′ ) est tel que 2r ≤ f ≤ g et r ≤ f ′ ≤ g -1, (avec f ≥ 2r + 2 quand p = 3) ; 3. Si g = 3r + 4 et (f, f ′ ) est tel que 2r ≤ f ≤ g (avec f ≥ 2r + 4 quand p = 3) et r + 1 ≤ f ′ ≤ g -1.
Tous les résultats d'existence pour les p-rangs décrits ci-dessus sont prouvés en utilisant un analyse géométrique de la stratification des espaces de modules de courbes et des revêtements doubles non-ramifiés par le p-rang. Par exemple, [START_REF] Faber | Complete subvarieties of moduli spaces and the Prym map[END_REF]

-quand f ′ = g -1, alors chaque composant de R (f,f ′ ) g a une dimension 2g -3 + f comme un cas particulier de [79, Théorème 1.1 (1)] ; -quand f ′ = g -2, avec f ≥ 2 quand p = 3, alors chaque composante de R (f,f ′ ) g a une dimension 2g -4 + f [79, Théorème 7.1] ; -quand p ≥ 5 et g 2 -1 ≤ f ′ ≤ g -3, alors au moins une composante de R (f,f ′ ) g a une dimension g -2 + f + f ′ [79, Corollaire 7.3].
Le Théorème 3.7.6, valable pour tout nombre premier p et un résultat inductif permettent de tirer parti de l'information lorsque g = 3 sur R (f,0) 3 afin d'obtenir des informations sur

R (f,f ′ ) g
pour tout genre g. Le résultat final est le Corollaire 3.7.7 ; il prouve l'existence des revêtements doubles non-ramifiés π : Y → X avec un contrôle sur le p-rang f de X et le p-rang f ′ de P π si f est supérieur à environ 2g/3 et f ′ est supérieur à environ g/3.

Corollaire. Si 3 ≤ p ≤ 19, la strate R (f,f ′ ) g
a une composante (non vide) de dimension g -2 + f + f ′ pour tout g ≥ 2 sous les conditions pour (f, f ′ ) trouvées dans le corollaire précédent.

Introduction

Algebraic curves are central objects in algebraic geometry which come into light also in arithmetic geometry and in various applications such as cryptography, theoretical physics etc. In this thesis, we study them under these different aspects.

Computations of Theta Constants

One way to understand an algebraic curve is to study the group structure called Jacobian associated to the curve. Theta constants play an important role to figure out the relation between a curve and its Jacobian.

Explicit computations of theta constants are closely related to a classical problem that asks which complex principally polarized abelian varieties arise as Jacobian varieties of curves. The problem is called the Schottky problem and that goes back to Riemann [START_REF] Riemann | Theorie der Abel'schen Functionen[END_REF][START_REF] Riemann | Über das Verschwinden der ϑ-Functionen[END_REF]. The field has been improved by a wide range of mathematicians until present. See [START_REF] Farkas | An explicit solution to the weak Schottky problem[END_REF] for a well described history of the subject. Another related question is to try to recover the curve explicitly from its Jacobian. See [START_REF] Rosenhain | Abhandlung über die Functionen zweier Variabler mit vier Perioden[END_REF] for the case g = 2, [START_REF] Takase | A generalization of Rosenhain's normal form for hyperelliptic curves with an application[END_REF][START_REF] Koizumi | Remarks on Takase's paper "a generalization of Rosenhain's normal form with an application[END_REF] for the general hyperelliptic case, and [START_REF] Weber | Theorie der Abel'schen Funktionen vom Geschlecht[END_REF][START_REF] Guàrdia | On the Torelli problem and Jacobian Nullwerte in genus three[END_REF] for the non-hyperelliptic case when g = 3. In addition, the topic has many applications in different areas such as theoretical physics [START_REF] Enolski | Thomae type formulae for singular Z N curves[END_REF] via integrable systems, and cryptography [START_REF] Weng | Constructing hyperelliptic curves of genus 2 suitable for cryptography[END_REF] via AGM-style point counting algorithms [START_REF] Ritzenthaler | Point counting on genus 3 non hyperelliptic curves[END_REF] and more recently isogeny based cryptography [START_REF] Lubicz | Arithmetic on abelian and Kummer varieties[END_REF].

Let g ≥ 0 be an integer. Denote M g the moduli space over C of curves of genus g and A g the moduli space of complex principally polarized abelian varieties of dimension g. The Torelli map

j : M g → A g (2)
maps the isomorphism class of a curve to the isomorphism class of its Jacobian with its canonical polarization. The Schottky problem is to characterize the locus of Jacobians J g which is defined to be the closure of j(M g ) in A g . The classical approach to the problem is to try to embed A g in a projective space and try to find the defining ideal for J g .

Let

H g = {τ ∈ GL g (C) | t τ = τ, Imτ > 0}
be the Siegel upper half space consisting of g × g complex matrices with positive definite imaginary part.

For τ ∈ H g , z = (z 1 , . . . , z g ) ∈ C g and

[q] = ε ε ′ ∈ Z g ⊕ Z g , the theta function with characteristic [q] is ϑ[q](z, τ ) = n∈Z g exp πi(n + ε/2)τ t (n + ε/2) + 2πi(n + ε/2) t (z + ε ′ /2) .
The evaluation of this function at z = 0, which is ϑ

[q](τ ) = ϑ[q](0, τ ), is called a theta constant (Thetanullwert). The characteristic [q] is called even (resp. odd) if the usual scalar product ε • ε ′ is even (resp. odd). If the characteristic [q]
is even (resp. odd), the theta constant ϑ[q](τ ) is called even (resp. odd). Note that the theta constant ϑ[q](τ ) is identically zero for all τ ∈ H g if and only if the characteristic [q] is odd.

On the other hand, any τ ∈ H g defines a complex principally polarized abelian variety C g /(Z g + τ Z g ). The symplectic group Sp(2g, Z) acts on H g . The quotient H g /Sp(2g, Z) is the moduli space A g . There is a level cover A ′ g → A g , where A ′ g is the quotient of H g by a certain subgroup of Sp(2g, Z) denoted Γ g [START_REF] Arbarello | Geometry of Algebraic Curves[END_REF][START_REF] Bernstein | Explicit-formulas database[END_REF]. Even theta characteristics provide a map

Φ : A ′ g → P 2 g-1 (2 g +1) , τ → (ϑ[q](τ )) q
which is an embedding when q ranges over the set of even theta characteristics. Actually, the study to determine all the relations among the even theta characteristics amounts to try to understand the image under the map Φ (see [START_REF] Manni | Modular varieties with level 2 theta structure[END_REF]).

In Chapter 1, we give an algorithm to compute the fourth power of the quotient of any pair of even theta constants corresponding to a period matrix in H g of a non-hyperelliptic curve of any genus g ≥ 3 in the case that a complete 2-level structure is given. Let C be a projective, smooth, non-hyperellitic curve of genus g over a field k ⊆ C. We define the Jacobian of C as C g /(Z g + τ Z g ) with respect to a normalized period matrix τ in H g . Denote it Jac(C). A complete 2-level structure is represented via the defining equations of the image of C under the canonical embedding and certain divisors on the curve with a suitable labelling as follows. Such divisors are called theta characteristic divisors. There are two kinds of theta characteristic divisors, even and odd, which depend on the dimension of the associated Riemann-Roch spaces. Note that the odd theta characteristic divisors correspond to some geometric objects called multitangents on the curve for arbitrary genus. For instance, these objects are called bitangents when g = 3 and tritangents when g = 4.

(a) Bitangents on the Trott Curve [START_REF] Rocchini | Claudio Rocchini's Home Page[END_REF].

(b) A tritangent of a curve with three ovals [START_REF] Kulkarni | Real space sextics and their tritangents[END_REF].

On the other hand, there is a canonical correspondence between the theta characteristic divisors on C and the quadratic forms on Jac [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF](C) over F 2 where Jac [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF](C) denotes the 2-torsion points of Jac(C). The quadratic forms are labelled through a combinatorial data which is called an Aronhold basis. Section 1.1 recalls a part of the mathematical background which is needed for the algorithm.

Computing such quotient is well known and given by a closed formula for a curve of g ≤ 3 and hyperelliptic curves of any genus, see [START_REF] Thomae | Beitrag zur Bestimmung von ϑ(0, 0, ...0) durch die Klassenmoduln algebraischer Funktionen[END_REF][START_REF] Weber | Theorie der Abel'schen Funktionen vom Geschlecht[END_REF]. These formulas can be seen as an explicit description of the Torelli map. Indeed, a principally polarized abelian variety can be written as an intersection of explicit quadrics in a projective space [START_REF] Mumford | On the equations defining abelian varieties[END_REF]. The coefficients of these quadrics are determined by theta constants. These formulas express theta constants in terms of geometry of the curve. In the case of a hyperelliptic curve given by y 2 = 2g+2 i=1 (xα i ), we have

ϑ[q](τ ) 4 = (2iπ) -2g • det(Ω 1 ) 2 • i,j∈U (α i -α j ),
where Ω 1 is the first half of a period matrix and U is a set of indices depending on the characteristic [q] [94, Page 218]. This formula, which we call the absolute Thomae formula, has then been reproved by [START_REF] Fuchs | Über die Form der Argumente der Thetafunction und über die Bestimmung von ϑ(0, 0...0) als Function der Klassenmoduln[END_REF][START_REF] Bolza | The partial differential equations for the hyperelliptic θ-and σ-functions[END_REF][START_REF] Fay | On the Riemann-Jacobi Formula[END_REF] using the variational method. A simpler version, which we call the relative Thomae formula, expressing the quotient ϑ[q](τ ) 8 /ϑ[q ′ ](τ ) 8 was then achieved in [START_REF] Zariski | On hyperelliptic ϑ-functions with rational characteristics[END_REF][START_REF] Mumford | Tata Lectures on Theta II[END_REF][START_REF] Eisenmann | An elementary proof of Thomae's formulae[END_REF] using elementary arguments. Note that this formula, which involves only the roots α i , is generally sufficient to recover the Jacobian and can moreover be worked out over an arbitrary field [START_REF] Shepherd-Barron | Thomae's formulae for non-hyperelliptic curves and spinorial square roots of theta-constants on the moduli space of curves[END_REF]. The issue of finding the correct 8th roots of the quotients is considered for g = 1, 2 in [START_REF] Cosset | Applications des fonctions thêta à la cryptographie sur courbes hyperelliptiques[END_REF] and can be simply solved over C by computing the theta contants with a weak precision.

For the non-hyperelliptic curve C of g = 3, for any two even theta characteristics p 1 , p 2 we have

ϑ[p 1 ](τ ) ϑ[p 2 ](τ ) 4 = (-1) n • [β 1 , β 2 , β 3 ] • [β 1 , β 12 , β 13 ] • [β 12 , β 2 , β 23 ] • [β 13 , β 23 , β 3 ] [β 23 , β 13 , β 12 ] • [β 23 , β 3 , β 2 ] • [β 3 , β 13 , β 1 ] • [β 2 , β 1 , β 12 ] , (⋆)
where [β i , β j , β k ] is the determinant of the coefficients of the equations β i , β j and β k which are certain bitangents labelled via an Aronhold basis [77, Theorem 3.1] and n = 0, 1 can be computed depending on p 1 , p 2 . This formula is called Weber's formula. Nevertheless, for any genus g ≥ 3, the quotient ϑ[p 1 ](τ )

ϑ[p 2 ](τ )
4 is expressed as a quotient of determinants of regular sections associated to certain line bundles over C. For explicit computations, we translate this algebraic expression into a quotient which is formed by some functions in certain Riemann-Roch spaces. We show the following theorem and thus have the algorithm.

Theorem. Let Qr i and Qs i be the quotients of ternary quadratic forms and A i 's (resp. B i 's) be fixed representatives for the contact points of C with a specific multitangent for i = 1, . . . , g -1. For any two even theta characteristics p 1 , p 2 , we have

(-1) n • ϑ[p 1 ](0) 4 ϑ[p 2 ](0) 4 = d 1 Qs 1 (B 1 ) • • • Qs g-1 (B 1 ) . . . . . . Qs 1 (B g-1 ) • • • Qs g-1 (B g-1 ) 2 Qr 1 (A 1 ) • • • Qs g-1 (A 1 ) . . . . . . Qr 1 (A g-1 ) • • • Qr g-1 (A g-1 ) 2 d 2 Qr 1 (B 1 ) • • • Qr g-1 (B 1 ) . . . . . . Qr 1 (B g-1 ) • • • Qr g-1 (B g-1 ) 2 Qs 1 (A 1 ) • • • Qs g-1 (A 1 ) . . . . . . Qs 1 (A g-1 ) • • • Qs g-1 (A g-1 ) 2 ,
where d 1 , d 2 are the values of products of linear forms defining certain multitangents at the points A i and B i 's and n = 0, 1 is given purely in terms of p 1 , p 2 . (For the complete statement, see Theorem 1.2.4.)

In order to apply this algorithm, one needs a complete 2-level structure of genus g. Firstly, we applied the algorithm on an example of a non-hyperelliptic curve of genus 3. In this case, to have an Aronhold basis is enough for the procedure of the algorithm. Indeed, this set gives a model (Riemann model [32,Chapter 6]) for the curve, all the equations of 28 bitangents of the curve and an elegant labelling for all the theta characteristic divisors, i.e. gives a complete 2-level structure. In addition, I was able to verify the algorithm via the closed formula of Weber (⋆).

For higher genus, we focus on the case g = 4. We studied Bring's curve. Although we had the equations of all 120 tritangents, we could not overcome the labelling problem efficiently in general. Therefore, we focused on a family of curves which comes from del Pezzo surfaces. Thus we were able to obtain a complete 2-level structure of genus 4. In the second part of Chapter 1, with the motivation of illustrating the algorithm, we shortly explain the geometric structure of del Pezzo surfaces and show how to get a complete 2-level structure for a non-hyperelliptic curve of genus 4. Let S be a del Pezzo surface of degree 1. The surface S is the blow up of eight points in general position in P 2 . If κ S is the canonical divisor of S, then the linear system | -2κ S | yields a double cover from S to a quadratic cone in P 3 , and the branch curve defines a curve C of genus 4. The positive point is that there is a 2-1 correspondence between the exceptional divisors of S and the odd theta characteristic divisors of C [START_REF] Yu | Del Pezzo surfaces of degree 1 and Jacobians[END_REF]. We compute the equations of all 120 tritangents of C via computing the equation of the surface by starting from 8 points in P 2 in general position and the exceptional curves of S by Magma. In this case, note that Aronhold bases come naturally via the configuration of exceptional divisors on S. Indeed, let ρ : Pic S → Pic C be the restriction homomorphism from the Picard group of S to the Picard group of C. We show the following proposition after some observations about the structure of 2-torsion points Pic(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF] of Pic(C).

Proposition. Suppose that E 1 , . . . , E 8 are the exceptional divisors corresponding to the eight points under the blow up map. Let v i = ρ(E i + κ S ) ∈ Pic 0 (C) for i = 1, . . . , 8 and

v 9 = v 1 + • • • + v 8 . For any odd theta characteristic divisor D of C, the set {D + v i + v 9 | i = 1, . . . , 9} is an Aronhold set.
This result is obtained by a proposition in the context of quadratic forms, see Proposition 1.1.5. It enables us to have a labelling for all theta characteristic divisors. Hence we have obtained a complete 2-level structure of C. Section 1.2.2 is an introduction to del Pezzo surfaces of firstly any degree d and then of degree 1. Section 1.2.3 relates the configuration of exceptional divisors of S with the theta characteristic divisors of C by focusing on how to find an Aronhold basis.

Hyperelliptic Curve Cryptography

Theta functions arise also in hyperelliptic curve cryptography (HECC [START_REF] Cohen | Handbook of Elliptic and Hyperelliptic Curve Cryptography[END_REF]). Based on remarks in [START_REF] Chudnovsky | Sequences of numbers generated by addition in formal groups and new primality and factorization tests[END_REF], Gaudry [START_REF] Gaudry | Fast genus 2 arithmetic based on Theta functions[END_REF] shows that scalar multiplication can be accelerated by working on the Kummer variety instead of on the Jacobian of a curve of genus 2. Let A be an abelian variety. The Kummer variety associated to A is the quotient K A = A/(-1) by the automorphism (-1) acting on A. Consider the Jacobian Jac(C) of a curve C of genus 2. Denote K C the Kummer variety associated to Jac(C). It is possible to have a model of K C in P 3 by four theta functions with certain characteristics, call them fundamental theta functions. The group structure of Jac(C) endows a pseudo group structure on K C . Thanks to the pseudo group law and some identities among the fundamental theta functions, we are able to do arithmetic on K C by explicit formulas [START_REF] Gaudry | Fast genus 2 arithmetic based on Theta functions[END_REF][START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF]. In the first part of Chapter 2, we present a compact and self-contained text for HECC and Kummer based HECC (KHECC) in genus 2 constituting mathematical background. Public key cryptography [25, Chapter 1] is a cryptographic system that uses pairs of keys which are public and private. Public keys might be distributed and private keys are only known by the owner. This system originated with Diffie and Helman [START_REF] Diffie | New directions in cryptography[END_REF] in 1976. Elliptic curve cryptography (ECC) has become a common and standard approach for public key cryptography. The Jacobians of hyperelliptic curves have also been considered for cryptographic objectives as an alternative for elliptic curves in public key cryptography. Indeed, HECC requires smaller finite fields than ECC at a similar security level. However, the number of field-level operations is bigger than in HECC. So the comparison ECC with HECC depends on not only curve parameters, algorithm optimisation but also on the implementation way. Hence, it is also important to analyze them by implementing on hardware platforms such as field programmable gate arrays (FPGAs [START_REF] Cohen | Handbook of Elliptic and Hyperelliptic Curve Cryptography[END_REF]). KHECC provides promising results for embedded software implementations [START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF]. Hardware architectures for KHECC based on [START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF] for scalar multiplication and their FPGA implementations are presented in [START_REF] Gallin | Architecture level optimizations for Kummer based HECC on FPGAs[END_REF] which is a joint work with Gabriel Gallin and Arnaud Tisserand in Hardware and Arithmetic for Hyperelliptic Curves Cryptography (HAH) project [START_REF] Labex | Hardware and arithmetic for hyperelliptic curves cryptography[END_REF]. Indeed, I was a member of HAH project and had the mission to provide the mathematical components for the implementation of KCCHE. The joint work studies and evaluates the impact of various architecture parameters on the cost and performances such as type, size and number of units (arithmetic, memory, internal communications); architecture topology; and exploitation of internal parallelism. The architectures are designed for F p with a generic prime number p and implemented on different FPGAs. In the second part of Chapter 2, we present results of these FPGA implementations with a comparison by similar works for HECC and ECC in the literature after giving a short description of [START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF]. I dismiss computer scientific background which is out of my research area. The main part of the work i.e. the engineering, is realised by the team of computer science. Nevertheless, we present a summary of the results after introducing a compact text looking at literature about (KH)ECC from mathematical point of view.

p-rank Computations

This is a joint work with Yara Elias, Burçin Güneş, Rachel Newton, Ekin Ozman, Rachel Pries and Lara Thomas which began at the Women in Numbers Europe 2 workshop in the Lorentz Centre, Leiden [START_REF] Celik | Non-ordinary curves with a Prym variety of low p-rank[END_REF].

Let p be a prime number and let k be an algebraically closed field of characteristic p. Let A be an abelian variety of dimension g defined over k. The p-rank of A is the integer f defined by #A[p](k) = p f . It is known that 0 ≤ f ≤ g. When f = g, we say that A (or X) is ordinary. Let X be a smooth projective irreducible curve of genus g defined over k. Then the p-rank of X is the p-rank of its Jacobian.

Example. Assume that X is a smooth hyperelliptic curve of genus g given by y 2 = f (x) for a polynomial f (x) ∈ k[x] having degree 2g + 1 or 2g + 2 which has distinct roots. Let c s denote the coefficient of x s in the expansion f (x) p-1 2 . For 0 ≤ l ≤ g -1, let M l be the g × g matrix whose ijth entry is (c ip-j ) p l . The p-rank of X is the rank of g-1 i=0 M g-1-i . The p-rank is an invariant for abelian varieties which plays a role to understand the structure of moduli space A g of principally polarized abelian varieties of dimension g defined over an algebraically closed field k of characteristic p. It induces important stratifications of A g . If we consider the moduli space M g of smooth, connected, projective curves of genus g then the Torelli map j : M g → A g allows us to define the analogous stratifications on M g by substructures M f g of M g where each point corresponds to curves of genus g and p-rank f (see [START_REF] Achter | Monodromy of the p-rank strata of the moduli space of curves[END_REF]). (For the p-rank stratification of the moduli space of hyperelliptic curves of genus g, see [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF].) Because of dimension reasons, this gives a lot of informations when 1 ≤ g ≤ 3 and little information when g ≥ 4. In Chapter 3, we focus on the moduli space R g of unramified double covers π : Y → X where X is a smooth curve of genus g by studying strata R (f,f ′ ) g for which X has p-rank f and the Prym variety P π has p-rank f ′ . More precisely, we assume that p is odd from now on and we consider an unramified double cover π : Y -→ X.

Then Jac(Y ) is isogenous to Jac(X) ⊕ P π where P π is the Prym variety of π. In this context, P π is a principally polarized abelian variety of dimension g -1. The p-rank f ′ of P π satisfies 0 ≤ f ′ ≤ g -1. Since the p-rank is an isogeny invariant, the p-rank of Y equals f + f ′ . Now the following question arises naturally.

Question. Suppose that p is an odd prime, and g, f, f ′ are integers such that g ≥ 2, 0 ≤ f ≤ g, and 0 ≤ f ′ ≤ g -1. Does there exist a curve X defined over k of genus g and p-rank f having an unramified double cover π : Y -→ X such that P π has p-rank f ′ ?

The answer to the question is yes for p ≥ 3 and 0 ≤ f ≤ g under the following restrictions, -when g = 2 [79, Proposition 6.1], unless p = 3 and f = 0, 1 and f ′ = 0, in which case the answer is no We study the first open case of the question, which occurs when X has genus g = 3 and P π has p-rank 0. We focus on the case that X is a smooth plane quartic or, equivalently, that X is non-hyperelliptic. As an application, we verify that the answer to the question is yes when g = 3 and 3 ≤ p ≤ 19.

Given a genus 2 curve Z : z 2 = D where D ∈ k[x], it is possible to describe all smooth plane quartic curves X having an unramified double cover π : Y → X whose Prym variety P π is isomorphic to Jac(Z). Specifically, the Kummer variety K = Jac(Z)/ -1 of Jac(Z) is a quartic surface in P 3 . Each smooth plane quartic X having an unramified double cover π : Y → X such that P π ≃ Jac(Z) arises as the intersection V ∩ K for some plane V ⊂ P 3 [START_REF] Mumford | Tata Lectures on Theta II[END_REF][START_REF] Verra | The fibre of the Prym map in genus three[END_REF][START_REF] Cassels | Prolegomena to a Middlebrow Arithmetic of Curves of Genus 2[END_REF]. Building on work of Kudo and Harashita [START_REF] Kudo | Superspecial curves of genus 4 in small characteristic[END_REF], we provide a method to determine the Hasse-Witt matrix of X from V and Z in Proposition 3.4.3.

Suppose that π : Y → X is an unramified double cover with P π ≃ Jac(Z) as in the previous paragraph. In Section 3.5, we first choose Z : z 2 = x 6 -1 and verify in Proposition 3.5.2 that the answer to the question is yes when (g, f, f ′ ) = (3, 3, 0) and p ≡ 5 mod 6.

In the second part of Section 3.5, for an arbitrary smooth curve Z of genus 2, we use commutative algebra to analyze the condition that X is non-ordinary and Z has p-rank 0.

(⋆⋆)

In Proposition 3.5.7, we prove that condition (⋆⋆) is equivalent to the vanishing of 4 homogeneous polynomials of degree (p + 1)(p -1)/2 in the coefficients on D and the vanishing of one homogeneous polynomial of degree 6(p -1) in the coefficients of D and V . As an application, when p = 3, we give an explicit characterization of the curves Z and planes V for which π : Y → X satisfies condition (⋆⋆), see Section 3.5.6.

For the sake of completeness, we present all the following results from our work [START_REF] Celik | Non-ordinary curves with a Prym variety of low p-rank[END_REF] without their proofs in the last part of Chapter 3. It is an application of the results described above for genus 3 curves in small characteristic to study the p-ranks of Prym varieties of smooth curves of arbitrary genus g ≥ 3. For this, an inductive method developed in [START_REF] Achter | Monodromy of the p-rank strata of the moduli space of curves[END_REF] is used. This yields Corollary 3.7.7, which extends [START_REF] Ozman | On the existence of ordinary and almost ordinary Prym varieties[END_REF]Corollary 7.3] for small p and gives the following application.

Corollary. Let 3 ≤ p ≤ 19. The answer to the question is yes, for any g ≥ 2, under the following conditions on (f, f ′ ),

1. If g = 3r and (f, f ′ ) is such that 2r ≤ f ≤ g and r -1 ≤ f ′ ≤ g -1; 2. If g = 3r + 2 and (f, f ′ ) is such that 2r ≤ f ≤ g and r ≤ f ′ ≤ g -1, (with f ≥ 2r + 2 when p = 3); 3. If g = 3r + 4 and (f, f ′ ) is such that 2r ≤ f ≤ g (with f ≥ 2r + 4 when p = 3) and r + 1 ≤ f ′ ≤ g -1.
All of the existence results for p-ranks described above are proven using a geometric analysis of the p-rank stratification of moduli spaces of curves and their unramified covers. For example, [START_REF] Faber | Complete subvarieties of moduli spaces and the Prym map[END_REF]Theorem 2.3] shows that the p-rank f stratum M f g of M g is non-empty and each component has dimension 2g -3 + f , see also [START_REF] Achter | Monodromy of the p-rank strata of the moduli space of curves[END_REF]Section 3].

Consider the moduli space R g . Once we have that R

(f,f ′ ) g
is non-empty then we can study its dimension. Suppose that R (f,f ′ ) g is non-empty. As an application of purity results for the Newton polygon stratification, [START_REF] Ozman | On the existence of ordinary and almost ordinary Prym varieties[END_REF]Proposition 5.2] shows that, if R (f,f ′ ) g is nonempty, then each of its components has dimension at least g -2 + f + f ′ .

In fact, the dimension of R (f,f ′ ) g attains this lower bound in the following cases,

-when f ′ = g -1, then each component of R (f,f ′ ) g has dimension 2g -3 + f as a special case of [79, Theorem 1.1(1)]; -when f ′ = g -2, with f ≥ 2 when p = 3, then each component of R (f,f ′ ) g has dimension 2g -4 + f [79, Theorem 7.1]; -when p ≥ 5 and g 2 -1 ≤ f ′ ≤ g -3, then at least one component of R (f,f ′ ) g has dimension g -2 + f + f ′ [79, Corollary 7.3].
Theorem 3.7.6, for any prime p, is an inductive result that allows one to leverage information when g = 3 about R

(f,0) 3 into information about R (f,f ′ ) g
for arbitrarily large g. The final result is Corollary 3.7.7; it proves the existence of unramified double covers π : Y → X with control over the p-rank f of X and the p-rank f ′ of P π as long as f is bigger than approximately 2g/3 and f ′ is bigger than approximately g/3.

Corollary. If 3 ≤ p ≤ 19, the stratum R (f,f ′ ) g has a (non-empty) component of dimension g -2 + f + f ′
for all g ≥ 2 under the conditions on (f, f ′ ) found in the previous corollary.

Chapter 1

Theta Constants

In this chapter, we aim to give an algorithm to compute the fourth power of the quotient of theta constants associated to a non-hyperelliptic curve of genus g ≥ 3. To obtain this algorithm, we also discuss how to study these curves combinatorially, algebraically and geometrically by emphasising the link between these perspectives alongside explaining theta functions and constants.

Background

1.1.1 Quadratic Forms over F 2
In this section, we overview the theory of quadratic forms over F 2 in parallel our requirements for Section 1.2.1. Throughout this section, we skip proofs for most of the statements, since the theory is classically well known. Once for all, we refer to [START_REF] Gross | On some geometric constructions related to theta characteristics[END_REF] and [START_REF] Dolgachev | Classical Algebraic Geometry: A Modern View[END_REF]Section 5.1].

Let g ≥ 1 be an integer and V be a vector space of dimension 2g over F 2 . We fix a bilinear, non-degenerate, alternating form , on V . Since Char F 2 = 2, there exists a basis {e 1 , . . . , e g , f 1 , . . . , f g } such that the matrix M g associated to the bilinear form , is

M g = 0 g I g I g 0 g ,
where 0 g , I g are the zero, identity g × g matrices respectively. In other words, e i , e j = f i , f j = 0 and e i , f j = δ ij for all i, j ∈ {1, . . . , g}. Such a basis is called a symplectic basis.

The symplectic group Sp(V ) is the group of all F 2 -linear isomorphisms T : V → V with

T (v), T (u) = v, u .
It acts simply transitively on the set of symplectic bases on V . Also, Sp(V ) is generated by the transvections T u which are defined by

T u (v) = v + v, u u with u = 0 in V . We say that q : V → F 2 is a quadratic form on V if q(u + v) = q(u) + q(v) + u, v for all u, v ∈ V.
Let QV denote the set of all quadratic forms on (V, , ).

The vector space V has an action on QV. Indeed, we define the quadratic form q + v by

(q + v)(u) = q(u) + v, u
for any q ∈ QV and v ∈ V . Since the form , is nondegenerate, the action is free. The equality #V = #QV implies that the action is also transitive. So, for any two quadratic forms q, q ′ ∈ QV, there is a unique vector v = q + q ′ such that v, u = q(u) + q ′ (u).

In other words, the space QV is a homogeneous space for V . This implies that the disjoint union V QV is an F 2 -vector space of dimension 2g + 1. The vector space V is a subspace of codimension 1. Also, the symplectic group acts on QV by

q → T (q),
where T q(T (v)) = q(v).

We now define an invariant on quadratic forms which play an important role in the theory of quadratic forms over F 2 .

Definition 1.1.1. Let {e 1 , . . . , e g , f 1 , . . . , f g } be a symplectic basis of (V, , ). We define the Arf invariant a(q) of a quadratic form q by a(q) = g i=1 q(e i )q(f i ).

A quadratic form q is called odd (resp. even) if a(q) = 1 (resp. a(q) = 0). Let QV -(resp. QV + ) denote the set of all odd (resp. even) quadratic forms.

Although the invariant is defined via symplectic bases, the Arf invariant does not depend on the choice of symplectic basis.

In addition, the action of Sp(V ) has two orbits on QV, namely QV -and QV + which have the cardinalities 2 g-1 (2 g -1) and 2 g-1 (2 g + 1) respectively.

Quadratic forms in terms of coordinates

We may introduce the quadratic forms also in terms of coordinates. This perspective is useful to study them. For this section, we refer to [START_REF] Nart | A new proof of a Thomae-like formula for non hyperelliptic genus 3 curves[END_REF].

Fix a symplectic basis {e 1 , . . . , e g ; f 1 , . . . , f g }. We write the linear expression of any vector w ∈ V as follows

w = λ 1 e 1 + • • • + λ g e g + µ 1 f 1 + • • • + µ g f g .
For the simplicity, we write w = (λ, µ) where λ = (λ 1 , . . . , λ g ) and µ = (µ 1 , . . . , µ g ) in F g 2 . We define the simplest quadratic form q 0 as

q 0 (w) = λ • µ, (1.1)
where • denotes the usual scalar product of g-tuples. This special quadratic form is central to understand the quadratic forms in terms of coordinates.

If we take any vector v ∈ V with the coordinates (ǫ, ǫ ′ ) = (ǫ 1 , . . . , ǫ g , ǫ ′ 1 , . . . , ǫ ′ g ) then the quadratic form q := q 0 + v acts on V by

q(w) = ǫ • µ + ǫ ′ • λ + λ • µ.
Let us write q = ǫ ǫ ′ . We see that ǫ = (q(e 1 ), . . . , q(e g )), ǫ ′ = (q(f 1 ), . . . , q(f g )),

and the so Arf invariant of the quadratic form q in coordinates is given as

a(q) = ǫ • ǫ ′ .
In terms of coordinates, we have

ǫ ǫ ′ + (λ, µ) = ǫ + µ ǫ ′ + λ , ǫ 1 ǫ ′ 1 + ǫ 2 ǫ ′ 2 + ǫ 3 ǫ ′ 3 = ǫ 1 + ǫ 2 + ǫ 3 ǫ ′ 1 + ǫ ′ 2 + ǫ ′ 3 ,
as the sum of a quadratic form and a vector and the sum of three quadratic forms respectively. This implies that

a(q + v) = a(q) + q(v), (1.2)
a(q 1 + q 2 + q 3 ) = a(q 1 ) + a(q 2 ) + a(q

3 ) + v 1 , v 2 , (1.3)
where v 1 = q 1 + q 2 , v 2 = q 1 + q 3 for any q, q 1 , q 2 , q 3 ∈ QV and v ∈ V .

Aronhold basis

Now, we introduce the notion of Aronhold basis and some basic properties of it. This set enables us to collect all the quadratic forms easily and provides a way to distinguish the odd and even ones. Let S = {q 1 , . . . , q 2g+1 } be a set of linearly independent vectors of the vector space V ∪ QV where all the vectors lie in QV. Then any vector q ∈ V ∪ QV can be written as the sum α i q i with α i = 0, 1 ∈ Z. We define the length of q as the sum α i . Denote it #q. So we have 0 ≤ #q ≤ 2g + 1. We remark that if q is in the coset QV then #q is odd, since the sum of two quadratic forms corresponds to a unique vector in V . Definition 1.1.2. The set S = {q 1 , . . . , q 2g+1 } is called an Aronhold basis if the Arf invariant of any element q only depends on #q modulo 4.

An Aronhold basis exists. Now, we introduce fundamental sets in V which are closely related with the Aronhold bases, and see how to obtain an Aronhold basis from a fundamental set.

Definition 1.1.3. A set {v 1 , . . . , v 2g+1 } of vectors in V is called a fundamental set if • 2g+1 i=1 v i = 0 (completeness),
• v i , v j = 1 for all i = j (being azygetic).

Remark 1.1.4. Any set {v 1 , . . . , v 2g } satisfying the condition of being azygetic in Definition 1.1.3 can be completed to a fundamental set which is {v 1 , . . . , v 2g , 2g i=1 v i }. In addition, note that any 2g-subset of a fundamental set forms a basis for V .

It is possible to obtain a fundamental set by an Aronhold basis. More concretely, if {q 1 , . . . , q 2g+1 } is an Aronhold basis then {q 1 + q 2 , . . . , q 1 + q 2g+1 } satisfies the condition of being azygetic in Definition 1.1.3. Indeed, for any 2 < i = j < 2g + 1, q 1 + q i , q 1 + q j = a(q 1 + a i + q j ) + a(q 1 ) + a(q i ) + a(q j ) = 1 since a(q 1 ) = a(q i ) = a(q j ) = a(q 1 + a i + q j ) which follows from that {q 1 , . . . , q 2g+1 } is an Aronhold basis.

Conversely, we can obtain an Aronhold basis from a fundamental set. Suppose that the set

F := {v 1 , . . . , v 2g+1 } is a fundamental set. Any subset of F with 2g elements forms a basis of V . Also note that v j = 2g+1 i =j v i for all j ∈ {1, . . . , 2g + 1}.
Now, let q be any quadratic form. For µ ∈ {0, 1}, consider the set

E q,µ := {v i ∈ F | q(v i ) = µ}.
Fix any µ ∈ {0, 1}. We may assume that E q,µ = {v 1 , . . . , v k } by reordering F . We set

w := k i=1 v i .
Proposition 1.1.5. Under the setting above, if q i = q + w + v i for i = 1, . . . , 2g + 1 then the set A := {q 1 , . . . , q 2g+1 } is an Aronhold basis.

Proof. First of all, we will show that A spans V ⊔ QV. Suppose that v ∈ V . Since any 2g-subset of F forms a basis, we can write v = v i 1 + • • • + v in as a linear combination of vectors in F . Thanks to the completeness property of F , we may assume that n is even.

So v = q i 1 +• • •+q in , since Char F 2 = 2. Now suppose that q ′ is a quadratic form, then q+q ′ is a vector v ∈ V . We write v + w = v i 1 + • • • + v in as a linear combination of v 1 , . . . , v 2g .
We may assume that n is odd because of the completeness property in Definition 1.1.3. Now, we have

q ′ = n j=1 q + w + v i j = n j=1 q i j .
Therefore it forms a basis for V ∪ QV since dim V ∪ QV = 2g + 1.

We need to show that a(q) depends only on #q modulo 4 for any q ∈ QV. Firstly, we compute

a(q i ) = a(q + w + v i ) = a(q) + q(w + v i ) = a(q) + q(w) + q(v i ) + w, v i = a(q) + q(w) + µ + k -1 if i ∈ {1, . . . , k} a(q) + q(w) + µ + 1 + k otherwise.
Both cases are equal modulo 2. So we have a(q 1 ) = • • • = a(q 2g+1 ). We will show that a(q) = a(q ′ ) + 1 for any q, q ′ ∈ QV with #q ′ = #q + 2.

Let #q = n. Write q = q i 1 + • • • + +q in and q ′ = q j 1 + • • • + +q j n+2 in terms of quadratic forms in A. a(q) = a(q i 1 + • • • + +q in ) = a(q i 1 ) + a(q i 2 ) + a(q i 3 + • • • + q in ) + q i 1 + q i 2 , q i 1 + q i 3 + • • • + q in = a(q i 1 ) + a(q i 2 ) + a(q i 3 + • • • + q in ) + v i 1 + v i 2 , v i 1 + v i 3 + • • • + v in = a(q i 1 ) + a(q i 2 ) + • • • + a(q in ) + v i 1 + v i 2 , v i 1 + v i 3 + • • • + v in + v i 3 + v i 4 , v i 3 + v i 5 + • • • + v in + • • • + v i n-2 + v i n-1 , v i n-2 + v in = a(q i 1 ) + a(q i 2 ) + • • • + a(q in ) + (n -1) + (n -2) + • • • + 2 + 1 (mod 2) = a(q i 1 ) + a(q i 2 ) + • • • + a(q in ) + (n -1) 2 (mod 2).
Similarly,

a(q ′ ) = a(q j 1 + • • • + +q j n+2 ) = a(q j 1 ) + a(q j 2 ) + • • • + a(q j n+2 ) + (n + 1) 2 (mod 2).
Since all the quadratic forms in A have the same Arf invariant, we have a(q) = a(q ′ ) + 1.

Proposition 1.1.6. Let A = {q 1 , . . . , q 2g+1 } be an Aronhold basis. For any i ∈ {1, . . . , 2g+ 1}, a(q i ) = 0 for g = 0, 1 (mod 4) 1 for g = 2, 3 (mod 4).

Proof. Any quadratic form q can be written uniquely as a linear combination of quadratic forms in A, and a(q) depends only on #q modulo 4. So if we count the lengths of the quadratic forms which are 1 modulo 4 as follows,

2g+1 i=1 (mod 4) 2g + 1 i = 2 g-1 (2 g + 1) for g = 0, 1 (mod 4) 2 g-1 (2 g -1) for g = 2, 3 (mod 4),
then the proposition follows since we have 2 g-1 (2 g -1) and 2 g-1 (2 g + 1) odd and even quadratic forms respectively.

Remark 1.1.7. We can determine the Arf invariants of all quadratic forms from their lengths, since we know the Arf invariant of a quadratic form of length 1 for any g.

Labelling

Let A = {q 1 , . . . , q 2g+1 } be an Aronhold basis. All quadratic forms can be written uniquely as the sum of an odd number of q i 's.

q i of length 1,

q i + q j + q k of length 3, . . . 2g+1 i=1 q i of length 2g + 1.
Thanks to Proposition 1.1.6, we can determine whether a quadratic form is even or odd from its length.

In addition, we can label any quadratic form by an odd cardinality subset of {1, . . . , 2g+ 1} of odd cardinality. For an odd number k in {1, . . . , 2g+1}, the set I := {i 1 , . . . , i k } labels the quadratic form q = k j=1 q i j uniquely since the linear expression is unique. We denote q I the quadratic form q. For our purpose, we are interested in labelling the quadratic forms. But, incidentally, note that any vector in V can be labeled via even cardinality subsets of {1, . . . , 2g + 1} in the same way as the quadratic forms are labeled.

Let I 1 , . . . , I k be labels for some quadratic forms or vectors in V . Since V is a vector space over F 2 , pairs of the same quadratic forms will be cancelled in the sum q

I 1 + • • • + q I k .
So it is labelled by I 1 △ . . . △I k where △ denotes the symmetric difference of set.

Finally, notice that once we fix the Aronhold basis A the labelling is naturally unique.

Syzygetic Tetrads and Steiner Sets

We introduce being syzygetic for quadratic forms which allows us to group odd quadratic forms. For this section, our reference is [START_REF] Dolgachev | Classical Algebraic Geometry: A Modern View[END_REF]Section 5.4].

Definition 1.1.8. A set of three elements q 1 , q 2 , q 3 in QV is called a syzygetic triad (resp. azygetic triad) if a(q 1 ) + a(q 2 ) + a(q 3 ) + a(q 1 + q 2 + q 3 ) = 0 (resp. = 1).

We remark that a syzygetic triad {q 1 , q 2 , q 3 } can be completed into a set of four quadratic forms {q 1 , q 2 , q 3 , q 1 + q 2 + q 3 } that adds up to zero. Such a set is called syzygetic tetrad. By Definition 1.1.8, any 3-subset of this tetrad forms a syzygetic triad, also a(q 1 ) = a(q 2 ) = a(q 3 ) = a(q 1 + q 2 + q 3 ). We have the following equivalent properties

• {q 1 , q 2 , q 3 } is a syzygetic triad,

• q 1 (q 2 + q 3 ) = a(q 2 ) + a(q 3 ),

• q 1 + q 2 , q 1 + q 3 = 0 for any q 1 , q 2 , q 3 ∈ QV. It easily follows from the property 1.2 of the Arf invariant. Syzygetic tetrads yield some sets called Steiner sets which classify syzygetic tetrads of odd quadratic forms. It is defined as associated to a vector in V . Definition 1.1.9. For any v ∈ V , we define the Steiner set

S v := {q, q ′ } | q, q ′ ∈ QV -and q + q ′ = v .
Firstly, notice that S v = {q, q + v} | q, q + v ∈ QV -. We also remark that any two pairs of the same Steiner set form a syzygetic tetrad. Indeed, suppose that {q 1 , q 2 } and {q ′ 1 , q ′ 2 } are two pairs in the same Steiner set S v . We take any 3-subset of {q 1 , q 2 , q ′ 1 , q ′ 2 }, say {q 1 , q 2 , q ′ 1 } without loss of generality. Now, a(q 1 + q 2 + q ′ 1 ) = a(q 1 ) + a(q 2 ) + a(q ′ 1 ) + q 1 + q 2 , q 1 + q ′ 1 implies that q 1 + q 2 , q 1 + q ′ 1 = 0 since q 1 , q 2 , q ′ 1 , q ′ 2 are odd and q 1 + q 2 + q ′ 1 + q ′ 2 = 0. Therefore, any 3-subset of {q 1 , q 2 , q ′ 1 , q ′ 2 } is syzygetic. Conversely, any two pairs of odd quadratic forms in a syzygetic tetrad are in the same Steiner set since such tetrad {q 1 , q 2 , q 3 , q 1 + q 2 + q 3 } adds up zero.

Remark 1.1.10. Being syzygetic reflects on the labelling of quadratic forms as follows. Suppose that q I i is a quadratic form labelled by I i ⊂ {1, . . . , 2g + 1} for 1 ≤ i ≤ 4. Notice that, {q I i | i = 1, . . . , 4} is a syzygetic tetrad if and only if I 1 △ . . . △I 4 = ∅ since being syzygetic for q I i 's means that

4 i=1 q I i = 0.
Each Steiner set has 2 g-2 (2 g-1 -1) pairs of quadratic forms. In addition, there are 2 2g -1 Steiner sets. An important characterization for an odd quadratic form q to belong to S v is the equality q(v) = 0 holds. It follows from a(q + v) = a(q) + q(v). Also note that

#S v ∩ S v ′ = 2 g-1 (2 g-2 -1) v, v ′ = 0, 2 g-2 (2 g-1 -1) v, v ′ = 0.
We say that S v and S v ′ are syzygetic (resp. azygetic) if v, v ′ = 0 (resp. v, v ′ =1). In addition, the union of the pairwise syzygetic Steiner sets S v , S v ′ and S v+v ′ is equal to QV -.

Theta Functions

In this section, we review some basic notions about theta functions [START_REF] Rauch | Theta functions with applications to Riemann surfaces[END_REF] and how to relate them with the Jacobian of a curve. For an integer g ≥ 1, let

H g = {τ ∈ GL g (C) | t τ = τ, Im τ > 0}
be the Siegel upper half space. For any x ∈ C, let e(x) = exp(2iπx).

Definition 1.1.11. For τ ∈ H g , z = (z 1 , . . . , z g ) ∈ C g and

[q] = ε ε ′ ∈ Z g ⊕ Z g , the function ϑ[q](z, τ ) = n∈Z g e 1 2 (n + ε/2)τ t (n + ε/2) + (n + ε/2) t (z + ε ′ /2) is called the theta function with characteristic [q].
This is an analytic function on C g × H g . If we evaluate ϑ[q](z, τ ) at z = 0 then we get a theta constant (Thetanullwert) (with characteristic [q]), which is denoted by ϑ

[q](τ ). The characteristic [q] is called even (resp. odd) if ε • ε ′ is even (resp. odd). Since ϑ ǫ ǫ ′ (-z, τ ) = (-1) ǫ•ǫ ′ • ϑ ǫ ǫ ′ (z, τ ), (1.4)
the theta function ϑ ǫ ǫ ′ is a even (resp. odd) function if and only if ε • ε ′ = 0 (resp. = 1). In addition, note that a characteristic [q] is odd if and only if the theta constant ϑ[q](τ ) is identically 0 for all τ ∈ H g . We also have that

ϑ ǫ + 2m ǫ ′ + 2n (z, τ ) = (-1) n•ǫ • ϑ ǫ ǫ ′ (z, τ ). (1.5)
Using the notation of Section 1.1.1, we identify a characteristic [q] modulo 2 with a quadratic form over F 2 which will be denoted by q. The quadratic from q 0 is identified with the characteristic 0 0 . Conversely, fixing a symplectic basis, if we start with a quadratic form q then we write q = ǫ ǫ ′ with entries {0, 1} in terms of coordinates. We associate

ǫ ǫ ′
to the characteristic of the theta function ϑ ǫ + 2m ǫ ′ + 2n (z, τ ) for all n, m ∈ Z. The characteristic ǫ ǫ ′ has only an impact on the sign of the theta function because of Equation (1.5). From now on, we only use characteristics with entries 0, 1. Now, we introduce the link between the curve and its Jacobian. Let C be a smooth, irreducible projective curve of genus g > 0 over C and ω = (ω 1 , . . . , ω g ) be a basis of regular differentials. Let δ = (δ 1 , . . . , δ 2g ) be a symplectic basis of H 1 (C, Z) such that the intersection pairing has the matrix 0 g I g I g 0 g with I g and 0 g are the g × g identity and zero matrices respectively.

With respect to these choices, the period matrix of

C is Ω = [Ω 1 , Ω 2 ]
where

Ω 1 = δ i ω j 1≤i≤g,1≤j≤g
,

Ω 2 = δ i ω j g+1≤i≤2g,1≤j≤g
.

We consider a second basis η = (η 1 , . . . , η g ) of regular differentials obtained by η = Ω -1 1 ω. The period matrix with respect to this new basis is [id, τ ] where τ = Ω -1

1 Ω 2 ∈ H g . This matrix is called the Riemann matrix. We let

Jac(C) = C g /(Z g + τ Z g ).

Let us denote

e i = 1 2 δ i η j 1≤j≤g = (0, . . . , 0, 1 2 , 0, . . . , 0) ∈ C g , and
f i = 1 2 δ g+i η j 1≤j≤g ∈ C g , and v = g i=1 λ i e i + µ j f j = (λ, µ)
with λ, µ ∈ Z g for 1 ≤ i ≤ g. Now, we let W be the Z-module generated by e 1 , . . . , e g , f 1 , . . . , f g , so that

Jac(C)[2] = W/(Z g + τ Z g ).
An element v ∈ W acts on a theta function. Indeed, if

[q] = ǫ ǫ ′ is a characteristic and v = (λ, µ) ∈ W then ϑ[q](z + v, τ ) = e - 1 4 µ t (ǫ ′ + λ) - 1 2 µ t z - 1 8 µτ t µ • ϑ ǫ + µ ǫ ′ + λ (z, τ ). (1.6)
Thanks to Equation (1.6), we will write

[q] + v = ǫ + µ ǫ ′ + λ
. It is possible to see an element of W as a difference of two characteristics.

At the same time, V = Jac(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF] is a vector space over F 2 of 2g dimension. The Weil pairing defines a nondegenerate symplectic form on V . We may induce the symplectic basis of V via e i , f i 's. Now, the theory of quadratic forms on V is coherent with the theta characteristics and (λ, µ) modulo 2. We denote v ∈ V the class of v where the class is identified with the vector (λ (mod 2), µ (mod 2)). So the quadratic form q + v is the quadratic form associated to the theta characteristic [q] + v .

Theta Characteristic Divisors

In this section, we introduce theta characteristic divisors of C. Moreover, we explain the link between such divisors and the quadratic forms on Jac(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF] over F 2 . For more detailed explanations and results, we refer to [4, Chapter 1].

Let C d be the d-fold symmetric product of C which is identified with the set of effective divisors of degree d. Fix a point Q on C. The Abel-Jacobi map is defined by

u d : C d -→ Jac(C) D = i m i P i -→ i m i P i Q (η 1 , . . . , η g ).
The map depends on the choice of the fixed point Q. Also, the value of the integral depends on the path chosen to integrate, however, u d (D) is well defined in Jac(C). It is possible to extend u d to noneffective divisors of degree d. Abel's theorem [4, Chapter 1] assures that this map is invariant under the linear equivalence between divisors. Denote Pic(C) the Picard group of C and Pic d (C) the subgroup of the divisor classes of degree d in Pic(C). By Abel's theorem, u d leads to a bijection from Pic d (C) into Jac(C). Moreover, it induces an isomorphism between the group Pic 0 (C) of the divisor classes of degree 0 in Pic(C) and the Jacobian Jac(C). We keep these identifications in mind when we study theta characteristic divisors in the following part.

The Riemann Theta function θ(z, τ ) of Jac(C) is the theta function ϑ 0 0 (z, τ ) with the characteristic 0 0 . Since it is an analytic function on C g × H g and quasi periodic with respect to the lattice Z g + τ Z g given by [id, τ ] it defines a divisor Θ of Jac(C) which is the zero divisor of ϑ(z, τ ). We denote ℓ(D) the dimension of the Riemann-Roch space of D. The following proposition allows us to relate certain divisors with quadratic forms. Proposition 1.1.12 (Riemann Singularity Theorem). Let κ be the canonical divisor of C. There exists a unique divisor class D 0 of degree g -1 with 2D 0 ∼ κ and ℓ(D 0 ) is even such that

u g-1 (C g-1 ) = Θ + u g-1 (D 0 ). Moreover for any v ∈ V , mult v (Θ) = ℓ(D 0 + v).
A divisor (class) D is called a theta characteristic divisor (class) if 2D ∼ κ. We denote TCh the set of theta characteristic divisors. TCh is nonempty since Jac(C) is a divisible group.

Remark 1.1.13. Proposition 1.1.12 allows us to have a correspondence between theta characteristic divisors of C and quadratic forms on Jac(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF] over F 2 . Before mentioning this correspondence, we emphasize some points. Firstly, recall that θ(z, τ ) = ϑ 0 0 (z, τ ).

In addition, Equation (1.6) implies that mult v (ϑ[q]) = mult 0 (ϑ[q +v]) for any characteristic

[q] and v ∈ Jac(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF]. In addition, if we let

[q] = ǫ ǫ ′ then it follows from Equation (1.4) that ϑ[q] is even if and only if ǫ • ǫ ′ = 0. So we have mult v (ϑ[q]) is even if and only if ǫ • ǫ ′ = 0
Firstly, define q D 0 (v) := ℓ(D 0 + v) (mod 2). Now, if v is given by (λ, µ) with respect to a fixed symplectic basis then by Proposition 1.1.12

q D 0 (v) = ℓ(D 0 + v) (mod 2) = mult v (Θ) (mod 2) = mult v ϑ 0 0 (mod 2) (1.7) = mult 0 ϑ λ µ (mod 2) = λ • µ.
So q D 0 corresponds to the quadratic form q 0 defined in Equation (1.1). We identify q D 0 with q 0 . In addition, any theta characteristic divisor D is linearly equivalent to D 0 + v with v = (λ, µ) ∈ V . Indeed, D -D 0 is a 2-torsion point of Jac(C). We can associate D to the quadratic form q = q 0 + v. Note that the Arf invariant of q a(q) = a(q

0 + v) = mult v (Θ) (mod 2)
since mult v (Θ) is equal to the multiplicity of ϑ[q](z, τ ) at 0 and the latter has the same parity as q. For any v ∈ V , we have

q(v) = a(q + v) + a(q) = ℓ(D + v) + ℓ(D) (mod 2).
In short, any theta characteristic divisor D defines a quadratic form q D on V by

q D (v) = ℓ(D + v) + ℓ(D) (mod 2).
It has Arf invariant a(q D ) ≡ ℓ(D) (mod 2). The divisor D 0 corresponds to the quadratic form q 0 . Conversely, any quadratic form q defines a divisor D q := D 0 + q 0 + q.

(1.8)

Remark 1.1.14. As we have seen above, there is a one-to-one correspondence between the set of quadratic forms on Jac(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF] and the theta characteristic divisors. Moreover, an odd (resp. even) theta characteristic corresponds to an odd (resp. even) quadratic form. By following Section 1.1, we know that there are 2 g-1 (2 g + 1) (resp. 2 g-1 (2 g + 1)) odd (resp. even) quadratic forms. Therefore, we know the number of odd (resp. even) theta characteristic divisors.

Multitangents

We assume that C is non-hyperelliptic. The basis of regular differentials {ω 1 , . . . , ω g } defines the canonical map φ : C → P g-1 P → (ω 1 (P ) : . . . : ω g (P )).

Let D be a theta characteristic divisor of C. We call D a vanishing theta characteristic divisor if ℓ(D) > 1. Note that φ * (O P g-1 (1)) = κ. Now, we let H D be any fixed hyperplane in P g-1 such that φ * H D • C ∼ 2D. For g = 4, first of all, note that ℓ(D) = 0, 1 or 2 because of Clifford's theorem for divisors [START_REF] Arbarello | Geometry of Algebraic Curves[END_REF]Chapter III]. Here multitangents are called tritangents in the literature. There are 120 tritangents which correspond to the odd characteristic divisors. To be more specific, the canonical model of C lies on a smooth quadric if and only if there is not a vanishing theta characteristic divisor. In this case, we have exactly 120 tritangents. Otherwise, C lies on a singular quadric Q, then there is a unique even theta characteristic divisor, call D e . The dimension ℓ(D e ) = 2. So there is a one dimensional family of tritangents, that pass through the node of Q. The tritangents which correspond to the odd theta characteristic divisors are the ones which do not pass through the node of Q. Note that, such a curve arises from a del Pezzo surface of degree 1 which follows from [START_REF] Yu | Cubic forms; Algebra, Geometry, Arithmetic[END_REF]Theorem 24.4.iii]. In Section 1.2.2, we come back to this subject. Remark 1.1.17. Everything aside, if C is a general curve of genus g, then ℓ(D) = 0, 1 for any theta characteristic divisor D. So there is a unique hyperplane H D if D is an odd theta characteristic divisor. For the generality condition, we refer to [START_REF] Harris | Theta-characteristics on algebraic curves[END_REF]. In this case, notice that we have exactly 2 g-1 (2 g -1) multitangents.

In the following proposition, we see the geometric meaning of being syzygetic for quadratic forms corresponding to four theta characteristic divisors. It will be important for us to be able to work out concrete computations in Section 1.2.1.

Proposition 1.1.18. Suppose that D 1 , D 2 , D 3 , D 4 are four odd theta characteristic divisors corresponding to the quadratic forms q 1 , q 2 , q 3 , q 4 respectively. If q 1 , q 2 , q 3 , q 4 is a syzygetic tetrad then

D 1 + D 2 + D 3 + D 4 is cut out by a quadric in P g-1 .
Proof. We write D i = D 0 + q 0 + q i for i = 1, . . . , 4 by following the correspondence between quadratic forms and theta characteristic divisors above. Because

q 1 + • • • + q 4 = 0, 4 i=1 D i = 4 i=1 (D 0 + q 0 + q i ) ∼ 2κ.
There is a quadric in P g-1 which cuts out

D 1 + D 2 + D 3 + D 4 since φ * (O P g-1 (2)) = 2κ.
Remark 1.1.19. We can construct the Steiner sets by using Proposition 1.1.18 geometrically. For an algorithm of such a construction, we refer to our article [START_REF] Celik | Tritangents and their space sextics[END_REF]. On the other hand, the labelling provides a more efficient way for this construction. In this case, we can verify being syzygetic of given four multitangents on their labels by Remark 1.1.10.

Link between combinatorics, algebra and geometry

We quickly summarize the link between notions which are explained in Section 1.1.1, 1.1.2, 1.1.3 and 1.1.4 in the following figure when C is general. odd theta constants of C modulo 2 ⇐⇒ odd quadratic forms q on Jac(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF] multitangents ⇐⇒ odd theta characteristic divisors D q of C

Line Bundles

In this section, we overview how to associate a line bundle to a given divisor on a variety and how a line bundle on a variety gives a divisor on this variety. We also mention some basic properties of sections over line bundles. For further interests, we refer to the following classical sources [45, Chapter 1], [START_REF] Hartshorne | Algebraic Geometry[END_REF].

Basics

Let X be a smooth algebraic variety over a field k. We recall that for any line bundle π : L → X of X there is an open cover {U α } of X and there are isomorphisms, called trivializations

φ α : L Uα → U α × k of L Uα = π -1 (U α ).
Note that φ α induces a linear isomorphism between L x and {x} × k where L x is the fiber π -1 (x). The composite function

φ α • φ -1 β : (U α ∩ U β ) × k → (U α ∩ U β ) × k is well defined with φ α • φ -1 β (x, z) = (x, g αβ (x)z)
for some k-valued function

g αβ : U α ∩ U β → k × .
These functions are called the transition functions. Conversely, given an open cover {U α } of X and maps g αβ : U α ∩ U β → k × satisfying some natural compatibility conditions, there is a unique line bundle L → X with transition functions {g αβ }. In addition, two collections of transition functions {g αβ }, {g ′ αβ } define the same line bundle if and only if there is a family of regular functions {f α } such that

g ′ αβ = f α f β g αβ .
If L, L ′ are line bundles with transition functions {g αβ },{g ′ αβ } respectively, then it is possible to define line bundles L ⊗ L ′ and L -1 with the transition functions {g αβ g ′ αβ } and {g -1 αβ } respectively.

Divisors and Line Bundles

Let D be a divisor on X with local defining functions {f α } over some open cover {U α } of X. The line bundle given by the functions

g αβ = f α f β
is called the associated line bundle of D, denoted by [D]. We note that

[D + D ′ ] = [D] ⊗ [D ′ ], [-D] = [D] -1 .
A section of a line bundle π : L → X is a map

s : X → L such that π • s = id X . A section s of L over ∪ α U α is
given by a family of rational functions {s α } on U α with

s α = g αβ s β on U α ∩ U β . (1.9)
Conversely, such a family defines a section of L.

It follows from (1.9) that the divisors (s α ), (s β ) are equivalent. So it is possible to define the divisor (s) of a section s of L as (s α ) for some α. Note that if a point P is in the zeroes of (s) then it is in the zeroes of (s α ) for all α. So we may define s(P ) = 0. In addition, the quotient of two sections of L is a well defined rational function because of the condition (1.9). Indeed, take any two sections s, s ′ of L. Suppose that they are given by the families {s α } and {s ′ α }. The section s/s ′ is given by the family {s α /s ′ α }. It is a well defined rational function since s α /s ′ α = (g αβ s β )/(g αβ s ′ β ) for any α, β. If D is a divisor with local defining functions {f α } then they provide a section s f of [D] with (s f ) = D. Conversely, if L is a line bundle of X with transition functions {g αβ } then L = [(s)] for any global rational section s of L.

Computations of Theta Constants

We are finally equipped capably to explain our algorithm for computations of theta constants. Firstly, we focus on the argumentation of developing the algorithm and then we will deal with problems arising from how to obtain an input for the algorithm.

General Algorithm

We describe an algorithm for computing fourth power of quotient even theta constants. The principal idea comes from [77, Remark 1,2], which is based on Weber formula [START_REF] Weber | Theorie der Abel'schen Funktionen vom Geschlecht[END_REF] for computing this quotient in terms of bitangents for g = 3.

Recall that C is a non-hyperelliptic curve of genus g with the canonical embedding φ into P g-1 .

Throughout this section, we fix a Riemann matrix τ associated a normalised regular differentials η as introduced in Section 1.1.2. Thus we avoid to write τ in the notation for Theta functions and constants. In addition, fix a theta hyperplane H Dq and also a linear polynomial β q ∈ C[X 1 , . . . , X g ] such that H Dq is the hyperplane with equation β q = 0.

Let p 1 , p 2 be two even quadratic forms. In the Steiner set S p 1 +p 2 there are 2 g-2 (2 g-1 -1) pairs of quadratic forms (see Section 1.1.1). Choose a pair {q 1 , q 1 } in S p 1 +p 2 . So

p 1 + p 2 = q 1 + q 1 .
Let D q 1 , D q 1 be the theta characteristics divisors associated to q 1 , q 1 . We write

D q 1 ∼ A 1 + • • • + A g-1 , D q 1 ∼ B 1 + • • • + B g-1 ,
where A i 's (respectively B i 's) are the points in the support of multitangent β q 1 (respectively β q 1 ) for i = 1, . . . , g -1.

Let S = S 1 + • • • + S 2g-3 be an arbitrary generic effective divisor of degree 2g -3 on C and be κ

= 2(A 1 + • • • + A g-1 )
. By fixing a point P 0 on C, we introduce

f i,S (P ) := ϑ[p i ](P + S -κ) := ϑ[p i ] P P 0 η + 2g-3 i=1 S i P 0 η -2 g-1 i=1 A i P 0 η .
According to Riemann theorem [80, Theorem V.1], f i,S (P ) is a regular section of a line bundle over C, and if f i,S is not identically zero then its zero divisor (f i,S ) 0 has degree g and satisfies

(f i,S ) 0 ∼ D 0 + (p i + q 0 ) + κ -S = D p i + κ -S.
Since ℓ(κ

+ D p i ) = 2g -2, we let {t (1)
i , . . . , t

(2g-2) i
} be a basis of sections on the line bundle [κ + D p i ] (called Wurzelfunctionen in Weber's book) which corresponds to a basis of L(κ + D p i ). Suppose that t (j) i is given by family of rational functions t (j) i,α with an open cover {U i,α } α∈I of C for i = 1, 2 and j = 1, . . . , 2g -2.

For each i = 1, 2, we can find an open cover {U i,α } α of C such that for each k = 1, . . . , 2g -3 there exists α k for which S k is not a pole of t (j)

i,α k for any j = 1, . . . , 2g -3. We define χ i,S as the family of the following rational functions

χ i,S,α (P ) = t (1) i,α (P ) • • • t (2g-2) i,α (P ) t (1)
i,α 1 (S 1 )

• • • t (2g-2) i,α 1 (S 1 ) . . . . . . t (1)
i,α 2g-3 (S 2g-3 ) • • • t (2g-2) i,α 2g-3 (S 2g-3 ) , 1 ≤ i ≤ 2, (1.10)
on U α for all α. Therefore, the section χ i,S belongs to the same line bundle [κ + D p i ], since the determinant is a linear combination of t (j)

i,α 's. Since χ i,S (S j ) = 0 for 1 ≤ j ≤ 2g -3, we see that (χ 1,S ) 0 = S + R i where R i is an effective divisor of degree g, uniquely defined by R i + S ∼ κ + D p i . Now

(f i,S ) 0 ∼ D p i + κ -S ∼ R i , so actually (f i,S ) 0 = R i . Therefore, (f 1,S ) 0 -(f 2,S ) 0 = R 1 -R 2 = (χ 1,S ) 0 -(χ 2,
S ) 0 and there exists a constant λ S such that f 1,S (P ) f 2,S (P ) = λ S • χ 1,S (P ) χ 2,S (P ) .

Lemma 1.2.1. λ S does not depend on S.

Proof. One has

f 1,S (P ) f 2,S (P ) • χ 2,S (P ) χ 1,S (P ) = λ S .
We have to prove that the expression on the left side does not depend on the support of

S = S 1 + • • • + S 2g-3 . It is enough to show that λ S = λ S ′ where S ′ = S ′ 1 + S 2 + • • • + S 2g-3 for another generic point S ′ 1 . Note that f i,S (S ′ 1 ) = ϑ[p i ](S ′ -κ) = f i,S ′ (S 1
) and χ i,S (S ′ 1 ) = -χ i,S ′ (S 1 ). Hence

λ S = f 1,S (S ′ 1 ) f 2,S (S ′ 1 ) • χ 2,S (S ′ 1 ) χ 1,S (S ′ 1 ) = f 1,S ′ (S 1 ) f 2,S ′ (S 1 ) • χ 2,S ′ (S 1 ) χ 1,S ′ (S 1 ) = λ S ′ .
In the sequel we are going to use two particular divisors S and S ′ .

Lemma 1.2.2.

If S = A 2 + • • • + A g-1 + A 1 + • • • + A g-1 then f 1,S (A 1 ) 2 f 2,S (A 1 ) 2 = ϑ[p 1 ](0) 2 ϑ[p 2 ](0) 2 .
If moreover

S ′ = A 2 + • • • + A g-1 + B 1 + • • • + B g-1 then f 1,S ′ (P ) 2 f 2,S ′ (P ) 2 = (-1) a(q 0 +p 1 +p 2 ) • f 2,S (P ) 2 f 1,S (P ) 2 .
Proof. The first equality is trivial. As for the second, let [p 1 ] = ǫ ǫ ′ and

(B 1 + • • • + B g-1 ) -(A 1 + • • • + A g-1 ) ∼ D q 1 -D 1 = [q 1 ] -[q 1 ] = (λ, µ), so that [p 2 ] = [p 1 ] + [q 1 ] -[q 1 ] = ǫ + µ ǫ ′ + λ
(the choices for the lifts of the quadratic forms are irrelevant because we are going to take squares). Then using (1.6)

f 1,S ′ (P ) 2 = ϑ[p 1 ](P + A 2 + • • • + A g-1 + B 1 + • • • + B g-1 -κ) 2 = ϑ[p 1 ](P + A 2 + • • • + A g-1 + B 1 + • • • + B g-1 -κ + (B 1 + • • • + B g-1 ) -(A 1 + • • • + A g-1 )) 2 = (-1) µ•(ǫ ′ +λ) • c τ,µ,z • f 2,S (P ) 2 ,
where

z = P + A 2 + • • • + A g-1 + B 1 + • • • + B g-1 -κ, c τ,µ,z is a constant depending on τ, µ, z and f 2,S ′ (P ) 2 = (-1) µ•ǫ ′ • c τ,µ,z • f 1,S (P ) 2 .
Hence for the quotient we get

f 1,S ′ (P ) 2 f 2,S ′ (P ) 2 = (-1) µ•λ • f 2,S (P ) 2 f 1,S (P ) 2 .
From this we get that

f 1,S (A 1 ) 2 • f 2,S ′ (A 1 ) 2 f 2,S (A 1 ) 2 • f 1,S ′ (A 1 ) 2 = (-1) a(q 0 +p 1 +p 2 ) • ϑ[p 1 ](0) 4 ϑ[p 2 ](0) 4 = χ 1,S (A 1 ) 2 • χ 2,S ′ (A 1 ) 2 χ 2,S (A 1 ) 2 • χ 1,S ′ (A 1 ) 2 .
We denote √ q a (fixed) section (Abelsche Function) of the line bundle associate to D q for a quadratic form q. We write √ q(P ) = P √ q. Let {r i , r i } | i = 1, . . . , g -1 and {s i , s i } | i = 1, . . . , g -1 be the sets of g -1 many distinct pairs in the Steiner sets S p 1 +q 1 and S p 1 +q 1 respectively. We may choose g -1 of them, since a Steiner set contains 2 g-2 (2 g-1 -1) many pairs of quadratic forms. We can then choose for t

i , . . . , t

(2g-2) i
the following expressions t (j) 1 = q 1 r j r j for j ∈ {1, . . . , g -1}, t

1 = q 1 s j s j for j ∈ {g, . . . , 2g -2} and t (j) 2 = q 1 s j s j for j ∈ {1, . . . , g -1}, t (j) 2 = q 1 r j r j for j ∈ {g, . . . , 2g -2}.

The quotient χ 1,S (A 1 )/χ 2,S (A 1 ) take the indeterminate form 0/0 so we need first to resolve this ambiguity and then we will express everything in terms of the multitangents. We begin with a divisor

S = S 2 + • • • + S g-1 + A 1 + • • • + A g-1 .
Note that A i q 1 r j r j = 0, since A i is in the zeroes of the divisor q 1 r j r j for i = 1, . . . , g -1 and j = 1, . . . , g -1.

χ 1,S (P )

= P √ q 1 r 1 r 1 • • • P q 1 r g-1 r g-1 P √ q 1 s 1 s 1 • • • P q 1 s g-1 s g-1 S 1 √ q 1 r 1 r 1 • • • S 2 q 1 r g-1 r g-1 S 2 √ q 1 s 1 s 1 • • • S 2 q 1 s g-1 s g-1 . . . . . . S g-1 √ q 1 r 1 r 1 • • • S g-1 q 1 r g-1 r g-1 S g-1 √ q 1 s 1 s 1 • • • S g-1 q 1 s g-1 s g-1 A 1 √ q 1 r 1 r 1 • • • A 1 q 1 r g-1 r g-1 A 1 √ q 1 s 1 s 1 • • • A 1 q 1 s g-1 s g-1 . . . . . . A g-1 √ q 1 r 1 r 1 • • • A g-1 q 1 r g-1 r g-1 A g-1 √ q 1 s 1 s 1 • • • A g-1 q 1 s g-1 s g-1 = P √ q 1 r 1 r 1 • • • P q 1 r g-1 r g-1 P √ q 1 s 1 s 1 • • • P q 1 s g-1 s g-1 S 2 √ q 1 r 1 r 1 • • • S 2 q 1 r g-1 r g-1 S 2 √ q 1 s 1 s 1 • • • S 2 q 1 s g-1 s g-1 . . . . . . S g-1 √ q 1 r 1 r 1 • • • S g-1 q 1 r g-1 r g-1 S g-1 √ q 1 s 1 s 1 • • • S g-1 q 1 s g-1 s g-1 0 • • • 0 A 1 √ q 1 s 1 s 1 • • • A 1 q 1 s g-1 s g-1 . . . . . . 0 • • • 0 A g-1 √ q 1 s 1 s 1 • • • A g-1 q 1 s g-1 s g-1 .
So χ 1,S (P )

= P √ q 1 r 1 r 1 • • • P q 1 r g-1 r g-1 S 2 √ q 1 r 1 r 1 • • • S 2 q 1 r g-1 r g-1 . . . . . . S g-1 √ q 1 r 1 r 1 • • • S g-1 q 1 r g-1 r g-1 A 1 √ q 1 s 1 s 1 • • • A 1 q 1 s g-1 s g-1 . . . . . . A g-1 √ q 1 s 1 s 1 • • • A g-1 q 1 s g-1 s g-1 = c 1,S P √ r 1 r 1 • • • P r g-1 r g-1 S 2 √ r 1 r 1 • • • S 2 r g-1 r g-1 . . . . . . S g-1 √ r 1 r 1 • • • S g-1 r g-1 r g-1 A 1 √ s 1 s 1 • • • A 1 s g-1 s g-1 . . . . . . A g-1 √ s 1 s 1 • • • A g-1 s g-1 s g-1 ,
where

c 1,S = P √ q 1 S 2 √ q 1 • • • S g-1 √ q 1 A 1 √ q 1 • • • A g-1 √ q 1 .
Similarly, we write down the determinant χ 2,S (P ). Also we note that A i q 1 s j s j = 0 for i = 1, . . . , g -1 and j = 1, . . . , g -1.

χ 2,S (P )

= P √ q 1 s 1 s 1 • • • P q 1 s g-1 s g-1 P √ q 1 r 1 r 1 • • • P q 1 r g-1 r g-1 S 2 √ q 1 s 1 s 1 • • • S 2 q 1 s g-1 s g-1 S 2 √ q 1 r 1 r 1 • • • S 2 q 1 r g-1 r g-1 . . . . . . S g-1 √ q 1 s 1 s 1 • • • S g-1 q 1 s g-1 s g-1 S g-1 √ q 1 r 1 r 1 • • • S g-1 q 1 r g-1 r g-1 A 1 √ q 1 s 1 s 1 • • • A 1 q 1 s g-1 s g-1 A 1 √ q 1 r 1 r 1 • • • A 1 q 1 r g-1 r g-1 . . . . . . A g-1 √ q 1 s 1 s 1 • • • A g-1 q 1 s g-1 s g-1 A g-1 √ q 1 r 1 r 1 • • • A g-1 q 1 r g-1 r g-1 = P √ q 1 s 1 s 1 • • • P q 1 s g-1 s g-1 P √ q 1 r 1 r 1 • • • P q 1 r g-1 r g-1 S 2 √ q 1 s 1 s 1 • • • S 2 q 1 s g-1 s g-1 S 2 √ q 1 r 1 r 1 • • • S 2 q 1 r g-1 r g-1 . . . . . . S g-1 √ q 1 s 1 s 1 • • • S g-1 q 1 s g-1 s g-1 S g-1 √ q 1 r 1 r 1 • • • S g-1 q 1 r g-1 r g-1 0 • • • 0 A 1 √ q 1 r 1 r 1 • • • A 1 q 1 r g-1 r g-1 . . . . . . 0 • • • 0 A g-1 √ q 1 r 1 r 1 • • • A g-1 q 1 r g-1 r g-1 .
So χ 2,S (P )

= P √ q 1 s 1 s 1 • • • P q 1 s g-1 s g-1 S 2 √ q 1 s 1 s 1 • • • S 2 q 1 s g-1 s g-1 . . . . . . S g-1 √ q 1 s 1 s 1 • • • S g-1 q 1 s g-1 s g-1 A 1 √ q 1 r 1 r 1 • • • A 1 q 1 r g-1 r g-1 . . . . . . A g-1 √ q 1 r 1 r 1 • • • A g-1 q 1 r g-1 r g-1 = c 2,S P √ s 1 s 1 • • • P s g-1 s g-1 S 2 √ s 1 s 1 • • • S 2 s g-1 s g-1 . . . . . . S g-1 √ s 1 s 1 • • • S g-1 s g-1 s g-1 A 1 √ r 1 r 1 • • • A 1 r g-1 r g-1 . . . . . . A g-1 √ r 1 r 1 • • • A g-1 r g-1 r g-1 ,
where c 2,S = P √ q

1 S 2 √ q 1 • • • S g-1 √ q 1 A 1 √ q 1 • • • A g-1 √ q 1 .
We firstly see that c 1,S = c 2,S . We cancel them out in the quotient χ 1,S (P ) χ 2,S (P ) then we let P = A 1 and S i = A i for i = 2, . . . , g -1. So we have

χ 1,S (A 1 ) χ 2,S (A 1 ) = 1.

Now we have that

(-1) a(q 0 +p 1 +p 2 ) • ϑ[p 1 ](0) 4 ϑ[p 2 ](0) 4 = χ 2,S ′ (A 1 ) 2 χ 1,S ′ (A 1 ) 2 .
In order to have (-1) a(q 0 +p 1 +p 2 ) ϑ[p 1 ](0) 4 ϑ[p 2 ](0) 4 , we need to compute

χ 2,S ′ (A 1 ) 2 χ 1,S ′ (A 1 ) 2 . Notice that χ 2 1,S ′ , χ 2
2,S ′ are sections on the same line bundle corresponding to 3κ. So their quotient is a rational function on the curve. All the following computations until we state the main theorem are carried out to find this rational function.

Now, suppose that S

′ = A 2 + • • • + A g-1 + B 1 + • • • + B g-1 .
Note that A i q 1 r j r j = 0, A i q 1 s j s j = 0 and B i q 1 r j r j = 0, B i q 1 s j s j = 0 for i = 1, . . . , g -1, j = 1, . . . , g -1.

χ 1,S ′ (A 1 ) = A 1 √ q 1 r 1 r 1 • • • A 1 q 1 r g-1 r g-1 A 1 √ q 1 s 1 s 1 • • • A 1 q 1 s g-1 s g-1 . . . . . . A g-1 √ q 1 r 1 r 1 • • • A g-1 q 1 r g-1 r g-1 A g-1 √ q 1 s 1 s 1 • • • A g-1 q 1 s g-1 s g-1 B 1 √ q 1 r 1 r 1 • • • B 1 q 1 r g-1 r g-1 B 1 √ q 1 s 1 s 1 • • • A 1 q 1 s g-1 s g-1 . . . . . . B g-1 √ q 1 r 1 r 1 • • • B g-1 q 1 r g-1 r g-1 B g-1 √ q 1 s 1 s 1 • • • B g-1 q 1 s g-1 s g-1 = 0 • • • 0 A 1 √ q 1 s 1 s 1 • • • A 1 q 1 s g-1 s g-1 . . . . . . 0 • • • 0 A g-1 √ q 1 s 1 s 1 • • • A g-1 q 1 s g-1 s g-1 B 1 √ q 1 r 1 r 1 • • • B 1 q 1 r g-1 r g-1 0 • • • 0 . . . . . . B g-1 √ q 1 r 1 r 1 • • • B g-1 q 1 r g-1 r g-1 0 • • • 0 = c 1,S ′ B 1 √ r 1 r 1 • • • B 1 r g-1 r g-1 . . . . . . B g-1 √ r 1 r 1 • • • B g-1 r g-1 r g-1 A 1 √ s 1 s 1 • • • A 1 s g-1 s g-1 . . . . . . A g-1 √ s 1 s 1 • • • A g-1 s g-1 s g-1 ,
where

c 1,S ′ = A 1 √ q 1 • • • A g-1 √ q 1 B 1 √ q 1 • • • A g-1 √ q 1 .
Similarly,

χ 2,S ′ (A 1 ) = A 1 √ q 1 s 1 s 1 • • • A 1 q 1 s g-1 s g-1 A 1 √ q 1 r 1 r 1 • • • A 1 q 1 r g-1 r g-1 . . . . . . A g-1 √ q 1 s 1 s 1 • • • A g-1 q 1 s g-1 s g-1 A g-1 √ q 1 r 1 r 1 • • • A g-1 q 1 r g-1 r g-1 B 1 √ q 1 s 1 s 1 • • • B 1 q 1 s g-1 s g-1 B 1 √ q 1 r 1 r 1 • • • A 1 q 1 r g-1 r g-1 . . . . . . B g-1 √ q 1 s 1 s 1 • • • B g-1 q 1 s g-1 s g-1 B g-1 √ q 1 r 1 r 1 • • • B g-1 q 1 r g-1 r g-1 = 0 • • • 0 A 1 √ q 1 r 1 r 1 • • • A 1 q 1 r g-1 r g-1 . . . . . . 0 • • • 0 A g-1 √ q 1 r 1 r 1 • • • A g-1 q 1 r g-1 r g-1 B 1 √ q 1 s 1 s 1 • • • B 1 q 1 s g-1 s g-1 0 • • • 0 . . . . . . B g-1 √ q 1 s 1 s 1 • • • B g-1 q 1 s g-1 s g-1 0 • • • 0 = c 2,S ′ B 1 √ s 1 s 1 • • • B 1 s g-1 s g-1 . . . . . . B g-1 √ s 1 s 1 • • • B g-1 s g-1 s g-1 A 1 √ r 1 r 1 • • • A 1 r g-1 r g-1 . . . . . . A g-1 √ r 1 r 1 • • • A g-1 r g-1 r g-1 ,
where

c 2,S ′ = A 1 √ q 1 • • • A g-1 √ q 1 B 1 √ q 1 • • • A g-1 √ q 1 . Since c 1,S ′ = c 2,S ′ , χ 2,S ′ (A 1 ) χ 1,S ′ (A 1 ) = B 1 √ s 1 s 1 • • • B 1 s g-1 s g-1 . . . . . . B g-1 √ s 1 s 1 • • • B g-1 s g-1 s g-1 A 1 √ r 1 r 1 • • • A 1 r g-1 r g-1 . . . . . . A g-1 √ r 1 r 1 • • • A g-1 r g-1 r g-1 B 1 √ r 1 r 1 • • • B 1 r g-1 r g-1 . . . . . . B g-1 √ r 1 r 1 • • • B g-1 r g-1 r g-1 A 1 √ s 1 s 1 • • • A 1 s g-1 s g-1 . . . . . . A g-1 √ s 1 s 1 • • • A g-1 s g-1 s g-1
.

In the following part, we reorganize the quotient in order to express it with more elementary functions. For that reason, we complete all the pairs of multitangents appearing in the matrices above to syzygetic tetrads.

Let {r g , r g } and {s g , s g } be any other two pairs of quadratic forms different than any {r i , r i } and {s i , s i } for i = 1, . . . , g -1 in S p 1 +q 1 and S p 1 +q 1 respectively. Then we divide each row of the matrices by one of S ′ i r g r g and S ′ i s g s g with a suitable S ′ i for i = 2, . . . , 2g-3 as follows.

χ 2,S ′ (A 1 ) χ 1,S ′ (A 1 ) = d 2,S ′ B 1 √ s 1 s 1 B 1 √ sgsg • • • B 1 √ s g-1 s g-1 B 1 √ sgsg . . . . . . B g-1 √ s 1 s 1 B g-1 √ sgsg • • • B g-1 √ s g-1 s g-1 B g-1 √ sgsg A 1 √ r 1 r 1 A 1 √ rgrg • • • A 1 √ r g-1 r g-1 A 1 √ rgrg . . . . . . A g-1 √ r 1 r 1 A g-1 √ rgrg • • • A g-1 √ r g-1 r g-1 A g-1 √ rgrg d 1,S ′ B 1 √ r 1 r 1 B 1 √ rgrg • • • B 1 √ r g-1 r g-1 B 1 √ rgrg . . . . . . B g-1 √ r 1 r 1 B g-1 √ rgrg • • • B g-1 √ r g-1 r g-1 B g-1 √ rgrg A 1 √ s 1 s 1 A 1 √ sgsg • • • A 1 √ s g-1 s g-1 A 1 √ sgsg . . . . . . A g-1 √ s 1 s 1 A 1 √ sgsg • • • A g-1 √ s g-1 s g-1 A g-1 √ sgsg , (1.11)
where

d 1,S ′ = B 1 r g r g • • • B g-1 r g r g A 1 s g s g • • • A g-1 s g s g and d 2,S ′ = B 1 s g s g • • • B g-1 s g s g A 1 r g r g • • • A g-1 r g r g .
Now, all the entries of the four matrices in Equation (1.11) are associated to quadratic forms making syzygetic tetrads. We will show how to obtain an elementary function by using such a syzygetic tetrad, and we will describe it for one of the aforementioned Steiner sets, namely S p 1 +q 1 , without loss of generality. We consider a (g + 1)-subset {r i , r i } | i = 1, . . . , g + 1 of S p 1 +q 1 . We know that each tetrad in a Steiner set is syzygetic. Suppose that the corresponding odd theta characteristic divisors to r i , r i are denoted by D r i , D r i for i = 1, . . . , g -1 respectively. Because of being syzygetic, it follows from Proposition 1.1.18 that

D r i + D r i + D r g+1 + D r g+1
is cut out by a quadric in P g-1 for i = 1, . . . , g. Denote such a quadric Q r i for i = 1, . . . , g.

Remark 1.2.3. A quadric cutting out the divisor D r i + D r i + D r g+1 + D r g+1 must be in the linear system |2κ -

(D r i + D r i + D r g+1 + D r g+1 )|.
The dimension of the linear system is 0 since D r i , D r i , D r g+1 , D r g+1 form a syzygetic tetrad. So there is a only one such quadric up to multiplicative constant.

Now we have div

√ r i r i r g r g = div Q r i Q r g . It implies that there is a constant c ig ∈ C such that √ r i r i r g r g = c ig Q r i Q r g .
(1.12)

By following the argument above, we rewrite χ 2,S ′ (A 1 )/χ 1,S ′ (A 1 ) in terms of the corresponding quadrics and take its square. Note that the constants in Equation (1.12) will appear in the numerator and denominator of the quotient χ 2,S ′ (A 1 )/χ 1,S ′ (A 1 ) in the same way, so they will be cancelled out. We do not include them in the following quotient.

χ 2,S ′ (A 1 ) χ 1,S ′ (A 1 ) 2 = d 2 1,S ′ Q s 1 Q s g (B 1 ) • • • Q s (g-1) Q s g (B 1 ) . . . . . . Q s 1 Q s g (B g-1 ) • • • Q s (g-1) Q s g (B g-1 ) 2 Q r 1 Q r g (A 1 ) • • • Q r (g-1) Q r (g) (A 1 ) . . . . . . Q r 1 Q r g (A g-1 ) • • • Q r (g-1) Q r g (A g-1 ) 2 d 2 2,S ′ Q r 1 Q r g (B 1 ) • • • Q r (g-1) Q r g (B 1 ) . . . . . . Q r 1 Q r g (B g-1 ) • • • Q r (g-1) Q r g (B g-1 ) 2 Q s 1 Q s g (A 1 ) • • • Q s (g-1) Q s g (A 1 ) . . . . . . Q s 1 Q s g (A g-1 ) • • • Q s (g-1) Q s g (A g-1 )
2 .

(1.13)

We give the statement of the result which is obtained above. Recall that β q is a fixed linear equation of the multitangent H Dq which corresponds to the associated theta characteristic divisor D q for any quadratic form q. Theorem 1.2.4. Let p 1 , p 2 be two even quadratic form p 1 +p 2 = q 1 +q 1 . For i = 1, . . . , g-1, let A i and B i be fixed representatives of the contact points of β q 1 and β q 1 with the canonical model of C. Consider g + 1 pairs of quadratic forms {r i , r i } | i = 1, . . . , g + 1 and {s i , s i } | i = 1, . . . , g + 1 in the Steiner sets S p 1 +q 1 and S p 1 +q 1 respectively and Q r i and Q s i be the aforementioned quadrics for i = 1, . . . , g. Then

(-1) a(q 0 +p 1 +p 2 ) • ϑ[p 1 ](0) 4 ϑ[p 2 ](0) 4 = d 1 Q s 1 (B 1 ) • • • Q s g-1 (B 1 ) . . . . . . Q s 1 (B g-1 ) • • • Q s g-1 (B g-1 ) 2 Q r 1 (A 1 ) • • • Q r g-1 (A 1 ) . . . . . . Q r 1 (A g-1 ) • • • Q r g-1 (A g-1 ) 2 d 2 Q r 1 (B 1 ) • • • Q r g-1 (B 1 ) . . . . . . Q r 1 (B g-1 ) • • • Q r g-1 (B g-1 ) 2 Q s 1 (A 1 ) • • • Q s g-1 (A 1 ) . . . . . . Q s 1 (A g-1 ) • • • Q s g-1 (A g-1 ) 2 ,
where q 0 is the quadratic form defined in Equation (1.7) and

d 1 = g-1 i=1 (β rg β rg )(B i )(1/Q s g (B i )) 2 g-1 i=1 (β sg β sg )(A i )(1/Q r g (A i )) 2
and

d 2 = g-1 i=1 (β sg β sg )(B i )(1/Q r g (B i )) 2 g-1 i=1 (β rg β rg )(A i )(1/Q s g (A i )) 2 .

Pseudocode

Because of the various identifications in Section 1.1, we will abuse notation and confuse a quadratic form and its corresponding theta characteristic.

Algorithm 1: ThetaConstants Input: C, the model of the curve in P g-1 under the canonical embedding, L 1 , the list of fixed equations of the multi-tangents, L 2 , the list of the labels of the equations in L 1 indexed such that the i-th element of L 2 is the label for i-th element of L 1 , I p 1 , I p 2 ⊂ {1, . . . , 2g + 1}, the labels of two even characteristic p 1 , p 2 respectively.

Output: ϑ[p 1 ](τ ) ϑ[p 2 ](τ )
4 .

1: Establish any two labels I q 1 , I q 1 such that I p 1 △I p 2 △I q 1 △I q 1 = ∅ where △ denotes the symmetric difference of sets. Note that {q 1 , q 1 } is a pair of odd quadratic forms in the Steiner set S p 1 +p 2 .

2: Call the multitangents β q 1 , β q 1 from L 1 by the indexes of I q 1 , I q 1 in L 2 .

3: Compute the tangency points of β q 1 and β q 1 . Denote them {A 1 , . . . , A g-1 } and {B 1 , . . . , B g-1 } respectively. 4: Now compute the Steiner set of p 1 + q 1 and p 1 + q 1 via their labels. Notice that p 2 + q 1 = p 1 + q 1 and p 2 + q 1 = p 1 + q 1 . 5: Set S ′ p 1 +q 1 and S ′ p 1 +q 1 as g + 1-subsets S p 1 +q 1 and S p 1 +q 1 respectively. i.e Choose g + 1 pairs of quadratic forms from each of Steiner sets. Denote them r i , r i and s i + s i respectively for i = 1, . . . , g + 1.

6: Call the multitangents β r i , β r i and β s i , β s i and compute their contact points with C. 7: Compute d 1 and d 2 defined in Theorem 1.2.4. 8: Now compute the quadrics Q r i , Q r g and Q s i , Q s g for i = 1, . . . , g -1, see Equation (1.12). 9: return Compute and return the quotient

χ 2,S ′ (A 1 ) χ 1,S ′ (A 1 ) 2 in Theorem 1.2.4.
As an input of the algorithm, we need the equation of a curve under the canonical embedding, the equations of the multi-tangents and a labelling which is given by an Aronhold basis. This triple is called a complete 2-level structure. Obtaining such a structure is generally not easy. We can overcome this problem thanks to the geometric structure of a del Pezzo surface of degree 1.

Del Pezzo Surfaces

Firstly, we review basic concepts about del Pezzo surfaces. In this regard, we benefited from several sources such as [32, Chapter 8], [START_REF] Demazure | Surfaces de del Pezzo[END_REF], [START_REF] Yu | Cubic forms; Algebra, Geometry, Arithmetic[END_REF]Chapter IV].

A complete, smooth surface S with ample anticanonical divisor -κ S is called del Pezzo surface. That is to say, -nκ S is very ample for some positive integer n i.e. there is a closed embedding ρ : S → P m for some m ≥ 0 such that (κ -1 S ) n = ρ * O P m (1). The degree d of a del Pezzo surface is defined as the self-intersection κ 2 S . The degree of a del Pezzo surface is at most 9. The ampleness of -κ S implies the self-intersection κ 2 S is positive(Nakai-Moishezon criterion).

Anticanonical model

For a given del Pezzo surface S, it is possible to have its projective model via the associated anticanonical model. For any variety X, if D is a divisor on X then we may construct the graded ring

R(X, D) = m≥0 L(mD).
In particularly, if D = -κ X then the graded ring is called the anticanonical ring of X.

Theorem 1.2.5. [58, Theorem III.3.5] If S be a del Pezzo surface and κ 2 S ≤ 4 then S is isomorphic to Proj R(S, -κ S ).

The scheme Proj R(S, -κ S ) is called the anticanonical model of S.

Del Pezzo surfaces as blow-ups

In this section, we see the description of a del Pezzo surface S as a blowup of P 2 . This description enables us to classify the exceptional classes in Pic(S) with exceptional curves of aforementioned blow-up. Definition 1.2.6. A collection of points of P 2 are said to be in general position if no three of them lie on a line, no six of them lie on a conic and no eight of them lie on a cubic with a singularity at one of the points. Conversely, the blow-up of P 2 at 9d points is a del Pezzo surface if and only if the points are in general position for 1 ≤ d ≤ 9.

In the case that S is isomorphic to the blow-up of P 2 at r many points P 1 . . . , P r in general position, we denote it Bl P 1 ...,Pr P 2 .

Exceptional curves and the Picard group

An exceptional curve E on a projective, smooth surface S is an irreducible curve on X with E 2 = κ S • E = -1. The class of an exceptional curve in Pic(X) is called the exceptional class. By the adjunction formula, an exceptional curve is of arithmetic genus 0, therefore it is isomorphic to P 1 .

Suppose that S = Bl P 1 ...,Pr P 2 . All the exceptional classes of S are closely related with the exceptional curves of the blow-up. In addition, the classes of exceptional curves of the blow-up play a fundamental role for the structure of Pic(S). Indeed, if E i is the exceptional curve corresponding to P i and L is the pullback of the class of line in P 2 then {L, E 1 , . . . , E r } forms a basis for Pic(S). More compactly,

Pic(S) = ZL ⊕ ZE 1 ⊕ • • • ⊕ ZE r .
The anticanonical class is given in terms of basis as

κ S = -3L + r i=1 E i .
Additionally, the intersection theory gives that

E i • E j = δ ij , E i • L = 0, L • L = 1,
where δ ij is the Kronecker delta function.

As we have explained above, any divisor class D ∈ Pic(S) can be expressed as aL -

a b 1 b 2 b 3 b 4 b 5 b 6 b 7 b 8 0 -1 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 2 1 1 1 1 1 0 0 0 3 2 1 1 1 1 1 1 0 4 2 2 2 1 1 1 1 1 5 2 2 2 2 2 2 1 1 6 3 2 2 2 2 2 2 2.
The following theorem mentions the correspondence between the exceptional curves on S and the classes in Pic(S) and gives a geometric description of the exceptional curves which will be useful for computational aspects. From now on, we focus on del Pezzo surfaces of degree 1 which enable us to have not only a curve C of genus 4 but also a correspondence between the odd theta divisors in Pic(C) and the exceptional curves in Pic(S).

Let S be a del Pezzo surface of degree 1. From now on, S = Bl P 1 ...,P 8 P 2 for P 1 , . . . , P 8 ∈ P 2 in general position.

Firstly, we say how to compute the anticanonical model of S. Afterwards, we discuss the linear system | -2κ S | and the Bertini involution in order to see how the curve C of genus 4 arises. And finally, we reveal the relationship between the odd theta divisors in Pic(C) and the exceptional divisors in Pic(S). Furthermore, we see how to label the theta characteristic divisors due to the configuration of the exceptional divisors.

Anticanonical model

Depending on the dimension formula in Equation (??), all the dimensions of the following vector spaces are simply known. We may start to compute the anticanonical model [START_REF] Cragnolini | Lines on del Pezzo surfaces with in characteristic = 2[END_REF].

(i) Firstly we choose a basis {x, y} of L(-κ S ).

(ii) The elements x 2 , xy, y 2 are linearly independent in L(-2κ S ). So we complete these elements into a basis {x 2 , xy, y 2 , z} of L(-2κ S ).

(iii) The elements x 3 , x 2 y, xy 2 , y 3 , xz, yz are linearly independent in L(-3κ S ), then we choose an element w ∈ L(-3κ S ) to get a basis {x 3 , x 2 y, xy 2 , y 3 , xz, yz, w} of L(-3κ S ).

(iv) The sets {x 4 , x 3 y, x 2 y 2 , xy 3 , y 4 , z 2 , x 2 z, y 2 z, xyz, xw, yw} and {x 5 , x 4 y, x 3 y 2 , x 2 y 3 , xy 4 , y 5 , xz 2 , yz 2 , x 3 z, y 3 z, x 2 yz, xy 2 z, zw, x 2 w, y 2 w, xyw} are bases of L(-4κ S ) and L(-5κ S ) respectively.

(v) The vector space L(-6κ S ) is of dimension 22. Then the 23 elements {x 6 , x 5 y, x 4 y 2 , x 3 y 3 , x 2 y 4 , xy 5 , y 6 , z 3 , x 2 z 2 , y 2 z 2 , xyz 2 , x 4 z, x 3 yz, x 2 y 2 z, xy 3 z, y 4 z, xzw, yzw, w 2 , x 3 w, x 2 yw, xy 2 w, y 3 w} in L(-6κ S ) are linearly dependent. Let h(x, y, z, w) be a linear dependence among them.

We suppose that T is the graded algebra k[x, y, z, w] by grading deg x = 1, deg y = 1, deg z = 2 and deg w = 3. Then there is a natural isomorphism between the anticanonical ring R(S, -κ S ) and T /(h) (see [27, Page 1202]). Hence S can be described as the zero locus of h in P(1, 1, 2, 3). We may write h = w 2 + wg(x, y, z) + f (x, y, z) where g and f are weighted homogeneous polynomials of degree 3 and 6 respectively. If Char k = 2 then we may (do) assume g = 0 with the change of coordinates y → yg/2.

Remark 1.2.10. We make the computation of this model of S by starting from the eight points P 1 , . . . , P 8 as follows. Since -κ S is equivalent to 3L -E 1 -• • • -E 8 where L is the pullback of the line class in P 2 and E i is the exceptional class lying above P i under the blow up map, we look at the space of plane cubics passing through P 1 , . . . , P 8 which has dimension 2. By abuse of notation, let {x, y} be any basis of this space. Next, we consider the space of plane sextics vanishing doubly on P 1 , . . . , P 8 has dimension 4. So there is a sextic z in this space for which {x 2 , xy, y 2 , z} forms a basis. Last, the space of plane nonics vanishing triply on P 1 , . . . , P 8 has dimension 7. It is spanned by {x 3 , x 2 y, xy 2 , xz, yz, w} for some nonic w. This defines a rational map ψ :

P 2 -→ P(1 : 1 : 2 : 3) (t 0 : t 1 : t 2 ) -→ (x(t 0 , t 1 , t 2 ) : y(t 0 , t 1 , t 2 ) : z(t 0 , t 1 , t 2 ) : w(t 0 , t 1 , t 2 )).

The Zariski closure of the image S under this map is a del Pezzo surface of degree 1 [START_REF] Yu | Cubic forms; Algebra, Geometry, Arithmetic[END_REF][Remark 24.4.2] and there is a morphism between S and S. By abuse of notation, we identify S with S. After a linear change of coordinates, we have the defining equation of S in P(1, 1, 2, 3) as

S : w 2 = z 3 + f 2 (x, y)z 2 + f 4 (x, y)z + f 6 (x, y) (1.14)
where f i ∈ k[w, z] are homogeneous polynomials of degree d for d = 0, 2, 4, 6.

The Bertini involution and linear system | -2κ S |

The linear system | -2κ S | defines a double cover φ 2 : S → P 3 onto a cone Q. The map φ 2 is called the antibicanonical map. Indeed, the basis {x 2 , xy, y 2 , z} of L(-2κ S ) determines a two-to-one map φ 2 onto the cone Q = V (t 0 t 2t 2 1 ) where t 0 , t 1 , t 2 , t 3 are coordinates for P 3 . The branch curve B is a smooth, reduced and irreducible curve of genus 4 which is the intersection of Q with a cubic surface. To be more precise, in the defining equation of S in Equation (1.14), if we let F ∈ k[t 0 , t 1 , t 2 , t 3 ] be the homogenous polynomial of degree 3 corresponding to f 2 (x, y)z 2 + f 4 (x, y)z + f 6 (x, y) under the map (z 2 , zw, w 2 , x) → (t 0 , t 1 , t 2 , t 3 ) then the branch curve B is given as the zero locus V (Q, F ) in P 3 [START_REF] Cragnolini | Lines on del Pezzo surfaces with in characteristic = 2[END_REF].

On the other hand, we consider the map

ι : P(1, 1, 2, 3) -→ P(1, 1, 2, 3) (x : y : z : w) → (x : y : z : -w + f ).
This map defines an involution ι called Bertini involution on the surface S. The fixed locus of ι is a smooth, irreducible, projective curve of genus 4, denote it C. We note that φ * 2 (B) = 2C [START_REF] Demazure | Surfaces de del Pezzo[END_REF].

We have the following figure

Exceptional divisors and theta characteristic divisors

Let ρ : Pic(S) → Pic(C) be the restriction homomorphism. Firstly, note that the adjunction formula gives κ C = -2ρ(κ S ) where κ C is the canonical divisor of C.

Our aim is to see the link between the odd theta characteristic divisors on C and the exceptional divisors on S.

So we firstly introduce

M := κ ⊥ S = {D ∈ Pic(S) | κ S • D = 0}. (1.15)
It is a Z-module generated by

B 1 := E 1 -E 2 , B 2 := E 2 -E 3 , . . . B 7 := E 7 -E 8 , B 8 := L -E 1 -E 2 -E 3 .
For the structure of κ ⊥ S , we refer to [32, Section 8. The action of the Bertini involution on the exceptional curves is as follows.

Proposition 1.2.12. [101, Section 2] If E is an exceptional divisor on S then

(i) ι(E) = -E -2κ S , (ii) ρ(ι(E)) = ρ(E).
As a corollary, we illustrate the action of ι on the exceptional curves more concretely. Let I = {1, . . . , 8}. For n ∈ {1, . . . , 8}, define I i 1 ...in := I \ {i 1 , . . . , i n } with i k = i l for any k = l. Now, we have the following correspondence Another corollary of Proposition 1.2.12 (ii) is that there is a two-to-one correspondence between the set of exceptional divisors on S and the set of odd theta divisors on C. The preimage of an odd theta characteristic divisor under ρ consists of two exceptional divisors which are conjugate under ι. Let us denote this correspondence

E i ι ←→ 6L - 8 j∈I i 2E j -3E i L -E i -E j ι ←→ 5L - 8 k∈I ij 2E k -E i -E j 2L - 8 l∈I ijk E l ι ←→ 4L - l∈I ijk E i l -2E i -2E j -2E k 3L -2E i - k∈I ij E k ι ←→ 3L -2E j - k∈I ij E k .
{E, ι(E)} ←→ D E .
(1.16)

Remark 1.2.13. Because of Proposition 1.2.12(i), for any exceptional divisors E we have

ρ(ι(E)) + ρ(E) = ρ(ι(E) + E) = ρ(-2κ S ) = κ C .
Since O P 3 (1) corresponds to κ C under the canonical embedding, ρ(ι(E)+E) defines a plane in P 3 . Moreover, this plane defines a tritangent of C. The equality also hints on how to compute the equations of the tritangents which corresponds to odd theta characteristic divisors by starting from P 1 , . . . , P 8 . Indeed, the preimage of any odd theta characteristic divisor gives a pair of exceptional divisors of S conjugated under the Bertini involution. All such pairs are mapped to geometric objects given in Theorem 1.2.9(i) under the blow down map. We may compute the zero locus of the union of such pair in P 2 and compute the image in P 3 by passing through P(1, 1, 2, 3) and P(1, 1, 2) under the maps π and φ (see Figure 1.3).

We are on our way to get a complete 2-level structure of a genus 4 curve C. Indeed, we are able to compute the canonical model of C and all the tritangent equations in P 3 . In the following section, we obtain an Aronhold basis which provides a labelling for all the theta characteristic divisors (see Section 1.1.1).

Finding an Aronhold basis

Because of Proposition 1.1.5, if we have a fundamental set in Jac C [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF] then we know how to construct an Aronhold basis. The following theorem gives such a fundamental set. Theorem 1.2.14. [101, Theorem 2.10] The set ρ(E i + κ S ) | i = 1, . . . , 8 forms a basis of Pic(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF] with ρ(E i + κ S ), ρ(E j + κ S ) = 1 if i = j where , is the Weil pairing. Futhermore, If M is defined as in (1.15) then the map M/2M → Pic(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF] induced by ρ is an isometry with respect to the pairing of intersection number on M modulo 2 and the Weil pairing , on Pic(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF].

Remark 1.2.15. By Remark 1.1.4, the set ρ(E i + κ S ) | i = 1, . . . , 8 can be completed to a fundamental set in Jac(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF]. Now, we construct an Aronhold basis by following the proof of Proposition 1.1.5. Consider ρ(-κ S ). Let the associated quadratic form q ρ(-κ S ) be the simplest quadratic form defined in Equation (1.7), and denote it by q 0 . By following Section 1.1.3, recall that D q denotes the theta characteristic divisor corresponding to the quadratic form q and D q = D q 0 + q + q 0 .

(1.17)

We denote T q the corresponding tritangent equation in P 3 . Now, we consider the following 2-torsion elements in Pic(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF] v i := ρ(E i + κ S ) for i = 1, . . . , 8,

v 9 := 8 i=1 v i .
By Proposition 1.2.14, the set {v 1 , . . . , v 9 } is a fundamental set in Jac(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF]. In order to use Proposition 1.1.5, we observe that

q 0 (v i ) = ℓ(ρ(-κ S ) + ρ(E i + κ S )) + ℓ(ρ(-κ S )) (mod 2) = ℓ(ρ(E i )) + ℓ(ρ(-κ S )) (mod 2) = 1 + 0 (mod 2)
for i = 1, . . . , 8 which follows from that ρ(E i ), ρ(-κ S ) are odd, even respectively. In addition, we can compute q 0 (v 9 ) = 0.

For i = 1, . . . , 9, define q i := q 0 + v i + v 9 . It follows from Proposition 1.1.5 that the set A = {q 1 , . . . , q 9 } forms an Aronhold basis for the quadratic forms on Jac(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF], in which the basis is formed by even quadratic forms since the genus of C is 4 because of Proposition 1.1.6. Note that

9 i=1 q i = q 0 .
Recall that S = Bl P 1 ...,P 8 P 2 . In the following part, we see how to realise the labelling (see 1.1.1) which comes from A in terms of the points P 1 , . . . , P 8 . Therefore, we will have a complete 2-level structure of C.

We know that if you have an odd theta divisor ρ(E) then ρ(E + κ S ) is a 2-torsion point of Pic(C). We express ρ(E + κ S ) as a linear combination of ρ(E i + κ S )'s. Recall that, I = {1, . . . , 8} and for n ∈ {1, . . . , 8}, I i 1 ...in = I \ {i 1 , . . . , i n } with i k = i l for any k = l. Proposition 1.2.16. We have

(i) ρ(L -E i -E j + κ S ) = k∈I ij ρ(E k + κ S ) for all distinct i, j ∈ I, (ii) ρ 2L - 8 l∈I ijk E l + κ S = l∈I ijk ρ(E l + κ S ) for all distinct i, j, k ∈ I, (iii) ρ 3L -2E i - k∈I ij E k + κ S = ρ(E i + κ S ) + ρ(E j + κ S ) for all distinct i, j ∈ I.
Proof. We have 8L +

8 i=1 3E i • κ S = 0 where κ S = -3L + E 1 + • • • + E 8 . It follows from Proposition 1.2.11 that ρ 16L + 8 i=1 6E i = 0. Now, ρ(L -E i -E j + κ S ) - 8 k=1 k =i,j ρ(E k + κ S ) = ρ L - 8 i=1 -5κ S = ρ 16L - 8 i=1 6E i = 0. We have that ρ(E i + κ S ) = ρ(-E i -κ S ) and (L + 3κ S ) • κ S = 0. Thus, ρ 2L - 5 k=1 i k ∈{1,...,8} E i k + κ S - 5 k=1 i k ∈{1,...,8} ρ(E i k + κ S ) = ρ 2L - 5 k=1 i k ∈{1,...,8} E i k + 5 k=1 i k ∈{1,...,8} ρ(E i k + κ S ) = ρ(2L + 6κ S ) = 0. We have that ρ(E i + κ S ) = ρ(-E i -κ S ) and κ S = -3L + E 1 + • • • + E 8 . Thus, ρ 3L -2E i - k∈I ij E k + κ S -ρ(E i + κ S ) -ρ(E j + κ S ) = ρ 3L -2E i - k∈I ij E k + κ S + ρ(E i + κ S ) -ρ(E j + κ S ) = ρ(3L -E 1 -E 2 -• • • -E 8 + κ S ) = 0.
Now, let us write down all the quadratic forms by using A and figure out the labelling in terms of the indexes of P 1 , . . . , P 8 . For the following part, recall Theorem 1.2.9 and Remark 1.2.13.

• The quadratic forms q i are even.

• The quadratic forms of length 3 are odd. Take any q ijk := q i + q j + q k of length 3 for i, j, k ∈ {1, . . . , 9} then

q ijk = q i + q j + q k = q 0 + v i + v 9 + q 0 + v j + v 9 + q 0 + v k + v 9 = q 0 + v i + v j + v k + v 9 ,
where i = j = k. There are two cases.

-If none of i, j, k is 9 then

q ijk = q 0 + l∈I ijk v l .
where I ijk = I \ {i, j, k}. The corresponding theta characteristic divisor (as in Equation (1.17) is

D q ijk = D 0 + q ijk + q 0 = D 0 + l∈I ijk v l = ρ 2L - l∈I ijk E l .
by Proposition 1.2.16. So, we actually label the corresponding tritangent via the indexes of the points P i , P j , P k which do not lie on the conic.

Example 1.2.17. The corresponding odd theta characteristic divisor D q 123 is ρ(2L -8 i=4 E i ). The equation of the tritangent arises by a conic passing through P 4 , . . . , P 8 which is the image of 2L -8 i=4 E i under the blown down map. The label is via the indexes of P 1 , P 2 , P 3 which do not lie on the conic in P 2 .

if one of i, j, k is 9, say k, then

q ijk = q 0 + v i + v j .
It corresponds to the odd theta characteristic divisor [START_REF] Caporaso | Characterizing curves by their odd Theta-characteristics[END_REF]. We know that 3L -2E i -k∈I ij E k + κ S maps to a cubic in P 2 that passes through P k 's for l ∈ I \ {j} where P i is a double point under the blow down map. We label the corresponding tritangent via the indexes of the point P i which is the double point and the point P j which does not vanish on the cubic. Although we can not distinguish whether i or j in the label {i, j, 9} is the index of the double point, it does not cause a problem since ι(3L

D q ij9 = D 0 + q ij9 + q 0 = ρ(-κ S ) + ρ(E i + κ S ) + ρ(E j + κ S ) = ρ 3L -2E i - k∈I ij E k by Proposition 1.2.
-2E i -k∈I ij E k + κ S ) = (3L -2E j -k∈I ij E k + κ S ) and both of 3L -2E i -k∈I ij E k + κ S , 3L -2E j -k∈I ij E k + κ S is in the fiber ρ -1 (D q ij9 ) by Proposition 1.2.12. Example 1.2.18. The corresponding theta characteristic divisor D q 129 is ρ(3L- 2E 1 -8 i=3 ρ(E i +κ S ))
. The corresponding tritangent is labelled via the indexes of P 1 , P 2 which are the double point and the point that is not on the cubic respectively.

• The quadratic forms of length 5 are even.

• We take any quadratic form q i 1 ...i 7 := 7 n=1 q in of length 7 for distinct i n 's in {1, . . . , 9}. It is odd.

-If none of i n 's is 9 then

q i 1 ...i 7 = 7 n=1 q in = 7 n=1 (q 0 + v in + v 9 ) = q 0 + v 9 + 7 n=1 v in = q 0 + v i 8 .
The corresponding odd theta characteristic divisor D q i 1 ...i 7 is ρ(E i 8 ). The image of E i 8 is the point P i 8 in P 2 . We label the corresponding tritangent via the indexes of P i 1 , . . . , P i 7 for which the complementary index i 8 in I is the index of the point P i 8 .

Example 1.2.19. The odd theta characteristic divisor D q 1...7 is ρ(E 8 ). So we label it via the indexes of P 1 , . . . , P 7 .

if one of i n 's is 9, without loss of generality say i 7 = 9, then

q i 1 ...i 7 = 7 n=1 q in = 7 n=1 (q 0 + v in + v 9 ) = q 0 + 6 n=1 v i 6 .
The corresponding theta characteristic divisor

D q i 1 ...i 7 = D 0 + q 0 + q i 1 ...i 7 = ρ(-κ S ) + 6 n=1 ρ(E i 6 + κ S ) = ρ(L -E i -E j ) for i = j ∈ I \ {i 1 , . . . , i 6 }.
by Proposition 1.2.16. The image of L -E i -E j is a line in P 2 passing through P i , P j under the blow down map. The corresponding tritangent is labelled by the indexes of the points P i 1 , . . . , P i 6 which do not lie on the line. The subset {i 1 , . . . , i 6 } of the label is the complementary set of the indexes of the points lying on the line.

Example 1.2.20. The odd theta characteristic divisor D q 1...69 is ρ(L-E 7 -E 8 ). We compute the corresponding tritangent by a line passing through P 8 , P 9 in P 2 . The tritangent equation is labelled via the indexes of P 1 , . . . , P 6 .

• The quadratic form q 12...9 = 9 i=1 q i of length 9 is the unique even form of this length.

Code for the Algorithm

We implement Algorithm 1 in the computational algebra system Magma [START_REF] Bosma | The Magma algebra system I: The user language[END_REF]. The algorithm is available on the https://turkuozlum.wixsite.com/tocj in which you find also implemented functions to generate an input for the algorithm which includes a part from algorithms appearing on https://software.mis.mpg.de. Algorithm 1 may return 0/0 if the abelsche functions which are chosen fail to give a basis for certain Riemann-Roch spaces to set the determinant in (1.10). Nevertheless, we can easily detect this phenomenon and try to avoid it by changing abelsche functions. This worked in all cases we have performed. We can not prove that such a solution always exist.

Our problem is based on the following question. Let C be a non-hyperelliptic curve of genus g. Fix (any) v ∈ Pic(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF]. Let κ be the canonical divisor of C. Can we find a basis of L(κ + v) by the span of the tensor product of the Riemann-Roch spaces {L(D), L(D + v)} while D, D + v run through the odd and effective divisors?

C S P 2 D ijk 2L - l∈I ijk E l conic passing through P l 's for l ∈ I ijk 4L - l∈I ijk E l - l∈{i,

(Kummer Based) Hyperelliptic Curve Cryptography

Jacobians of hyperelliptic curves of genus 2 are also considered for cryptographic purposes as well as elliptic curves. Furthermore, not only Jacobians but also Kummer surfaces associated to the Jacobians are taken into the account for certain cryptographic objectives.

In particular, they are suitable for protocols for which only scalar multiplication is needed. Scalar multiplication on the Kummer surfaces associated to the Jacobian of a genus 2 curve can be more efficient than the scalar multiplication on the Jacobian itself [START_REF] Gaudry | Fast genus 2 arithmetic based on Theta functions[END_REF]. In this chapter, we aim to represent a compact text collecting mathematical basics from the literature about hyperelliptic curve cryptography (HECC) and Kummer based HECC (KHECC). We firstly introduce hyperelliptic curves of genus g and how to do arithmetic on themselves, and then we describe Kummer based arithmetic when g = 2 with the link between the Kummer surface and the corresponding Jacobian.

The usage of the multiplicative groups in Diffie-Hellmann key exchange scheme is replaced with elliptic curve groups. Elliptic curve groups use base fields of size around 256 bits while multiplicative groups use a size more than 3000 bits to achieve a security level around 128 [START_REF] Bernstein | Hyper-and-elliptic-curve cryptography[END_REF]. The Jacobians of hyperelliptic curves of genus 2 give better performance for high-security [START_REF] Bos | Fast cryptography in genus 2[END_REF]. For a security level around 128 bits, hyperelliptic curves of genus 2 use 128 bits base field which produces a group (Jacobian) size around 256 bits. This reduction of the number of bits from genus 1 to genus 2 makes speedup factor around 3 on the base field arithmetic. However, the group operations for genus 2 requires more operations at the level of the base field. The algorithms by Kummer varieties (see Section 2.1.2) making this requirement rise less. So the parameters of the curve, the costs of the algorithms and the implementation play a role for the comparison between ECC and KHECC.

There are many works to reduce the cost of arithmetic operations on the curve in HECC. We may refer to [START_REF] Lange | Formulae for arithmetic on genus 2 hyperelliptic curves[END_REF], [START_REF] Gaudry | Fast genus 2 arithmetic based on Theta functions[END_REF], [START_REF] Bos | Fast cryptography in genus 2[END_REF] and [START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF]. Table 2.1 presents some costs for the operations in Elliptic Curve Cryptography (ECC), HECC and KHECC to have a point of view for a comparison in terms of costs of curve level operations. solution and source field width (bits) ADD DBL F p ECC [START_REF] Bernstein | Explicit-formulas database[END_REF] l ECC 3m + 5s 6m + 2s F p KECC [START_REF] Bernstein | Explicit-formulas database[END_REF] l ECC 9m + 7s F 2 n HECC [START_REF] Lange | Formulae for arithmetic on genus 2 hyperelliptic curves[END_REF] l HECC ≈ 0.5l ECC 40m + 4s 38m + 6s F p KHECC [START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF] l HECC ≈ 0.5l ECC 19m + 12s

Table 2.1: Cost per key bit of curve level operations in various HECC solutions, m and s denote multiplication and square in the field. KECC stands for Kummer based elliptic curve cryptography [START_REF] Montgomery | Speeding the pollard and elliptic curve methods of factorization[END_REF].

KHECC has several advantages such as having smaller finite field size (comparing with ECC); efficient pseudo addition algorithm for the scalar multiplication with a constant time and uniform behaviour against some side channel attacks; large and regular internal parallelism.

I dismiss computer scientific background which is out of my research area. The main part of the work i.e. the engineering is realised by the team of computer science. Nevertheless, we present a summary of the results after introducing a compact text looking at literature about (KH)ECC from the mathematical point of view. At the end of the chapter, we will present some results which are obtained from a hardware design for KHECC. The hardware implementation is based on a software implementation in [START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF]. We focus on only hardware acceleration for scalar multiplication since this is the main operation in terms of performance, energy consumption and security against side channel attacks (when the scalar is the private key).

Mathematical Background

An elliptic curve is a hyperelliptic curve of genus 1. Unlike the case of genus 1, in higher genus g ≥ 2, the points on a hyperelliptic curve do not form a group. However, there is a group structure associated to it. In this section, the aim is to understand the group structure associated to any hyperelliptic curve of genus g, and also how to consider such a group for cryptographic aspects.

Hyperelliptic Curves

Throughout this section, unless otherwise stated, we refer to [START_REF] Menezes | An elementary introduction to hyperelliptic curves[END_REF] for most of the statements.

Let K be a field and K denote the algebraic closure of K.

C : y 2 + h(x)y = f (x), (2.1)
where

1. h(x) ∈ K[x] with deg h(x) ≤ g, 2. f (x) ∈ K[x] is a monic polynomial of degree 2g + 1,
3. there is no point over K on the curve which satisfies both of the equations 2y + h(x) = 0 and h ′ (x)yf ′ (x) = 0.

Remark 2.1.3. Conversely, a projective curve which is birationally isomorphic to an affine curve given by such an Equation (2.1) is a hyperelliptic curve of genus g [25, Theorem 4.122].

We will use then the following definition for hyperelliptic curves of genus g.

Definition 2.1.4. A hyperelliptic curve C of genus g over K (g ≥ 1) is the set {(a, b) ∈ K × K | b 2 + h(a)b = f (a)} ∪ {∞}, (2.2)
where the defining equation y 2 + h(x)y = f (x) satisfies the conditions in (2.1). The point ∞ is called the point at infinity.

The third condition ensures that the curve is nonsingular. If Char(K) = 2 then the change of variables

x → x y → y - h(x) 2
transforms the curve to one for which the defining equation is

y 2 = f (x) where f (x) ∈ K[x].
In this case, the third condition is equivalent to f (x) has no repeated root in K.

The point at infinity lies in the projective plane P(K). If g ≥ 2 then it is a singular point in the projective plane.

The opposite of a point P = (a, b), denoted -P , is (a, -bh(a)). We also define -∞ := ∞. Let C be a hyperelliptic curve of genus g over K which is given by Equation (2.1). In order to understand the group structure associated to C, we introduce divisors of C. We denote Div 0 (C) the subgroup of Div(C) consisting all the divisors of degree 0.

In order to define the Jacobian of C, we introduce rational functions of C and divisors of rational funtions.

Firstly, the coordinate ring

K[C] (resp. K[C]) of C over K (resp. K) is K[x, y]/(y 2 -h(x)y -f (x)) (resp. K[x, y]/(y 2 -h(x)y -f (x))). An element of K[C] is called a polynomial function. Note that each polynomial function F ∈ K[C] is represented as F 1 (x) -F 2 (x)y where F 1 , F 2 ∈ K[C] are unique. The field of fractions of the coordinate ring over K (resp. K) is called the function field of C over K (resp. K). Denote it by K(C) (resp. K(C)). An element of K(C) is called a rational function of C. Let R ∈ K(C), P ∈ C and P = ∞. R is said to be defined at P if there exist polynomial functions F 1 , F 2 ∈ K[C] such that R = F 1 /F 2
and F 2 (P ) = 0. Otherwise, we say that R is not defined at P . If R is defined at P then the value is defined to be R(P ) = F 1 (P )/F 2 (P ). Note that the value of R is independent of the choice of F 1 , F 2 . We say that R has a zero at P if the value of R at P is zero. If it is not defined at P then we say that R has a pole at P , in which case we write R(P ) = ∞. For any P ∈ C, there exists a function U ∈ K(C) with U (P ) = 0 such that for any polynomial function G ∈ K[C] × there is d ∈ Z and V ∈ K(C) with V (P ) = 0, ∞ and G = U d V . The integer d does not depend on the choice of U . The function U is called a uniformizing parameter for P . The integer d is defined to be the order of G at P , denoted as ord P (G). We define ord P (R) for For R ∈ K(C), we define the divisor of R, denoted div(R), to be the sum

R = F 1 /F 2 ∈ K(C) with F 1 , F 2 ∈ K[C] to be ord P (G 1 ) -ord P (G 2 ).
P ∈C ord P (R)P
in the light of Remark 2.1.5. Then notice that the degree of the divisor of a rational function is 0. Remark 2.1.6. It is possible to express div(R) as a difference of two divisors div 0 (R) and div ∞ (R) where div 0 (R) corresponds to the intersection of C with the variety f = 0 and similarly div ∞ (R) corresponds to the intersection of C with the variety 1/f = 0.

A divisor D is called principal if D = div(F ) for some F ∈ K(C) × . The set of all the principal divisors is denoted Prin(C). It is possible to show that Prin(C) is a subgroup of Div 0 (C) by noticing div(R 1 ) + div(R 2 ) = div(R 1 R 2 ) for R 1 , R 2 ∈ K(C) × .
Jac(C) = Div 0 (C)/ Prin(C) (2.3) is called the Jacobian of C. If D 1 , D 2 are two divisors such that D 1 -D 2 ∈ Prin(C) then D 1 , D 2 are said to be equivalent. We denote it D 1 ∼ D 2 .
Hence any element of Jac(C) is an equivalence class of a divisor. By Riemann-Roch theorem, it can be shown that each equivalence class contains a unique reduced divisor which is in the form

r i=1 P i -r∞, P i ∈ C \ {∞}, r ≤ g, (2.4)
where P i = -P j for i = j.

Example 2.1.8. For g = 1, we can take the set of points together with a point at infinity as a group. The group law actually comes from its Jacobian. For g = 2, notice that r ≤ 2 for a reduced divisor (see (2.4)). We may visualise the group law on the pair of points.

Remark 2.1.9. (Group law on a curve of genus 2). Assume that g = 2.

Let D 1 ∼ P 1 + P 2 -2∞ and D 2 ∼ Q 1 + Q 2 -2∞.
We focus on the general case of divisors for applications. So we may assume

P 1 , P 2 , Q 1 , Q 2 are all different and P 1 , P 2 = -Q 1 , -Q 2 .
There is a cubic polynomial passing through P 1 , P 2 , Q 1 , Q 2 . Call it a(x) = a 3 x 3 + a 2 x 2 + a 1 x + a 0 . (In the case P 1 = P 2 , we actually take the multiplicity into the account.) Now, we have y 2 = f (x) = a(x) 2 by putting y = a(x). Hence f (x)a(x) 2 is a polynomial of degree 6. This polynomial cut the curve at 2 other points, call them -R 1 , -R 2 . So

P 1 + P 2 -2∞ + Q 1 + Q 2 -2∞ -R 1 -R 2 -2∞
is a principal divisor. It is equivalent to the identity element of Jac(C). Once you define

D 3 = R 1 + R 2 -2∞, we see that D 1 + D 2 = D 3 .
+ P 2 ) + (Q 1 + Q 2 ) = R 1 + R 2 [43].
The following theorem gives a representation of the equivalence classes of Jac(C) in terms of polynomials over K. This representation is much more convenient for computational aspects.

Theorem 2.1.10 (Mumford's Representation). Each nontrivial divisor class over K can be uniquely represented by a pair of polynomial [u(x), v(x)] where u(x), v(x) ∈ K[x] with the following properties,

1. u(x) is monic, 2. deg v(x) < deg u(x) ≤ g, 3. u(x) divides v(x) 2 + v(x)h(x) -f . Let r i=1
m i P i -r∞ be a reduced divisor with m i = 0 and P i = -P j for i = j. Put

P i = (a i , b i ). Then D is represented by u(x) = r i=1 (x -a i ),
and if m i = 1 then ∂ ∂x j v(x) 2 + v(x)h(x) -f (x) |x=a i , 0 ≤ j ≤ m i -1.
In other words, we have u(a i ) = 0 for 1 ≤ i ≤ r and v(a i ) = b i with approriate multiplicity. The pair [u(x), v(x)] is called the Mumford's representation of D.

C : y 2 + (x 2 + x)y = x 5 + x 3 + 1 of genus 2 over F 2 5 = F 2 [
t]/(t 5 + t 2 + 1). Let α be a root of (t 5 + t 2 + 1). Then P 1 = (α 30 , 0), P 2 = (0, 1) are two points on C. Consider the divisor

D = P 1 + P 2 -2∞. By Theorem 2.1.10, if u(x) := (x -α 30 )x and v(x) := αx + 1 then [u(x), v(x)] is the Mumford's representations of D.
Thanks to Cantor and Koblitz [START_REF] Cantor | Computing in the Jacobian of a hyperelliptic curve[END_REF][START_REF] Koblitz | Hyperelliptic cryptosystems[END_REF], the group law can be represented in terms of Mumford's representations. The following algorithm is the initial one in the literature by Cantor. There are two main steps in it. These are addition and reduction. Firstly, the algorithm finds the corresponding Mumford's representation of the sum of two divisors D 1 , D 2 . This representation is generally not in the reduced form i.e. do not come from a reduced divisor. As a second step, the algorithm reduces the representation which comes from unique reduced divisor in the class of

D 1 + D 2 . Algorithm 2: AdditionReduction Input: Two divisors D 1 , D 2 with the Mumford's representations [u 1 , v 1 ], [u 2 , v 2 ]
respectively. Output: The unique reduced divisor D such that D ∼ D 1 + D 2 .

1:

Compute d 1 = gcd (u 1 , u 2 ) = e 1 u 1 + e 2 u 2 2: Compute d = gcd (d 1 , v 1 + v 2 + h) = c 1 d 1 + c 2 (v 1 + v 2 + h) 3: s 1 = c 1 e 1 , s 2 = c 1 e 2 and s 3 = c 2 4: u = u 1 u 2 d 2 and v = s 1 u 1 v 2 +s 2 u 2 v 1 +s 3 (v 1 v 2 +f ) d mod u 5: u ′ = f -vh-v 2 u and v ′ = (-h -v) mod u ′ 6: If deg u ′ > g then u = u ′ and v = v ′ and repeat step 5 until deg u ′ ≤ g 7: D = [u ′ , v ′ ] 8: return D

Kummer Based Arithmetic

In this section, we overview Kummer varieties and how to relate these objects with cryptography.

Let A be an abelian variety over a field K of dimension g. The Kummer variety K of dimension g is the variety A/ι, where ι is the automorphism of A with ι(P ) = -P for P ∈ A. We focus on the cases when A is an elliptic curve or A is the Jacobian of a hyperelliptic curve of genus 2. Although there is not a group structure on K, there is a way to do scalar multiplication using the pseudo addition.

Montgomery Ladder

In this part, we introduce a way to do scalar multiplication in a given group by a method which is called the Montgomery ladder. For this section, we refer to [START_REF] Duquesne | Montgomery scalar multiplication for genus 2 curves[END_REF], [START_REF] Lange | Montgomery addition for genus two curves[END_REF].

Let G be an additive group and g ∈ G. We want to compute ng for some positive integer n. Write n in the binary expansion

k i=0 n i 2 i . For 0 ≤ j ≤ k, put g j = k i=j n i 2 i-j g, h j = g j + g.
Then we have

g j = 2g j+1 + n j g = g j+1 + h j+1 + n j g -g = 2h j+1 + n j g -2g. So (g j , h j ) = (2g j+1 , g j+1 + h j+1 ) if n j = 0 (g j+1 + h j+1 , 2h j+1 ) if n j = 1 for 1 ≤ j ≤ k -1.
Notice that g 0 = ng and g k = n k g.

Algorithm 3: ScalarMultiplication Input: g, (n k . . . n 0 ) 2 which is the binary expansion of n. Output:

g ′ = ng 1: f 0 = 1, f 1 = g. 2: for i = k to 0 do 3:
if n i = 0 then 4:

f 1 = f 0 + f 1 , f 0 = 2f 0 . 5:
else 6:

f 0 = f 0 + f 1 , f 1 = 2f 1 . 7:
end if 8: end for 9: return f 0 The first step always compute the pair (g, 2g) since n k is always 1. We can avoid this step, by putting f 0 = g and f 1 = 2g.

Example 2.1.12. Consider n = 5. Then the binary expansion (n 2 n 1 n 0 ) is (101) 2 . We start with the pair (0, g). Then we compute (g, 2g) since n 2 = 1. And we compute (2g, 3g) in the step of n 1 = 0. As the last step with n 0 = 1, we compute (5g, 6g). Finally, we return 5g.

The case of dimension 1

We firstly consider Kummer varieties of dimension 1 to discuss the pseudo addition. For this section, we refer to [START_REF] Duquesne | Montgomery scalar multiplication for genus 2 curves[END_REF]. Let K be a field. An abelian variety of dimension 1 is an elliptic curve E. The Kummer variety K E of E, known as the Kummer line obtained by identifying the opposite points of E. The way of doing arithmetic on K enables us to avoid to do computations of the second coordinate of points lying on E which is given in the Weierstrass form.

Let P , Q ∈ K E such that {P, -P } and {Q, -Q} are the corresponding points lying on E respectively. To define P + Q, there are two natural candidates P + Q and P -Q. However, P + Q is not well defined with any choice among P + Q and P -Q. So the pseudo addition takes P , Q and one of P + Q, P -Q, say R, and then it gives S ∈ K E which is one of P + Q, P -Q with S = R. Note that, it is possible to define 2P since it easy to distinguish 2P and the identity element of E. The pseudo addition provides the scalar multiplication on K. Indeed, suppose that we know P , nP , (n + 1)P , then we are able to compute not only the double of these points but also (2n + 1)P since we have the substraction P of (n + 1)P , nP .

We refer to [START_REF] López | Fast multiplication on elliptic curves over GF(2m) without precomputation[END_REF], [START_REF] Okeya | Efficient elliptic curve cryptosystems from a scalar multiplication algorithm with recovery of the y-coordinate on a Montgomery-form elliptic curve[END_REF] for the recovery of the point on E which corresponds to a given point on Kummer line of E.

The case of dimension 2

Now, we focus on the case of dimension 2. Although the way to do scalar multiplication for this case is similar to the case of dimension 1, we use different notation than the case of elliptic curves since we prefer to adhere to the notation appearing in [START_REF] Gaudry | Fast genus 2 arithmetic based on Theta functions[END_REF].

We firstly describe Kummer varieties of dimension 2, namely Kummer surfaces, and then we mention the link between the Kummer surfaces and the Jacobians of hyperelliptic curves of genus 2.

Let H 2 be the Siegel upper half plane and ϑ[q](z, τ ) be the theta function with characteristic [q] on C 2 × H 2 (see Definition 1.1.11). For basic properties of Theta functions with characteristic, see Section 1.1.2. Now fix τ ∈ H 2 . For our purpose, we focus on the ones which are given by the characteristics from the set {0, 1 2 } 2 ⊕ {0, 1 2 } 2 . There are sixteen many of them such that ten of them are even and the remaning six of them are odd. Let ϑ i (z) denote the odd and even ones for 1 ≤ i ≤ 10 and 11 ≤ i ≤ 16 respectively. Also, ϑ i denotes the Theta constant associated to ϑ i (z). For the construction of a Kummer surface and arithmetic on it, we need four many theta functions

ϑ 1 (z) = ϑ (0, 0) (0, 0) (z, τ ), ϑ 2 (z) = ϑ (0, 0) ( 1 2 , 0) (z, τ ), ϑ 3 (z) = ϑ (0, 0) (0, 1 2 )
(z, τ ),

ϑ 4 (z) = ϑ (0, 0) ( 1 2 , 1 2 ) (z, τ ).
Put

a 2 = ϑ 1 (0) 2 , b 2 = ϑ 2 (0) 2 , c 2 = ϑ 3 (0) 2 , d 2 = ϑ 4 (0) 2 .
(2.5) Definition 2.1.13. The zero locus of the image of

ϕ : C 2 → P 3 (C) (2.6) z → (ϑ 1 (z) 2 , ϑ 2 (z) 2 , ϑ 3 (z) 2 , ϑ 4 (z) 2 ) (2.7)
is called the Kummer surface K(τ ) associated to τ . We denote it K simply.

Note that (ϑ 1 (z), ϑ 2 (z), ϑ 3 (z), ϑ 4 (z)) = (0, 0, 0, 0) for any z ∈ C 2 . In addition, ϕ can be defined from the abelian variety

C 2 /Z 2 ⊕ τ Z 2 because ϑ 0 b (z + τ m + n) = exp(-2iπ t b • m -iπ t mτ m -2iπ t m • z)ϑ 0 b (z)
for all z ∈ C 2 , for all b ∈ {0, Since ϑ i is even for 1 ≤ i ≤ 4, ϕ(z) = ϕ(-z) for z ∈ C 2 . So ϕ does not carry the group law on C 2 /Z 2 ⊕ τ Z 2 to K. Once we have the four coordinates of ϕ(z) for some z ∈ C 2 , it is possible to compute the coordinates of ϕ(2z) by relations among fundamental theta functions [START_REF] Cosset | Applications des fonctions thêta à la cryptographie sur courbes hyperelliptiques[END_REF]Property 3.2.3]. On the other hand, we do not have good candidate to define ϕ(z 1 ) + ϕ(z 2 ) among ϕ(z 1 + z 2 ), ϕ(z 1z 2 ) since {z 1 , -z 1 } and {z 2 , -z 2 } are the preimages of ϕ(z 1 ) and ϕ(z 2 ) respectively. In order to do arithmetic on K, we try to deduce ϕ(z 1 ) + ϕ(z 2 ) from ϕ(z 1 + z 2 ), ϕ(z 1z 2 ). We will present the algorithms for the scalar multiplication after introducing a projective model of K. The algorithms are obtained by relations among fundamental theta functions [START_REF] Cosset | Applications des fonctions thêta à la cryptographie sur courbes hyperelliptiques[END_REF]Property 3.2.3,3.2.4].

Because of applicational motivations for operations on Kummer varieties, we need an algebraic equation of the variety. Thanks to some relations among Theta constants [START_REF] Cosset | Applications des fonctions thêta à la cryptographie sur courbes hyperelliptiques[END_REF]Property 3.1.13], it is possible to have a projective model of K in P 3 which is given by the following equation

E ′ XY ZT -X 2 + Y 2 + Z 2 + T 2 -F (XT + Y Z) -G (XZ + Y T ) -H (XY + ZT ) 2 = 0,
where

A = a 2 + b 2 + c 2 + d 2 , B = a 2 + b 2 -c 2 -d 2 , C = a 2 -b 2 + c 2 -d 2 , D = a 2 -b 2 -c 2 + d 2 , E ′ = ABCD (a 2 d 2 -b 2 c 2 )(a 2 c 2 -b 2 d 2 )(a 2 b 2 -c 2 d 2 ) , F = a 4 -b 4 -c 4 + d 4 a 2 d 2 -b 2 c 2 , G = a 4 -b 4 + c 4 -d 4 a 2 c 2 -b 2 d 2 , H = a 4 + b 4 -c 4 -d 4 a 2 b 2 -c 2 d 2 ,
thanks to the Riemann equations [26, Proposition 3.1.13] among the fundamental Theta functions.

Remark 2.1.15. Let τ be the period matrix (see Section 1.1.2) of a hyperelliptic curve C of genus 2, then Jac(C) Page 18]. In this case, the Kummer surface which is given with τ is the one corresponding to C. We remark also that products of two Theta constants vanish (e.g.

∼ = C 2 /Z 2 ⊕ τ Z 2 [4,
a 2 b 2 -b 2 d 2 = ϑ 5 (0) 2 ϑ 6 (0) 2 ) if Jac(C
) is a product of two elliptic curves which implies vanishing denominators F, G, H. We may avoid it by avoiding such abelian varieties [START_REF] Gaudry | Fast genus 2 arithmetic based on Theta functions[END_REF].

We refer to [START_REF] Gaudry | Fast genus 2 arithmetic based on Theta functions[END_REF] for the algorithms named as DoubleKummer, PseudoAddKummer and ScalarMultiplication.

Firstly, we present the algorithm for doubling of a point on K.

Algorithm 4: DoubleKummer

Input: A point P = (X, Y, Z, T ) on K.

Output: The point 2P on K.

1: X ′ = (X + Y + Z + T ) 2 /A 2: Y ′ = (X + Y -Z -T ) 2 /B 3: Z ′ = (X -Y + Z -T ) 2 /C 4: T ′ = (X -Y -Z + T ) 2 /D 5: X 2 = (X ′ + Y ′ + Z ′ + T ′ )/a 2 6: Y 2 = (X ′ + Y ′ -Z ′ -T ′ )/b 2 7: Z 2 = (X ′ -Y ′ + Z ′ -T ′ )/c 2 8: T 2 = (X ′ -Y ′ -Z ′ + T ′ )/d 2 9: return (X 2 , Y 2 , Z 2 , T 2 )
The following algorithm is the implementation of the pseudo addition on K.

Algorithm 5: PseudoAddKummer Input: Two points P = (X, Y, Z, T ) and Q = (X, Y , Z, T ) on K and R = (X, Y , Z, T ) = P -Q, with XY ZT = 0. Output: The point P + Q = (X, Y, Z, T ).

1:

X ′ = (X + Y + Z + T ) × (X + Y + Z + T )/A 2: Y ′ = (X + Y -Z -T ) × (X + Y -Z -T )/B 3: Z ′ = (X -Y + Z -T ) × (X -Y + Z -T )/C 4: T ′ = (X -Y -Z + T ) × (X -Y -Z + T )/C 5: X = (X ′ + Y ′ + Z ′ + T ′ )/X 6: Y = (X ′ + Y ′ -Z ′ -T ′ )/Y 7: Z = (X ′ -Y ′ + Z ′ -T ′ )/Z 8: T = (X ′ -Y ′ -Z ′ + T ′ )/T 9: return (X, Y, Z, T )
The following algorithm proceeds the scalar algorithm by composing the pseudo addition algorithm with the Montgomery ladder algorithm (see Section 2.1.2). Algorithm 6: ScalarMultiplication which is the combination of the Montgomery ladder (see Algorithm 3) and the pseudo addition.

Input: A point P on K with no zero coordinate and an integer n > 1.

Output: The point nP on K.

1: If n = 2 then return DoubleKummer(P ).

2: Let n 0 n 1 . . . n k be the binary expansion of n where n 0 is the most significant bit. We focus on the relation between K and the curve C associated to K in the Rosenhain form. The Rosenhain model for the curve C is

y 2 = x(x -1)(x -λ)(x -µ)(x -ν),
where λ, µ, ν can be computed in terms of the fundamental Theta constants as follows

λ = a 2 c 2 b 2 d 2 , µ = c 2 (AB + CD) d 2 AB -CD , ν = a 2 (AB + CD) b 2 (AB -CD) .
On the other hand, by setting d 2 = 1, we can compute the squared fundamental Theta constants

c 2 = λµ ν , b 2 = µ(µ -1)(λ -ν) ν(ν -1)(ν -µ) , a 2 = b 2 c 2 ν µ
to obtain the associated K from a Rosenhain form with λ, µ, ν of a hyperelliptic curve of genus 2.

From now on, consider K to be Jac(C)/ < ι > (see Remark 2.1.14) where C is given in the Rosenhain form with λ, µ, ν and ι is the involution with ι(P ) = -P for P ∈ C. We denote D the image of an element D ∈ Jac(C) on K and identify the elements of Jac(C) with their Mumford's representations. In the following part, we see to go back and forth between K and C.

The following algorithm [START_REF] Chung | Fast, uniform scalar multiplication for genus 2 Jacobians with fast Kummers[END_REF]Algorithm 1] is the implementation of finding the image of a divisor in Jac(C) on K.

if D =< x -u, v > then 5: (t 1 , t 2 , t 3 , t 4 ) = (u -1, u -λ, u -µ, u -ν) 6: D = (a 2 t
(D =< x 2 + a 1 x + a 0 , b 1 x + b 0 >) 9: (t 1 , t 2 , t 3 ) = (a 1 + λ, a 1 + 1, b 2 0 )
10:

(t 4 , t 5 ) = (a 0 × (a 0µ) × (t 1 + ν), a 0 × (a 0λν) × (t 2 + µ))

11:

(t 6 , t 7 ) = (a 0 × (a 0ν) × (t 1 + µ), a 0 × (a 0λν) × (t 2 + ν))

12:

with (a 2 : b 2 : c 2 : d 2 ) and (X P : Y P : Z P : T P ). More precisely, at the iteration of i-th step in the scalar multiplication algorithm, (lP , (l + 1)P )

is computed with l = β-1 j=i m j 2 β-1-i .
Finally, the algorithm produces (kP , (k + 1)P ). The execution of the algorithm xDBLADD is uniform and in a constant time.

We present the algorithms cryptoscalarmult and xDBLADD to give a complete description. For this, we need three operations in P 3 and the pseudo addition algorithm xADD.

Let

M : P 3 × P 3 → P 3 ,
where M((x 1 : y 1 : z 1 : t 1 ), (x 2 : y 2 :

z 2 : t 2 )) = (x 1 x 2 : y 1 y 2 : z 1 z 2 : t 1 t 2 ).
Let H be the Hadamard transform

H : P 3 → P 3
such that H((x : y : z : t)) = (x ′ : y ′ : z ′ : t ′ ) where

           x ′ = x + y + z + t, y ′ = x + y -z -t, z ′ = x -y + z -t, t ′ = x -y -z + t.
Algorithm 8 implements the pseudo addition. Algorithm 9 combines doubling on K C with the pseudo addition. Finally, the algorithm cryptoscalarmult is an implementation of the ML on K C .

Algorithm 8: xADD

Input: A triple (P , Q, P -Q)) of points on K C for some P, Q in Jac(C) where P -Q = (X : Y : Z : T ).

Output: P + Q ∈ K C . 1: (V 1 , V 2 ) = (H(P ), H(Q)) 2: V 1 = M(V 1 , V 2 ) 3: V 1 = M(V 1 , (1/A : 1/B : 1/C : 1/D)) 4: V 1 = H(V 1 ) 5: V 1 = M(V 1 , V 1 ) 6: (C 1 , C 2 ) = (Z × T, X × Y ) 7: V 2 = M((C 1 : C 2 : C 3 : C 4 ), (Y : X : T : Z)) 8: return M(V 1 , V 2 )
Remark 2.2.1. The steps ( 5) and ( 6) of Algorithm 8 computes (Y ZT : XZT : XY T : XY Z). This point projectively equivalent to (1/X : 1/Y : 1/Z : 1/T ) (if none of X, Y, Z, T is nonzero). In Algorithm 10, the third argument of the pseudo addition is fixed. It makes sense to precompute (1/X : 1/Y : 1/Z : 1/T ) by scaling it by X. So (1 : X/Y : X/Z : X/T ) can be stored which is the wrapped form of P -Q = (X : Y : Z : T ).

Algorithm 9: xDBLADD

Input: A triple (P , Q, (X/Y, X/Z, Z/T )) in K 2 C × F p for some P, Q in Jac(C) with P -Q = (X : Y : Z : T ). Output:

(2P , P + Q) ∈ K 2 C . 1: (V 1 , V 2 ) = (M(P , P ), M(Q, Q)) 2: (V 1 , V 2 ) = (H(V 1 ), H(V 2 )) 3: (V 1 , V 2 ) = (M(V 1 , V 1 ), M(V 1 , V 1 )) 4: (V 1 , V 2 ) = (M(V 1 , (1/A : 1/B : 1/C : 1/D)), M(V 2 , (1/A : 1/B : 1/C : 1/D)) 5: (V 1 , V 2 ) = (H(V 1 ), H(V 2 )) 6: return (M(V 1 , (1/a 2 : 1/b 2 : 1/c 2 : 1/d 2 )), M(V 2 , (1 : X/Y : X/Z : X/T )))
If CSWAP is a constant-time conditional swap routine such that

CSWAP(b, (V 1 , V 2 )) = (V 1 , V 2 ) if b = 0 (V 2 , V 1 ) if b = 1 (2.8)
then we have Algorithm 10.

Algorithm 10: cryptoscalarmult

Input: A tuple (m = β-1 i=0 m i 2 i , (X/Y, X/Z, Z/T ) in [0, 2 β ) × F 3
q for some P in K C with P = (X : Y : Z : T ) where (X/Y, X/Z, Z/T ) is the wrapped form of P . Output: (mP , (m + 1)

P + Q) ∈ K 2 C . 1: V 1 = (a 2 : b 2 : c 2 : d 2 ) 2: V 2 = P 3: for i = 250 to 0 do 4: (V 1 , V 2 ) = CSWAP(m i , (V 1 , V 2 )) 5: xDBLADD(V 1 , V 2 , (X/Y, X/Z, Z/T )) 6: CSWAP(m i , (V 1 , V 2 )) 7: end for 8: return (V 1 , V 2 )
In order to avoid branching in the procedure combining the Montgomery ladder with pseudo addition and doubling, cryptoscalarmult uses the routine CSWAP which is swapping V 1 , V 2 depending on the bits at the each of iteration level. This method makes Algorithm 10 uniform and constant-time.

Results

These results come from a joint work with Gabriel Gallin and Arnaud Tisserand under HAH (Hardware and Arithmetic for Hyperelliptic Curves Cryptography) project [START_REF] Labex | Hardware and arithmetic for hyperelliptic curves cryptography[END_REF]. In this thesis, we depose computer scientific background which is out of our research area. Nevertheless, we present a summary of the results after introducing a compact text looking through the literature about (KH)ECC from the mathematical point of view.

We aim KHECC on generic finite fields. We suggest to use the parameters a 2 , b 2 , c 2 , d 2 (fundamental theta constants) from [START_REF] Gaudry | Fast genus 2 arithmetic based on Theta functions[END_REF] for the construction of the Kummer variety. We present results of 4 selected hardware architectures in various configurations of hardware architectures on several FPGAs such as Virtex 4 VLX100 (V4), Virtex 5 LX110T (V5) and Spartan 6 SLX75 (S6). We denote the architectures A i for i = 1, . . . , 4. The first design A 1 is small and basic one embedding the minimum number of units, A 2 is designed similarly with A 1 by optimising CSWAP (2.8) unit in A 1 . The architecture A 3 embeds more units for arithmetic operations (at the level of the field). The design of A 4 is a cluster of parallel units for both arithmetic operations and data memory operations. The sources in the hardware accelerators are arithmetic units for field level operations (addition, subtraction and multiplication in F p with a generic prime p), memory unit(s) for storing intermediate values (elements in F p for the coordinates of the points on the Kummer variety K C , parameters and constants for the construction of K C ), an internal communication system for data transfer between the units, a control unit based on a microcode running the architecture. Table 2.2 summarizes the FPGA implementation results. For the comparison of the results with some ECC and HECC solutions, we present the Table 2.3 and 2.4.

For more detailed architectural information, we refer to our article [START_REF] Gallin | Architecture level optimizations for Kummer based HECC on FPGAs[END_REF]. This work is the first hardware implementation of scalar multiplication in KHECC for 128-bit security level. Several architectures with different amount of internal parallelism have been optimised and fully implemented on 3 different FPGAs. The results give similar speed with the best curve based solutions for embedded systems by using almost a half size area. Chapter 3

p-Rank Computations

Motivation

Let p be a prime number and let k be an algebraically closed field of characteristic p. Let A be an abelian variety of dimension g defined over k. The p-rank of A is the integer

f A defined by #A[p](k) = p f A . It is known that 0 ≤ f A ≤ g.
Let X be a smooth projective connected curve of genus g defined over k. Then the p-rank of X is the p-rank of its Jacobian. An equivalent definition is that f A equals the maximal integer m such that there exists an unramified (Z/pZ) m -Galois cover X ′ → X. When f A = g, we say that A (or X) is ordinary.

The p-rank of a curve X equals the stable rank of the Frobenius map on H 1 (X, O X ), and thus can be determined from its Hasse-Witt or Cartier-Manin matrix (see subsections 3.2.1-3.2.3). Given a prime p and integers g and f with 0 ≤ f ≤ g, a result of Faber and Van der Geer [37, Theorem 2.3] implies that there exists a curve over F p of genus g and p-rank f .

We assume that p is odd from now on. Consider an unramified double cover π : Y -→ X.

Then Jac(Y ) is isogenous to Jac(X) ⊕ P π where P π is the Prym variety of π. In this context, P π is a principally polarized abelian variety of dimension g -1. The p-rank f ′ of P π satisfies 0 ≤ f ′ ≤ g -1. Since the p-rank is an isogeny invariant, the p-rank of Y equals f + f ′ where f is the p-rank of X. Now the following question arises naturally.

Question 3.1.1. Suppose that p is an odd prime, and g, f, f ′ are integers such that g ≥ 2, 0 ≤ f ≤ g, and 0 ≤ f ′ ≤ g -1. Does there exist a curve X defined over F p of genus g and p-rank f having an unramified double cover π : Y -→ X such that P π has p-rank f ′ ? Table 3.1 presents the cases for which the answer to Question 3.1.1 is yes.

In this chapter, we study an open case of Question 3.1.1, which occurs when X has genus g = 3 and P π has p-rank 0. We focus on the case that X is a smooth plane quartic or, equivalently, that X is not hyperelliptic.

Background

In this section, we introduce some definitions and background material.

g, genus f ′ , p-rank of P π f , p-rank of X p, prime reference g = 2 0 ≤ f ′ ≤ g -1 0 ≤ f ≤ g p > 3 [79, Proposition 6.1] f ′ = 1 f = 2 p = 3 [37, Example 7.1] g ≥ 3 f ′ = g -1 0 ≤ f ≤ g p ≥ 3 [79, Theorem 1.1(1)] f ′ = g -2 0 ≤ f ≤ g p > 3 [79, Theorem 7.1] 2 ≤ f ≤ g p = 3 [79, Theorem 7.1] g ≤ 4 g/2 -1 ≤ f ′ ≤ g -3 0 ≤ f ≤ g p ≥ 5 [79, Corollary 7.3]
Table 3.1: p-rank of unramified double cover π : Y → X.

Let k be an algebraically closed field of characteristic p > 0. Unless stated otherwise, every curve is a smooth projective connected k-curve. Suppose that C is a curve of genus g ≥ 1.

The Cartier-Manin matrix

Let L be the function field of C/k. Since k is perfect, there exists a separating variable x ∈ L \ k such that L/k(x) is algebraic and separable. It follows that L = L p (x) and hence every element z ∈ L can be written uniquely in the form

z = z p 0 + z p 1 x + • • • + z p p-1 x p-1
with z 0 , . . . , z p-1 ∈ L. The Cartier operator C is defined on differentials of the first kind by C ((z p 0 + z p 1 x + • • • + z p p-1 x p-1 )dx) = z p-1 dx. The Cartier operator is 1 p -linear, meaning that C (a p ω 1 + b p ω 2 ) = aC (ω 1 ) + bC (ω 2 ) for all a, b ∈ L and all ω 1 , ω 2 ∈ Ω 1 (L). It is independent of the choice of separating variable and hence gives a well-defined map on the k-vector space of regular differentials on C,

C : H 0 (C, Ω 1 C ) → H 0 (C, Ω 1 C ). Definition 3.2.1. Let ω 1 , . . . , ω g be a k-basis for H 0 (C, Ω 1 C ). Write C (ω j ) = g i=1 c ij ω i with c ij ∈ k.
The Cartier-Manin matrix of C with respect to the basis ω 1 , . . . , ω g is the matrix (c p ij ) i,j .

Remark 3.2.2. The Cartier-Manin matrix depends on the choice of basis. Let ω ′ 1 , . . . , ω ′ g be another k-basis for H 0 (C, Ω 1 C ) and let T = (t ij ) be the change of basis matrix so that ω j = g i=1 t ij ω ′ i . Then the Cartier-Manin matrix with respect to the basis ω

′ 1 , . . . , ω ′ g is T (p) (c p ij )T -1
, where T (p) denotes the matrix obtained from T by taking the pth power of each of its entries.

The Cartier-Manin matrix of a hyperelliptic curve

Let p be odd and let Z be a hyperelliptic curve of genus g. Then Z has an equation of the form y 2 = f (x) for a separable polynomial f (x) ∈ k[x] having degree 2g + 1 or 2g + 2. Write ω i = x i-1 y dx, so that {ω 1 , . . . , ω g } is a basis for H 0 (Z, Ω 1 Z ).

Proposition 3.2.3. (Yui) [100, Proposition 2.1] Let c s denote the coefficient of x s in the expansion of f (x) (p-1)/2 . Then the Cartier-Manin matrix of Z is A 0 = (c ip-j ) i,j .

The Hasse-Witt matrix

The (absolute) Frobenius F of C is the morphism of schemes given by the identity on the underlying topological space and f → f p on O C . We write F * for the induced endomorphism of H

, : H 1 (C, O C ) × H 0 (C, Ω 1 C ) → k such that F * ξ, ω = ξ, C ω p for all ξ ∈ H 1 (C, O C ) and all ω ∈ H 0 (C, Ω 1 C ). Definition 3.2.5. Let ξ 1 , . . . ξ g be a k-basis of H 1 (C, O C ). Write F * (ξ j ) = g i=1 a ij ξ i with a ij ∈ k.
The Hasse-Witt matrix of C with respect to the basis ξ 1 , . . . ξ g is the matrix (a ij ) i,j . Remark 3.2.6. The Hasse-Witt matrix depends on the choice of basis. Let ξ ′ 1 , . . . , ξ ′ g be another k-basis for H 1 (C, O C ) and let S = (s ij ) be the change of basis matrix so that ξ ′ j = g i=1 s ij ξ i . Then the Hasse-Witt matrix with respect to the basis ξ ′ 1 , . . . , ξ ′ g is S -1 (a ij )S (p) , where S (p) denotes the matrix obtained from S by taking the pth power of each of its entries.

The p-rank

We recall that If A is an abelian variety of dimension g over k, its p-rank is the number

f A such that #A[p](k) = p f A .
If C is a curve of genus g over k, its p-rank is the p-rank of Jac(C). We write f A (resp. f C ) for the p-rank of A (resp. C).

Here is another definition of the p-rank. The k-vector space H 1 (C, O C ) has a direct sum decomposition into F * -stable subspaces as

H 1 (C, O C ) = H 1 (C, O C ) s ⊕ H 1 (C, O C ) n where F * is bijective on H 1 (C, O C ) s and nilpotent on H 1 (C, O C ) n . The dimension of H 1 (C, O C ) s is
equal to the rank of the composition of F * with itself g times, and this rank is called the stable rank of Frobenius on H 1 (C, O C ). Proposition 3.2.8. The p-rank of C is equal to the stable rank of the Frobenius endomorphism

F * : H 1 (C, O C ) → H 1 (C, O C ).
Proof. See [START_REF] Serre | Sur la topologie des variétés algébriques en caractéristique p[END_REF].

The p-rank of the Jacobian of C can be determined from either the Cartier-Manin or Hasse-Witt matrix. For a matrix M , we write M (p i ) for the matrix obtained from M by raising each of its entries to the power p i . Proposition 3.2.9. Let C be a curve of genus g with Hasse-Witt matrix H and Cartier-Manin matrix M . Then the p-rank of C is f C = rk(HH (p) . . . H (p g-1 ) ) = rk(M (p g-1 ) . . . M (p) M ).

the Hasse-Witt matrices of X and P π in terms of the quadratic forms, using results of Stöhr and Voloch in [START_REF] Stöhr | A formula for the Cartier operator on plane algebraic curves[END_REF] and Yui in [START_REF] Yui | On the Jacobian varieties of hyperelliptic curves over fields of characteristic p > 2[END_REF]. As an application, we answer Question 3.1.1 affirmatively when 3 ≤ p ≤ 19 and g = 3 in Proposition 3.3.4.

A smooth curve X of genus 3 which is not hyperelliptic is isomorphic to a smooth plane quartic.

Lemma 3.3.1. [START_REF] Bruin | The arithmetic of Prym varieties in genus 3[END_REF]Bruin] Suppose π : Y → X is an unramified double cover of a smooth plane quartic curve. Then there exist quadratic forms

Q 1 , Q 2 , Q 3 ∈ k[u, v, w] such that X ⊂ P 2 is given by the equation X : Q 1 (u, v, w)Q 3 (u, v, w) = Q 2 (u, v, w) 2 , (3.1)
Y ⊂ P 4 is given by the equations

Y : Q 1 (u, v, w) = r 2 , Q 2 (u, v, w) = rs, Q 3 (u, v, w) = s 2 , (3.2)
and the Prym variety P π is isomorphic to Jac(Z) for the smooth genus 2 curve Z with equation Z :

z 2 = D(x) := -det(M 1 + 2xM 2 + x 2 M 3 ), (3.3)
where M i is the symmetric 3 × 3 matrix such that

(u, v, w)M i (u, v, w) T = Q i (u, v, w). Conversely, if Q 1 , Q 2 , Q 3 ∈ k[u, v, w]
are quadratic forms such that (3.1) defines a smooth plane quartic X, then the equations above give an unramified double cover π : Y → X and a smooth genus 2 curve Z such that P π ≃ Jac(Z).

Proof. This is proven in [START_REF] Bruin | The arithmetic of Prym varieties in genus 3[END_REF]Theorem 5.1(4)]. The fact that Z is smooth when X is smooth can be found in [14, Section 5, Case 4].

Hasse-Witt matrices

Lemma 3.3.2. Let π : Y → X be an unramified double cover of a smooth plane quartic curve and suppose

P π = Jac(Z). Let Q 1 , Q 2 , Q 3 ∈ k[u, v,
w] be quadratic forms as in Lemma 3.3.1, and let D(x) ∈ k[x] be defined as in Lemma 3.3.1(3.3).

Let

q(u, v) = Q 2 (u, v, 1) 2 -Q 1 (u, v, 1)Q 3 (u, v , 1).
Let a i,j be the values in k such that q(u, v) p-1 = i,j a i,j u i v j . Then the Hasse-Witt matrix of X is

H X =   a p-1,p-1 a 2p-1,p-1 a p-1,2p-1 a p-2,p-1 a 2p-2,p-1 a p-2,2p-1 a p-1,p-2 a 2p-1,p-2 a p-1,2p-2   . 2. Let b i ∈ k be the values in k such that D(x) (p-1)/2 = i b i x i . Then the Hasse-Witt matrix of Z is H Z = b p-1 b 2p-1 b p-2 b 2p-2 .
Remark 3.3.3. In Lemma 3.3.2(1), the Hasse-Witt matrix is taken with respect to the basis of H 1 (X, O X ) given by the dual of the basis du qv , u du qv , v du qv of H 0 (X, Ω 1 X ). In Lemma 3.3.2(2), the Hasse-Witt matrix is taken with respect to the basis of H 1 (Z, O Z ) given by the dual of the basis dx z , x dx z of H 0 (Z, Ω 1 Z ).

Proof.

1. Let ω 1 , . . . , ω g be a basis for H 0 (X, Ω X ) and suppose that the action of the Cartier operator is given by

C (ω i ) = g j=1 c ij ω j . ( 3
∇ = ∂ 2p-2 ∂u p-1 ∂v p-1 . Then for any h ∈ k(u, v), C h du q v = ∇(q p-1 h) 1 p du q v . (3.5) Also, if α i,j ∈ k, then ∇   i,j α i,j u i v j   = i,j α ip+p-1,jp+p-1 u ip v jp . (3.6)
Write ω i = h i (u, v) du qv . By (3.5) and (3.4),

∇(q p-1 h i ) = j c p ij h p j . (3.7)
In this case, a basis for H 0 (X, Ω 1 X ) is ω 1 = du qv , ω 2 = u du qv , ω 3 = v du qv . By definition, q(u, v) p-1 = i,j a i,j u i v j . By (3.7) and (3.6) we have

∇(q p-1 ) = i,j a ip+p-1,jp+p-1 u ip v jp = c p 11 + c p 12 u p + c p 13 v p
where c 11 , c 12 , c 13 are the entries in the first row of the Hasse-Witt matrix. Note that deg(q) = 4, so deg(q p-1 ) = 4(p -1) and hence deg(∇(q p-1 )) ≤ 2(p -1). Therefore, the coefficient of u ip v jp in ∇(q p-1 ) is zero unless i + j ≤ 1. Equating the nonzero coefficients gives c 11 = a p-1,p-1 , c 12 = a 2p-1,p-1 and c 13 = a p-1,2p-1 .

Similarly, for the other two rows in the Hasse-Witt matrix,

∇(q p-1 u) = i,j a ip+p-1,jp+p-1 u ip+1 v jp = c p 21 + c p 22 u p + c p 23 v p , and
∇(q p-1 v) = i,j a ip+p-1,jp+p-1 u ip v jp+1 = c p 31 + c p 32 u p + c p 33 v p .
Explicitly, the following 4-by-4 matrix H 0 represents the map (vh) p-1 F * 1 on H 3 (P 3 , O P 3 (-5)), with respect to the basis e 1 , e 2 , e 3 , e 4 :

H 0 =     c 2p-2,p-1,p-1,p-1 c p-2,2p-1,p-1,p-1 c p-2,p-1,2p-1,p-1 c p-2,p-1,p-1,2p-1 c 2p-1,p-2,p-1,p-1 c p-1,2p-2,p-1,p-1 c p-1,p-2,2p-1,p-1 c p-1,p-2,p-1,2p-1 c 2p-1,p-1,p-2,p-1 c p-1,2p-1,p-2,p-1 c p-1,p-1,2p-2,p-1 c p-1,p-1,p-2,2p-1 c 2p-1,p-1,p-1,p-2 c p-1,2p-1,p-1,p-2 c p-1,p-1,2p-1,p-2 c p-1,p-1,p-1,2p-2     . (3.9)
Now we calculate the 3-by-3 matrix representing the restriction of (vh

) p-1 F * 1 to the kernel of [×v] on H 3 (P 3 , O P 3 (-5)). First, note that if ℓ ∈ H 3 (P 3 , O P 3 (-5)) is in Ker([×v]), then (vh) p-1 F * 1 (ℓ) is also in Ker([×v]
), by the commutativity of (3.8). The k-vector space H 3 (P

3 , O P 3 (-4)) is 1-dimensional with basis element λ = x -1 y -1 z -1 w -1 . Note that v • e i = a i λ. Thus Ker([×v]) = { 4 i=1 c i e i | 4 i=1 a i c i = 0}. For 1 ≤ i, j ≤ 4, write β (i) j = a i e j -a j e i . If a t = 0, then Ker([×v]) has basis {β (t) j } 1≤j≤4,j =t . It follows that (vh) p-1 F * 1 (β (t) j ) = a p t (vh) p-1 F * 1 (e j ) -a p j (vh) p-1 F * 1 (e t ) = a p t 4 i=1 γ i,j e i -a p j 4 i=1 γ i,t e i = 4 i=1 (a p t γ i,j -a p j γ i,t )e i . (3.10)
The commutativity of the diagram (3.8) shows that (vh

) p-1 F * 1 (β (t) j ) is in Ker([×v]
). Therefore, there are coefficients λ i,j ∈ k such that for j = t,

(vh) p-1 F * 1 (β (t) j ) = 1≤i≤4,i =t λ i,j β (t) i = 1≤i≤4,i =t λ i,j (a t e i -a i e t ). (3.11)
Comparing the coefficients of e i for i = t in (3.10) and (3.11), we see that

λ i,j = a -1 t (a p t γ i,j -a p j γ i,t ).
This completes the proof of Proposition 3.4.3.

3.5

The fiber of the Prym map when g = 3

In Section 3.3, we used a description from [START_REF] Bruin | The arithmetic of Prym varieties in genus 3[END_REF] of an unramified double cover π : Y → X of a plane quartic curve X and its Prym variety P π in terms of quadratic forms. We then calculated the Hasse-Witt matrices of X and P π and produced examples where X and P π have specified p-ranks for small primes p. However, since the entries of the Hasse-Witt matrices are very complicated, it is not clear how to apply this method for arbitrarily large primes p.

In the current section, we describe an alternative method in which we start with a smooth curve Z of genus 2 over k and construct smooth plane quartic curves X having an unramified double cover π : Y → X such that P π ≃ Jac(Z). The advantage of this alternative method is that it allows us to prove an existence result for infinitely many primes. In particular, in Proposition 3.5.2, we prove that if p ≡ 5 mod 6, then there exists a smooth curve X defined over F p with genus 3 and p-rank 3 having an unramified double cover π : Y -→ X such that P π has p-rank 0.

Here is an outline of the section. In Section 3.5.1, we review a result of Verra that describes the geometry of the fibers of the Prym map R 3 → A 2 . In Section 3.5.2, we work with an explicit construction of the curves represented by points in the irreducible 3-dimensional component of the fiber above Jac(Z). These curves occur as the intersection in P 3 of a plane and the Kummer surface of Jac(Z). They are smooth plane curves X having an unramified double cover π : Y → X such that P π ≃ Jac(Z). In Section 3.5.3, we describe the determinant of the Hasse-Witt matrix of X. The main application when p ≡ 5 mod 6 is in Section 3.5.4.

In Section 3.5.5, we use commutative algebra to characterize when X is non-ordinary (under conditions on the p-rank of Z). In Section 3.5.6, we fix p = 3 and apply the results of the section to a 1-dimensional family of genus 2 curves Z with 3-rank 0. This allows us to deduce information about the locus of planes V for which X is non-ordinary and the geometry of the corresponding moduli space R (2,0) 3 .

Review of work of Verra

Let A be a principally polarized abelian surface. Let A 2 be the moduli space of principally polarized abelian surfaces. Let s be the point of A 2 representing A. We would like to consider the fiber of the Prym map P r 3 : R 3 → A 2 over s. (More precisely, let Ã2 denote the smooth toroidal compactification of A 2 and R3 the compactification of R 3 and consider the fiber of P r 3 : R3 → Ã2 over s.)

Following [95, Section 2], let Θ ⊂ A be a symmetric theta divisor. Suppose that Aut(Θ) ≃ Z/2. Under this mild condition on s, Verra proves in [95, where X is a smooth plane quartic and P π ≃ A. We briefly review the results of Verra in more detail below.

The linear system |2Θ| has dimension 3 and is thus isomorphic to P 3 . Every element C in the linear system is a curve of arithmetic genus 5 with an involution. The linear system is base point free and its generic element is a smooth irreducible curve. For each C ∈ |2Θ|, there is a morphism ψ : A → (P 3 ) ∧ , where the wedge in superscript indicates taking the dual space. Let K = ψ(A). Then deg(ψ) = 2 if and only if A = Jac(Z) for some smooth irreducible curve Z of genus 2; (if not, then deg(ψ) = 4). If deg(ψ) = 2, then K is the Kummer quartic surface of A.

By [95, page 438], this yields a map φ : P 3 -T → P r -1

3 (s). Here T denotes the set of C which are not stable. By [95, (2.1)], T = B ∩ K ∧ . Note that K ∧ ⊂ ((P 3 ) ∧ ) ∧ ≃ P 3 is birational to K. Here B denotes the union of B τ where τ is a 2-torsion point of A and B τ denotes the set of C in the linear system |2Θ| such that C contains τ .

Explicit version of the fiber of the Prym map

Let Z be a smooth curve of genus 2. The results of [START_REF] Verra | The fibre of the Prym map in genus three[END_REF] give a way to find all smooth plane quartics X having an unramified double cover π : Y → X such that P π ≃ Jac(Z). This is discussed in [14, Section 7], where Bruin shows how to recover a model of the form X : Q 1 Q 3 = (Q 2 ) 2 from a smooth plane section X of the Kummer surface K. are non-empty when p = 3, by finding curves X of 3-rank 1 or 0 having an unramified double cover π : Y → X such that P π has 3-rank 1. Here we give a second proof of this using the methods of this section.

For t, u ∈ k with t = u, consider the genus 2 curve Z t,u : z 2 = D(x) := x 6 + x 3 + 1 + x(x 3 + 1)(tx + u) = x 6 + tx 5 + ux 4 + x 3 + tx 2 + ux + 1.

One can check that Z t,u is smooth if t = u and Z t,u has 3-rank 1 for t = ±u.

Example 3.5.9. Let p = 3. Consider the plane quartic X = V ∩ K where K is the Kummer surface of Jac(Z t,u ) and V ⊂ P 3 is a plane. Then X has an unramified double cover π : Y → X such that P π ≃ Z t,u has p-rank 1.

1. If V : -X 2 + X 3 + X 4 = 0 and t = 1, u = 0, then X is smooth with 3-rank f = 1.

2. If V : -X 1 -X 2 + X 4 = 0 and t = 0, u = 1, then X is smooth with 3-rank f = 0.

3.5.6

The moduli space of genus 3 curves having Pryms of 3-rank 0 when p = 3

In this section, we fix p = 3. In Section 3.5.6, we parametrize M 0 2 (the 3-rank 0 stratum of M 2 ) by a 1-parameter family of curves of genus 2 and 3-rank 0. Let α be the name of this parameter. In Section 3.5.6, we then analyze det(H X ) as V and α vary. This allows us to prove some information about the locus of the parameter space where X is non-ordinary. This implicitly provides geometric information about R The importance of the next lemma is that it shows that Jac(Z α ) parametrizes the 3-rank 0 stratum of A 2 , which is irreducible of dimension 1 when p = 3. Lemma 3.5.10. When p = 3, then the family {Z α } α is a non-isotrivial family of smooth curves of genus 2 and 3-rank 0.

Proof. For α ∈ k -{0, 1, -1}, the polynomial A(x)B(x) has no repeated roots, hence the curve Z α is smooth and of genus 2. If Z α is isomorphic to Z β for α, β ∈ k -{0, 1, -1} then they have the same absolute Igusa invariants j 1 , j 2 , j 3 [START_REF] Igusa | Arithmetic variety of moduli for genus two[END_REF]. Using SageMath [START_REF]SageMath, the Sage Mathematics Software System[END_REF], we find that the absolute Igusa invariants of Z α are:

j 1 = - (α -1) 6 α(α + 1) 2 , j 2 = - (α -1) 6 α(α + 1) 2 , j 3 = (α -1) 2 (α 2 -α -1) 2 α 2 .
In particular, the absolute Igusa invariants are non-constant functions of α, hence the family {Z α } α is non-isotrivial. By Proposition 3.2.3, the Cartier-Manin matrix M of Z α is (α + 1) 3 -(α + 1) 4 1 -(α + 1)

so the matrix M (3) M is (α + 1) 9 -(α + 1) 12 1 -(α + 1) 3 (α + 1) 3 -(α + 1) 4 1 -(α + 1) = 0 0 0 0 , so Z α has 3-rank f ′ = 0 by Proposition 3.2.9.

The locus of the parameter space where X is non-ordinary when p = 3

Now, we compute the equation of the Kummer surface K α of Z α and choose a plane V = V a,b,c,d to obtain the smooth plane quartic X α V = K α ∩ V . Our goal is to find information about the 3-rank f = f α V of X α V as V and α vary. To do this, we determine the Hasse-Witt matrix H := H X α V of X α V as in (3.18). Proposition 3.5.11. For a generic choice of plane V , the curve X α V is ordinary for all but finitely many α and has 3-rank 2 for at least one and at most finitely many α.

Proof. When d = 1, the value of the 3-rank of X α V is determined by polynomial conditions in a, b, c and α. In particular, X α V has 3-rank 3 if and only if the determinant of H α V is non-zero. So the first statement can be proven by checking, for a fixed plane V and fixed parameter α, whether det(H α V ) = 0. The second statement can be proven by checking, for a fixed plane V , whether det(H α V ) = 0 under a polynomial condition on α and whether there exists one value of α satisfying that polynomial condition for which X α V is smooth and has 3-rank 2.

Thus both statements follow from the next claim.

Claim: For the plane V : -X 2 + X 4 = 0, the curve X α V is ordinary for all but finitely many α ∈ k -{0, 1, -1}, and X α V has 3-rank 2 for a non-zero finite number of α ∈ k. Proof of claim: When V : -X 2 + X 4 = 0, the Hasse-Witt matrix H of X Lemma 3.6.1. Let Z be a genus 2 curve over F q and let W be its quadratic twist. Let K = Jac(Z)/ -1 . Then |K(F q )| = (|Jac(Z)(F q )| + |Jac(W )(F q )|)/2.

Proof. The degree 2 cover φ : Jac(Z) → K is defined over F q . Let ψ : Jac(Z) → Jac(W ) be the isomorphism of abelian varieties over F q 2 induced by the isomorphism of the underlying curves given by (x, z) → (x, √ λz). Let τ be a generator for Gal(F q 2 /F q ). Then τ ψτ -1 = -ψ.

Let P ∈ K(F q ). Write φ -1 (P ) = {Q, -Q}. Since P ∈ K(F q ) and φ is defined over F q , then {σ(Q), -σ(Q)} = {Q, -Q} for all σ ∈ Gal(F q /F q ). Therefore, Q is defined over F q 2 and either τ (Q) = Q, whereby Q ∈ Jac(Z)(F q ), or τ (Q) = -Q, whereby ψ(Q) ∈ Jac(W )(F q ). The points P ∈ K(F q ) for which φ -1 (P ) = {Q, -Q} with Q = -Q are precisely those for which Q ∈ Jac(Z)(F q ) and ψ(Q) ∈ Jac(W )(F q ). Therefore, every point in K(F q ) is counted twice in | Jac(Z)(F q )| + | Jac(W )(F q )|.

The zeta function of a genus 2 curve Z/F q is

Z(T ) = exp   k≥1 |Z(F q k )| k T k   = L Z/Fq (T ) (1 -T )(1 -qT ) ,
where L Z/Fq (T ) = 1+a 1 T +a 2 T 2 +qa 1 T 3 +q 2 T 4 = 4 i=1 (1α i T ) with α 1 α 3 = α 2 α 4 = q. Lemma 3.6.2. Let Z be a genus 2 curve over F q , let A = Jac(Z) and let K = A/ -1 . Then |Jac(Z)(F q )| = 1 + a 1 + a 2 + a 1 q + q 2 and |K(F q )| = 1 + a 2 + q 2

where the a i are the coefficients of L Z/Fq (T ) as defined above.

Proof. The second statement follows from the first, using Lemma 3.6.1 and the fact that if W/F q is the quadratic twist of Z, then L W/Fq (T ) = L Z/Fq (-T ) = 1a 1 T + a 2 T 2qa 1 T 3 + q 2 T 4 . For the first statement, note that

|Jac(Z)(F q )| = |Z(F q )| 2 + |Z(F q 2 )| 2 -q. (3.19)
Equating the coefficients of T and T 2 in

L Z/Fq (T ) (1 -T )(1 -qT ) = exp   k≥1 |Z(F q k )| k T k  
gives a 1 = |Z(F q )| -(q + 1) and a 2 = 1 2 |Z(F q )| 2 + 1 2 |Z(F q 2 )| -(q + 1)|Z(F q )| + q. The result now follows from (3.19).

Corollary 3.6.3. Let Z be a supersingular genus 2 curve over F q , let A = Jac(Z) and let K = A/ -1 . Then |K(F q )| ≡ 1 mod q.

Proof. If Z is supersingular then q | a 2 . The result now follows.

Question 3.6.4. Suppose Z is supersingular. Does there exist a plane V ⊂ P 3 defined over F q such that p divides #X(F q ) where X = V ∩ K? If so, then the p-rank of X is at least 1.

be the curve with components C 1 and C 2 , formed by identifying x 1 and x 2 in an ordinary double point. Let Y be the curve with components C ′ 1 and C ′ 2 , formed by identifying x ′ 1 and x ′ 2 (resp. x ′′ 1 = σ(x ′ 1 ) and x ′′ 2 = σ(x ′ 2 )) in an ordinary double point. Then κ g 1 :g 2 (τ 1 , τ 2 ) is the point representing the unramified double cover Y → X. This is illustrated in Figure 3.1.

x 1 = x 2 C 1 C 2 C ′ 1 C ′ 2 x ′ 1 = x ′ 2 x ′′ 1 = x ′′
κ g 1 :g 2 : R (f 1 ,f ′ 1 ) g 1 ;1 × R (f 2 ,f ′ 2 ) g 2 ;1 → ∆ g 1 :g 2 [ R(f 1 +f 2 ,f ′ 1 +f ′ 2 +1) g ]. (3.20)
The following lemma is useful in the inductive arguments in Section 3.7.5.

Lemma 3.7.2. Suppose that S i ⊂ R (f i ,f ′ i ) g i has dimension d i for i = 1, 2. Then the dimension of K = κ g 1 :g 2 (ψ -1 R (S 1 ) × ψ -1 R (S 2 ))

is d 1 + d 2 + 2. Furthermore, if S i is a component of R (f i ,f ′ i ) g i for i = 1, 2, then K is contained in a component of R(f 1 +f 2 ,f ′ 1 +f ′ 2 +1) g
whose dimension is at most d 1 + d 2 + 3.

Some extra results when p = 3

The p = 3 case is guaranteed to be more difficult, because R (0,0) 2 and R

(1,0) 2 are empty in that case [START_REF] Faber | Complete subvarieties of moduli spaces and the Prym map[END_REF]Section 7.1]. In other words, when p = 3, if π : Y → X is an unramified double cover of a genus 2 curve such that P π is non-ordinary, then X is ordinary. This is the key reason why there are extra hypotheses when p = 3 in [79, Propositions 6.1, 6.4, Theorem 7.2].

We now have the extra information that all pairs (f, f ′ ) occur when p = 3 and g = 3. In this section, we use this to confirm that the extra hypotheses when p = 3 can be removed from most of the results of [START_REF] Ozman | On the existence of ordinary and almost ordinary Prym varieties[END_REF]Sections 6 and 7]. This will allow us to work more uniformly for odd p in the next section.

Let Ãg-1 denote the toroidal compactification of A g-1 . Let Ãf ′ g-1 denote the p-rank f ′ stratum of Ãg-1 . Let V f ′ g = P r

Conclusion

Computations of Theta Constants

We aim to compute certain power of the quotient of theta constants of a non-hyperelliptic curve C of genus g with motivation originated from Weber's formula which is expressing such a power in terms of bitangents of C when g = 3. Although we could not obtain a similar formula for curves of genus strictly bigger than 3 due to complicated geometric and combinatorial structure of the curve, we were able to find a way to compute them algorithmically and algebraically (heuristically). Nevertheless, we have the following question left. Let κ be the canonical divisor. For any fixed v ∈ Pic(C) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF], can we find a basis of L(κ + v) by the span of the tensor product of the Riemann-Roch spaces {L(D), L(D + v)} while D, D + v run through the odd and effective divisors?

On the other hand, one of the challenges of this part is to obtain a 2-level structure of C. We achieved solving this problem in a particular case when C is a non-hyperelliptic curve of genus 4 by using the algebraic and geometric structure of del Pezzo surfaces. Labelling all the theta characteristic divisors is an important part of getting the structure and is generally difficult. One can overcome it via computations in terms of theta characteristics and 2-torsion points in Pic(C) but this way is inconvenient. One further direction would be to study the labelling problem in terms of extrinsic geometric data for a generic curve of genus g ≥ 4.

In order to experiment the algorithm, we work out the rich geometric structure of curves of genus 4. This gave some ways to certain questions. One of such motivating problems is the reconstruction of the curve from its multitangents. This problem goes back to Aronhold and Coble. They provided formulas for non-hyperelliptic curves of genus 3 to recover the curve from its 7 bitangents corresponding to an Aronhold basis [START_REF] Coble | Algebraic Geometry and Theta Functions[END_REF][START_REF] Dolgachev | Classical Algebraic Geometry: A Modern View[END_REF]. Recently, several directions have shown up such as working on weakening the condition of being labelled for the bitangents [START_REF] Caporaso | Recovering plane curves from their bitangents[END_REF][START_REF] Lehavi | Any smooth plane quartic can be reconstructed from its bitangents[END_REF], also a generalization of the result to higher genus [START_REF] Caporaso | Characterizing curves by their odd Theta-characteristics[END_REF] and abelian varieties [START_REF] Grushevsky | Gradients of odd theta functions[END_REF][START_REF] Grushevsky | Theta functions of arbitrary order and their derivatives[END_REF]. However, even for genus 4, the results are not effective. Finally, Lehavi gave an effective result for generic curves of genus 4 [START_REF] Lehavi | Effective reconstruction of generic genus 4 curves from their theta hyperplanes[END_REF]. In a joint work with Avinash Kulkarni, Yue Ren and Mahsa Sayyary Namin, we give several algorithms related to non-hyperelliptic curves of genus 4, including an implementation of the effective result of Lehavi by extending his result. Another problem is an appropriate generalisation of the bitangent matrix for a non-hyperelliptic curve of genus 3 [START_REF] Piazza | Plane quartics: the universal matrix of bitangents[END_REF] to the case of genus 4.

Kummer Based Hyperelliptic Curve Cryptography

Our work [START_REF] Gallin | Architecture level optimizations for Kummer based HECC on FPGAs[END_REF] is the first hardware implementation of Kummer-based HECC solution for 128-bit security level. Several architectures with different amount of internal parallelism have been optimised and fully implemented on 3 different FPGAs. The obtained results lead to similar speed than the best curve based solutions for embedded systems but with an area almost divided by 2 (-40% for DSP and RAM blocks and -60% for logic slices). The results were obtained with generic prime fields and fully programmable architectures.

p-rank Computations

We have shown that R

(2,0) 3 has dimension 3 for 3 ≤ p ≤ 19; more specifically, that there is a 3-dimensional family of smooth plane quartics X with p-rank 2 having an unramified double cover π : Y → X such that P π has p-rank 0 for 3 ≤ p ≤ 19. We expect this to be true for all odd primes p but were only able to prove it computationally for 3 ≤ p ≤ 19.

3 . 3

 33 Hasse-Witt matrices of genus 3 curves and their Prym varieties . . . . . . . 3.3.1 Hasse-Witt matrices . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.2 The p-ranks of X and Z . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 The Hasse-Witt matrix of a smooth plane quartic defined as an intersection in P 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 The fiber of the Prym map when g = 3 . . . . . . . . . . . . . . . . . . . . . 3.5.1 Review of work of Verra . . . . . . . . . . . . . . . . . . . . . . . . . 3.5.2 Explicit version of the fiber of the Prym map . . . . . . . . . . . . . 3.5.3 The Hasse-Witt matrix of X . . . . . . . . . . . . . . . . . . . . . . 3.5.4 An existence result for each p ≡ 5 mod 6 . . . . . . . . . . . . . . . . 3.5.5 The condition that X is non-ordinary . . . . . . . . . . . . . . . . . 3.5.6 The moduli space of genus 3 curves having Pryms of 3-rank 0 when p = 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6 Points on the Kummer surface . . . . . . . . . . . . . . . . . . . . . . . . . 3.7 Results for arbitrary g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.7.1 Increasing the p-rank of the Prym variety . . . . . . . . . . . . . . . 3.7.2 Background on boundary of R g . . . . . . . . . . . . . . . . . . . . . 3.7.3 Some extra results when p = 3 . . . . . . . . . . . . . . . . . . . . . 3.7.4 A dimension result . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.7.5 Final result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 2 :

 2 Figure 2: Une surface de del Pezzo de degré 2 [7].

Figure 3 :

 3 Figure 3: Une surface de Kummer [85].

  une courbe X définie sur k de genre g et de p-rang f ayant une revêtement double non-ramifié π : Y -→ X tel que P π a p-rang f ′ ? La réponse à la question est oui pour p ≥ 3 et 0 ≤ f ≤ g sous les restrictions suivantes, -quand g = 2 [79, Proposition 6.1], sauf si p = 3 et f = 0, 1 et f ′ = 0, auquel cas la réponse est non [37, Exemple 7.1] ; -quand g ≥ 3 et f ′ = g -1, comme un cas particulier de [79, Théorème 1.1 (1)] ;

Figure 5 :

 5 Figure 5: A del Pezzo surface of degree 2 [7].

Figure 6 :

 6 Figure 6: A Kummer surface [85].

[ 37 , 2 - 1 ≤

 3721 Example 7.1]; -when g ≥ 3 and f ′ = g -1, as a special case of [79, Theorem 1.1(1)]; -when g ≥ 3 and f ′ = g -2 (with f ≥ 2 when p = 3), by [79, Theorem 7.1]; -when p ≥ 5 and g ≥ 4 and g f ′ ≤ g -3, by [79, Corollary 7.3].

  Definition 1.1.15. We call such a hyperplane a multitangent.Remark 1.1.16. When g = 3, the dimension of the Riemann-Roch space of any theta characteristic divisor is either 0 or 1 because C is non-hyperelliptic. There are 28 multitangents, in this case these geometrical objects are known as bitangents.

Figure 1 . 1 :

 11 Figure 1.1: 28 bitangents on the Trott curve.

Figure 1 . 2 :

 12 Figure 1.2: A tritangent of a curve.

Theorem 1 . 2 . 7 .

 127 [START_REF] Yu | Cubic forms; Algebra, Geometry, Arithmetic[END_REF] Theorem 24.4]Let S be a del Pezzo surface of degree d.Then (i) 1 ≤ d ≤ 9, (ii) if d = 9 then S is isomorphic to P 2 ,(iii) if d = 8 then S isomorphic to either P 1 × P 1 or the blow-up of P 2 at a point, (iv) if 1 ≤ d ≤ 7, then S is isomorphic to the blow-up P 2 at 9d points in general position.

b

  i E i in terms of the basis. If D is an exceptional class then we have the following equalities 3aa, b i by the definition of an exceptional class. The solutions of these equalities lead to the following proposition. Proposition 1.2.8. [71, Theorem 26.1] The exceptional classes of Pic(S) are in the form aL -r i=1 b i E i where {a, b 1 . . . , b r } are obtained by all possible permutations of b i in the following table

Theorem 1 . 2 . 9 .

 129 [START_REF] Yu | Cubic forms; Algebra, Geometry, Arithmetic[END_REF] Theorem 26.2] Let S = Bl P 1 ...,Pr P 2 be a del Pezzo surface of degree d. The following results hold;(i) The image of any exceptional curve on S under the blow down map to P 2 is in the following type;(a) one of the points P i , (b) a line passing through two of the points P i , (c) a conic passing through five of the points P i , (d) a cubic passing through seven points P i such that one of them is double point, (e) a quartic passing through eight of the points P i such that three of them are double points, (f ) a quintic passing through eight of the points P i such that six of them are double points, (g) a sextic passing through eight of points P i such that seven of them are double points and one is triple. For d = 2 only (a)-(d), for d = 3, 4 only (a)-(c), for d = 5, 6, 7 only (a)-(b), for d = 8 only (a) hold.(ii) The number of exceptional curves on S are given in the following table;

1 Del

 1 number of exceptional curves 240 56 27 16 10 6 3 Pezzo surfaces of degree 1

Figure 1 . 3 :

 13 Figure 1.3: The del Pezzo surface S of degree 1 and the branch curve B.

  2.2]. Proposition 1.2.11. [101, Section 2] We have the following (i) for any D ∈ κ ⊥ S , ρ(2D) = 0, (ii) if E is an exceptional divisor then ρ(E) is an odd theta characteristic divisor on C, (iii) ρ(-κ S ) is an even theta characteristic divisor on C.

Figure 1 . 4 :

 14 Figure 1.4: Pairs of exceptional curves under the Bertini involution.

Definition 2 . 1 . 1 .

 211 A nonsingular algebraic curve C of genus g > 1 is called a hyperelliptic curve if the function field K(C) is a separable extension of degree 2 of the rational function x ∈ K(C).

Remark 2 . 1 . 2 .

 212 The function field of C is the field of fractions of the coordinate ring K[C]/I(C) where K[C] = K[X 1 , . . . , X n ]/I(C) for some n ∈ N and I(C) is the corresponding prime ideal of C. Thanks to Riemann-Roch theorem, we have an equation describing a plane affine part of C [25, Theorem 4.122]

Figure 2 . 1 :

 21 Figure 2.1: A hyperelliptic curve over the field of real numbers.

A

  divisor is a formal sum of points on C D = P ∈C n P P with n P ∈ Z, where only finite number of n P 's are nonzero. The degree of D, denoted deg D, is defined as the sum P ∈C n p . The set Div(C) of all divisors forms a group under the addition P ∈C n P P + P ∈C m P P = P ∈C (n p + m P )P.

Remark 2 . 1 . 5 .

 215 It is possible to show that a polynomial function F ∈ K[C] × has a finite number of zeroes and poles. In addition, P ∈C ord P (F ) = 0.

Figure 2 . 2 :

 22 Figure 2.2: Intuitively, multiplicity of a zero [43].

Figure 2 . 3 :

 23 Figure 2.3: An example of rational functions of the curve over Q by the equation y 2 + xy + 2y = x 3 + x 2 -3x -1 [43].

Figure 2 . 4 :

 24 Figure 2.4: An example of a principal divisor P 1 + P 2 + P 3 + P 4 -2Q 1 -2Q 2 [43].

Figure 2 . 5 :

 25 Figure 2.5: Geometric visualisation of the group law when g = 2, (P 1+ P 2 ) + (Q 1 + Q 2 ) = R 1 + R 2[START_REF] Gaudry | Algorithmique des courbes hyperelliptiques et applications à la cryptologie[END_REF].

Example 2 . 1 .

 21 11. (Mumford's representation of a divisor). Consider the hyperelliptic curve

3 : 4 :

 34 P m = P ; P p = DoubleKummer(P ) For i from 1 to k do (a) Q = PseudoAddKummer(P p , P m , P ) (b) If n i equals 1 then (i) P p = DoubleKummer(P p ) (ii) P m = Q (c) else (i) P m = DoubleKummer(P m ) (ii) P p = Q 5: return P m Back and Forth between K and C in genus 2

Algorithm 7 : 2 :D = (a 2 : b 2 : c 2 : d 2 )

 722222 JacobianToKummerInput: An element D ∈ Jac(C). Output: The image D of D on K.1: if D = 0 then

Remark 3 . 2 . 7 .

 327 If the basis ξ 1 , . . . ξ g of H 1 (C, O C ) is the dual basis for the basis ω 1 , . . . , ω g of H 0 (C, Ω 1 C ), then the Hasse-Witt matrix is the transpose of the Cartier-Manin matrix.

. 4 )

 4 By Definition 3.2.1 and Remark 3.2.7, the Hasse-Witt matrix with respect to the dual basis is the matrix (c p ij ). The result [92, Theorem 1.1] of Stöhr and Voloch yields the following information in (3.5) and (3.6) about the action of the Cartier operator on the smooth plane curve X, with affine equation q(u, v) = 0. Consider the partial derivative operator

- 1 3 1 3

 11 Corollary 4.1] that P r (s) is a blow-up of P 3 . Moreover, P r -(s) has one irreducible component N s of dimension 3 and three components of dimension 2. By [95, (3.14)-(3.16), page 442], the latter represent unramified double covers of hyperelliptic or singular curves whose Prym is isomorphic to A. The generic point of N s represents an unramified double cover π : Y → X

Example: Genus 3

 3 curves having Pryms of 3-rank 1 when p = 3In Example 3.3.5, we showed that R

3 .

 3 A family of genus 2 curves with 3-rank 0 when p = 3For α ∈ k -{0, 1, -1}, define Z α : z 2 = A(x)B(x),where A(x) = x 3αx 2 + αx + (α + 1), and B(x) = (xα)(x -(α + 1))(αx + (α + 1)).

11 a 12 a 13 a 21 a 22 a 23 a 31 a 32 a 33   where a 11 =

 3311 α13 α 11α 10 + α 9 + α 7 + α 6α 3α 2 -1,a 12 = -α 7α 6 + α 5 + α 4 + α 2 + α, a 13 = α 10 + α 9 + α 7α 6 + α 5α 4 , a 21 = -α 16α 13 + α 11 + α 9 + α 8 + α 7α 5 + α 4α 3α 2 , a 22 = α 13 + α 9 + α 8 + α 7α 6α 4α 3α 2α -1, a 23 = -α 13 + α 10 + α 9α 6 + α 5 + α 4 + α 3α 2α -1, a 31 = α 13 + α 12α 9 + α 8 + α 7 + α 6α 5 + α 2 + α, a 32 = α 10α 8 + α 7 + α 5α 4α 3α 2α -1,a 33 = α 12α 10 + α 6 + α 5α 4α -1.

2

 2

Figure 3 . 1 : 2 In [ 79 ,

 31279 Figure 3.1: ∆ g 1 :g 2

- 1 g

 1 ( Ãf ′ g-1 ) ∩ R g ,The next result about the p-rank stratification of R (f,1) 3 is true for all p ≥ 5 by[START_REF] Ozman | On the existence of ordinary and almost ordinary Prym varieties[END_REF] Proposition 6.4].

  Hardware Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.1 The Cartier-Manin matrix . . . . . . . . . . . . . . . . . . . . . . . . 3.2.2 The Hasse-Witt matrix . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.3 The p-rank . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.4 Prym varieties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.5 Moduli spaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

	Contents
	Introduction en Français
	Introduction
	1 Theta Constants

1.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.1 Quadratic Forms over F 2 . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.2 Theta Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.3 Theta Characteristic Divisors . . . . . . . . . . . . . . . . . . . . . . 1.1.4 Multitangents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.5 Line Bundles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Computations of Theta Constants . . . . . . . . . . . . . . . . . . . . . . . 1.2.1 General Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.2 Del Pezzo Surfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.3 Finding an Aronhold basis . . . . . . . . . . . . . . . . . . . . . . . . 1.2.4 Code for the Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . 2 (Kummer Based) Hyperelliptic Curve Cryptography 2.1 Mathematical Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.1 Hyperelliptic Curves . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.2 Kummer Based Arithmetic . . . . . . . . . . . . . . . . . . . . . . . 2.2 2.2.1 Software Implementation . . . . . . . . . . . . . . . . . . . . . . . . 2.2.2 Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 p-Rank Computations 3.1

  12 , β 13 ] • [β 12 , β 2 , β 23 ] • [β 13 , β 23 , β 3 ] [β 23 , β 13 , β 12 ] • [β 23 , β 3 , β 2 ] • [β 3 , β 13 , β 1 ] • [β 2 , β 1 , β 12 ] ,(⋆) où [β i , β j , β k ] est le déterminant des coefficients de β i , β j et β k qui sont certains bitangentes étiquetées via une base d'Aronhold [77, Théorème 3.1] et n = 0, 1 en fonction de p 1 , p 2 .

Cette formule est appelée formule de Weber. Pour tout genre g ≥ 3, le quotient ϑ[p 1 ](τ ) ϑ[p 2 ](τ ) 4

  , Théorème 2.3] montre que la strate M f g de M g est non vide et chaque composant a une dimension 2g -3 + f , voir aussi [1, Section 3]. Considérons l'espace des modules R g . Une fois prouvé que R

	(f,f ′ ) g est non vide. Comme application des résultats de pureté pour la = ∅ on peut s'inté-(f,f ′ ) g n'est stratification par les polygones de Newton, Ozman et Pries montrent que : si R resser à sa dimension. Supposons que R (f,f ′ ) g pas vide, alors chacun de ses composants a une dimension au moins g -2 + f + f ′ dans [79, Proposition 5.2] .
	En fait, la dimension de R	(f,f ′ ) g	atteint cette borne inférieure dans les cas suivants,

  1 2 } and for all m, n ∈ Z 2 × Z 2 [74, page 123]. Remark 2.1.14. By Lefschetz Theorem [26, Theorem 3.1.10], K is the image of the induced embedding of ϕ from C 2 /Z 2 ⊕τ Z 2 / ∼ where ∼ is the equivalence relation such that z ∼ -z.

  1 t 3 : bt 2 t 4 : ct 1 t 4 : dt 2 t 3 )

	7:	else
	8:

Table 2 .

 2 2: FPGA implementations results. Note that we do not include A 1 into the table since A 2 is an improved version of A 1 .

	archi	w	target logic	DSP	RAM	freq. time
		[bit]		slices blocks blocks [MHz] [ms]
	A 2	34		1121	11	4	330	0.56
	A 3	136	V4	3660	22	9	285	0.42
	A 4	34		2158	22	7	324	0.44
	A 2	34		541	11	4	360	0.51
	A 3	136	V5	1594	22	9	348	0.34
	A 4	34		1013	22	7	358	0.40
	A 2	34		381	11	4	293	0.63
	A 3	136	S6	1131	22	9	225	0.53
	A 4	34		758	22	7	262	0.54

Table 2 .

 2 3: FPGA implementation results for HECC solutions over F 2 n . (The values with an upper star are estimated numbers of RAM blocks.)

	ref. year	target	n	LUT	FF	logic	DSP	RAM	freq. time
						slices blocks blocks [MHz] [ms]
	[3] 2014 XCV6FX760 NIST-256 32900	n.a.	11200	289	128	100	0.4
	[49] 2008	XC4VFX12 NIST-256 2589 XC4VFX12 NIST-256 34896 32430 24574 2028 1715	32 512	11 176	490 375	0.5 0.04
	[63] 2012	XC4VFX12 GEN-256 XC5VLX110 GEN-256	n.a. n.a.	n.a. n.a.	2901 3657	14 10	n.a. n.a.	227 263	1.09 0.86
	[70] 2013	XC4VLX100 GEN-256 5740 XC5LX110T GEN-256 4177	4876 4792	4655 1725	37 37	11 10	250 291	0.44 0.38

Table 2 . 4

 24

: FPGA implementation results for ECC solutions over F p and 128-bit security level.

  1 (C, O C ). It is a p-linear map, meaning that F * (λξ) = λ p F * ξ for all λ ∈ k and all ξ ∈ H 1 (C, O C ).

	Proposition 3.2.4. [89, Proposition 9] Serre duality gives a perfect pairing

Note that Z is smooth since X is smooth by [14, Section 5, Case 4]. The result follows from [13, Lemma 5.1]. Alternatively, the matrix H Z is the transpose of the Cartier-Manin matrix for Z from [100, Proposition

3.2.3].

Acknowledgements

to thank Alessio Fiorentino.

D = (at 4 + t 3 : bt 5 + t 3 : ct 6 + t 3 : dt 7 + t 3 )

13:

end if 14: end if 15: return D Additionally, it is possible to recover the corresponding Mumford's representations associated to the Rosenhain model for a given point on K. The formulas for the corresponding Mumford's representation are obtained by [START_REF] Mumford | Tata Lectures on Theta II[END_REF]Theorem IIIa.7.6]. For the complete expressions for the formulas, we refer to [START_REF] Bos | Fast cryptography in genus 2[END_REF]Section 5.3]. Suppose that (X : Y : Z : T ) ∈ K. There are two divisors mapping to (X : Y : Z : T ) which are opposite to each other. Call them D and -D. Write D =< x 2 + u 1 x + u 0 , v 1 x + v 0 >, and then

where

Note that the sequence of the characteristics [q j ] | j ∈ {5, . . . , 10, 11, 12, 14, 16} which is used in the formulas is the sequence

, 0) (0, 1 2 )

,

, (0, 1 2 ) (0, 1 2 )

, 1 2 ) (0, 1 2 )

.

Remark 2.1.16. (Finite fields). In order to apply the algorithms on the Kummer surfaces, we need to be sure that these make sense over F q . For this, we need to find a curve C over a number field K and a prime ideal p in the ring of integers O K with the residue field F q such that C and Jac(C) have good reduction modulo p and C reduces to C [44, Section 5.1].

Hardware Implementation

Hardware implementation provides a fast way of encrypting and/or signing messages. It also allows parallelism which may increase performance significantly. To design an hardware architecture for KHECC by studying and evaluating the impact of architecture parameters on the cost and performance is an objective of HAH (Hardware and Arithmetic for Hyperelliptic Curves Cryptography) project [START_REF] Labex | Hardware and arithmetic for hyperelliptic curves cryptography[END_REF].

Software Implementation

Firstly, we describe a part of the work [START_REF] Renes | µKummer: efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF] of embedded software implementations in which the potential of genus-2 hyperelliptic curves is analysed for key exchange and signatures on the 8-bit AVR ATmega architecture and 32-bit ARM Cortex-M0 processor. Their implementation for Diffie-Hellmann key exchange scheme improves the application of Kummer surfaces of hyperelliptic curve cryptography which is described in Section 2.1.2. They work over the finite field F p where p = 2 127 -1. Note that p is a Mersenne prime, which provides fast modular reduction algorithms. The Kummer surface K C is constructed by the (squared) theta constants by where C is the corresponding hyperelliptic curve given in the Rosenhain form. Let P := (X P : Y P : Z P : T P ) be a point on K C . For the scalar multiplication kP for a scalar k, they let the scalar size be 256-bits. Due to advantages of the Montgomery Ladder 2.1.2, it is used for the scalar multiplication algorithm which is called cryptoscalarmult. The algorithm xDBLADD is the main operation in ML. It modifies and combines the pseudo addition and doubling algorithms (see the algorithms 4,5). The scalar multiplication computes a couple of points at each iteration level of the algorithm xDBLADD by starting Proof. The first equality follows from Proposition 3.2.4 and the fact that Frobenius is p-linear. The second equality is a consequence of Serre duality, see Proposition 3.2.8. Remark 3.2.10. Notice that C is ordinary, i.e. p-rank of C is g. Proposition 3.2.9 implies that rk(M (p g-1 ) . . . M (p) M ) = g where M is the Cartier-Manin matrix, i.e. the determinant |(M (p g-1 ) . . . M (p) M )| is nonzero. On the other hand,

since determinant is a multiplicative map. Hence, it is enough to show that |M | = 0 to see that Jac(C) is ordinary.

Prym varieties

Suppose that p is odd. If X is a curve of genus g defined over k, then Jac(X) is a principally polarized abelian variety of dimension g. There is a bijection between 2-torsion points on Jac(X) and unramified double covers π : Y → X. Without further comment, we require that Y is connected, which is equivalent to the 2-torsion point being non-trivial. Also, we note that Y is smooth if X is smooth.

Let π : Y → X be an unramified double cover of X. By the Riemann-Hurwitz formula, Y has genus 2g -1. Also Jac(X) is isogenous to a sub-abelian variety of Jac(Y ). Let σ be the endomorphism of Jac(Y ) induced by the involution generating Gal(Y /X). The Prym variety P π is the connected component containing 0 in the kernel of the map π * : Jac(Y ) → Jac(X). It is also the image of the map 1σ in Jac(Y ). In other words,

The canonical principal polarization of Jac(Y ) induces a principal polarization on P π . Finally, Jac(Y ) is isogenous to Jac(X) ⊕ P π .

Moduli spaces

Throughout this chapter, we consider M g the moduli space of curves of genus g over k, A g the moduli space of principally polarized abelian varieties of dimension g over k, R g the moduli space whose points represent unramified double covers π : Y → X over k, where X is a curve of genus g,

g the stratum of R g representing points where X has p-rank f and P π has p-rank f ′ .

Hasse-Witt matrices of genus 3 curves and their Prym varieties

We continue to work over an algebraically closed field k of characteristic p > 2. Suppose π : Y → X is an unramified double cover of a non-hyperelliptic smooth curve of genus 3. In [START_REF] Bruin | The arithmetic of Prym varieties in genus 3[END_REF], Bruin describes the equations for X and P π in terms of quadratic forms. We describe

and the p-rank

For each pair (f, f ′ ) such that 0 ≤ f ≤ 3 and 0 ≤ f ′ ≤ 2, there exists an unramified double cover π : Y → X such that X is a smooth curve of genus 3 and p-rank f and P π has p-rank f ′ ; in other words, R

Proof. The result holds (without any restriction on p) when f ′ = 2 or f ′ = 1 by [79, Proposition 6.4], as long as (f, f ′ ) = (0, 1), (1, 1) when p = 3. To complete the proof, we provide an example below in each case when f ′ = 0 (and when p = 3 and (f, f ′ ) = (0, 1), [START_REF] Achter | Monodromy of the p-rank strata of the moduli space of curves[END_REF][START_REF] Achter | Monodromy of the p-rank strata of the moduli space of curves[END_REF]). These examples were found with a computational search, using Lemma 3.3.2.

In the examples below, we give the equations of the curves X, Z along with the coefficients of the quadratic forms that lead to these curves in the following format [q 111 , q 112 , q 122 , q 113 , q 123 , q 133 , q 211 , q 222 , q 233 , q 311 , q 312 , q 322 , q 313 , q 323 , q 333 ],

where:

• Q 1 = q 111 u 2 + q 112 uv + q 122 v 2 + q 113 uw + q 123 vw + q 133 w 2 ;

• Q 2 = q 211 u 2 + q 222 v 2 + q 233 w 2 ;

• Q 3 = q 311 u 2 + q 312 uv + q 322 v 2 + q 313 uw + q 323 vw + q 333 w 2 .

(2, 0)

(1, 0)

(1, 1)

(2, 0)

(1, 0)

(0, 0)

= [8, 0, 5, 0, 0, 2, 1, 1, 0, 0, 0, 0, 0,

(2, 0)

= [10, 0, 6, 0, 0, 9, 1, 1, 0, 0, 0, 0, 0,

(1, 0)

= [3, 0, 6, 0, 0, 8, 1, 1, 1, 0, 0, 0, 0, 2, 0]

(2, 0)

= [1, 0, 12, 0, 0, 12, 1, 1, 1, 0, 0, 0, 0,

(1, 0)

(0, 0)

(2, 0)

(1, 0)

= [9, 0, 7, 0, 0, 16, 1, 1, 1, 0, 0, 0, 0, 3, 10] (0, 0)

(2, 0)

Remark 3.3.12. Since k is an algebraically closed field of odd characteristic p, it is possible to diagonalize the quadratic form Q 2 and take its coefficients to be 0 or 1. Even so, the complicated nature of the entries of H X and H Z makes it difficult to analyze the p-ranks algebraically.

The entries of H X are quite complicated even in terms of the coefficients of

Similarly, even the equation for Z : z 2 = D(x) is rather complicated in terms of the coefficients of Q 1 and Q 3 .

3.4

The Hasse-Witt matrix of a smooth plane quartic defined as an intersection in P 3

In this section, we determine the Hasse-Witt matrix of a curve C of genus 3 defined as the intersection of a plane and degree 4 hypersurface in P 3 . We use this result in Section 3.5 to determine the Hasse-Witt matrix of each smooth plane quartic X which has an unramified double cover π : Y → X such that P π is isomorphic to a fixed abelian surface.

As before, let k be an algebraically closed field of characteristic p > 2. Following [START_REF] Kudo | Superspecial curves of genus 4 in small characteristic[END_REF], let C/k be a curve in

Let r and s denote the degrees of v and h respectively. Let C p denote the curve in P 3 defined by v p = h p = 0. For n ∈ Z, let O P 3 (n) denote the nth tensor power of Serre's twisting sheaf.

Proof. This is an excerpt from the diagram immediately preceding [START_REF] Kudo | Superspecial curves of genus 4 in small characteristic[END_REF]Proposition 3.1.4].

For t ∈ Z >0 , the k-vector space H 3 (P 3 , O P 3 (-t)) has basis

Then the following diagram is commutative with exact rows, where the map F is the Frobenius morphism on C and the map F 1 is the Frobenius morphism on P 3 .

Proof. This follows immediately from Lemma 3.4.1 and the fact that H 3 (P 3 , O P 3 (-r)) = 0 for r ≤ 3.

Then the Hasse-Witt matrix of C is given by

Proof. Consider the multiplication-by-v map [×v] : H 3 (P 3 , O P 3 (-5)) → H 3 (P 3 , O P 3 (-4)). By Lemma 3.4.2, computing the matrix of F * is equivalent to computing the matrix of (vh) p-1 F * 1 on the kernel of [×v]. First, we compute the matrix of (vh) p-1 F * 1 on all of H 3 (P 3 , O P 3 (-5)). The k-vector space H 3 (P 3 , O P 3 (-5)) is 4-dimensional with basis

Explicitly, a basis is given by

As in the proof of [59, Proposition 3.1.4], for each j ∈ {1, . . . , 4}, then

3 -pk

Consider the Kummer surface K = Jac(Z)/ -1 ⊂ P 3 associated to Z, namely the quotient of Jac(Z) by the Kummer involution. It is a quartic surface, with 16 singularities corresponding to Jac(Z) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF] ≃ (Z/2Z) 2g . Let φ : Jac(Z) -→ K be the degree 2 quotient map. For a sufficiently general plane V ⊆ P 3 , the intersection

is a smooth quartic plane curve. This implies that X does not contain any of the branch points of φ. Thus the restriction of φ to Y = φ -1 (X) is an unramified double cover π : Y → X. Since Y is in |2Θ|, the Prym variety P π is isomorphic to Jac(Z), as seen on [6, page 616]. Conversely, by Verra's result, if Jac(Z) is isomorphic to the Prym variety of an unramified double cover π : Y → X, with X a smooth plane quartic, then X is isomorphic to a planar section of K and Y is its preimage in Jac(Z).

The Kummer surface

Suppose that Z is a smooth curve of genus 2 with affine equation Z :

Consider the Kummer surface K = Jac(Z)/ -1 associated to Z, which is a quartic surface in P 3 . In this section, we write down the equation of K as found in [18, Chapter 3, Section 1].

There is a map φ : Jac(Z) → K defined as follows. A generic divisor of degree 2 on Z has the form (x 1 , z 1 ) + (x 2 , z 2 ). Let Z ∞ be the divisor above x = ∞. Then

where

The map φ realizes Jac(Z) as a double cover of K that ramifies precisely at Jac(Z) [START_REF] Achter | The p-rank strata of the moduli space of hyperelliptic curves[END_REF]. It maps the 16 points of order 2 of Jac(Z) to the 16 singularities of K.

Let X 1 , . . . , X 4 denote the coordinates on P 3 . By [18, (3.1.8)], a projective model of the Kummer surface K in P 3 is the zero locus of the following equation,

Plane quartics as planar sections of the Kummer surface

Let K be the Kummer surface from (3.12). For a plane V ⊂ P 3 , consider the curve

If X is smooth, then it has genus 3 and the pullback of Jac(Z) → K to X yields an unramified double cover π : Y → X such that the Prym variety P π is isomorphic to Jac(Z).

Let V = V a,b,c,d be a plane defined over k by

The point (0 : 0 : 0 : 1) is a singular point of the Kummer surface. For planes V which avoid the singularities of K, it is no restriction to take d = 1.

The Hasse-Witt matrix of X

In Section 3.4, we determined the Hasse-Witt matrix for a curve X given as the intersection of a plane and quartic surface in P 3 . Recall that X = V ∩ K ⊂ P 3 where K : κ = 0 and V : v = 0 are defined in (3.12) and (3.13). Recall that

In other words, Proof. First, note that the equation κ in (3.12) for K is homogeneous of degree 2 in d 0 , . . . , d 6 , X 4 . This is because K 2 X 2 4 , K 1 X 4 , and K 0 are each homogeneous of degree 2 in d 0 , . . . , d 6 , X 4 . Also, the equation v for V is homogeneous of degree 1 in a, b, c, X 4 . Thus (κv) p-1 is homogeneous of degree 3(p -1) in a, b, c, d 0 , . . . , d 6 , X 4 . The coefficients of the 4 × 4 matrix H 0 from (3.9) are coefficients of (κv) p-1 .

We now determine information about the coefficients of the Hasse-Witt matrix H X . Set d = 1. Let U be the 3 × 3 matrix obtained by removing the 4th row and 4th column of

thus they are each homogeneous of degree 2(p -1) in a, b, c, d 0 , . . . , d 6 . The coefficients of C are of the form c i 1 ,i 2 ,i 3 ,i 4 with i 4 = 2p -1; thus they are each homogeneous of degree p -2 in a, b, c, d 0 , . . . , d 6 . Thus each coefficient of H X = U -C[a p , b p , c p ] is homogeneous of degree 2(p -1) in a, b, c, d 0 , . . . , d 6 .

An existence result for each p ≡ 5 mod 6

Proposition 3.5.2. If p ≡ 5 mod 6, then there exists a smooth curve X defined over F p with genus 3 and p-rank 3 having an unramified double cover π : Y -→ X such that P π has p-rank 0. More generally, R (3,0) 3 is non-empty of dimension 4 for each prime p ≡ 5 mod 6.

Proof. Consider the genus 2 curve Z : z 2 = x 6 -1; it is superspecial, and thus has p-rank 0, when p ≡ 5 mod 6 [START_REF] Ibukiyama | Supersingular curves of genus two and class numbers[END_REF]Proposition 1.11]. The Kummer surface K in P 3 is the zero locus of

By Lemma 3.5.3 (below), when p ≡ 5 mod 6, then the determinant of H X has degree 4(p -1) when considered as a polynomial in b. In particular, det(H X ) is a non-zero polynomial in a, b, c. The condition that X is singular is a non-zero polynomial condition in a, b, c. Therefore, there exists a triple (a, b, c) ∈ F 3 p such that X is smooth and det(H X ) = 0. This implies that X is ordinary, with p-rank 3, and the unramified double cover π : Y → X has the property that P π ≃ Jac(Z) has p-rank 0. Thus R We remark that a result similar to Proposition 3.5.2 may be true when p ≡ 5, 7 mod 8 with Z : z 2 = x 5x or when p ≡ 2, 3, 4 mod 5 with Z : z 2 = x 5 -1.

The next lemma provides the cornerstone of the proof of Proposition 3.5.2.

Lemma 3.5.3. Let p ≡ 5 mod 6 and let X be as in the proof of Proposition 3.5.2. When considered as a polynomial in b, the determinant of H X has degree 4(p -1).

Proof. When considered as a polynomial in b, the coefficient

4 in (κv) p-1 has degree at most p -1. Any occurrence of b comes from the term bX 2 in v, so c i 1 ,i 2 ,i 3 ,i 4 has degree at most i 2 in b.

Note that κ has degree 2 in X 4 , so κ p-1 has degree 2p -2 in X 4 . Any monomial in κ p-1 not divisible by X 2 arises as the product

Claim 1: When considered as a polynomial in b, any term of the form c i 1 ,p-1,i 3 ,2p-1 has degree at most p -2.

Proof of Claim 1:

in κ p-1 is zero because κ p-1 has degree 2p -2 in X 4 . By Claim 1, in the middle column of H X , the top and bottom entries,

have degrees at most 2p -2 in b. We consider the six terms in the expansion of det(H X ). The four terms that do not contain the central coefficient of H X have degrees at most 2p -2 + p -1 + p -2 = 4p -5. It remains to consider the product of the diagonal coefficients, and the product of the antidiagonal coefficients. We show that the former has degree at most 4p -6 and the latter has degree 4p -4 as polynomials in b.

Claim 2: When considered as a polynomial in b, each of the two terms c k(p-1),p-1,ℓ(p-1),p-1 for (k, ℓ) ∈ {(1, 2), (2, 1)} has degree at most p -2.

Proof of Claim 2:

We must show that the coefficient of X

in κ p-1 is zero. Since X 2 does not divide this monomial, it appears as a product as in (3.15). In order to attain the desired powers of X 1 and X 3 , we must have

and m 1 + 3m 3 + 2m 4 = ℓ(p -1).

Subtracting the two equations gives 3(m 2m 3 ) = ±(p -1). But 3 ∤ (p -1) since p ≡ 5 mod 6. So the coefficient of X

in κ p-1 is zero, as required. Combining Claims 1 and 2 shows that the product of the diagonal entries of H X has degree at most p -2 + 2p -2 + p -2 = 4p -6 in b. Finally, we show that the product of the antidiagonal entries has degree 4p -4 when considered as a polynomial in b.

Claim 3: When considered as polynomials in b, the following terms have degree p -1:

Proof of Claim 3: For (1), any occurrence of b p-1 in (κv) p-1 comes from κ p-1 (bX 2 ) p-1 . Hence we must show that the coefficient of X p-2

does not divide this monomial, it arises as a product as in (3.15). In order to attain the desired power of X 4 , we must have

whereby m 1 = m 4 . In order to attain the desired powers of X 1 and X 3 , we must have

So m 1 determines m 2 , m 3 , m 4 . Write p = 6k + 5 for some integer k, so

Note that

Therefore, the coefficient of b p-1 X p-2

is the nonzero number

For (2), consider the coefficient of b p-1 in c 2p-1,p-1,p-2,p-1 . By the same strategy as above:

Claim 4: When considered as a polynomial in b, the term c p-1,p-2,p-1,2p-1 has degree p -2.

Proof of Claim 4:

in (κv) p-1 comes from choosing the monomial bX 2 in p -2 factors v of v p-1 , and X 4 in the remaining one. There are p -1 ways of doing so. Now we compute the coefficient of X p-1

in κ p-1 . A monomial divisible by X 2 cannot be chosen in a factor κ of κ p-1 . Therefore, to obtain the exponent 2p -2 of X 4 , we need to pick the monomial -4X 1 X 3 X 2 4 in each factor κ of κ p-1 . Hence, the coefficient of

which is not zero. By the claims, the leading power of b arises in the product of the antidiagonal entries and has degree p -1 + p + p -2 + p -1 = 4p -4.

The condition that X is non-ordinary

In this subsection, Z is an arbitrary smooth curve of genus 2 and X = K ∩ V with Hasse-Witt matrix H X as in Section 3.5.3.

The condition that X is non-ordinary

The curve X is non-ordinary if and only if det(H X ) is non-zero. Proposition 3.5.4. Setting d = 1, then det(H X ) is non-zero and homogeneous of degree 6(p -1) in a, b, c, d 0 , . . . , d 6 .

Proof. By Lemma 3.5.1, each coefficient of the 3 × 3 matrix H X is homogeneous of degree 2(p -1) in these variables. Thus it suffices to prove that det(H X ) is non-zero. We expect that this can be proven algebraically, but to avoid long computations we continue with the following theoretical argument. If det(H X ) is identically 0, then a generic point of R 3 = Π -1 (M 3 ) would represent an unramified double cover π : Y → X such that X is non-ordinary; this is false.

We apply a fractional linear transformation to x in order to reduce the number of variables defining Z, while preserving the degree of det(H X ) and its homogeneous property. Without loss of generality, we can suppose that no Weierstrass point of Z lies over x = ∞ and that 3 of the Weierstrass points are rational and lie over x = 0, 1, -1; (over a nonalgebraically closed field, this may only be true after a finite extension). Then,

Note that A 0 = 0 by the hypothesis at ∞ and C = 0 since Z is smooth.

The condition that X is non-ordinary and Z has p-rank 1

As in (3.16), write Z :

The curve Z is not ordinary if and only if det(H Z ) = 0 Lemma 3.5.5. Then det(H X ) does not vanish identically under the polynomial condition det(H Z ) = 0, which is homogeneous of degree p -1 in A 0 , A, B, C.

Proof. Since D(x) is linear in A 0 , A, B, C, the entries of the Hasse-Witt matrix H Z are homogeneous of degree (p -1)/2 so det(H Z ) is homogeneous of degree p -1.

For the non-vanishing claim, it suffices to show that X is typically ordinary when Z has p-rank 1. This follows from the fact that each component of R For example, when p = 3 and (A 0 , A, B, C, a, b, c) = (1, 0, 1, 2t, 0, 1, 1) with t ∈ F 9 a root of t 2t -1 then f = 1 and f ′ = 1 and the curve X is smooth.

The condition that X is non-ordinary and Z has p-rank 0 Lemma 3.5.6. The curve Z is not ordinary under a polynomial condition on A 0 , A, B, C which is homogeneous of degree p -1. The curve Z has p-rank 0 under 4 polynomial conditions on A 0 , A, B, C which are each homogeneous of degree (p + 1)(p -1)/2.

Proof. The curve Z has p-rank 0 if and only if

Z are homogeneous of degree p(p -1)/2, so the entries of H Z H (p) Z are homogeneous of degree (p + 1)(p -1)/2. Proposition 3.5.7. Let Z be a genus 2 curve with equation z 2 = (x 3x)(A 0 x 3 + Ax 2 + Bx + C). Let V be a plane with equation aX 1 + bX 2 + cX 3 + X 4 . Let X = V ∩ K and consider the unramified double cover π : Y → X given by the restriction of φ : Jac(Z) → K. Then the condition that X is non-ordinary and Z has p-rank 0 is given by the vanishing of 4 homogeneous polynomials of degree (p + 1)(p -1)/2 in A 0 , A, B, C and the vanishing of one homogeneous polynomial det(H X ) of degree 6(p -1) in a, b, c, A 0 , A, B, C.

Proof. The curve X is non-ordinary if and only if det(H X ) vanishes. By Proposition 3.5.4, det(H X ) is homogeneous of degree 6(p -1) in a, b, c and the coefficients of D(x), which are linear in A 0 , A, B, C. The curve Z has p-rank 0 under the conditions in Lemma 3.5.6.

We expect that the answer to Question 3.1.1 is yes for all odd p when g = 3, f = 2, 3, and f ′ = 0. We now rephrase the question in those cases to a question in commutative algebra.

Question 3.5.8. For all odd primes p, is there a plane V for which det(H X ) does not vanish identically under the 4 conditions when H Z H (p) Z = [0]? Is there a plane V for which det(H X ) does vanish for some Z such that

The difficulty in showing that det(H X ) does not vanish identically when Z has p-rank 0 is that we do not know much about the variety of the ideal generated by the 4 polynomial conditions when H Z H (p) Z = [0] or the behavior of the derivatives of det(H X ) with respect to the variables a, b, c.

Example: when p = 3

The 4 entries of H Z H

Z are:

Recall that C = 0 since Z is smooth. If Z has 3-rank 0 then if any of A, B, B -A 0 are zero then all of them are zero, which implies A 0 = 0, which contradicts the hypothesis at ∞. Thus AB(B -A 0 ) = 0 when Z has 3-rank 0. One can check that H Z H By Proposition 3.2.9, the 3-rank of X is the stable rank of H X , which is the rank of

X . The entries of H X are homogeneous of degree 4 and det(H X ) is homogeneous of degree 12 in a, b, c, A 0 , A, B, C.

The determinant Det

For each α ∈ k -{0, 1, -1} which is not a root of Det H , the Hasse-Witt matrix is invertible and so X α V is ordinary. For α ∈ k satisfying α 3 +α 2 +α-1 = 0, a computation in SageMath [START_REF]SageMath, the Sage Mathematics Software System[END_REF] shows that X α V is smooth and the matrix HH (3) H (3 2 ) has rank 2. Therefore, for these values of α, X α V has 3-rank 2 by Proposition 3.2.9.

Proposition 3.5.11 does not eliminate the possibility that there exists a plane V such that det(H α V ) = 0 for all α.

Proposition 3.5.12. For a generic choice of α ∈ k, the curve X α V is ordinary for a generic choice of V and has 3-rank 2 under a codimension 1 condition on V .

Proof. The first statement already follows from Proposition 3.5.11. The second statement can be proven by checking, for fixed α ∈ k, whether det(H α V ) = 0 under a polynomial condition on a, b, c and whether there exists one possibility for a, b, c satisfying that polynomial condition for which X α V is smooth and has 3-rank 2. Let α ∈ F 9 be fixed to be a root of the polynomial t 2 + 2t + 2. If d = 1, the Hasse-Witt matrix H = (a ij ) i,j of X α V , for arbitrary a, b, c, is given by : Then one can check that det(H) is non-vanishing in a, b, c. Also, when (a, b, c) = (2, 0, 2), then one can check that the curve X α V is smooth with 3-rank 2. We note that Proposition 3.5.12 does not eliminate the possibility that there exists α ∈ k such that det(H α V ) = 0 for all planes V .

Points on the Kummer surface

Suppose that Z is a supersingular curve of genus 2 defined over a finite field F q of characteristic p. This section contains a result about the number of F q -points on the Kummer surface K of Jac(Z). The material in this section is probably well known to experts but we could not find it in the literature. The connection between this section and the rest of the paper is found in Question 3.6.4 below: if X = V ∩ K for some plane V and if p divides #X(F q ), then the p-rank of X is at least 1.

Let Z be a genus 2 curve over F q . Suppose that Z has equation z 2 = D(x) and define a quadratic twist W of Z by λz 2 = D(x) for λ ∈ F × q \ (F × q ) 2 . The isomorphism class of W does not depend on the choice of non-square element λ.

Results for arbitrary g

In this section, when 3 ≤ p ≤ 19, we use the results from Section 3.3 about genus 3 curves in characteristic p to verify the existence of smooth curves X of arbitrary genus g ≥ 3 having an unramified double cover whose Prym has small p-rank. Specifically, we work inductively to study the dimension of certain moduli strata R (f,f ′ ) g for g ≥ 3 in characteristic p with 3 ≤ p ≤ 19. The reader is strongly advised to read [START_REF] Ozman | On the existence of ordinary and almost ordinary Prym varieties[END_REF] before reading this section.

A highlight of this approach is that X is smooth and we can control its p-rank f . Indeed, the original proof of [START_REF] Wirtinger | Untersuchungen über Thetafunctionen[END_REF], found in [6, Section 2], shows that R(f ′ +1,f ′ ) g is non-empty for each g ≥ 2 and 0 ≤ f ′ ≤ g -1; in other words, there is a singular curve of genus g and p-rank f ′ + 1 with an unramified double cover π such that P π has p-rank f ′ . We omit the details of this argument.

In this section, the word component means irreducible component. Although the phrasing is slightly redundant, we emphasize that a component of a given dimension is non-empty because this property of the component is the most difficult to prove and is sufficient to yield the existence applications.

Increasing the p-rank of the Prym variety

The next result allows us to use geometric information about R

Background on boundary of R g

The strategy used in [START_REF] Ozman | On the existence of ordinary and almost ordinary Prym varieties[END_REF] is to use unramified double covers of singular curves of given genus and p-rank to produce unramified double covers of smooth curves of the same genus and prank, with control over the p-rank of the Prym variety. This strategy must be implemented very precisely because, in general, the p-rank of both the curve and the Prym will increase when deforming X away from the boundary. In fact, there are situations where this is guaranteed to happen.

This section contains background about p-ranks of unramified double covers of singular curves. Let Rg be the compactification of R g as defined and analyzed in [START_REF] Chiodo | Syzygies of torsion bundles and the geometry of the level ℓ modular variety over M g[END_REF]Section 1.4]. The points of Rg \R g represent unramified double covers of singular stable curves of genus g.

Let Rg;1 = Rg × Mg Mg;1 be the moduli space whose points represent unramified double covers π : Y → X together with marked points y ∈ Y and x ∈ X such that π(y) = x, as in [START_REF] Ozman | On the existence of ordinary and almost ordinary Prym varieties[END_REF]Section 2.3]. Adding a marking increases the dimension of the moduli space by 1. By [79, Lemma 2.1], there is a surjective morphism ψ R : Rg;1 → Rg whose fibers are irreducible.

Suppose that g = g 1 + g 2 , with g i ≥ 1. We recall some material about the boundary divisor ∆ g 1 :g 2 [ Rg ] from [START_REF] Chiodo | Syzygies of torsion bundles and the geometry of the level ℓ modular variety over M g[END_REF]Section 1.4]. This boundary divisor is the image of the clutching map κ g 1 :g 2 : Rg 1 ;1 × Rg 2 ;1 → Rg , defined on a generic point as follows. Let τ 1 be a point of Rg 1 ;1 representing (π 1 :

and let τ 2 be a point of Rg 2 ;1 representing (π 2 :

The result [START_REF] Ozman | On the existence of ordinary and almost ordinary Prym varieties[END_REF]Proposition 6.4] does not require the hypothesis f = 0, 1 when p = 3. In other words, if p = 3 and 0

3 is non-empty with dimension 2 + f . The next result about non-ordinary Prym varieties is true for all p ≥ 5 by [79, Theorem 7.1]. We say that P π is almost ordinary if its p-rank satisfies f ′ = g -2.

Lemma 3.7.4. The result [START_REF] Ozman | On the existence of ordinary and almost ordinary Prym varieties[END_REF]Theorem 7.1] does not require the hypothesis f ≥ 2 when p = 3 and g ≥ 3. In other words, if p = 3, g ≥ 3, and 0 ≤ f ≤ g, then R (f,g-2) g is non-empty and each of its components has dimension 2g -4 + f . More generally, let S be a component of M f g , then the locus of points of Π -1 (S) representing unramified double covers for which the Prym variety P π is almost ordinary is non-empty and codimension 1 in Π -1 (S).

The hypothesis p ≥ 5 also appears in [START_REF] Ozman | On the existence of ordinary and almost ordinary Prym varieties[END_REF]Corollary 7.3], because a key point of the proof is that R (1,0) 2 and R (0,0) 2 are non-empty, which is false when p = 3. We generalize [START_REF] Ozman | On the existence of ordinary and almost ordinary Prym varieties[END_REF]Corollary 7.3] to include the case p = 3 in Section 3.7.5.

A dimension result

The following result is also needed in Section 3.7.5.

Final result

In this section, in characteristic 3 ≤ p ≤ 19, we verify the existence of unramified double covers π : Y → X where X has genus g and p-rank f and P π has p-rank f ′ , for arbitrary g as long as f is bigger than approximately 2g/3 and f ′ is bigger than approximately g/3. This is most interesting when either g 3 ≤ f ′ < g 2 -1 or p = 3 because [79, Corollary 7.2] resolves the case when g 2 -1 ≤ f ′ ≤ g -1 with no conditions on g and f when p ≥ 5. We first include an inductive result which holds for any odd prime p. This strengthens [START_REF] Ozman | On the existence of ordinary and almost ordinary Prym varieties[END_REF]Theorem 7.2]. Theorem 3.7.6. Let f 0 be such that R (f 1 ,0) 3 has a (non-empty) component of dimension 1 + f 1 in characteristic p for each f 1 such that f 0 ≤ f 1 ≤ 3.

Let g ≥ 2 and write g = 3r + 2s for integers r, s ≥ 0. Suppose that rf 0 ≤ f ≤ g (with f ≥ rf 0 + 2s when p = 3) and r + s -1 ≤ f ′ ≤ g -1.

Then R (f,f ′ ) g has a (non-empty) component of dimension g -2 + f + f ′ in characteristic p.

Corollary 3.7.7. Let f 0 = 2 and 3 ≤ p ≤ 19. Let g ≥ 2 and write g = 3r + 2s for integers r, s ≥ 0. Suppose that 2r ≤ f ≤ g (with f ≥ 2r + 2s when p = 3) and r + s -1 ≤ f ′ ≤ g -1.

Then R (f,f ′ ) g has a (non-empty) component of dimension g -2 + f + f ′ in characteristic p.

In particular, this holds in the following situations:

1. If g = 3r and (f, f ′ ) is such that 2r ≤ f ≤ g and r -1 ≤ f ′ ≤ g -1;

2. If g = 3r + 2 and (f, f ′ ) is such that 2r ≤ f ≤ g and r ≤ f ′ ≤ g -1, (with f ≥ 2r + 2 when p = 3);

Abstract

Algebraic curves are central objects in algebraic geometry. In this thesis, we consider these objects from different angles in algebraic geometry such as computational algebraic geometry and arithmetic geometry. In the first chapter, we study non-hyperelliptic curves of genus g and their Jacobians linked via theta characteristic divisors. Such divisors provide extrinsic geometric properties which allow us to compute theta constants. In the second chapter, we focus on hyperelliptic curves of genus 2 and the associated Kummer surface with a cryptographic motivation. In the third and final chapter, we examine unramified double covers of non-hyperelliptic curves of genus g to obtain information about the p-rank.

Résumé

Les courbes algébriques sont des objets centraux de la géométrie algébrique. Dans cette thèse, nous étudions ces objets sous différents angles de la géométrie algébrique tels que la géométrie algébrique effective et la géométrie arithmétique. Dans le premier chapitre, nous étudions les courbes non-hyperelliptiques de genre g et leurs jacobiennes liées par l'intermédiaire de diviseurs thêta caractéristiques. Ces derniers contiennent des propriétés géométriques extrinsèques qui permettent de calculer les constantes thêta. Dans le deuxième chapitre, nous nous concentrons sur les courbes hyperelliptiques de genre 2 et leur surface de Kummer associée avec une motivation cryptographique. Dans le troisième et dernier chapitre, nous étudions les revêtements doubles non-ramifiés des courbes nonhyperelliptiques de genre g pour obtenir des informations sur le p-rang.