Maike Massierer

Jan Tuitman

Cyril Hugounenq

Alexandre Gélin

David Kohel

Ben Smith

Benjamin Wesolowski

Marius Vuille

Chloe Martindale

Daniel Lazard

Grégoire Lecerf

Reynald Lercier

Enea Milio

Théorème. Pour toute thèse en position générique, les remerciements sont la partie la plus lue et la plus délicate à rédiger.

Preuve. C'est de notoriété publique, d'ailleurs les thèses contenant cet énoncé forment un sous-ensemble dense de l'ensemble des thèses muni de la topologie de Zariski.

Corollaire. Malgré mes efforts, cette partie contient son lot de formulations approximatives et d'oublis qui sont de surcroît plus faciles à remarquer que les éventuelles erreurs tapies dans le chapitre 4 ou dans la section 5.4.

Ces fondements théoriques solides étant posés, je sollicite l'indulgence de celles et ceux qui me liront concernant les erreurs qui se trouvent dans mes remerciements (ou ailleurs) ainsi que les répétitions peu élégantes du verbe remercier dans les quelques paragraphes qui suivent. J'en profite également pour préciser que l'ordre de mes remerciements est globalement peu significatif, même si j'ai tenté autant que possible de séparer ce qui relève du scientifique de ce qui relève du personnel.

 dans lequel nous nous sommes (re)plongés à deux reprises, avec un plaisir toujours renouvelé.

Je remercie Christophe Ritzenthaler pour avoir accepté d'être rapporteur de ma thèse, pour l'attention qu'il y a portée ainsi que pour les remarques et les discussions enrichissantes qui en ont découlé. I wish to thank Fréderik Vercauteren for accepting the task of reviewing my thesis, and for his thorough reading. Many thanks also to Elisa Gorla for being a member of my committee and attending my defense from overseas. Je remercie Magali Bardet dont la thèse m'a beaucoup aidé à enrichir, à clarifier et à réorganiser mes connaissances en matière de bases de Gröbner et qui a accepté de faire partie de mon jury. Merci également à Guillaume Hanrot d'être toujours fidèle au poste dans le jury d'un énième doctorant CARAMEL / CARAMBA. Merci enfin à Monique Teillaud d'avoir été ma référente de thèse au cours de ces trois ans.

Je remercie toute l'équipe CARAMBA pour cette ambiance agréable et stimulante : j'y ai rencontré des gens remarquables autant par leurs compétences scientifiques et techniques que par leurs qualités humaines. Même si j'ai dû m'habituer au troll alors que c'était tout sauf ma spécialité, je garderai un excellent souvenir de ces années passées avec vous. Merci d'avoir fait honneur à l'ADN Inria en encourageant ma fibre entrepreneuriale disruptive et en supportant mes nombreux pitchs (et je ne parle pas de la brioche fourrée) et autres idées de jeunes pousses dans des domaines allant des objets connectés pour chevaux à la blockchain du froid. Merci également d'avoir tous contribué à ma culture scientifique mais aussi culinaire, agricole, musicale, cinématographique et hippique. Merci en particulier à Cécile dont le chat m'a bien aidé à rédiger l'introduction, j'espère que tu y reconnaîtras son style littéraire et que ton cheval trouvera ça beau (vous l'avez ?).

Introduction

Curves over finite fields and their applications

Algebraic curves have been part of the mathematical landscape for over 2000 years, from the foundations of geometry in the Antiquity to the proof of Fermat's last theorem in the late 1990's. Such curves are often described as the solution set of a polynomial system and can model various situations, hence their wide range of applications even outside mathematics. In this thesis, we focus on algebraic plane curves, i.e. curves given by an equation of the form f (x, y) = 0 with f a bivariate polynomial. A point of the curve corresponds to a solution of an associated equation, but we must be clear about what we call a solution: much to their dismay, the mathematicians of ancient Greece were confronted with the fact that even when considering equations with coefficients in Z, the associated points may live outside Q. We must therefore specify the field in which the coefficients of f live, which we call the base field of the curve, and consider points in the algebraic closure of this field. Some of the points on the curve may still belong to the base field, and they are called rational when it is the case. While the real field R seems quite a natural field to study plane curves and in particular to plot them, curves defined over finite fields also have many interesting applications and properties. In this thesis, we consider almost exclusively curves defined over a finite field of odd characteristic although we sometimes take advantage of special properties of reductions modulo primes of curves defined over Q.

Algebraic curves over finite fields can lead to efficient algorithms used in practice for factoring integers and primality testing. Indeed, the elliptic curve method (ECM) of [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] is still competitive compared to algorithms based on the number field sieve for finding factors of size less than 64 bits. The elliptic curve primality proving (ECPP) introduced by Goldwasser and Kilian and improved by Atkin and Morain [START_REF] Goldwasser | Almost all primes can be quickly certified[END_REF][START_REF] Morain | Primality proving using elliptic curves: an update[END_REF] is still among the fastest algorithms to generate primality certificates and it was used recently to prove the primality of a 34987-bit integer [START_REF] Kaiser | Greatest numbers certified with Primo[END_REF]. Although the ECCP-based algorithms are efficient in practice, the complexity of ECPP is not proven. Using genus-2 curves, Adleman and Huang [START_REF] Adleman | Primality testing and Abelian varieties over finite fields[END_REF] designed a polynomial-time Las Vegas algorithm for primality proving. More general curves have also been investigated to achieve a deterministic polynomial-time algorithm for factoring polynomials over finite fields. One can also mention the use of interpolation on algebraic curves by Chudnovsky and Chudnovsky [START_REF] Volfovich | Algebraic complexities and algebraic curves over finite fields[END_REF] in the late 1980's to study the complexity of multiplying polynomials over finite fields. This is still ongoing research and there is an important literature [START_REF] Rambaud | Finding optimal Chudnovsky-Chudnovsky multiplication algorithms[END_REF][START_REF] Ballet | On some bounds for symmetric tensor rank of multiplication in finite fields[END_REF] on how to improve this method, for instance by a careful choice of the interpolating curves. To this end, the curves are chosen to have many rational points, and [START_REF] Van Der Geer | Tables of curves with many points[END_REF] provides an open database of such curves over some finite fields.

The same goes for ECM, as families of curves are chosen to increase the efficiency of the algorithm, either because they are more likely to have a smooth cardinality [START_REF] Oliver | Finding suitable curves for the elliptic curve method of factorization[END_REF][START_REF] Barbulescu | Finding ECM-friendly curves through a study of Galois properties[END_REF], or because they allow for faster arithmetic [START_REF] Peter | Speeding the Pollard and elliptic curve methods of factorization[END_REF][START_REF] Bernstein | ECM using Edwards curves[END_REF]. Elliptic curves defined over finite fields have also been of interest to cryptographers as their rational points form a group in which computing discrete xi Introduction logarithms is hard in general. They now represent a widespread standard which benefits from much smaller keysizes compared to RSA. The reason is that contrary to factoring integers or computing discrete logarithms in the multiplicative group of a finite field, there is still no subexponential algorithm for computing discrete logarithms on an elliptic curve. Yet, a result by Pohlig and Hellman shows in [START_REF] Pohlig | An improved algorithm for computing logarithms over GF(p) and its cryptographic significance (corresp.)[END_REF] that even an exponential algorithm turns out to be efficient if the elliptic curve has a smooth number of rational points. Therefore, elliptic curves must be carefully chosen for cryptographic applications, and in particular the number of their rational points has to be known.

As the theory around curves developed, other objects were designed or related to curves. Examples are the various zeta and L functions associated to curves, which are now central tools in modern number theory. Indeed, there are various examples of number-theoretical results that were achieved by proving analytical results for these complex functions, such as the Sato -Tate conjecture. This conjecture gives a result on the behavior of the statistical distribution of the number of rational points of the reduction modulo p of an elliptic curve over Q when p varies, and was proven circa 2005 [START_REF] Harris | A family of Calabi-Yau varieties and potential automorphy[END_REF][START_REF] Clozel | Automorphy for some -adic lifts of automorphic mod Galois representations[END_REF][START_REF] Taylor | Automorphy for some -adic lifts of automorphic mod Galois representations[END_REF]. For more general curves, work is in progress to formulate generalizations of the Sato -Tate conjecture such as [START_REF] Fité | Sato-Tate distributions and Galois endomorphism modules in genus 2[END_REF]. To this end, heavy experiments are made and point-counting represents a major part of the computations [START_REF] Harvey | Computing Hasse-Witt matrices of hyperelliptic curves in average polynomial time II[END_REF].

All these applications entail different contexts, from the nature of the curves involved to their fields of definition. In this thesis, we focus on hyperelliptic curves given by an odd-degree model y 2 = f (x), with f a monic squarefree polynomial of odd degree. The degree deg f = 2g + 1 determines the genus g of the associated hyperelliptic curve which will be an important parameter throughout the whole manuscript. The two additional parameters p and n determine the base field F p n of the curve, and we set q = p n when only the size of the field matters. In the whole manuscript, we use the usual O notation, the O notation for the O notation in which we omit (poly)logarithmic terms, and O g when we further omit all the terms depending only on g. Using fast arithmetic (see for instance [START_REF] Brent | Modern computer arithmetic[END_REF]), we assume that field operations in F q have a cost in O(log q).

Schoof's algorithm

We have seen several reasons why knowing the number of rational points on an elliptic curve can be crucial. One approach is to find methods to build curves with a prescribed number of points, such as the CM-method of [START_REF] Oliver | Finding suitable curves for the elliptic curve method of factorization[END_REF] used for cryptographic applications in [START_REF] Koblitz | CM-curves with good cryptographic properties[END_REF]. Another way is to consider "random" curves and count their points until we are satisfied with the outcome. While there are low-brow methods for so doing, such as testing all the pairs (x, y) ∈ F q and check if they satisfy the curve's equation, their complexities considerably limit their use. A groundbreaking progress was made by Schoof in 1985, who proposed in [START_REF] Schoof | Elliptic curves over finite fields and the computation of square roots mod p[END_REF] an algorithm for counting points on elliptic curves in time polynomial in log q. Although at that time his algorithm was not considered efficient enough for practical use, he set the path for numerous improvements and extensions that are now known as -adic algorithms. A few years later, Elkies and Atkin designed improvements [START_REF] Schoof | Counting points on elliptic curves over finite fields[END_REF] to Schoof's algorithm that contributed to its practicality and remarkable efficiency. Under the name SEA (Schoof-Elkies-Atkin), the variant of Schoof's algorithm is still used for generating cryptographic curves and successfully addresses the problem of counting points on elliptic curves.

The idea of Schoof's algorithm is to compute the number of rational points modulo prime numbers until the actual value can be recovered by the Chinese remainder theorem (CRT). Indeed, the Weil bounds imply that it lies in an interval of size [START_REF] Adleman | Primality testing and Abelian varieties over finite fields[END_REF] √ q so that the number and maximal size of primes to consider is in O(log q). To obtain the modular information, Schoof xiii considers the action of the Frobenius endomorphism π : (x, y) → (x q , y q ) on the -torsion, i.e. the sets of points P such that P is the point at infinity, which is the zero element for the addition on the curve. For = p a prime number, the -torsion is actually a vector space isomorphic to (Z / Z) 2 . The action of the Frobenius endomorphism can therefore be represented by a 2 × 2 matrix, and its trace determines the number of rational points modulo . The bottleneck of this algorithm is the computation of π in the -torsion, which costs O( 2 log q) field operations. Taking into account the cost of such operations, the size of the largest and the number of , the overall complexity of Schoof's algorithm is in O(log 5 q). The SEA improvement consists of replacing the -torsion by a subgroup isomorphic to Z / Z in which each operation costs O( log q) field operations, so that the SEA algorithm runs in time O(log 4 q).

Jacobians of curves

For some applications such as cryptography, the natural extension of elliptic curves are not curves of larger genera because their rational points no longer form a group. A more suitable tool for this purpose is to consider the Jacobian of the curve, which is a group -actually an Abelian variety-built from formal sums of points on the curve. The same goes for the -torsion of an elliptic curve which has to be replaced by that of the Jacobian of the curve. In fact, we will see that determining the -torsion is a prominent step in order to extend Schoof's algorithm, and this relies extensively on arithmetic in Jacobians.

Although algorithms for group operations in non-hyperelliptic Jacobians have been designed in [START_REF] Hess | Computing Riemann-Roch spaces in algebraic function fields and related topics[END_REF][START_REF] Khuri-Makdisi | Linear algebra algorithms for divisors on an algebraic curve[END_REF], this thesis focuses on the hyperelliptic case because it greatly simplifies the arithmetic of the associated Jacobians, and in particular the description of the -torsion. Elements of genus-g hyperelliptic Jacobians can be represented by their Mumford form, which is a pair of polynomials of respective degrees at most g and g -1. Arithmetic on elements given in Mumford form is performed using Cantor's algorithm [START_REF] Cantor | Computing in the Jacobian of a hyperelliptic curve[END_REF], for a space and time complexity quasi-linear in g log q. Through binary exponentiation, Cantor's addition algorithm provides an efficient way to perform scalar multiplications in the Jacobian.

Counting points on curves

In the early 1990's, Pila [START_REF] Pila | Frobenius maps of Abelian varieties and finding roots of unity in finite fields[END_REF] noticed that the theoretical machinery behind Schoof's algorithm still held in a much more general context. He therefore extended Schoof's algorithm into an algorithm for counting points on Abelian varieties and in particular on (Jacobians of) algebraic curves. The output of Pila's algorithm is not only the number of rational points, but the full characteristic polynomial of the Frobenius endomorphism, or equivalently the local zeta function of the curve. The complexity of Pila's algorithm is still polynomial in log q but depends on additional parameters of the input such as its genus / dimension in a much more critical way. This algorithm was not intended to be practical but considering the particular case of genus-2 hyperelliptic curves and using suitable tools from computer algebra to describe the torsion subgroups and the associated Frobenius action, a practical analogue of Schoof's algorithm was designed by Gaudry-Harley [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF]. It was further improved by Gaudry and Schost to the point of using it to generate a cryptographic genus-2 curve [START_REF] Gaudry | Construction of secure random curves of genus 2 over prime fields[END_REF][START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF]. As in genus 1, it is also possible to build curves with a prescribed number of points, for example with the CM-method [START_REF] Weng | Constructing hyperelliptic curves of genus 2 suitable for cryptography[END_REF][START_REF] Sutherland | Accelerating the CM method[END_REF][START_REF] Enge | Computing class polynomials for abelian surfaces[END_REF].

In the early 2000's, other methods also based on computing the action of (p-adic approximations of) lifts of the Frobenius endomorphism were developped, first by Satoh [START_REF] Satoh | On p-adic point counting algorithms for elliptic curves over finite fields[END_REF] for elliptic curves. This was later extended in a much broader context and many algorithms regrouped under the denomination of p-adic methods were designed, considering other lifts or their actions on different spaces. Among the vast literature on the subject, one can point another p-adic approach for hyperelliptic curves based on Monsky-Washnitzer cohomology by Kedlaya [START_REF] Kiran | Counting points on hyperelliptic curves using Monsky-Washnitzer cohomology[END_REF] and its counterpart in characteristic 2 by Denef and Vercauteren [START_REF] Denef | An extension of Kedlaya's algorithm to hyperelliptic curves in characteristic 2[END_REF], and further extensions to more and more general curves [START_REF] Castryck | Computing zeta functions in families of C a,b curves using deformation[END_REF][START_REF] Castryck | Computing zeta functions of nondegenerate curves[END_REF][START_REF] Tuitman | Counting points on curves using a map to P 1 , II[END_REF]. In characteristic 2, a variant of Satoh's algorithm was independently designed by Mestre [START_REF] Mestre | Lettre adressée à Gaudry et Harley[END_REF], who proposed an expression of the Frobenius in terms of an arithmetic-geometric sequence which is still the fastest option for counting points on elliptic curves over F 2 n . Also in [START_REF] Mestre | Lettre adressée à Gaudry et Harley[END_REF], Mestre suggested an extension of his method to genus 2. This was further extending in two directions: either over field of (small) odd characteristic [START_REF] Lercier | Counting points on elliptic curves over finite fields of small characteristic in quasi quadratic time[END_REF] or for curves of larger genus [START_REF] Ritzenthaler | Point counting on genus 3 non hyperelliptic curves[END_REF][START_REF] Lercier | A quasi quadratic time algorithm for hyperelliptic curve point counting[END_REF].

An interesting fact is that these methods yield practical algorithms and that their complexity is polynomial in g and n but exponential in log p, so that both the p-adic and -adic provide complementary approaches when either one of p or g is small. There is still no classical pointcounting algorithm that runs in time polynomial both in g and n log p 1 , but Harvey designed in [START_REF] Harvey | Computing Hasse-Witt matrices of hyperelliptic curves in average polynomial time[END_REF] an algorithm that, given a curve over Q as input, computes the zeta functions of its reduction modulo p for all primes p of good reduction lower than a bound N . This algorithm runs in time quasi-linear in N , meaning that the average time spent counting points on each reduction modulo p is polynomial in log p for each p. This is particularly relevant when running experiments for analogues of the Sato -Tate conjecture.

In this thesis we focus on the following problem, which we sometimes also call counting points although we retrieve more information than the number of rational points on the curve (or its Jacobian).

Computing local zeta functions of hyperelliptic curves. Given an odd prime power q, a positive integer g and a squarefree univariate polynomial f ∈ F q [X] of degree 2 g + 1, let C be the hyperelliptic curve with Weierstrass form Y 2 = f (X). Compute the numerator P C ∈ Z[T ] of the local zeta function of C:

Z(C/F q , T ) = exp ∞ i=1 #C(F q i ) • T i i = P C (T ) (1 -T )(1 -qT ) .
Where C(F q i ) is the set of points of C whose coordinates live in F q i .

Torsion subgroups

A key ingredient to the -adic methods is the determination of the action of the Frobenius on the -torsion subgroups. In Schoof's algorithm, the -torsion of the input elliptic curve is the set of points whose abscissae are the roots of the so-called -division polynomial ψ of degree ( 2 -1)/2. Therefore, the action of the Frobenius endomorphism π : (x, y) → (x q , y q ) on the torsion can be computed by repeatedly squaring and reducing by the equations defining the -torsion: y 2 = f (x) and ψ (x) = 0. In a more general context, Pila calls this step computing a low-degree representation of the Frobenius. For elliptic curves, the division polynomials give a straightforward representation of thetorsion. For curves of larger genera, a priori, we do not have access to a representation that would allow us to compute a low-degree representation of the Frobenius by performing binary exponentiation in a quotient ring. This entails an additional step in which we compute a

Contributions

This thesis focuses on -adic methods derived from Schoof-Pila's algorithm. A central question of the whole manuscript is the complexity of such methods and in particular the dependency on g of the exponent of log q. The first contribution of this manuscript, to appear as [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF], is a point-counting algorithm for hyperelliptic curves, whose complexity is such that this exponent asymptotically grows linearly in g when the characteristic p is large enough. This improves on previous results by Adleman and Huang [START_REF] Adleman | Counting points on curves and Abelian varieties over finite fields[END_REF] who proved that this exponent was in general polynomial in g and even quadratic in the case of hyperelliptic curves. The state of the art concerning this exponent is detailed in Table 1. To achieve this complexity result, our algorithm itself is no different from that of Pila but our complexity analysis benefits from a novel modelling of the -torsion by a structured polynomial system, as explained above. This structure is the key of the improvement, and performing our analysis without exploiting it yields a result similar to that of Adleman and Huang in O (log q) O(g 2 log g) . This involves some technicalities, however, as we must first ensure that our system satisfies some genericity hypothesis to invoke complexity bounds for the computation of a geometric resolution; also, our modelling involves in fact many polynomial systems to handle "special" torsion elements.

Table 1: Asymptotic complexity bounds for computing the local zeta function of a g-dimensional Abelian variety defined over F q Authors (year) Complexity Context

Pila [START_REF] Pila | Frobenius maps of Abelian varieties and finding roots of unity in finite fields[END_REF] (1990) O (log q) g O(g) Abelian varieties

Huang-Ierardi [START_REF] Huang | Counting points on curves over finite fields[END_REF] (1998) O (log q) g O (1) Plane curves Adleman-Huang [START_REF] Adleman | Counting points on curves and Abelian varieties over finite fields[END_REF] (2001) O (log q) g O (1) Abelian varieties Adleman-Huang [START_REF] Adleman | Counting points on curves and Abelian varieties over finite fields[END_REF] (2001) O (log q) O(g 2 log g) Hyperelliptic curves

Chapter 5 (2017) O g (log q) O(g) Hyperelliptic curves

Chapter 7 (2018) O η (log q) 8

Hyp. curves with explicit RM

Another aspect we study is the practicality of Schoof-Pila's algorithm in small genus, which goes along with the value of the exponent of log q for a fixed genus. Although Pila's algorithm seems unfit for straightforward implementation, what he calls a small representation of the Frobenius, i.e. the Frobenius modulo the -torsion ideal can be computed in practice using standard tools from computer algebra. This was studied and implemented in genus 2 by Gaudry, Harley and Schost in [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF][START_REF] Gaudry | Construction of secure random curves of genus 2 over prime fields[END_REF][START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF]. Due to the size of the objects to manipulate, the complexity is much larger than in genus 1 but the algorithm is practical enough so as to provide a cryptographic curve defined over a 128-bit prime field. In this thesis, we informally analyze the feasibility of designing such a secure genus-2 curve over a field of 192-bit characteristic, which seems quite unlikely at the moment. Curves equipped with an explicit and efficient real multiplication (RM) benefit from additional structure that is used in [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF] to decrease the exponent of log q from 8 to 5, reaching a complexity similar to that of Schoof's algorithm.

One step further, the other main contribution within this manuscript deals with hyperelliptic curves of genus 3 [START_REF] Abelard | Counting points on genus-3 hyperelliptic curves with explicit real multiplication[END_REF]. Practical experiments in that case seem almost hopeless for primes > 3.

xvii However, for genus-3 hyperelliptic curves with explicit RM, the work of [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF] extends modulo several additional subtleties with a complexity in O(log 6 q), even lower than that of the general genus-2 case. As expected from such a result, the algorithm is quite practical, although efficiency requires some modifications compared to the version used to establish the complexity bound. In particular, we count points on a genus-3 hyperelliptic curve with RM defined over the prime field F 2 64 -59 , which has a 192-bit Jacobian. Our algorithm can readily be turned into a pointcounting algorithm for general genus-3 hyperelliptic curves (i.e. without explicit RM) with a much larger complexity in O(log 14 q), thus giving a partial answer for the complexity of the Schoof-Pila algorithm in genus 3. As in the genus-2 case, the bottleneck of our algorithm is the resolution of the polynomial system describing the -torsion. This system is trivariate but successive elimination using resultants is still sufficient to achieve our reference complexity which is the square of the degree of the ideal. In practice however, we computed a Gröbner basis using the F4 [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF] and FGLM [START_REF] Faugère | Efficient computation of zero-dimensional Gröbner bases by change of ordering[END_REF] algorithms because they were far more efficient, although their theoretical complexity is much harder to control in our case.

Since the literature presents numerous examples of RM-curves of any genus [START_REF] Kohel | Efficiently computable endomorphisms for hyperelliptic curves[END_REF][START_REF] Boyer | Variétés abéliennes et jacobiennes de courbes hyperelliptiques, en particulier à multiplication réelle ou complexe[END_REF][START_REF] Ellenberg | Endomorphism algebras of Jacobians[END_REF][START_REF] Mestre | Familles de courbes hyperelliptiques à multiplications réelles[END_REF][START_REF] Tautz | Explicit hyperelliptic curves with real multiplication and permutation polynomials[END_REF], it is quite natural to wonder what changes this additional structure brings to the asymptotic complexity when g is no longer fixed to 2 or 3. We therefore extended some results and methods of the genus-3 case to design a point-counting algorithm for hyperelliptic curves with explicit RM of arbitrary high genus. The main primitive we use is the computation of a geometric resolution for the kernel of an endomorphism of degree 2 . This is done by adapting the machinery of Chapter 5 which was applied to the kernel of the multiplication by , itself being an endomorphism of degree 2g . The difference of degrees impacts our modelling by reducing the degrees of the equations from O g ( 3 ) to O g ( 3/g ). Therefore, after checking that the hypotheses still hold and applying the geometric resolution algorithm, we achieve a complexity in O g ((log q) c ), with c an absolute constant and O g hiding a term that depends both on g and the ring by which the curve has RM. However, we emphasize that our algorithm is not polynomial both in g and log q because the factor hidden by the O g -notation remains exponential in g. We nonetheless analyze the cause of that exponential dependency in the hope that further results might provide tighter complexity estimates for the exponential steps, or find a way to replace or remove them. Schoof-Elkies-Atkin [START_REF] Schoof | Counting points on elliptic curves over finite fields[END_REF] (∼ 1990) g = 2 O(log 8 q) Gaudry-Harley-Schost [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF] (∼ 2000) g = 3 O(log 14 q) Chapter 6 (2018) g = 2 with RM O(log 5 q) Gaudry-Kohel-Smith [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF] (2011) g = 3 with RM O(log 6 q) Chapter 6 (2018)

Organization of the thesis

Chapter 1 gives definitions and an overview on (hyperelliptic) curves, arithmetic in their Jacobians and point-counting. We survey in deeper details some applications of point-counting and recall fundamental results that lie at the heart of the Schoof-Pila algorithms. Since modelling the -torsion by polynomial systems and controlling their degrees and structures are cornerstones of our contributions, Chapter 2 presents three techniques for solving polynomial systems, along with their complexities, that will be used in all the following chapters apart from Chapter 4. Chapter 3 reviews previous work on point-counting over genus-2 curves, and finishes with an updated analysis on prospective and change that occurred in the last years. Although most of its content was produced before this thesis, we emphasize on the parts that are later reused or adapted.

Chapter I Background on curves

Chapter II Polynomial systems

Chapter IV Cantor's polynomials Chapter III Genus-2 curves Chapters V and VI Genus-g and genus-3 with RM Chapter VII Genus-g curves with RM Figure 1: Chapters' dependencies Chapter 4 provides bounds on Cantor's analogue to -division polynomials, which we use to bound the degrees of the systems modelling the -torsion. These bounds were originally proven in [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF]Sec. 6] and [START_REF] Abelard | Counting points on genus-3 hyperelliptic curves with explicit real multiplication[END_REF]Sec. 6] but we regrouped them to form a chapter that does not rely on any other, and that can be skipped on first reading. Indeed, the results are restated when needed so that a reader willing to skip the proofs can avoid to read this technical chapter. Chapter 5 is based on [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF] and presents a probabilistic algorithm for counting points on hyperelliptic curves over fields of sufficiently large characteristic with time and space complexity in O g (log q) O(g) . Chapter 6 follows [START_REF] Abelard | Counting points on genus-3 hyperelliptic curves with explicit real multiplication[END_REF] and deals with point-counting on genus-3 hyperelliptic curves, mostly for curves with an explicit RM. Lastly, Chapter 7 combines the approaches of both Chapters 6 and 5 to improve the bounds of Chapter 5 in the case of hyperelliptic curves with explicit real multiplication (RM). To this end, we extend the algorithm and results of Chapter 6 in any genus and then prove that the systems involved in the extended algorithm satisfy genericity hypotheses similar to those of 5, so that the complexity bounds for computing a geometric resolution of these systems still apply. The complexity gain over the general case is then a pure consequence of the smaller degrees of the systems involved. Figure 1 sums up the dependencies between all the chapters.

Part I

Background and preliminaries

Chapter 1

Point-counting and applications

In this chapter, we introduce objects and concepts of algebraic geometry that are ubiquitous in this thesis such as curves, Jacobians and point-counting. We also recall fundamental results used by point-counting algorithms such as the Weil conjectures. Section 1.2 reviews the main families of point-counting algorithms and their principles, and Section 1.3 presents applications of point-counting.

In the whole manuscript, p stands for a prime number and q = p n is a power of that prime. We denote by F p the finite field of cardinality p and by F q its extension of degree n, up to isomorphism. In this first chapter, we consider objects (curves and varieties) defined over a perfect field K which will often, but not always, be a finite field in the other chapters. We denote by K the algebraic closure of K.

Background and definitions 1.Abelian varieties

Definition 1.1. We denote by P n ( K) the quotient set {(X 0 : X 1 : • • • : X n ) | X i ∈ K, ∃ j, X j = 0}/ ∼, for the equivalence relation

(X 0 : X 1 : • • • : X n ) ∼ (Y 0 : Y 1 : • • • : Y n ) ⇔ ∃λ ∈ K, ∀i X i = λY i .
Definition 1.2. We define A n ( K) = {(x 1 , . . . , x n ) | x i ∈ K} the set of affine points.

For an extension L ⊂ K of K, its absolute Galois group Gal( K/L) acts coordinate-wise on P n ( K) and we define the set of L-rational points P n (L) as the subset of P n ( K) fixed by this action. The same can be done to define A n (L) the set of L-rational points of A n ( K). In other words, we have

P n (L) = {(X 0 : X 1 : • • • : X n ) ∈ P n ( K) | ∃λ ∈ K ∀i, λX i ∈ L},
and

A n (L) = {(x 1 , . . . , x n ) | x i ∈ L}.
Both the affine and projective spaces can be endowed with the Zariski topology, for which we refer to [68, Chap. 1, Sec. 1 and 2]. A subset of P n ( K) (resp. A n ( K)) is closed for the Zariski topology if and only if it is the set of simultaneous zeroes of homogeneous polynomials in K[X 0 , . . . , X n ] (resp. of polynomials in K[x 1 , . . . , x n ]).

For S a set of polynomials in K[X 0 , . . . , X n ] (resp. K[x 1 , . . . , x n ]), we denote Z(S) the associated closed set in P n ( K) (resp. A n ( K)).

Let V be a Zariski closed subset of either P n ( K) or A n ( K), and I K be the associated ideal of (homogeneous) polynomials of either K[X 0 , . . . , X n ] or K[x 1 , . . . , x n ] vanishing on V . We say that V is defined over K if and only if Z(I K ) = V .

If I K is a prime ideal, we say that V is irreducible over K. Note that irreducibility depends on the field K as, for instance, the ideal

I = x 2 1 -2x 2 2 is a prime ideal in Q[x 1 , x 2 ] but it splits in Q( √ 2)[x 1 , x 2 ]
. When I K is a prime ideal, we say that V is absolutely irreducible.

Definition 1.3. A projective (resp. affine) variety over K is an irreducible projective closed set over K.

Definition 1.4. The dimension dim(V ) of a variety V is the largest integer k such that there exist a chain S 0 S 1 • • • S k of subsets of V that are closed and absolutely irreducible. A variety of dimension 1 is called a curve.

Definition 1.5. Let V ⊂ A n ( K) be an affine variety over K. It corresponds to a prime ideal

I(V ) = {f ∈ K[x 1 , . . . , x n ] | ∀P ∈ V, f (P ) = 0}. Denote K[V ] = K[x 1 , . . .
x n ]/I, since it is an integral domain we can define its quotient field K(V ). The ring K[V ] and the field K(V ) are respectively called the coordinate ring and function field of V . For V a projective variety, defining I(V ) as the set of homogeneous polynomials vanishing on V , we similarly define the notion of coordinate ring K[V ] and we define K(V ) as the set of quotients of homogeneous polynomials of identical degrees. Definition 1.6. [START_REF] Cohen | Handbook of elliptic and hyperelliptic curve cryptography[END_REF]Def. 4.33 & 4.34] A morphism ϕ from A n ( K) to A 1 ( K) is given by a polynomial f ∈ K[x 1 , • • • , x n ] and defined by ϕ : P = (a 1 , . . . , a n ) → f (a 1 , . . . , a n ) = f (P ).

Likewise, a morphism between A n ( K) and A m ( K) is given by a m-tuple of polynomials in

K[x 1 , • • • , x n ].
Definition 1.7. [START_REF] Cohen | Handbook of elliptic and hyperelliptic curve cryptography[END_REF]Def. 4.35] A K-rational morphism between two affine varieties V ⊂ A n ( K) and W ⊂ A m ( K) is defined as a morphism ϕ : A n ( K) → A m ( K) between their associated affine spaces such that ϕ(V ) ⊂ W . Definition 1.8 (Rational map). [START_REF] Cohen | Handbook of elliptic and hyperelliptic curve cryptography[END_REF]Def. 4.40] Let U be a nonempty open set of an affine variety V , a rational map from V to A 1 ( K) with definition set U is a map r U : U → A 1 ( K) given by r U (P ) = ψ(P )ϕ(P ) -1 for some ψ, ϕ ∈ K[V ] such that ϕ does not vanish on U .

We say that two rational maps are equivalent if they coincide on the intersection of their respective definition sets. This defines an equivalence relation whose classes are called rational functions.

Definition 1.11. [START_REF] Cohen | Handbook of elliptic and hyperelliptic curve cryptography[END_REF]Def. 4.53] An algebraic group G over K is an absolutely irreducible variety defined over K, along with • a K-rational morphism ⊕ : G × G → G for the group law,

• a K-rational morphism ι : G → G for the inverse,

• a K-rational point 0 ∈ G(K) for the neutral, such that ⊕ is associative, 0 is the neutral element for ⊕ and for any e ∈ G, ⊕(e, ι(e)) = 0.

For L an extension of K, denote G(L) the set of L-rational points, it is a group in which the group law is computed by evaluating the previous morphisms that are defined on K and do not depend on L.

Surprisingly, when G is a projective variety one can prove that the group law induced by ⊕ has to be commutative, leading to the following definition: Definition 1.12. An Abelian variety over a field K is a projective algebraic group over K.

Curves and their Jacobians

In general, Abelian varieties are not easy objects to manipulate, as representing their elements may require a number of coordinates that is exponential in the dimension. See for instance [START_REF] Lubicz | Arithmetic on Abelian and Kummer varieties[END_REF] for group laws in Abelian varieties using theta functions. However, many examples of Abelian varieties come from simpler cases, for which this difficulty can be avoided. Let us now focus on a particular class of Abelian varieties: Jacobians of curves. Definition 1.13. Let P be a point on a curve C. The set of rational functions that are regular at P is a subring of K(C) denoted O P . Definition 1.14. A point P on a curve C is called nonsingular if O P is integrally closed. We say that P is singular otherwise and that C is a nonsingular or smooth curve if every point of C( K) is nonsingular.

From now on, the word curve will refer to a smooth projective curve unless mentioned otherwise. ). We define Div C (L) (resp. Div 0 C (L)) the subgroup of L-rational divisors (resp. degree-zero divisors) as the subgroup of Div C (resp. Div 0 C ) fixed under that action. Definition 1.19. Let L be an intermediate field between K and K, let ϕ be a non-zero rational function in L(C) and set v P (ϕ) equal to either the multiplicity of P as a zero of ϕ, minus its multiplicity as a pole of ϕ or zero if P is neither a pole nor a zero of ϕ. We define the associated divisor as (ϕ) = P ∈C( K) v P (ϕ)P . A divisor of this form is said to be principal, and we denote Pr C (L) the group of principal divisors.

Remark that a principal divisor has to be in Div

L(D) = {ϕ ∈ K(C) | (ϕ) ≥ -D}.
This is a vector space over K whose dimension is denoted (D).

Theorem 1.22 (Riemann's inequality). Let C be as in Definition 1. [START_REF] Berlekamp | Factoring polynomials over large finite fields[END_REF]. Then there exists an integer g ≥ 0 such that for any D ∈ Div C ,

(D) ≥ deg D -g + 1.
The smallest such g is called the genus of the curve C.

Theorem 1.23. [START_REF] Milne | Jacobian varieties[END_REF]Th. 1.1 & Prop. 2.1] Let C be a smooth projective and absolutely irreducible curve of genus g > 0 over K and L/K an extension. Then, there exists an Abelian variety J of dimension g over K such that J(K) = Pic 0 C ( K) Gal( K/K) and such that J(L) = Pic 0 C (L) as soon as C(L) = ∅. This Abelian variety J is called the Jacobian (variety) of the curve C, and it is denoted either Jac C or J C .

Hyperelliptic curves and their Jacobians

Performing explicit group operations in Jacobians of curves has drawn a lot of attention and many algorithms were proposed to achieve this goal with a polynomial-time complexity in g, such as [START_REF] Khuri-Makdisi | Linear algebra algorithms for divisors on an algebraic curve[END_REF][START_REF] Hess | Computing Riemann-Roch spaces in algebraic function fields and related topics[END_REF]. However, since the contributions presented in this thesis only apply to hyperelliptic curves, we do not give further detail on those algorithms and restrict to one of the simplest example of Abelian varieties: hyperelliptic Jacobians. In particular, following [START_REF] Cantor | Computing in the Jacobian of a hyperelliptic curve[END_REF], we present a way to store elements of such Jacobians using O(g) elements in the base field, and an algorithm to add points in the Jacobian in time quasi-linear in g. Definition 1.24. An elliptic curve over K is a nonsingular absolutely irreducible projective curve of genus 1 over K with at least one K-rational point.

Definition 1.25. A nonsingular projective curve C of genus g > 1 over K is called a hyperelliptic curve if there exists a function x ∈ K(C) such that the function field K(C) is a separable quadratic extension of the rational function field K(x).

By [START_REF] Cohen | Handbook of elliptic and hyperelliptic curve cryptography[END_REF]Theorem 4.122], if we characterize hyperelliptic curves by their affine plane parts, we can rewrite the previous definition in a more concrete way: Definition 1.26. Let K be a field of characteristic = 2, any plane affine curve given by an equation of the form C :

y 2 = f (x), with f in K[x]
such that f is monic of degree 2g + 1 and squarefree is birationally equivalent to a hyperelliptic curve of genus g over K. Such hyperelliptic curves are called imaginary hyperelliptic curves.

In the remainder of this thesis, we will sometimes refer to "the hyperelliptic curve C of equation y 2 = f (x)". To be accurate, this refers to the nonsingular projective curve birationally equivalent to C which is indeed a hyperelliptic curve in the sense of Definition 1.25.

Note that when setting g = 1 in the equations of imaginary hyperelliptic curves, we fall back to the case of elliptic curves, which are famous for their use as cryptographic groups (i.e. groups in which the discrete logarithm problem is hard). Curves of genus 2 are no longer groups but their Jacobians also offer good candidates for cryptosystems, in a sense that we detail later on. The first requirement for constructing a cryptographic group is to provide an efficient way to represent and manipulate its elements: this is achieved thanks to the Mumford form for divisors and Cantor's algorithm to add and reduce them. Before giving details on this, we first review the specificities of hyperelliptic Jacobians.

Like elliptic curves, imaginary hyperelliptic curves have a unique K-rational point P ∞ at infinity and an involution sending an affine point (x, y) to its opposite (x, -y). In what follows, we see that these additional properties give a simpler description of divisors on C. Definition 1.27. Let C be a hyperelliptic curve and D = P ∈C( K) n P P be a divisor in Div 0 C . We say that D is semi-reduced if for any P = P ∞ we have n P ≥ 0 and n P n -P = 0. Furthermore, we say that a semi-reduced divisor D is reduced if P =P∞ n P ≤ g.

Theorem 1.28. Any element of Pic 0

C is uniquely represented by a reduced divisor. The following theorem gives an efficient way of manipulating elements of J C which is used in computer algebra systems. Theorem 1.29. Let C be a hyperelliptic curve of genus g given by an equation of the form y 2 = f (x) with f a monic squarefree polynomial of degree 2g + 1. Each element of Pic 0 C (K) can be represented by a unique pair of polynomials u, v ∈ K[x] where u is monic, deg v < deg u ≤ g and u|v 2 -f . The pair u, v is called the Mumford form of the divisor class.

The link between the previous two representations is the following. If an element of Pic 0 C is represented by a reduced divisor r i=1 (P i -P ∞ ) where each P i has coordinates (x i , y i ), then its Mumford is u, v with u of degree r whose roots are the x i 's counted with multiplicities and v satisfying v(x i ) = y i . The integer r ≤ g is called the weight of the divisor.

From the group isomorphism of Theorem 1.23 between Pic 0 C (L) and J C (L) for any K ⊂ L ⊂ K, the Mumford form also gives a way of representing the points of the Jacobian of C.

input :

Two reduced divisors D 1 = u 1 , v 1 and D 2 = u 2 , v 2 on the curve C : y 2 = f (x), given in Mumford form. output: The unique reduced divisor D = D 1 ⊕ D 2 . Composition step: Compute d 1 = gcd(u 1 , u 2 ) and e 1 , e 2 such that d 1 = e 1 u 1 + e 2 u 2 Compute d = gcd(d 1 , v 1 + v 2 ) and c 1 , c 2 such that d = c 1 d + c 2 (v 1 + v 2 ) s 1 ← c 1 e 1 , s 2 ← c 1 e 2 , s 3 ← c 2 u ← u 1 u 2 d 2 , v ← s 1 u 1 v 2 +s 2 u 1 v 1 +s 3 (v 1 v 2 +f ) d mod u Reduction step: while deg u > g do U ← f -v 2 u , V ← -v mod U u ← U , v ← V end Make u monic return u,v Algorithm 1: Cantor's algorithm
The algorithm we describe has a complexity in O(g 2 ), but this complexity can be reduced to O(g) by replacing the reduction step by a more efficient one inspired by the fast gcd algorithm. Since performing group operations in J C is essential, faster algorithms have been designed in [START_REF] Lange | Formulae for arithmetic on genus 2 hyperelliptic curves[END_REF][START_REF] Kuroki | Fast genus three hyperelliptic curve cryptosystems[END_REF][START_REF] Gaudry | Fast genus 2 arithmetic based on theta functions[END_REF] to reduce the number of field operations involved in less general frameworks. In what follows, we make use of some of them in genus 2 and 3.

Another fundamental operation is scalar multiplication of a divisor. Once the addition is known, this can be done by a double-and-add approach but we emphasize here on the form of the result rather than the method to achieve it. In the case of elliptic curves, given an affine point P ∈ C of coordinates (x, y) and an integer > 1, we have

P = x - ψ -1 ψ +1 (x) ψ 2 (x) , ψ 2 (x, y) 2ψ 4 (x) ,
where the ψ i 's are called division polynomials and they are defined inductively by ψ 0 = 0, ψ 1 = 1 and

ψ 2m+1 = ψ m+2 ψ 3 m -ψ m-1 -ψ m-2 ψ 2 m+1 for m ≥ 2, ψ 2m = ψ m 2y ψ m+2 ψ 2 m-1 -ψ m-2 ψ 2 m+1 for m ≥ 3.
These polynomials have been generalized in [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF] as follows: given > g and the weight-one divisor D = P -∞ with P ∈ C of coordinates (x, y) the generic point, there exist 2g + 2 polynomials (d i ) 0≤i≤g and (e i ) 0≤i≤g such that the Mumford form of D is

X g + g-1 i=0 d i (x) d g (x) X i , y g-1 i=0 e i (x) e g (x) X i .
As in the elliptic case, there exist recurrence formulas for those division polynomials, which we use later to bound their degrees. To compute them, however, it is much simpler to directly multiply the generic affine point (x, y) by in the function field of the curve. In Chapter 4, we present two bounds for the degrees of Cantor's division polynomials, one for hyperelliptic curves of arbitrary genera and another sharper bound specific to genus-3 hyperelliptic curves.

Endomorphisms, torsion and Tate modules

To be more precise about what is point-counting and the main algorithms to do so, we give further theoretical background. We switch back to a broader context as we later present algorithms capable of counting points on Abelian varieties. Definition 1.30. Let A and B be two Abelian varieties over K, and let ϕ ∈ Hom K (A, B) be a morphism of Abelian varieties, i.e. a morphism of varieties that is also a group homomorphism. We say that ϕ is an isogeny if the induced morphism A( K) → B( K) is surjective and has a finite kernel. If there exists such an isogeny, we say that A and B are isogenous.

Definition 1.31. The degree of such an isogeny is defined as its degree as a rational map. Definition 1.32. Given an isogeny ϕ of degree n between A and B, there exists a unique isogeny ϕ ∨ of degree n between B and A such that ϕϕ ∨ = [n]. We call it the contragredient isogeny of ϕ.

Definition 1.33. The set Hom K (A, A) of endomorphisms of A, denoted End K (A), is a ring with composition as a multiplicative structure, called the endomorphism ring of A.

Example 1.34. Let A be an Abelian variety over F q . Let π be the Frobenius map x → x q of F q , it extends to a map of projective spaces which stabilizes A, since A is defined over F q . The group law and zero-element of A are also defined over F q so π is also an endomorphism for the group structure of A. Thus, π ∈ End Fq (A) can be seen as an endomorphism called the Frobenius endomorphism.

Another common endomorphism is the aforementioned scalar multiplication that we denote [ ]. We say that an element of ker[ ] is an -torsion point and denote A[ ] the -torsion, i.e. the elements of A( K) that vanish after multiplication by . This set is at the heart of Schoof-like algorithms and so is the following statement about its structure. Proposition 1.35. [START_REF] Cohen | Handbook of elliptic and hyperelliptic curve cryptography[END_REF]Th. 4.73] Let A be an Abelian variety of dimension g defined over K of positive characteristic, and let n be an integer coprime to the characteristic of K.

Then A[n] is a Z /n Z-module isomorphic to (Z /n Z) 2g .
Note that it is important to highlight the fact that we consider the torsion elements in the algebraic closure, for they have no reason to be rational, and in general they live in (large) extensions of the base field.

In what follows, let be a prime number different from the characteristic. For any positive

k, [ ]A[ k+1 ] = A[ k ]
. Thus, the groups A[ k ] form a projective system, which brings us to the following definition. Definition 1.36. Let be a prime different from char(K), the -adic Tate module of A is defined as

T (A) = lim ← - A[ k ].
We have seen that for n coprime to char(K), A[n] has a structure of free Z /n Z-module of dimension 2g, from which we deduce that T (A) is a free Z -module, also of dimension 2g. Thus, Aut(T (A)) and Aut(A[n]) can be respectively identified with GL 2g (Z ) and GL 2g (Z /n Z).

By acting on each A[ k ], the Frobenius endomorphism acts on the Z -module T (A), and we can extend its action to the 2g-dimensional Q -vector space T (A) ⊗ Z Q . This action can be represented by a square matrix of size 2g whose characteristic polynomial we denote χ . Theorem 1.37. [START_REF] Cohen | Handbook of elliptic and hyperelliptic curve cryptography[END_REF]Lem. 5.71] The polynomials χ have integer coefficients which are independent from . Their common value χ is called the characteristic polynomial of the Frobenius endomorphism.

Note that this section relies on some powerful theoretic results that we do not want to linger on. In what follows we will mostly consider actions of the Frobenius on subspaces such as the -torsion, on which there are more elementary definitions. We invite the interested reader to look for more detailed information on this subject in [START_REF] Mumford | Abelian varieties[END_REF]Sec. 19].

Real multiplication

(A) = End K ⊗ Z Q. If A is simple, then End 0 K (A) is a skew field.
Definition 1.40. Let F be a totally real number field, we say that A has real multiplication (RM) by F if there exists an embedding F → End 0 K (A). Likewise, we say that A has RM by a subring R of a totally real number field if there exists an embedding R → End K (A).

Previous examples of endomorphisms highlighted the fact that if A is nonzero, then Z is always a subring of the ring End K (A). When K is a finite field, this is also true for Z[π] with π the Frobenius endomorphism.

This definition may seem tautological as every Abelian variety has RM by Z. In Section 3.1.2 and Chapter 6, we ask for hyperelliptic Jacobian with RM by an order Z[η] satisfying further constraints.

Point-counting 1.2.1 Definitions

Definition 1.41 (Local zeta function). Let C be a nonsingular projective algebraic curve over a finite field F q , the (local) zeta function of C is defined as the formal power series in Q[[t]]:

Z(t) = exp   k≥1 #C(F q k ) t k k   .
In what follows, most point-counting algorithms actually compute the whole zeta function of the input curve instead of simply computing #C(F q ) or #J C (F q ). The reason is that these algorithms strongly rely on the fact that zeta functions satisfy remarkable properties, as conjectured by Weil in 1949 and later proved by Dwork, Grothendieck and Deligne.

The Weil conjectures can be summed up by the following three properties:

• Z(t) ∈ Q [[t]] is a rational function • Z(t) verifies a functional equation • the numerator of Z(t) is a polynomial in Z[t]
whose roots are algebraic integers of norm 1/ √ q.

For counting points, we use the following consequences of the Weil conjectures.

Proposition 1.42. The zeta function Z(t) of a nonsingular projective algebraic curve C is a rational fraction of the form

Z(t) = L(t) (1 -t)(1 -qt) ,
where L = a 0 + • • • + a 2g t 2g is a degree 2g polynomial whose coefficients a i are integers such that a 0 = 1, a 2g = q g and ∀i ≤ g, a 2g-i = q g-i a i and

|a i | ≤ 2g i q i/2 .
We have reduced the problem to computing the polynomial L, but we can get even more information on this polynomial by relating it further to the curve. In fine, we can translate all these properties into efficient point-counting algorithms.

Lemma 1.43. The polynomial L is the reciprocal polynomial of the characteristic polynomial χ of the Frobenius endomorphism, as defined in Definition 1.37. This lemma is the cornerstone to all the algorithms that we discuss next, each one follows the same principle indeed: deducing χ from the characteristic polynomial of the action of the Frobenius on some spaces, of course provided that we can recover the actual χ from the partial information obtained.

Algorithms

In this section, we review the main families of algorithms for counting points on hyperelliptic curves, as well as their complexities. Note that the input curve is given by a degree 2g + 1 polynomial in F q [X], with q = p n . This input has a bit-size in O(ng log p) which is why ng log p = g log q is the reference when we give complexity estimates. Therefore, an algorithm in O(p) will be called exponential. See for instance [START_REF] Gaudry | Algorithmes de comptage de points d'une courbe définie sur un corps fini[END_REF] for a survey on the subject, along with record computations.

Exhaustive search

Since by Proposition 1.42 we are looking for a finite number of bounded integers, an algorithm that comes to mind would be to simply try all possibilities. To do so, one can try all the finitely many possibilities for χ until the characteristic equation χ(π) = 0 is satisfied in the Jacobian. This amounts to a searchspace of size determined by the Weil bounds, at least in O(q g/2 ). The complexity is therefore both exponential in g and log q.

The birthday-paradox approach

Replacing exhaustive search by a birthday-paradox approach, this running-time can be reduced to the square root of the size of the search space, but there is also a memory cost of similar magnitude. This was improved using distinguished points as in [START_REF] Matsuo | An improved baby step giant step algorithm for point counting of hyperelliptic curves over finite fields[END_REF][START_REF] Gaudry | A low-memory parallel version of Matsuo, Chao and Tsujii's algorithm[END_REF], increasing the running time by a constant factor but making the memory requirements negligible.

This approach is exponential in both log q and g, but it has the major advantage of being massively parallelisable and having small memory requirements. This is the reason why, as we will see in Sections 3 and 6, it is still used in practice to finish computations. It can also benefit from previous knowledge on χ mod m as this reduces the size of the searchspace by a factor m g/2 . Such information on χ can be gained using "polynomial-time" algorithms such as the ones we describe below. For simplicity, we only present these methods in genus 2 and 3, respectively in Chapters 3 and 6.

p-adic methods

Instead of considering the action of the Frobenius directly on J C , the p-adic approaches are based on computing (a p-adic approximation of) a lift of the Frobenius and its action on some differential forms. There are many algorithms following this philosophy, each using a different lift or different differential forms. For instance, Satoh's algorithm for elliptic curves [START_REF] Satoh | The canonical lift of an ordinary elliptic curve over a finite field and its point counting[END_REF] computes the canonical lift of both the curve and the (dual) Frobenius endomorphism, whose action on the lifted curve determines the trace of the Frobenius. Kedlaya's algorithm [START_REF] Kiran | Counting points on hyperelliptic curves using Monsky-Washnitzer cohomology[END_REF] just needs a monic lift but it acts on a larger space, namely a Monsky-Washnitzer cohomology group. Compared to Satoh's, this algorithm also has the advantage of working for hyperelliptic curves of arbitrary genera, with a complexity in O(pg 4 n 3 ) bit-operations and O(pg 3 n 3 ) space. Note that Kedlaya's algorithm does not apply as such in characteristic 2, but this was fixed by Denef and Vercauteren in [START_REF] Denef | An extension of Kedlaya's algorithm to hyperelliptic curves in characteristic 2[END_REF]. This was extended by Tuitman in [START_REF] Tuitman | Counting points on curves using a map to P 1 , II[END_REF] for (possibly non-hyperelliptic) curves with a "good" lift, where good hides various technical hypotheses that are expected to be satisfied in general.

All these approaches have polynomial complexities in both g and n, and despite an improvement by Harvey [START_REF] Harvey | Computing zeta functions of arithmetic schemes[END_REF] reducing the dependency in p to √ p, this is still exponential in log p, which is why they are used for fields of small characteristic. However, when counting points over many fields, it is remarkable that an average polynomial-time complexity can be reached [START_REF] Harvey | Computing Hasse-Witt matrices of hyperelliptic curves in average polynomial time II[END_REF]. Indeed, given a curve over Q, this algorithm computes the zeta function of its reduction modulo p on F p for all the primes p of good reduction smaller than N in time O(N log 3 N ) and polynomial in g. Thus, on average, counting points on each curve amounts to a polynomial complexity in log p, n and g. However, we still do not know any algorithm that has polynomial-time complexity in all these parameters for counting points on a single curve.

Schoof's algorithm and its extensions

input : An elliptic curve E/F q given by the equation

y 2 = x 3 + ax + b output: #E(F q ) L ← 0 ← 3 while L ≤ 4 √ q do Compute ψ Let R = F q [X, Y ]/ ψ (X), Y 2 -X 3 -aX -b /* this is E[ ] */ In R, compute F 0 = (X q 2 , Y q 2 ) ⊕ E [q mod ](X, Y ) and F 1 = (X q , Y q ) Store t the unique element of Z / Z such that F 0 = [t ]F 1 L ← L • ← NextPrime( ) end
By CRT find t such that t ≡ t mod for all previous . return q -t + 1

Algorithm 2: Schoof's algorithm

In [START_REF] Schoof | Elliptic curves over finite fields and the computation of square roots mod p[END_REF], Schoof describes an algorithm to compute the zeta function of an elliptic curve, which amounts to computing the trace of the associated Frobenius endomorphism. The idea is to consider the action of the Frobenius on the -torsion subgroup to recover χ mod for sufficiently many and, using Proposition 1.42, to recover χ by CRT. Proposition 1.44. Let C be a smooth projective curve over F q and coprime to q, then the restriction of π to the -torsion subgroup J C [ ] has χ mod for characteristic polynomial.

Note that in Algorithm 2, ⊕ E denotes the group law of the elliptic curve, which may lead to a division by zero in the algebra R. To avoid this problem, one can previously factor ψ to perform operations in fields. This is a costly solution and we prefer to follow the approach of [START_REF] Della | About a new method for computing in algebraic number fields[END_REF] and let the representations of elements of R evolve during the computations. In the unlikely event of a "forbidden" division, we can split ψ as a product of two factors and pursue the computations in the algebras obtained by replacing ψ by each of its factors, with no consequence on the complexity since each factor has a smaller degree. In this thesis, we sometimes reuse this method under the name of "D5 strategy". Another important aspect in practice is that we can modify the group law to avoid handling the ordinate, and work only in a univariate algebra. While this does not change the asymptotic complexity, it greatly reduces the running time.

Let us analyze the cost of one iteration of Schoof's algorithm for a fixed . First, ψ can be obtained from the recurrence formulas on the ψ i 's. These formulas show that computing ψ amounts to computing 5 ψ k 's with k /2, which yields an overall complexity in O( log 2 5 ) for computing Cantor's -division polynomials. The bottleneck is the computation of F 0 which requires O(log q) operations in R, each of them accounting for a bit-complexity in O( 2 log q) since ψ has degree ( 2 -1)/2. Likewise, computing F 1 is feasible within O(log q) operations in R, and recovering t can be done by exhaustive search for additions in R.

Thus, for a fixed the loop costs O( 2 log q( + log q)) bit operations. Using results of analytic number theory such as [START_REF] Tenenbaum | Introduction to analytic and probabilistic number theory[END_REF]Cor. 10.1], one sees that we have to repeat the loop about O(log q/ log log q) times and the largest to consider has size O(log q). This proves that the complexity of Schoof's algorithm is in O(log 5 q). Schoof's algorithm was later improved by restricting to specific primes for which we can test the characteristic equation of the Frobenius in a proper subgroup of E[ ]. This amounts to replacing ψ by a factor of degree O( ) in the definition of R, reducing the cost of each operation in R by a factor and therefore having an overall complexity in O(log 4 q). We do not discuss these improvements further and refer to [START_REF] Schoof | Counting points on elliptic curves over finite fields[END_REF] for more information.

Schoof's algorithm relies on theoretical results such as Weil's conjecture and Proposition 1.44 which are still valid even in a much more general setting, and it was extended few years later by Pila [START_REF] Pila | Frobenius maps of Abelian varieties and finding roots of unity in finite fields[END_REF] who proposed an algorithm to count points on Abelian varieties with time-complexity in O((log q) ∆ ), where ∆ depends on the dimension g of the input Abelian variety A, and its group law.

Although most of the theoretical background is still valid in this much more general context, to compute the action of π on A[ ] we need to find an explicit description A[ ] as a 2g-dimensional vector space, so that given e ∈ A[ ] we can compute π(e). This is the most difficult part and it constitutes the bottleneck of many if not all the -adic point-counting algorithms appearing in this thesis. Pila's approach to the problem is to view A[ ] as a zero-dimensional algebraic set, after getting a description for the maps [n], with n ≤ . Applying straightforwardly the Frobenius map to an element would not give a polynomial-time algorithm, but using the description of A[ ] we can repeatedly square elements and reduce by the defining equations. The complexity result follows by bounding the number of monomials appearing in these equations, and applying various primitives such as ideal membership testing and monomial bases computations.

As in Schoof's algorithm, the complexity is polynomial in log q but the exponent ∆ is actually exponential in the dimension g of A, so that the overall complexity is doubly exponential in g. The dependency in g of the exponent of log q has later been improved by [START_REF] Huang | Counting points on curves over finite fields[END_REF] and [START_REF] Adleman | Counting points on curves and Abelian varieties over finite fields[END_REF].

In [START_REF] Huang | Counting points on curves over finite fields[END_REF], Huang and Ierardi reduce the dependency in g of the exponent in the case of plane curves to a polynomial in g. This is achieved by using another way of representing J C [ ]: by considering its elements as divisor classes and by using effective Riemann-Roch algorithms to get a semi-algebraic description with size polynomial in and exponential in the degree of C. An important obstacle to overcome is the presence of singular points.

In [START_REF] Adleman | Counting points on curves and Abelian varieties over finite fields[END_REF], Adleman and Huang extend the result of [START_REF] Huang | Counting points on curves over finite fields[END_REF] to Abelian varieties, with a more precise complexity bound in (log q) O(g 2 log g) for hyperelliptic curves of genus g. This time, the low-degree representation of the Frobenius is achieved through faster ad hoc algorithms on semi-algebraic sets.

Applications of point-counting

In this section, we review some of the various applications of point-counting. While some of them are based on slight variations of previous algorithms, others only need the output of pointcounting algorithms. Some applications involve designing curves with special properties that are closely related to the number of points on the (Jacobian of the) curve. In this context, the so-called CM-method can be used to create curves with a prescribed number of points, instead of applying point-counting algorithms to random curves until we are satisfied with the result. For further information on this approach, we refer to [START_REF] Oliver | Finding suitable curves for the elliptic curve method of factorization[END_REF]. This problem has lead to cryptographic applications taking advantage of the fact that the exponentiation P → nP is a one-way function as long as the DLP is hard.

Cryptographic use

In [START_REF] Shoup | Lower bounds for discrete logarithms and related problems[END_REF], Shoup defined a concept of generic group and proved that in such a group, any algorithm must perform at least Ω( √ M ) group operations in order to compute a discrete logarithm. There are many models for black box groups in the literature for which similar results were proven, such as [START_REF] Vassiliy | Complexity of a determinate algorithm for the discrete logarithm[END_REF], but we do not intend to review them all.

However, finding such generic groups in real life is not that easy: for instance if G = Z /M Z, the DLP can be solved in polynomial time by computing an XGCD. In real-life cryptography, G is either the multiplicative group of a finite field or (the Jacobian of) an elliptic curve. Note that the DLP in finite fields is much easier than in a generic group, as the complexity to solve it range from quasipolynomial to subexponential, depending on its characteristic.

Thus, surprisingly enough, Jacobians of curves of fixed genus are the only known examples of groups in which there is still no classical subexponential algorithm to solve the DLP. Yet, some subexponential algorithms exist when g grows asymptotically as fast as log q and some attacks like in [START_REF] Gaudry | Constructive and destructive facets of Weil descent on elliptic curves[END_REF], though still exponential, reduced the hardness of the DLP in genus strictly larger than 2, making genus 1 and 2 optimal in terms of keysize. For a more detailed survey on the subject, we refer to [START_REF] Galbraith | Recent progress on the elliptic curve discrete logarithm problem[END_REF].

We emphasize that even if we consider a group G in which the DLP is hard, exponential algorithms may still be succesful in practice, for instance if #G is small. The following technique due to Pohlig and Hellman in [START_REF] Pohlig | An improved algorithm for computing logarithms over GF(p) and its cryptographic significance (corresp.)[END_REF] shows that considering G of large size is not sufficient since the difficulty of the DLP is entailed to the largest prime factor of #G.

Let us assume that G has order N = r i=1 p e i i , where the p i 's are distinct primes. Let P i = N i P with N i = N/p e i i , then the subgroup G i generated by P i has order p e i i , so that we can solve the DLP in G by solving it in each G i and using the Chinese remainder theorem. Thus, the DLP in G is as hard as the DLP in the "hardest" G i .

We can now assume that G has a prime-power order N = p e . Given Q = nP , we want to find n. Since n < N , we decompose n in basis p as n = e-1 i=0 n i p i . Multiplying this decomposition by p e-1 , we get

p e-1 n = p e-1 n 0 + p e e-1 i=1 n i p i .
Now since Q = nP , we have p e-1 Q = np e-1 P so that p e-1 Q = n 0 p e-1 P . We can now recover n 0 by solving a DLP, but in a group of size p instead of p e . Once done, we do the same for n 1 and so on by induction. Finally, the DLP in G is broken down into solving e DLPs in groups of order p.

To sum up, if we only focus on finding the smallest groups achieving a fixed security level, then we have to choose (Jacobians of) curves of genus 1 and 2. But then, we must find curves such that #J C = χ(1) is prime (or actually almost prime for other cryptographic reasons). Because of Weil's bounds, we already know that our curves have to be defined over a large field. Although no practical attack against curves over fields of small characteristic has been published, standards seem to prefer curves defined over F p or F p 2 with p a large prime, so that -adic methods are more adapted in this context.

For elliptic curves, Schoof's algorithm and its improvements based on Elkies and Atkin's work [START_REF] Schoof | Counting points on elliptic curves over finite fields[END_REF] are efficient enough to allow choosing random curves, counting points on them and retaining only those with an almost prime order. The same method was used in [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF] to create a secure genus-2 curve, as we will detail in Chapter 3, but it involves much heavier computations.

Extensions of the Sato -Tate conjecture

Contrary to cryptographic applications for which only the size of the Jacobian is needed, we can use the fact that most of the point-counting algorithms actually compute the full zeta function of the curve. This has been used to study how the zeta functions (or the characteristic polynomials of the p-Frobenius) of a fixed curve C over F p behaves when p varies. In genus 1, this was predicted by the Sato -Tate conjecture in 1948 and proven by Clozel, Harris, Shepherd-Barron and Taylor in [START_REF] Clozel | Automorphy for some -adic lifts of automorphic mod Galois representations[END_REF][START_REF] Harris | A family of Calabi-Yau varieties and potential automorphy[END_REF][START_REF] Taylor | Automorphy for some -adic lifts of automorphic mod Galois representations[END_REF].

Theorem 1.46. Let E be an elliptic curve over Q and t p the trace of the p-Frobenius of its reduction modulo a prime of good reduction p. If E does not have complex multiplication, then the normalized traces t p /2 √ p are equidistributed with respect to the measure 2dt/π √ 1 -t 2 .

Note that the distribution of these quantities was also known since Deuring for curves with complex multiplication. A natural question is to ask for generalization of this statement in higher genera, both in the general case and in less likely cases analogous to the CM case in genus 1.

It is conjectured that given a curve C, the normalized Weil polynomials L p (t)/ √ p of its reductions modulo primes of good reduction follow a distribution that matches that of the Chapter 1. Point-counting and applications characteristic polynomials of random matrices of a compact subgroup of USp(2g), called the Sato -Tate group of C. We refer to [START_REF] Katz | Random matrices, Frobenius eigenvalues, and monodromy[END_REF] and [START_REF] Shieh | Arithmetic aspects of point counting and Frobenius distributions[END_REF] for more information on this subject. In genus 2 and 3, this was investigated in [START_REF] Fité | Sato-Tate distributions and Galois endomorphism modules in genus 2[END_REF] and [START_REF] Kedlaya | Hyperelliptic curves, L-polynomials, and random matrices[END_REF]. Although the exponential generic approaches such as detailed in [START_REF] Sutherland | Order computations in generic groups[END_REF] are still faster than the p-adic ones for the range of curves and Jacobians studied, average polynomial-time algorithms perfectly fit such investigations.

Algorithmic applications

Shortly after Schoof's algorithm, Lenstra used elliptic curves to tackle the problem of factoring integers with the celebrated elliptic curve method (ECM). In this section, we detail two examples where curves, and more precisely point-counting on curves, are involved in designing deterministic algorithms for number theory or computer algebra. Although point counting is not involved in ECM, the number of rational points of the chosen elliptic curve plays an important role since it has to be smooth.

Primality proving

Given an integer N , we want an algorithm running in time polynomial in N that returns "yes" if N is prime and "no" if not, with a small probability of giving a wrong answer. We present two algorithms in which -adic methods play a central role, but let us first give an introductory example.

Assume that we can find another integer m < N such that m -1 is coprime to N and such that m (N -1)/2 ≡ 1 mod N , then if (N -1)/2 is prime, N is prime as well and we repeat the process until the primality of N has been reduced to a number which is known to be prime (for instance any prime smaller than 100). Since it is quite easy to find a good m quickly by taking random integers, this would yield a probabilistic polynomial-time algorithm. But it has a fatal flaw: if (N -1)/2 is not prime we cannot draw any conclusion on the primality of N .

To deal with this obstacle, Goldwasser and Kilian [START_REF] Goldwasser | Almost all primes can be quickly certified[END_REF] reduced the primality of N to that of another integer r which is roughly two times smaller than N but can be different from (N -1)/2. This is achieved by considering a random elliptic curve E and computing m = #E(Z /N Z) using Schoof's algorithm. Then if m happens to be even, one can prove that the primality of r = m/2 entails that of N . Provided that there are sufficiently many "good" integers m occurring as cardinalities of random elliptic curves such that r is actually prime, this method achieves polynomial complexity. Unfortunately, this amounts to proving that there are sufficiently many primes between N -√ N and N + √ N , but current knowledge on the distribution of primes is not even sufficient to even prove that there is a single prime in that interval.

Adleman and Huang found a workaround in [START_REF] Adleman | Primality testing and Abelian varieties over finite fields[END_REF] by devising two extensions of the previous algorithm, and combining them together. First, instead of only considering the case m = 2r, they reduced the primality of N to r such that m = λr with λ a small prime. This yields an algorithm terminating in polynomial time for integers smaller than x outside of a subset of size bounded by x 15/16 . The other extension is to consider genus 2 curves instead of elliptic curves. Indeed, while there is still a polynomial-time analogue of Schoof's algorithm for counting points, the Hasse-Weil interval has a size larger than N √ N . This "reduces" the primality of N to that of a larger integer, which could be a flaw at first sight. But they actually proved that after repeating this step three times at most, they obtained a candidate prime large enough for the first variant of the Kilian-Goldwasser algorithm to return the correct answer in polynomial time.

Agrawal, Kayal and Saxena later proposed a deterministic polynomial-time algorithm for primality proving. Although these algorithms answer a theoretical question, we also remark that using elliptic curves for probabilistic primality testing is also competitive in practice thanks to work of Atkin and Morain [START_REF] Oliver | Elliptic curves and primality proving[END_REF][START_REF] Morain | Primality proving using elliptic curves: an update[END_REF]. Indeed, a recent computation using ECPP gave a primality certificate for 2 116224 -15905 in November 2017 by Peter Kaiser [76].

Deterministic factorisation of polynomials over finite fields

A recent paper by Poonen [START_REF] Poonen | Using zeta functions to factor polynomials over finite fields[END_REF] highlights the potential of -adic methods to design a polynomialtime deterministic algorithm for factoring polynomials over finite fields. This is based on an idea by Kayal using Schoof's algorithm in the following way. Let us assume that we are given P ∈ F p [t] such that P = (t -r 1 )(t -r 2 ), and we want to recover the two factors of P . By a result of Berlekamp [START_REF] Berlekamp | Factoring polynomials over large finite fields[END_REF], one can reduce the problem of factorization in F q [t] to that of factoring polynomials in F q [t] with distincts roots all in F p , and by induction on the degree of P , handling the case P = (t -r 1 )(t -r 2 ) is sufficient to perform factorization of any polynomial over a finite field.

Defining B = F p [t]/P , we consider an elliptic curve E on B. Actually, E splits as a cartesian product of two elliptic curves over F p , which we denote E 1 and E 2 . Assuming #E 1 (F p ) = #E 2 (F p ), the respective traces t 1 and t 2 of the Frobenius of E 1 and E 2 are also different. Therefore, there is a prime such that t 1 ≡ t 2 mod . When applying Schoof's algorithm on E as if B were a field, we end up considering that and looking for a candidate t 0 for the trace of the Frobenius of E modulo . Doing so by exhaustive search we encounter special phenomena for t 0 = t 1 and t 0 = t 2 , and eventually recover r 1 and r 2 . Indeed, for t 0 = t 1 , all the elements of the curve E over F p [t]/(t -r 1 ) satisfy the characteristic equations φ 2 p -t 0 φ p + p = 0, but not all the elements of E, since t 1 = t 2 . This leads to a division by a non-invertible element in B, itself leading to a proper factor of P .

If #E 1 (F p ) = #E 2 (F p ), however, this does not work so we have to choose another E and hope not to fall in the same pathologic case. It is reasonable to think that there is enough room for the choice of E to end up in a good situation after only a few attempts, but this is still unproved. To increase the chances of success, Poonen suggests to switch to higher-dimensional Abelian varieties and use Pila's algorithm instead of Schoof's, as their zeta functions have g degrees of freedom instead of one. Although it is even more convincing, the fact that we have "enough" different zeta functions remains unproved.

Other applications

Schoof's algorithm and its generalization all rely on having a nice representation of the -torsion, in a sense that we have already mentioned, and will make clearer in Chapters 3 to 5. An example is given in [START_REF] Robert | Fonctions thêta et applications à la cryptographie[END_REF]Sec. 7.5] to compute all the -isogenies from an Abelian variety knowing itstorsion subgroups.

Last, some multiplication algorithms like [START_REF] Volfovich | Algebraic complexities and algebraic curves over finite fields[END_REF] or algebro-geometric codes benefit from curves with many rational points [START_REF] Denisovich | Algebraico-geometric codes[END_REF][START_REF] Miura | Algebraic geometric codes on certain plane curves[END_REF][START_REF] Qiu | Certain sextics with many rational points[END_REF]. We do not further develop these aspects since they use mostly non-hyperelliptic curves.

Chapter 2

Polynomial systems

The generalizations of Schoof's algorithm all rely on describing the -torsion in a way that allows to test ideal membership and perform group operations. In genus greater than 1, this step is the bottleneck of these algorithms, and therefore the step to improve in order to get better complexity estimates. The direction that we investigate in this thesis consists in formally multiplying a divisor D by and then solving the polynomial system obtained after equating D = 0. The aim of this section is to define what we mean by polynomial system solving, to present the methods that we use to do so and to study their complexities. These methods and complexity results are used in Chapters 3 to 6.

Since all our systems will be designed to model (subsets of) the -torsion of Abelian varieties, they will all have dimension zero. Thus, all the definitions and statements of this section are given in the particular case of zero-dimensional systems.

In this chapter, we review three methods for solving polynomial systems along with complexity results that we reuse later. Section 2.2 recalls algorithms for computing Gröbner bases, but their complexities are hard to bound, so that they are only used for practical results in Chapter 6. Section 2.3 deals with resultants that provide a good alternative both in theory and in practice for bivariate systems, as detailed in Chapter 3. In the trivariate case, they are no longer competitive against algorithms like F4 but they can still be used to derive complexity bounds in Chapter 6. Lastly, Section 2.4 is dedicated to the geometric resolution, a method used in Chapter 5 to take advantage of structural properties of our polynomial systems.

Solving polynomial systems

Definition 2.1. Let K be a field, and let f 1 , . . . , f m be polynomials in K[x 1 , . . . , x n ]. The solutions of the polynomial system {f 1 , . . . , f m } are the tuples (z 1 , . . . , z n ) ∈ Kn such that for all i ∈ {1, . . . , m}, f i (z 1 , . . . , z n ) = 0. When the set of solutions is finite, we say that the system is zero-dimensional (or has dimension zero). In that case, we refer to the number of solutions (in K) counted with multiplicities as the degree of the system.

The simplest possible case of operations in a quotient ring is the univariate case. For instance, given an elliptic curve E the -division polynomials allow us to reduce the computations of the Frobenius in E[ ] to exponentiation in the quotient ring F q [X]/ψ (X). In more general cases, we always fall back to the univariate case using one of the following strategies. Either we eliminate variables one by one to end up with one univariate equation, or we parametrize all the variables by another one. More precisely, we say that we have solved a system when we have put it in one of the two following forms.

Chapter 2. Polynomial systems Definition 2.2 (Triangular form). We say that a zero-dimensional polynomial system is triangular if it has the form g 1 (x 1 , x 2 , x 3 , . . . , x n ) . . .

g i 1 (x 1 , x 2 , x 3 , . . . , x n ) g i 1 +1 (x 2 , x 3 , . . . , x n ) . . . g i 2 (x 2 , x 3 , . . . , x n ) g i 2 +1 (x 3 , • • • , x n ) . . . g in (x n )
Actually, we can often get an even simpler form like

x 1 -h 1 (x n ) . . . x n-1 -h n-1 (x n ) h n (x n ).
When a system can be put in this form, we say that the system is in shape position. It has been proven in [START_REF] Becker | The shape of the shape lemma[END_REF] that when the associated ideal is radical this is very likely after a random linear change of variables, provided that the field of definition is large enough.

Definition 2.3 (Geometric resolution).

A geometric resolution of a zero-dimensional polynomial system is a linear combination x 0 of the variables x i 's and a system of the form h 0 (x 0 ) = 0

x 1 = h 1 (x 0 ) . . . x n = h n (x 0 )
where h 0 is a univariate polynomial whose degree D is the degree of the polynomial system, and the h i are univariate polynomials of degrees smaller than D. The linear combination x 0 is called a separating variable or a primitive element.

To compute a triangular form of our system, a possible strategy is to eliminate one variable and then repeat the same procedure on the equations with n -1 variables. We made this precise by introducing the following definition Definition 2.4. [START_REF] Cox | Ideals, varieties, and algorithms[END_REF]Sec. 3 Def. 1]

Given I = f 1 , . . . f m ⊂ K[x 1 , . . . , x n ], the k-th elimination ideal I k is defined by I k = I ∩ K[x k+1 , . . . , x n ].
An elimination scheme is an algorithm to compute a generating set of I k , or at least a set of elements of I k . A historical example of elimination is the Gauß-Jordan elimination for solving linear systems of equations. This method can be seen as computing the row-reduced form of a matrix associated to the system, so it is no surprise that we end up with a system in triangular form. In Sections 2.2 and 2.3, we review two ways of performing elimination, respectively by computing a Gröbner basis or resultants.

Gröbner bases

This section presents properties of Gröbner bases and explains why they are a particularly convenient tool for solving polynomial systems. We briefly present known strategies to compute them and review complexity results.

Gröbner bases and elimination

≺ on Z n ≥0 such that • if α ≺ β and γ ∈ Z n ≥0 , then α + γ ≺ β + γ,
• ≺ is a well-ordering, i.e. it is a strict total ordering such that every nonempty subset of Z n ≥0 has a smallest element under ≺. This gives an ordering on the set of monomials via α → x α which is compatible with the multiplication of monomials. Given an element P = α a α x α of K[x 1 , . . . , x n ], it allows to define:

• the multidegree mdeg(P ), the greatest α (for the monomial order) such that a α = 0,

• the leading monomial LM(P ) = x mdeg(P ) , the greatest monomial appearing in P ,

• the leading coefficient LC(P ) = a mdeg(P ) , the coefficient of the leading monomial of P ,

• the leading term LT(P ) = LC(P ) LM(P ), If S ∈ K[x 1 , . . . , x n ] is a set of polynomials, we define LT(S) = {LT(P ) | P ∈ S}. In this thesis, we mostly encounter the following two monomial orderings: Example 2.7. (Lexicographic order). Let α and β be two elements in Z n ≥0 , we write α ≺ lex β if there exists i such that α j = β j for any j < i and α i < β i .

In other words, the monomials are ordered by lexicographic order using the order

x n ≺ x n-1 ≺ • • • ≺ x 1 for the variables.
Example 2.8. (Graded reverse lex order). Let α and β be two elements in Z n ≥0 , we write α ≺ grevlex β if |α| < |β| or if |α| = |β| and there exists i such that α j = β j for any j > i and

α i > β i .
In other words, grevlex orders first by total degree and then uses the reverse lexicographic order to compare in case of equality, using the order

x 1 ≺ x 2 ≺ • • • ≺ x n for the variables.
Consider the case of a system of two univariate polynomials, {P (X), Q(X)}. A triangular form of this system is {gcd(P (X), Q(X))}, and the GCD computation can be done using Euclid's algorithm, i.e. successively reducing one polynomial by the other. In what follows, we introduce definitions to extend the notion of reduction to the multivariate case. Theorem 2.9. [START_REF] Cox | Ideals, varieties, and algorithms[END_REF]Chap. 2,Th. 3] Let us fix a monomial order and let F = (f 1 , . . . , f s ) be an ordered tuple of polynomials in

K[x 1 , . . . , x n ]. Every f ∈ K[x 1 , . . . , x n ] can be written f = s i=1 a i f i + g,
with the a i 's and g in K[x 1 , . . . , x n ] such that g is either 0 or a linear combination of monomials that are not divisible by any of the LM (f i )'s. Furthermore, if a i f i = 0, then we have mdeg(f ) ≥ mdeg(a i f i ).

Definition 2.10. In the setting of the previous theorem, we denote g = f F and call it a remainder of f modulo F . Furthermore, if LM(g) ≺ LM(f ), we say that f is top-reducible.

These definitions generalize the univariate Euclidean division but in a much weaker sense: even given a fixed monomial ordering, there is no unicity of the remainder in general. For some well-chosen sets F , however, the remainder modulo F is unique and it is thus possible to perform an analogue of Euclid's algorithm. In the next section, we define Gröbner bases that are an example of such nice sets. Definition 2.11 (Gröbner basis). Let I be an ideal of K[x 1 , . . . , x n ], ≺ a monomial ordering and a finite subset G ⊂ I. Then G is a Gröbner basis of I for the order ≺ if LM (G) = LM (I) . Theorem 2.12. [START_REF] Cox | Ideals, varieties, and algorithms[END_REF]Chap. 2,§5 Cor. 6] Given a monomial ordering ≺, any nonzero ideal has a Gröbner basis for ≺.

The previous theorem guarantees the existence of a Gröbner basis but there is no unicity: given G a Gröbner basis, the set G obtained by adding any element in I is another Gröbner basis. In the following definition, this inconvenience is fixed by adding some minimality condition. Definition 2.13. A Gröbner basis G of I is said to be reduced if for all h ∈ G we have LC(h) = 1 and no monomial of h is in LM (G\{h}) . Proposition 2.14. [START_REF] Cox | Ideals, varieties, and algorithms[END_REF]Chap. 2,§7 Prop. 6] Let I be a non-zero ideal of K[x 1 , . . . , x n ] and ≺ a monomial ordering. Then I has a unique reduced Gröbner basis G for ≺.

Note that while the reduced Gröbner basis of I for a monomial order is unique, it may differ from the reduced Gröbner basis for a different monomial order. As announced previously, one of their essential features is the unicity of the reduction of a polynomial by a Gröbner basis, as defined in Definition 2.10. Proposition 2.15. Let G = {g 1 , . . . , g k } be a Gröbner basis of an ideal I and let

f ∈ K[x 1 , . . . x n ].
Then there exists a unique r ∈ K[x 1 , . . . x n ] such that:

• no monomial of r is divisible by any LT(g i ), i.e. r is in normal form modulo G,

• there exists h ∈ I such that f = h + r.

The unique r is called the normal form of f modulo G, still denoted r = f G .
The following proposition gives additional characterizations of Gröbner bases.

Proposition 2.16.

A finite set G is a Gröbner basis of an ideal I if one of the following equivalent properties is satisfied:

• for every f ∈ I, at least one of the reductions of f modulo G is zero.

• every non-zero f ∈ I is top-reducible modulo G,

• for every f ∈ I, there exists g ∈ G such that LM(g) divides LM(f ).

Theorem 2.17 (The elimination theorem). [38, Sec. 2, Th. 2] Let I ⊂ K[x 1 , . . . , x n ] be an ideal and let G be a Gröbner basis of I with respect to the lexicographic order where x n ≺ . . . ≺ x 1 , then for every j ≤ n the set

G j = G ∩ K[x j+1 , . . . , x n ]
is a Gröbner basis of the j-th elimination ideal

I j = I ∩ K[x j+1 , . . . , x n ].
In particular, this shows that a Gröbner basis of an ideal for the lexicographic order is in triangular form.

Computing Gröbner bases

The first algorithm to compute Gröbner bases was introduced by Buchberger in 1965. Like Gaussian elimination, it relies on cancelling the leading monomials of two polynomials by combining them.

Definition 2.18. Let P and Q be two polynomials in K[x 1 , . . . , x n ], the S-polynomial of P and Q with respect to the monomial ordering ≺ is the combination

S(P, Q) = lcm(LM(P ), LM(Q)) LT(P ) P - lcm(LM(P ), LM(Q)) LT(Q) Q.
Then LM(S(P, Q)) is strictly smaller (for ≺) than lcm(LM(P ), LM(Q))). We call (P, Q) a critical pair and S(P, Q) the S-polynomial associated to the critical pair.

This gives another characterization of Gröbner bases.

Proposition 2.19. Let G = {g 1 , . . . , g k } be a subset of K[x 1 , . . . , x n ] not containing 0 and let S ij = S(g i , g j ) be the S-polynomials for the monomial ordering ≺. Then G is a Gröbner basis of g 1 , . . . , g k if and only if for any i, j, at least one of the reductions modulo G of S ij is zero.

Buchberger's algorithm constructs Gröbner bases by forcing this proposition to be satisfied: starting from a set F = {f 1 , . . . , f m }, compute all the S-polynomials, reduce them by F and repeat the operation to the union of F and all the non-zero remainders modulo F .

Note that we still have to worry about the termination of Buchberger's algorithm. Dickson's lemma states that any monomial ideal has a finite basis, which is equivalent to the fact that there is no infinite increasing sequence of monomial ideals. See for instance [START_REF] Cox | Ideals, varieties, and algorithms[END_REF]Chap. 2,Sec. 4 & 5] for statements and proofs.

There is an extensive literature on improvements to Buchberger's algorithm, but we mainly focus on two types of improvement that we used in practice in Chapter 6. The first idea is to compute Gröbner bases for the grevlex order as their computations involve polynomials of smaller degrees. This is noticeable both in practice and in the complexity bounds given in [START_REF] Lazard | Gröbner bases, Gaussian elimination and resolution of systems of algebraic equations[END_REF]. However, grevlex bases are often not sufficient to directly solve a system, contrary to their lex counterparts. We can circumvent this difficulty by a change of ordering using either the FGLM algorithm [START_REF] Faugère | Efficient computation of zero-dimensional Gröbner bases by change of ordering[END_REF] in dimension zero, or a Gröbner walk [START_REF] Collart | Converting bases with the Gröbner walk[END_REF] in positive dimension.

Since most of the running time of Buchberger's algorithm is spent computing reductions of critical pairs, the choice of the order in which we reduce them plays a prominent role. There is

input : F = {f 1 , . . . , f m } and ≺ a monomial ordering output: A Gröbner basis G for ≺ G ← F , G ← ∅ while G = G do G ← G for each critical pair (P, Q) with P, Q in G and P = Q do S ← S(P, Q) G if S = 0 then G ← G ∪ {S} end end end return G
Algorithm 3: Buchberger's algorithm as in [START_REF] Cox | Ideals, varieties, and algorithms[END_REF]Chap. 2,Th. 2].

no absolute answer to this question, but practical experiments allow to compare the efficiency of different choices. The so-called normal strategy consists of reducing first by pairs of small degrees and seems to be quite efficient. Another improvement was brought by the F4 algorithm [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF], using linear algebra to perform reductions much faster. The link between Gröbner bases and linear algebra will be detailed in the next section, as it is also helpful to prove complexity bounds. Further improvements on the reduction step can be designed, for instance by anticipating and avoiding reductions of some critical pairs to zero. This idea was introduced by Buchberger's criteria (see [START_REF] Cox | Ideals, varieties, and algorithms[END_REF]Sec. 9]) and later improved in the F5 algorithm [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases without reduction to zero (F5)[END_REF].

Complexity results

Let us consider an ideal I generated by m homogeneous polynomials f i ∈ K[x 1 , . . . , x n ] of respective degrees d i . We introduce I d = {f ∈ I | deg f = d} and point out that it is a vector space of finite dimension. Since any element of I d can be decomposed in the basis of degree-d monomials of K[x 1 , . . . , x n ], dim

I d ≤ n+d-1 d .
Definition 2.20. Let I = f 1 , . . . , f m be a homogeneous ideal. A finite set G is a d-Gröbner basis of I if it generates I and if any of the following equivalent statements hold:

• ∀g 1 , g 2 ∈ G, S(g 1 , g 2 ) G = 0 as long as deg S(g 1 , g 2 ) ≤ d, • every f ∈ I with deg(f ) ≤ d is top-reducible by G.
Note that a d-Gröbner basis is also a k-Gröbner basis for k ≤ d, so that a sequence G i of i-Gröbner bases is increasing. Thus, the ascending chain condition implies that G i is stationnary, i.e. there is a D such that G k = G D for any k ≥ D. Hence, for k ≥ D, a k-Gröbner basis is a Gröbner basis. An algorithm computing d-Gröbner basis can be derived from Buchberger's algorithm by only considering S-polynomials of degrees ≤ d.

To make the link between Gröbner bases and Gaussian elimination even clearer, one can represent the vector space I d by a matrix whose columns are indexed by the degree-d monomials of K[x 1 , . . . , x n ] (in decreasing order for ≺) and the rows by the degree-d multiples of the m generators of I. This was introduced by Macaulay in [START_REF] Macaulay | Some formulae in elimination[END_REF] and the matrix is named the degreed Macaulay matrix of I. It enables to perform operations in I by using linear algebra, and generalizes the notion of Sylvester matrix (see Definition 2.30, below).

Definition 2.21. A homogeneous polynomial f of degree d is generic if it can be written as

f = i 1 +•••+in=d U i 1 ,...,in x i 1 1 • • • x in n ,
where the U i 1 ,...,in are variables. In [START_REF] Lazard | Gröbner bases, Gaussian elimination and resolution of systems of algebraic equations[END_REF][START_REF] Lazard | Solving systems of algebraic equations[END_REF], Lazard performs Gaussian elimination to the degree-d Macaulay matrices for d ≤ D. This yields a D-Gröbner basis, which is a Gröbner basis for D large enough. From the maximal degree of polynomials appearing in the computations and the size of the Macaulay matrix of that degree, one can deduce a complexity bound for Lazard's algorithm. However, as in Buchberger's algorithm, we expect this algorithm to perform many unnecessary reductions to zero since the matrix has a rank much smaller than its size. Using the F5 criteria, it is possible to consider a much smaller matrix and design a matrix-based counterpart to the F5 algorithm [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases without reduction to zero (F5)[END_REF].

To construct the degree-d Macaulay matrix in the affine case, the columns are indexed by all the monomials of degree ≤ d and the rows by multiples of the f i 's by monomials such that the product has degree ≤ d. As previously, a d-Gröbner basis is computed by reducing the affine degree-d Macaulay matrix.

A similar method to find a solution of a polynomial system is to solve the linear system M X = 0 with M the Macaulay matrix of the system. We do not detail it further and refer to [START_REF] Courtois | Efficient algorithms for solving overdefined systems of multivariate polynomial equations[END_REF] for the introduction of XL and its application to cryptanalysis.

In the worst case, the cost of computing a Gröbner basis is doubly exponential in the number of variables (see [START_REF] Mayr | The complexity of the word problems for commutative semigroups and polynomial ideals[END_REF]), but this bound was reached using tailored systems and is pessimistic even for random inputs. In fact, most systems that we encounter have particularities that make them even simpler to solve. Indeed, we seldom want to solve random polynomial systems but rather focus on examples coming from specific contexts. In our case, the ideals that we consider are zero-dimensional by nature, a special case for which the complexity drops to simply exponential.

In the overdetermined case, the following theorem states that the maximal degree is at least twice smaller than the Macaulay bound. Theorem 2.24. [START_REF] Szanto | Multivariate subresultants using Jouanolou matrices[END_REF] Let f 1 , . . . , f n+1 be a generic system (i.e. the coefficients of the f i 's are parameters) of respective degrees d 1 , . . . , d n+1 in K[x 1 , . . . , x n ]. Then the Macaulay resultant of the homogeneized system can be computed from a Macaulay matrix of degree at most n+1 i=1 (d i -1) + 1 /2. The Macaulay bound gives a dependency of the complexity in the arithmetic mean of the degrees of the equations. On the other hand, one can wish for results involving their geometric mean given by the following theorem due to Lakshman and Lazard.

Theorem 2.25. [89, Th. 1] There exists a probabilistic algorithm which, given a zero-dimensional system, computes a Gröbner basis of its radical over the field of coefficients in time polynomial in the Bézout bound i = 1 n d i .

The remainder of the section presents a tighter complexity estimate from [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF], when further assumptions are made on the system. These assumptions guarantee that all the trivial reductions in Buchberger's algorithm are avoided using the F5 criteria. Definition 2.26 (Regular sequence). [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF]Def. 1.7.1] Let f 1 , . . . , f m be a sequence of homogeneous polynomials in K[x 1 , . . . , x n ]. We say that the sequence is regular if the following conditions hold (Hyp. 1) the sequence f 1 , . . . , f m is regular (Hyp. 2) for any 1 ≤ i ≤ m, the ideal f 1 , . . . , f i is in Noether position. Define g d,i (n) as the coefficient of z d in the expansion of

• f 1 , . . . , f m = K[x 1 , . . . , x n ] • for 2 ≤ i ≤ m, if g i f i ∈ f 1 , . . . , f i-1 , then g i ∈ f 1 , . . . , f i-
z d i (1 -z) i-1 i-1 k=1 (1 -z d k ).
The g d,i (n) bound the number of degree-d polynomials in the Gröbner basis of f 1 , . . . , f i for the grevlex ordering [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF]Th. 3.4.1] . The previous expression is in fact a polynomial whose degree equals the Macaulay bound i j=1 (d j -1) + 1.

Theorem 2.29. [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF]Th. 3.4.2] Under Hypotheses 1 and 2, there exists an algorithm to compute the Gröbner basis of f 1 , . . . , f m which performs a total number of elementary operations bounded by

m-1 i=1 ∞ d=0 g d+d i+1 ,i+1 (n) i + d + d i+1 d + d i+1 n + d + d i+1 -1 d + d i+1 .
This result is achieved using a variant of the F5 algorithm, and although it is not easily compared to other complexity bounds, it is instantiated in particular cases in [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF][START_REF] Bardet | On the complexity of the F5 Gröbner basis algorithm[END_REF] in which a simpler complexity bound is derived and indeed yields an improvement over that of Lazard's algorithm. As explained in [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF], these bounds where notably used for solving equations over F 2 and in particular attacking the public-key system HFE, as well as decoding codes. In our setting however, the regularity hypotheses fail and the complexity bound is not tight enough, just as the Bézout bound.

Although Gröbner bases are a powerful tool for polynomial system solving, we cannot use them to derive asymptotic complexity estimates because only the most general and pessimistic complexity bounds apply to our setting. In particular, the Bézout bound is much too large for our purpose as it does not take into account the fact that most variables come with a small degree, contrary to its multihomogeneous counterpart. In practice however, we will see in Chapter 6 that they are particularly efficient to solve trivariate systems. The next two sections review alternative options for which we have tighter complexity estimates, and Section 2.4 presents a method to achieve a polynomial-time complexity in the multihomogeneous Bézout bound, which is the cornerstone of Chapter 5.

Resultant-based approaches 2.3.1 Resultants and elimination

Definition 2.30. Let m and n be two positive integers, and

P = a 0 X m + • • • + a m and Q = b 0 X n + • • • + b n be two polynomials in K[X]. We define Syl(P, Q) the Sylvester matrix of P and Q as                 a 0 a 1 • • • a m a 0 a 1 • • • a m . . . • • • . . . a 0 a 1 • • • a m b 0 b 1 • • • b n b 0 b 1 • • • b n . . . • • • . . . b 0 b 1 • • • b n                 .
Definition 2.31. The resultant of P and Q, denoted Res(P, Q) or Res X (P, Q) is the determinant of the Sylvester matrix defined above.

There is a strong link between resultants and GCD, as the last non-zero row of the rowechelon form of Syl(P, Q) contains the coefficients of a GCD of P and Q. In particular, the degree of GCD(P, Q) is the corank of Syl(P, Q) and we have the following result: Proposition 2.32. The polynomials P and Q are coprime if and only if Res(P, Q) = 0.

There is an extensive literature on the numerous properties of the resultant, but we only detail those we will reuse. For more information on the subject, we refer for instance to [START_REF] Apéry | Élimination : le cas d'une variable. Hermann, Collection Méthodes[END_REF].

Let us now remark that it is possible to define resultants even when the coefficient ring is not a field, and in particular when

P and Q live in R[X] with R = K[Y ]. In that case, Res X (P, Q) is a polynomial in Y but no
longer in X and we expect that the previous proposition still holds, i.e. that the solutions of

P (X, Y ) = Q(X, Y ) = 0 satisfy Res X (P, Q)(Y ) = 0.
If so, by adding either the equation P (X, Y ) = 0 or Q(X, Y ) = 0 we have put the system in triangular form. However, the following proposition shows that those two systems are not equivalent since we may have added additional solutions. Proposition 2.33 (Prop 6.4, [START_REF] Bostan | Algorithmes efficaces en calcul formel[END_REF]). Let m and n be two positive integers,

P = a 0 X m + • • • + a m and Q = b 0 X n + • • • + b n be two polynomials in (K[Y ])[X],
with K an algebraically closed field. Then the roots of Res X (P, Q) ∈ K[Y ] are the y-coordinates of the solutions of the system P = Q = 0 and the common roots of the leading coefficients a 0 (Y ) and b 0 (Y ).

In our bivariate example, we eliminated a variable using a resultant and then carried on one of the initial equations to have a triangular system. In many cases and in particular in the one encountered in Chapter 3, the additional equation can be "nicer", i.e. of the form S 1 (Y )X -S 0 (Y ). Such an equation is given by one of the subresultants defined below. Definition 2.34 (Subresultant matrix [START_REF] Terui | Recursive polynomial remainder sequence and its subresultants[END_REF]). Let m, n and j be three positive integers, and

P = a 0 X m + • • • + a m and Q = b 0 X n + • • • + b n be two polynomials in K[X]
. We define the j-th subresultant matrix of P and Q as the (n + m -2j) × (n + m -j) submatrix N (j) (P, Q) of the Sylvester matrix by taking the top m -j rows of coefficients of P and the top n -j rows of coefficients of Q.

                a 0 a 1 • • • a n a 0 a 1 • • • a n . . . . . . . . . a 0 • • • a n b 0 b 1 • • • b m b 0 b 1 • • • b m . . . . . . . . . b 0 • • • b m                            m -j            n -j .
Definition 2.35 (Subresultant [START_REF] Terui | Recursive polynomial remainder sequence and its subresultants[END_REF]). Keeping the notation of the previous definition, for k ≤ j, we further define N (j) k (P, Q) as the (square) submatrix of N (j) (P, Q) obtained by taking only its rightmost m + n -2k -1 columns and its (m + n -j -k)-th column. The j-th subresultant of P and Q is then defined as the polynomial

j k=0 det N (j) k X k .
Considering P and Q in K[X, Y ], one can define the bivariate resultants and subresultants except that the coefficients a i and b j are now polynomials in (say) Y . Thus, the bivariate resultant R(Y ) = Res X (P, Q) is now a univariate polynomial and the j-th subresultant is a bivariate polynomial of degree at most j in X. If the first subresultant of P and Q is nonzero, then it has degree 1 in X so that we can write it S 1 (Y )X + S 0 (Y ) with S 1 a non-zero univariate polynomial. Since the resultant and subresultants of P and Q are all in the ideal generated by P and Q, the system

P (X, Y ) = Q(X, Y ) = 0 is equivalent to the system {R(Y ) = 0, S 1 (Y )X + S 0 (Y ) = 0}.
Let us consider P and

Q in K[x 1 , . . . , x n ], which we view as R[X] = K[x 2 , . . . , x n ][X]
. We can likewise define the Sylvester matrix and resultant Res

x 1 (P, Q) ∈ K[x 2 , . . . , x n ].
As in the bivariate case, we eliminate the variable x 1 but the resultant is not necessarily a generator of the first elimination ideal. However, we will see in Chapter 6 that successive elimination by resultants is still accurate enough for us to use it in the trivariate case with an asymptotic complexity that matches that of more sophisticated methods. In the remainder of the section, we give more details about the complexity of computing resultants of polynomials in up to three variables.

Computing univariate resultants

Consider P and Q two univariate polynomials over K. To compute Res(P, Q), an algorithm that comes in mind would be computing the determinant of the Sylvester matrix. This can be done in O(n ω ), where n is a bound on the degrees of P and Q and ω < 2.38 the exponent of linear algebra. Using the fact that Res(P, Q) = (-1) mn b m-r 0 Res(Q, R) with R the remainder of the Euclidean division of P by Q, one can design a algorithm that returns Res(P, Q) in time quadratic in n. The subresultants can similarly be related to (variations of) Euclid's algorithm by the fundamental theorem of subresultants (see for instance [START_REF] Terui | Recursive polynomial remainder sequence and its subresultants[END_REF]Th. 3.4.]).

In general, by following Euclid's algorithm, we have a sequence of polynomials whose degrees decrease by one at each step so that n steps are needed and the complexity is indeed quadratic. However, one can imitate the half-GCD algorithm to halve the degree at each step. This yields a quasi-optimal algorithm for computing the resultant and the last non-zero subresultant of two univariate polynomials P and Q.

Properly presenting a fast algorithm for computing the resultant of two polynomials along with their last non-zero subresultant is not a challenge that we want to take in this thesis, insomuch as we did not contribute on this aspect. We therefore limit ourselves to stating the following theorem, which is the only statement about (sub)resultants that will be needed throughout this thesis.

Theorem 2.36 (Computing resultants and subresultants). [START_REF] Bostan | Algorithmes efficaces en calcul formel[END_REF]Prop. 6.15 & Thm. 6.16] Let P and Q be two univariate polynomials in K[X] of degrees bounded by n > 0. Then Res(P, Q) can be computed in time and space O(n), and so can any subresultant of P and Q.

For our purpose, we will also need to compute bivariate and trivariate (sub)resultants, for which the existence of a quasi-optimal algorithm is still an open problem. In the next section, we give complexity bounds for computing these resultants by using evaluation / interpolation schemes to reduce to the univariate case.

Bivariate and trivariate resultants

In Chapters 3 and 6, we put the equations of the -torsion ideal in triangular form by successively eliminating variables using resultants. In this section, we bound the complexity of computing bivariate and trivariate resultants. We also provide bounds on the degrees of the resultants, either because they intervene in another complexity result or for the following reason: we have seen that the resultant of two polynomials belongs to the elimination ideal but there is no guarantee that it is a generator, and it can even be zero. This gives rise to extraneous solutions of our system that we are not interested in and that we call parasites. When the resultants are not zero, bounding their degrees is a way of controlling the number of parasites. In our case, we can use this to ensure that parasites do not harm the asymptotic complexity. On the other hand, they are not innocuous in practice and part of Chapter 3 is dedicated to reducing their number.

Definition 2.37 (Evaluation-Interpolation).

Given n distinct elements a 0 , . . . , a n-1 in a field K, and P ∈ K[X] a polynomial of degree < n, we call (multipoint) evaluation the computation of P (a 0 ), . . . , P (a n-1 ).

Conversely, given b 0 , . . ., b n-1 , n additional elements of K we call interpolation the computation of a polynomial P of degree < n such that P (a 0 ) = b 0 , . . . , P (a n-1 ) = b n-1 .

Theorem 2.38. [START_REF] Bostan | Algorithmes efficaces en calcul formel[END_REF]Th. 5.1] Given n distinct field elements a 0 , . . . , a n-1 , one can perform the multipoint evaluation or the interpolation in O(n) field operations.

Note that when K = F q , we may not have enough distinct points to perform evaluation or interpolation of a polynomial of large degree. However, when it is the case, we can take a field extension F q δ of F q , and that will add a factor O(δ) to the complexity. The complexity of the algorithms will be polynomial in the number of evaluation points, therefore, the final complexity will be logarithmic in δ, so that the cost of taking a field extension will be hidden in the O() notation. We will therefore not mention this potential complication further.

Another difficulty is that an evaluation / interpolation strategy assumes that the points of evaluation are generic enough, so that all the degrees after evaluation are generic. This is again guaranteed by taking a large enough base field. Still, the algorithm remains a Monte-Carlo one. In Chapters 3 and 6, the final results of our algorithms can readily be tested, which is why they are Las Vegas even though they involve resultants-based primitives that are not. Proof. The Sylvester matrix has at most 2d columns and its entries are bivariate polynomials whose degrees in y and z are bounded by d. Thus, its determinant is a polynomial whose degrees in y and z are bounded by 2d 2 . We first perform a Kronecker substitution by considering P (x, y) = P (x, y, y 2d 2 +1 ) and Q(x, y) = Q(x, y, y 2d 2 +1 ), which are polynomials of degrees ≤ d in x and ≤ 2d 3 + d in y. Note that the choice to replace z by y 2d 2 +1 is made to be able to invert the Kronecker substitution after the resultant computation.

Next, we compute R(y) = Res x ( P (x, y), Q(x, y)). By Lemma 2.39, it is a univariate polynomial of degree at most 4d 4 + 2d 2 and can be computed in O(d 5 ) operations. We can then invert the Kronecker substitution to get R(y, z), which can be done in time linear in the number of monomials, that is in O(d 4 ). Proposition 2.39 has remained unimproved for several decades, however Villard has recently announced [START_REF] Villard | On computing the resultant of generic bivariate polynomials[END_REF] that given two generic bivariate polynomials P and Q in K[x, y], the bivariate resultant Res x (P, Q) can be computed in O (d (1) field operations. Since the computations of resultants are the bottleneck of the algorithms presented in Chapters 3 and 6, this new algorithm may have a direct impact on their complexity bounds. We discuss this in the dedicated chapters and sum up the impact of these new bounds in the conclusion.

(2-1/ω) x d y ) 1+o

Geometric resolution 2.4.1 Bézout bound and multihomogeneity

We expect the complexity of solving polynomial systems to depend on n the number of variables, m the number of equations, their respective degrees and possibly also their number of solutions. The number of solutions greatly depends on the system itself and cannot be predicted. However, it is possible to bound it by the previous data, which is the point of the following definition. This bound was introduced by Bézout to study the number of points of intersection between two curves, but it can be generalized as follows: Theorem 2.41 (Bézout's theorem). Let f 1 , . . . , f n be n homogeneous polynomials in n + 1 variables of respective degrees d 1 , . . . , d n . Then either the number of projective solutions counted with multiplicities (in the algebraic closure) is infinite or equal to the product

d 1 • • • d n .
We will see later that this bound plays a role in complexity results, but we anticipate that it will not satisfy our needs and we therefore introduce a sharper bound for more structured systems.

Definition 2.42 (Multihomogeneous system).

A multihomogeneous polynomial f is a polynomial such that there exists a partition of the variables in subsets on which the polynomial is homogeneous. If d i is the degree of the homogeneous polynomial with respect to the i-th subset of variables, the sequence

(d i ) is called the multi-degree of f . For example, on K[x 1 , . . . , x nx , y 1 , . . . , y ny ] a bihomogeneous polynomial f of bidegree d 1 , d 2 is such that ∀λ, µ ∈ K, f (λx 1 , . . . , λx nx , µy 1 , . . . , µy ny ) = λ d 1 µ d 2 f (x 1 , . . . , x nx , y 1 , . . . , y ny ).
Definition 2.43 (Multi-degree). We extend this notion to non-homogeneous polynomials by defining the multi-degree of a polynomial f with respect to a partition of the variables as the tuple (d i ) where d i is the degree of f in the variables of the i-th block, when all the other variables are evaluated at a generic value. Definition 2.44. [START_REF] Morgan | A homotopy for solving general polynomial systems that respects m-homogeneous structures[END_REF] Let

F = {f 1 , . . . , f m } be a non-homogeneous system on K[X 1 , . . . , X n ],
where each X i = (x i,1 , . . . , x i,n i ) is a tuple of variables and let d j,1 , . . . , d j,n be the multi-degree of f j with respect to the X i 's. The multihomogeneous Bézout number of F is defined as the coefficient of n i=1 T n i i in the product

m j=1 n i=1 d j,i T i .
Theorem 2.45. [START_REF] Morgan | A homotopy for solving general polynomial systems that respects m-homogeneous structures[END_REF] Consider F as above, then it has no more isolated solutions than its multihomogeneous Bézout number d.

This bound is much more convenient than the original Bézout bound when dealing with a system which has a large number of variables appearing with small degree and a small number of variables appearing with large degree. In Chapter 5 we encounter systems of O(g 2 ) variables with only g variables of "large" degree δ. In this context, the Bézout bound is in δ O(g 2 ) versus δ O(g) for its multihomogeneous counterpart. The reason why these bounds appear in the complexity is detailed later on: we will see in Section 2.4 that the cost of computing a geometric resolution is polynomial in the maximum of the degrees of intermediate ideals, as defined below. However, contrary to the Bézout bound which is readily computable from the input system, computing the degree of an ideal is not straightforward. When the input system is generic enough (i.e. when it is a regular sequence as in Definition 2.26), the degrees of the intermediate ideals can be bounded by the (multihomogeneous) Bézout bound.

Definition 2.46 (Degree of an ideal). By identifying a point

(λ 0 , . . . , λ n ) ∈ K n+1 with the polynomial λ 0 + λ 1 X 1 + • • • + λ n X n ∈ K[X 1 , . . . , X n ], there is a dense Zariski open subset O ⊂ (K n+1 ) dim V (I) such that for any ( 1 , . . . , dim V (I) ) ∈ O, the algebra K[X 1 , . . . , X n ]/(I + Definition 2.47 (Reduced sequence). The sequence (f 1 , . . . , f i ) is reduced if every intermediate ideal f 1 , . . . , f j with j ∈ [1, i] is radical. Proposition 2.48. Let f 1 , . . . , f m be a regular sequence in F q [X 1 , . . . , X nx , Y 1 , . . . , Y ny ] and d x , d y ∈ Z ≥0 be such that for any i ∈ [1, m], deg x (f i ) ≤ d x and deg y (f i ) ≤ d y .
Then the degree of the ideal f 1 , . . . , f m is at most

j 1 +j 2 =m 0≤j 1 ≤nx 0≤j 2 ≤ny m j 1 d j 1 x d j 2 y . (2.1)
Moreover, this degree is bounded above by

2 nx+ny d nx x d ny y .
Proof. This is a direct consequence of [123, Prop. I.1] using, with the notation of [123, Prop.

I.1], k = 1, e = 0, P = m, D i,0 = d x , D i,1 = d y , n = n x , n 1 = n y . Note that [123, Prop. I.1]
is stated when the base field is C, but the proof works without any major modification when the base field is a finite field. The last sentence of the statement follows from the fact that the regularity assumption implies that m ≤ n x + n y , and hence the sum of the binomial coefficients is bounded above by 2 m ≤ 2 nx+ny .

Geometric resolutions

Contrary to the previous two sections, we no longer work with multivariate polynomials in dense representation but as programs describing which operations to perform to evaluate them. We call that a straight line program (SLP) and give a more precise definition of particular instances of SLP.

Definition 2.49 (Division-free SLP). A division-free SLP (DFSLP) defined over a field K is a sequence of polynomials h

1 , h 2 , . . . , h ∈ K[X 1 , . . . , X n ] such that each polynomial h i is either a variable X t with t ∈ [1, n],
an element in K, or h i = h j • h j , where j, j < i and • ∈ {+, -, ×} is an arithmetic operation. The time of a DFSLP is the total number of arithmetic operations, and its space is the minimal number of arithmetic registers required to evaluate it. A polynomial system f 1 , . . . , f m is said to be represented by a DFSLP h

1 , . . . , h if {f 1 , . . . , f m } ⊂ {h 1 , . . . , h }.
The following lemma gives a bound on the size of a DFSLP needed to represent a bihomogeneous polynomial: For describing 0-dimensional (i.e. finite) sets V ⊂ F q n where V is defined over F q , we use a data structure called a geometric resolution of V . The terminology here is borrowed from [START_REF] Cafure | Fast computation of a rational point of a variety over a finite field[END_REF],

Lemma 2.50. Let d x , d y ∈ Z >0 be two positive integers. A polynomial system f 1 , . . . , f m ∈ F q [X 1 , . . . , X nx , Y 1 , . . . , Y ny ] such that for all i ∈ [1, m], deg x (f i ) ≤ d x and deg y (f i ) ≤ d y can
monomials µ in F q [X 1 , . . . , X nx , Y 1 , . . . , Y ny ] such that deg x (µ) ≤ d x
see also [START_REF] Giusti | A Gröbner free alternative for polynomial system solving[END_REF]. The following definition is slightly simpler than the one in [25, Sec. 2.1] because we restrict ourselves to the 0-dimensional case in the whole thesis (in [25, Sec. 2.1], the definition is also valid for equidimensional varieties with positive dimension).

Definition 2.51 (Geometric resolution). We say that an

F q e -geometric resolution of V is a tuple (( 1 , . . . , n ), Q, (Q 1 , . . . , Q n ))
where:

• The vector ( 1 , . . . , n ) ∈ F n q e is such that the linear form

: F q n → F q (x 1 , . . . , x n ) → n i=1 i x i
takes distinct values at all points in V . The linear form is called the primitive element of the geometric resolution;

• The polynomial Q ∈ F q e [T ] equals x∈V (T -(x)); • The polynomials Q 1 , . . . , Q n ∈ F q e [T ] parametrize V by the roots of the polynomial Q, i.e. V = {(Q 1 (t), . . . , Q n (t)) | t ∈ F q , Q(t) = 0}.

Computing geometric resolutions

Following [START_REF] Giusti | A Gröbner free alternative for polynomial system solving[END_REF], we present the main aspects of the computation of a geometric resolution. Let us consider {f 1 , . . . , f n } a system of homogeneous polynomials in K[X 0 , . . . , X n ] such that the f i 's form a reduced regular sequence, along with an inequation g = 0. The general idea is to take the equations into account one by one, deducing a geometric resolution of the ideal

I i+1 = f 1 , . . . , f i+1 from a geometric resolution of I i = f 1 , . . . , f i .
Let us assume that we already have a geometric resolution for I i , that is a description of the system

S i = {x 1 , . . . , x n-i , f 1 , . . . , f i } in the form q(T ) = 0,              x n-i+1 = T x n-i+2 = v n-i+2 (T ),
. . .

x n = v n (T )
The lifting step consists of computing a description of the system

x 1 = • • • = x n-i-1 = f 1 = • • • = f i = 0, g = 0,
in the form

Q(x n-i , T ) = 0,              x n-i+1 = T x n-i+2 = W n-i+2 (x n-i , T ), . . . x n = W n (x n-i , T )
This step can be seen as seeing the variable x n-i as a parameter of the geometric resolution, and a solution of S i can be seen as an approximated solution of the above system at precision O(x n-i ). By the Newton method, this solution can be lifted at precision O(x 2 n-i ), and the process can be repeated until the precision is sufficient to have an exact resolution. This is achieved when the precision becomes greater than the degree of the variety. At the end of the lifting step, the equation f i+1 = 0 is still not taken into account. This is the point of the so-called intersection step and it is achieved as follows. First, introduce a new variable X and perform the change of variable in K

[[t]] x n-i = X -tx n-i+1 + O(t 2 ),
in the previous system. This yields

Q t (X, T ) = 0,              x n-i+1 = T x n-i+2 = V t,n-i+2 (X, T ),
. . .

x n = V t,n (X, T )
With Q t a polynomial in X and T and the V t,j 's are polynomials in T and rational fractions in X with coefficients in K

[[t]] at precision O(t 2 ). Let us now compute A(X) = Res T (Q t (X, T ), f i+1 (0, . . . , 0, X -tT, T, V t,n-i+2 (X, T ), . . . , V t,n (X, T ))). This resultant is in K[X] [[t]] and substituting X = x n-i + tx n-i+1 in A(X) = a 0 (X) + ta 1 (X) + O(t 2 ), we get a 0 (x n-1 ) = 0, a 0 (x n-i )x n-i+1 + a 1 (x n-i ) = 0.
Therefore, we have the following geometric resolution for S i ∪ {f i+1 = 0}:

a 0 (T ) = 0,                        x n-i = T, x n-i+1 = - a 1 (T ) a 0 (T ) = V n-i+1 (T ),
. . .

x n = W n - a 1 (T ) a 0 (T ) , T = V n (T ).
This is not completely satisfying as we must still remove the potential solutions contained in the hypersurface g = 0. This is the cleaning step and consists essentially of replacing a 0 (T ) by a 0 (T )/c(T ), where

c(T ) = GCD T (a 0 , g(0, . . . , 0, T, v n-i+1 , . . . , v n )).

Complexity bounds

Theorem 2.52. [START_REF] Giusti | A Gröbner free alternative for polynomial system solving[END_REF]Th. 1] Let K be a field of characteristic 0 and let f 1 , . . . , f n , g be polynomials in K[x 1 , . . . , x n ] of degree bounded by d and given in SLP representation of size at most L. Assume furthermore that the f i 's define a reduced regular sequence in the open subset {g = 0}. The geometric resolution of the variety

V ( f 1 , . . . , f n ) \ V ( g ) can be computed with O n(nL + n ω )M(dδ) 2 field operations, where ω < 2.38 is the exponent of linear algebra, δ = max i=1,...,n deg( f 1 , . . . , f i ) and M(N ) = O(N log 2 N log log N ).
For our purposes, the main result to remember is that one can compute a geometric resolution in time polynomial (actually quadratic) in the (multi-homogeneous) Bézout bound. Note that this result does not apply to our setting, but the following theorem gives a similar statement for finite fields of sufficiently large size.

Theorem 2.53. [START_REF] Cafure | Fast computation of a rational point of a variety over a finite field[END_REF]Thm. 4.8] Let f 1 , . . . , f n ∈ F q e [x 1 , . . . , x n ] be a reduced regular sequence, where the polynomials are represented by a DFSLP with space S and time T . Set the following notation:

• The integer d is max i∈[1,n] (deg f i );
• For any real number x ≥ exp(1), U(x) = x(log x) 2 log log x;

• Let δ ∈ Z ≥0 be an integer larger than the degrees of the ideals

f 1 , f 1 , f 2 , . . . , f 1 , . . . , f n .
Assume further that q e ≥ 60 n 4 dδ 4 . There is a probabilistic Turing machine using space O((S + n + d)δ 2 log(q e δ)) and time O((nT + n 5 )U(δ)(U(dδ) + log(q e δ))U(log(q e δ))) which takes such polynomial systems as input and which outputs an F q e -geometric resolution of the algebraic set

{x ∈ F q e n | f (M ) 1 (x) = • • • = f (M ) n (x) = 0} with probability at least 11/12.
The above complexity estimates derive from two costly steps: the lifting and the intersection. The former's complexity is essentially due to the cost of computing a Newton lift at precision δ and the latter's bottleneck is the computation of the resultant A. The regularity assumption on the input system ensures that we have an invertible Jacobian matrix to perform the Newton iterations. We do not investigate further and refer the interested reader to [START_REF] Giusti | A Gröbner free alternative for polynomial system solving[END_REF][START_REF] Cafure | Fast computation of a rational point of a variety over a finite field[END_REF] for more details.

Chapter 3

Counting points on genus-2 curves

In this chapter, we investigate genus-2 extensions of Schoof's algorithm both in theory and practice, along with their applications in cryptography. Like elliptic curves, Jacobians of hyperelliptic curves are ideal candidates for cryptographic groups. However, some attacks were designed for Jacobians of curves of genus ≥ 3 and while these attacks remain exponential, they imply a less advantageous ratio between key-length and security level. For genus-2 curves, this ratio is comparable to elliptic curves and by using the Kummer surface associated to the curve rather than its Jacobian, a genus-2 Diffie-Hellman protocol detailed in [START_REF] Renes | µKummer: Efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF] can be made faster than its elliptic analogue [START_REF] Victor | Use of elliptic curves in cryptography[END_REF][START_REF] Daniel | Curve25519: new Diffie-Hellman speed records[END_REF] thanks to more efficient arithmetic operations designed in [START_REF] Gaudry | Fast genus 2 arithmetic based on theta functions[END_REF]. More recently, a signature scheme based on Kummer surfaces of genus-2 curves was designed in [START_REF] Renes | qDSA: Small and secure digital signatures with curvebased Diffie-Hellman key pairs[END_REF]. Almost all the results presented here were already known before the beginning of this thesis, so this section can be considered as a warm-up for Chapters 5 and 6 as we focus on parts of the algorithm that we extend later to hyperelliptic curves of larger genera. Although Pila's algorithm [START_REF] Pila | Counting points on curves over families in polynomial time[END_REF] already yields a polynomial-time algorithm for counting points on genus-2 curves, the first practical attempt was made in 2000 [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF] by combining three different methods. First, using the Cartier-Manin operator, χ mod p can be computed provided that the characteristic p is not too large. Since this relates to p-adic methods and will not be used in this thesis, we do not explore this approach and focus on the two other points: the computation of χ mod for small primes in the spirit of Schoof's algorithm, and the reconstruction of χ exploiting previous modular knowledge by a baby-step giant-step (BSGS) algorithm. By then, it was already possible to count points on a curve over a 63-bit prime field (i.e. in a 126-bit Jacobian) in about two CPU-months. However, generating a Jacobian of cryptographic size requires much heavier computations that were made possible in [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF] by introducing numerous practical optimizations.

In Section 3.1, we first give an overview of these algorithms along with their complexity estimates. Section 3.2 reviews practical improvements taken mostly from [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF] and how they were used to compute a cryptographic Jacobian of size 256 bits, i.e. with a 128-bit security level. A recent note by the NSA [START_REF]Use of public standards for the secure sharing of information among national security systems[END_REF] advised to upgrade the security level of curve-based protocols to 192 bits, casting doubt about possibly more efficient yet still exponential attacks on ECDLP. While finding elliptic curves with this security level is not a problem, it seems quite a challenge in genus 2. With this motivation in mind, Section 3.1.2 focuses on genus-2 curves with real multiplication (RM) and how this property is used in [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF] to speed-up point-counting. For non-RM curves, Section 3.3 surveys prospective improvements and ongoing research that could make it possible to design genus-2 curves that offer a 192-bit security level.

Genus-2 extensions of Schoof's algorithm

In this section, C is a genus-2 hyperelliptic curve over a finite field F q of characteristic p > 2 given by an equation y 2 = f (x), with f monic squarefree of degree 5. The Jacobian of C is denoted by J C or simply by J when there is no ambiguity. The Frobenius endomorphism is denoted by π and the characteristic polynomial of its action by either χ or χ π when there is need for disambiguation.

The Gaudry-Harley-Schost algorithms

We now briefly instantiate properties of hyperelliptic curves from Chapter 1 in genus 2. First, recall that the characteristic polynomial of π has the form

χ(t) = t 4 -s 1 t 3 + s 2 t 2 -s 1 qt + q 2 .
Hence, by the Weil bounds, we are looking for the integers s 1 and s 2 which respectively satisfy

|s 1 | ≤ 4
√ q and |s 2 | ≤ 6q. To recover (s 1 , s 2 ), we compute them modulo for sufficiently many primes . Given a fixed , we compute an -torsion divisor D ∈ J[ ] and test whether -s 1 (π 3 (D) + qπ(D)) and π 4 (D) + s 2 π 2 (D) + (q 2 mod )D coincide. If there is only one couple (s 1 , s 2 ) satisfying this condition, then we can deduce χ mod and move to the next . Were it not the case, we apply the same procedure to another torsion divisor D to further reduce the number of candidates for (s 1 , s 2 ) until only one remains.

Let us now switch to the problem of computing a torsion element. In genus 2, an element of J is either the neutral element P ∞ , the image P -P ∞ of a point on C, twice the image of a point 2(P -P ∞ ) or, in most cases, a divisor D = P 1 + P 2 -2P ∞ with P 1 = ±P 2 . In the latter case, we call such a divisor a "generic" divisor. In general, C does not have a rational torsion point so that we only look for torsion elements of the last form. In fact, even if there were non generic divisors other than the neutral element in J[ ], Kampkötter showed in [START_REF] Kampkötter | Explizite gleichungen für Jacobische varietäten hyperelliptischer kurven[END_REF] that generic divisors generate J[ ] so that it does no harm to miss potential non-generic elements. In genus larger than 2, we do not know of any similar result and although we still expect torsion divisors to be generic, we will have to consider some degenerate cases.

Let us consider a generic divisor D = P 1 +P 2 -2P ∞ , with P i = (x i , y i ) and write a polynomial system enforcing the fact that D is in J[ ]. If D = 0, then (P 1 -P ∞ ) = -(P 2 -P ∞ ). We denote by u i , v i the respective Mumford forms of both terms, then D = 0 is equivalent to u 1 = u 2 and v 1 = -v 2 . To develop further, we give a description of the u i and v i , which is a genus-2 version of the division polynomials defined in [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF].

Proposition 3.1. Using the above notation and setting

D i = P i -P ∞ , there exist univariate polynomials d 0 , d 1 , d 2 , e 0 , e 1 , e 2 in F q [x] such that for ≥ 3, the Mumford form u i , v i of D i is given by u i (X) = X 2 + d 1 (x i ) d 2 (x i ) X + d 0 (x i ) d 2 (x i ) , v i (X) = y i e 2 (x i ) (e 1 (x i )X + e 0 (x i )) .
In the particular case of genus-2 curves, it is known that the respective degrees of these polynomials are 2

2 -1, 2 2 -2, 2 2 -3, 3 2 -1, 3 2 -2 and 3 2 -3.
Rewriting the equality of the u i , we get the following system in the variables x 1 , x 2 :

E 1 (x 1 , x 2 ) = d 1 (x 1 )d 2 (x 2 ) -d 1 (x 2 )d 2 (x 1 ) = 0, E 2 (x 1 , x 2 ) = d 0 (x 1 )d 2 (x 2 ) -d 0 (x 2 )d 2 (x 1 ) = 0. (3.1)
This system is put in triangular form by computing R(x 1 ) = Res x 2 (E 1 , E 2 ) and replacing one of the equations by R(x 1 ) = 0. Before doing so, one must actually remove a factor (x 1 -x 2 ) that appears in both E 1 and E 2 to avoid having R = 0. This factor is due to the fact that if x 1 = x 2 , then we have P 1 = ±P 2 , thus (P 1 -P ∞ ) = ± (P 2 -P ∞ ) and therefore u 1 = u 2 . This is an example of solutions to our system that do not yield useful information on J[ ], we call them parasites and investigate them later on. Apart from that factor which threatened the validity of our algorithm, other parasites only increase the complexity by a constant factor. In larger genus, many more degenerate cases can occur so that a thorough analysis of those parasites is required.

Once the resultant is computed, a torsion point can be reconstructed as follows: find a root x 1 of R, possibly in an extension of F q . From the other equation in x 1 and x 2 , deduce a value for x 2 . Then, there are only four possibilities for (y 1 , y 2 ), pick one of them to deduce two points P 1 and P 2 and finally test whether any of the combinations P 1 ± P 2 leads to a torsion divisor. If it is not the case, then x 1 was a root of a parasite factor of R, so we have to consider another root. The same can be done if x 1 leads to a torsion divisor for which there are still several candidates for (s 1 , s 2 ) mod .

Actually, it may happen that even after checking the whole -torsion we may end up with more than one candidate for (s 1 , s 2 ). When this is the case, one must remember that the (s 1 , s 2 ) correspond to polynomials that annihilates the Frobenius action. Computing their GCD, we can first deduce a multiple of its minimal polynomial. Luckily, the degree and roots of that polynomial are enough information to recover the actual characteristic polynomial χ mod . Since this is unlikely, we do not detail that subtlety and refer to [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF]Sec. 3.4] for that matter.

It is possible to eliminate all the parasites by taking into account all the equations and not only the first two. Writing that the v-coordinates of (P 1 -P ∞ ) and (P 2 -P ∞ ) have to be opposite amounts to the third equation

E 3 (x 1 , x 2 ) = e 1 (x 1 )e 2 (x 1 ) -e 1 (x 2 )e 2 (x 1 ). (3.2)
Then, one can compute R 1 = Res x 2 (E 1 , E 3 ) and apply the previous method to R = gcd(R, R 1 ) instead of R.

Following the D5 strategy of [START_REF] Della | About a new method for computing in algebraic number fields[END_REF] mentioned in Section 1.2.2.0, one could actually recover a triangular form of the -torsion ideal I , and perform operations in the quotient ring while handling the potential "forbidden divisions" by removing the vanishing factor from the univariate polynomial of the lex Gröbner basis of I . This approach was considered but not used in [START_REF] Gaudry | Construction of secure random curves of genus 2 over prime fields[END_REF] as the first strategy seems more efficient for primes smaller than 19. In [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF], the D5 strategy is preferred as goes up to 31.

To do so, we compute both the resultant and subresultant of the equations E 1 and E 2 to put the system in the form

S 0 (x 1 ) + x 2 S 1 (x 1 ) = 0, R(x 1 ) = 0.
Then, taking into account the equation E 3 , we clean up the parasites by computing R and the modular inverse S = S 0 /S 1 mod R. We can therefore represent the -torsion ideal by the base

y 2 2 -f (x 2 ) y 2 1 -f (x 1 ) x 2 +S(x 1 ) R(x 1 ).
Once given such a representation, it is no longer necessary to factor R, as one can consider a generic D = (x 1 , y 1 ) + (x 2 , y 2 ) -2P ∞ in F q [x 1 , x 2 , y 1 , y 2 ] and test the equation χ(D ) = 0 in F q [x 1 , x 2 , y 1 , y 2 ]/I . input : A genus-2 hyperelliptic curve C given by a monic squarefree f ∈ F q [x] of degree 5 output: The characteristic polynomial of the Frobenius w ← 1;

while w ≤ 12q do ← NextPrime( ) ; w ← w • ; Compute R(x 1 ) = Res x 2 (E 1 , E 2 ) and S 0 (x 1 ) + x 2 S 1 (x 1 ) = Subres x 2 (E 1 , E 2 ) ; R ← GCD(R, Res x 2 (E 1 , E 3 )); S ← S 0 /S 1 mod R; Deduce a basis for I ; Set D a generic divisor in F q [x 1 , x 2 , y 1 , y 2 ]/I ; Eliminate candidates (s 1 , s 2 ) ∈ (Z / Z) 2 for which χ(D ) = 0 ; Deduce (s 1 , s 2 ) mod ; end Perform a CRT to recover the actual (s 1 , s 2 ) ; return χ(t) = t 4 -s 1 t 3 + s 2 t 2 -s 1 qt + q 2
Algorithm 4: Genus-2 point counting algorithm from [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF][START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF][START_REF] Gaudry | Construction of secure random curves of genus 2 over prime fields[END_REF] We now follow the complexity analysis of [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF][START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF]. Note that [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF] originally proves a complexity in O(log 9 q) because it does not make use of fast arithmetic in F q . Theorem 3.2. [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF]Sec. 5.4] Algorithm 4 has a complexity in O(log 8 q) bit operations and a memory requirement in O(log 5 q). Proof. Compared to the rest of the algorithm, computing the genus-2 division polynomials takes negligible time and memory in practice: even a naive approach using the recurrence formulas of [28, Eq. (1.8)] and storing each -division polynomials yield a complexity in O( 3 log q) memory bits and O( 3 log q) binary operations (each step requires O(1) operations on polynomials over F q with degree in O( 2)) which is within the complexity bounds we aim for.

Computing the bivariate resultant R is done by an evaluation / interpolation scheme. The degrees of E 1 and E 2 in the x i are in O( 2) so that by Proposition 2.39 the polynomials R, S 1 , S 2 can be computed in O( 6) field operations using O( 4 ) interpolation points, i.e. O( 4 log q) bits of memory. Since we consider polynomials of degrees in O( 4), the GCD computations also fit within O( 4 ) field operations.

In the algebra F q [x 1 , x 2 , y 1 , y 2 ]/I , each operation costs O( 4 ) field operations and each element is stored on O( 4 log q) memory bits. Finding χ mod costs at most O( ) operations in the algebra F q [x 1 , x 2 , y 1 , y 2 ]/I and a constant number of Frobenius computations, which amounts to O( 4 (log q + )) field operations. During this step, only a fixed (i.e. independent of ) number of elements needs to be stored, hence a memory requirement in O( 4 log q) bits.

Since both the number of primes and the size of the largest to consider are in O(log q) and that each operation in F q has a bit complexity in O(log q), we deduce the final bit complexity in O(log 8 q) and a memory requirement of O(log 5 q) bits.

The complexity in O(log 8 q) bit operations is much larger than that of Schoof's algorithm in O(log 5 q) and the exponent is twice larger than that of the SEA algorithm. It is very challenging to get modular information on χ for prime numbers above 30, which is the reason why other strategies are used in practice to terminate the computations. This complexity analysis also reveals an interesting phenomenon: compared to Schoof's algorithm, applying powers of π to a generic torsion element is no longer the bottleneck in the genus-2 case. Indeed, the most costly step is the computation of a triangular form for the -torsion ideal. When g grows, it is even more conspicuous that this step is also the bottleneck of our generalizations of Schoof's algorithm.

Confronted with such a complexity bound, one may look for more favorable instances of the problem in which the bounds are more reasonable. For example, one would like to find Jacobians with "a smaller torsion". Unfortunately, such Jacobians cannot exist as they must satisfy Proposition 1.35. However, we will see in the next section that there exist families of curves whose torsion can be split into a direct sum of subspaces which are similar in size to the -torsion subgroup of an elliptic curve. Such subspaces correspond to ideals of smaller degrees than the -torsion ideal, and therefore putting them in triangular form is less costly than doing the same to the full -torsion.

The case of RM curves

In this section, we review how the previous point-counting algorithm can be adapted into a faster one when applied to families of curves that are equipped with a particular endomorphism. This is work of Gaudry, Kohel and Smith in [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF] and it will be extended to genus-3 curves in Chapter 6.

Since we consider hyperelliptic curves defined over F q , the Frobenius yields an endomorphism of their Jacobians, so that Z[π] ⊂ End(J). Furthermore, the dual π ∨ of the Frobenius endomorphism is also in End(J) hence any curve has RM by F = Q(π + π ∨ ) in the sense of Definition 1.40. However, this RM is not efficient because applying the endomorphism ψ = π + π ∨ to a point of C costs O(log q) operations in J as it involves q-th powers. Worse, this RM is not explicit in the sense that we do not have formulas to describe the action of ψ on the curve. For our purpose, we ask for curves with an additional endomorphism that is easy to compute in the sense of the following definition. Definition 3.3. Let η be a real element of a number field, and let C be a hyperelliptic curve with RM by Z[η]. We say that the real multiplication is explicit if we have explicit formulas to compute the Mumford form η(P -P ∞ ) for P = (x, y) the generic point on the curve C.

Remark Consider Q(π) the so-called CM-field of J, then the intersection Q(π) ∩ End Fq (A) is an order O of Q(π)
and hence it is a subring of the maximal order O Q(π) . By a result from [START_REF] Waterhouse | Abelian varieties over finite fields[END_REF], O also contains a "minimal order" as it has to contain

Z[π, π ∨ ].
Let us consider a genus-2 curve C with explicit RM by Z[η] as in Definition 3.3. Examples of such curves are given by the family C t : Y 2 = X 5 -5X 3 + 5X + t from [START_REF] Tautz | Explicit hyperelliptic curves with real multiplication and permutation polynomials[END_REF] with RM by

Z[ζ 5 + ζ -1
5 ], as well as other families due to Humbert and Mestre [START_REF] Mestre | Familles de courbes hyperelliptiques à multiplications réelles[END_REF]. They are detailed in [START_REF] Kohel | Efficiently computable endomorphisms for hyperelliptic curves[END_REF] along with examples of RM in higher genus.

In what follows, we assume that the curve C has explicit RM by Z[η]. Let us denote ψ = π+π ∨ and recall the expression of χ π (t) = t 4 -s 1 t 3 + s 2 t 2 -s 1 qt + q 2 , from which we deduce the characteristic polynomial of ψ, χ

ψ (t) = t 2 -s 1 t + s 2 .
By the previous remark, Z[ψ] ⊂ Z[η] hence there exist two integers a and b such that ψ = a + bη. They are uniquely determined by s 1 and s 2 because

s 1 = Tr(ψ) = 2a + b Tr(η), and s 2 = N (ψ) = a 2 + ab Tr(η) + b 2 N (η). (3.3)
Contrary to Section 3.1 we do not test directly the characteristic equation of π but the equality between the last two members of ψπ = π 2 + q = aπ + bηπ. In other terms, we compute a mod and b mod by finding ā and b in (Z / Z) such that for any torsion divisor D we have

āπ(D) + bηπ(D) = π 2 (D) + (q mod )D.
This brings two advantages over the general case: first, we only have to apply powers of π up to π 2 instead of π 4 , and more importantly, [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF]Eq. 10] shows that both a and b are in O( √ q) while s 2 is in O(q). More precisely, one can prove that |a| ≤ 4 √ q and |b| ≤ 2(| Tr(η)| + 1) √ q.

Yet, this improvement only reduces the number (and size) of primes to consider by a constant factor since it depends logarithmically on the width of the Hasse-Weil interval. The most significant gain lies in the structure of the -torsion, which allows us to find torsion divisors D more easily.

Let us consider a prime that splits in Z[η] into the product p 1 p 2 . We first detail how this can be used to split J[ ] (Z / Z) 4 into a direct sum of two subspaces isomorphic to (Z / Z) 2 .

In [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF], the ideals p i are assumed to be principal because the order Z[η] has class number 1 in all the examples of RM families. This assumption is not necessary and will be removed in Chapter 6 although it still holds in the genus-3 RM family that we used for practical experiments. For simplicity, we follow [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF] and make the same assumption in this chapter.

Lemma 3.4. [59, Lemma 1] If p is a principal ideal of norm in a real quadratic order Z[η],

then there exists an effectively computable generator α = a + bη of p with both a and b in O( √ ).

Computing small generators α 1 and α 2 of p 1 and p 2 , we have

J[ ] = J[α 1 ] ⊕ J[α 2
] so that any torsion divisor D can be written

D 1 + D 2 with D i ∈ J[α i ].
We have therefore transformed the problem of finding a generic element of -torsion into finding a generic element of α i -torsion.

To do so, we proceed exactly as in Subsection 3.1.1 but with the equation α i (D i ) = 0 instead of D i = 0. Once found D i a generic element of J[α i ], we compute π 2 (D i ) + (q mod )D i and kπ(D i ) for any k ∈ Z / Z to find k i the only value of k such that these two quantities are equal. This is summed up in Algorithm 5. Proof. Let us consider a fixed prime that splits in Z[η]. For each p i , we compute a small generator α i = β i + γ i η as in Lemma 3.4. Since we know there is one of size O( √ ), it is possible to find it by exhaustive search for O( ) field operations.

We now compute a generic element D i ∈ J[α i ] using the strategy of Section 3.1.1 except that we write α i (P

1 -P ∞ ) = -α i (P 2 -P ∞ ) instead of (P 1 -P ∞ ) = -(P 2 -P ∞ ). Since β i and γ i are in O( √ )
, the Mumford form of α i (P i ) have coefficients whose degrees in the abscissa x i is in O( ). Then, following the analysis in the proof of Theorem 3.2 with equations of degree instead of 2 , we prove that a generic element of Ker α i can be computed in O( 3 ) field operations.

Then, finding the k i 's require two applications of π and hence O(log q) field operations and at most O( ) field operations for the exhaustive search. Deducing (a, b) from k 1 and k 2 is linear algebra in F , which is negligible, and therefore each step in the main loop of Algorithm 5 has an overall cost of O( 3 ) field operations i.e. O( 3 log q) bit operations. input : q an odd prime power, and f ∈ F q [X] a monic squarefree polynomial of degree 5 such that the curve Y 2 = f (X) has explicit RM by Z[η]. output: The characteristic polynomial χ π ∈ Z[T ] of the Frobenius endomorphism on the Jacobian J of the curve. w ← 1; ← 2; while w < max(|2 Tr(η)| + 1, 4)

√ q do Pick the next prime that splits in

Z[η] ; Compute the ideal decomposition Z[η] = p 1 p 2 , corresponding to the eigenvalues λ 1 , λ 2 of η in J[ ] ; for i ← 1 to 2 do Compute a small generator α i of p i with coefficients in O( √ ) ; Compute a generic element D i in J[α i ] ; Find the unique k i ∈ Z / Z such that k i π(D i ) = π 2 (D i ) + qD i ; end Find the unique (a, b) in (Z / Z) 2 such that a + bλ i = k i , for i in {1, 2} ; w ← w • ; end Reconstruct (a, b) using the Chinese Remainder Theorem ; Deduce χ π from Equations (3.3).
Algorithm 5: Overview of the genus-2 RM point-counting algorithm from [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF] Since the RM field is fixed, by Chebotarev's density theorem, half of the primes split in Z[η] and thus both the number of primes to consider and the size of the largest one are still in O(log q). Replacing by log q and adding a factor log q for the number of primes proves the theorem.

In this section, we have actually given a simplified version of point-counting algorithms to simplify the exposition and the complexity analysis. In practice, more optimizations have to be done to achieve significant practical results, in particular when using Algorithm 4. These modifications are the focus of the following section.

Practical improvements and past results

In this section, we review practical improvements to Algorithm 4. None of them change the complexity in O(log 8 q) bit operations but some enabled to halve the number of operations. We conclude by reviewing the efforts made to design a genus-2 curve with 128-bit security level, which took great advantage of the practical improvements. Both the improvements and computations were made prior to this thesis, in the early 2010's so we also give a panorama of what has changed since then in the next section.

Sharper modelling

Eliminating "parasites"

In Section 3.1.1, we already mentioned the possibility of parasites, i.e. extraneous factors of the resultant coming not from torsion points but from particularities of the input system. More than the factor (x 1 -x 2 ), it is pointed out in [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF] that d 2 (x 1 ) 2 2 -2 divides the resultant R(x 1 ). Indeed, recall the equations

E 1 (x 1 , x 2 ) = d 1 (x 1 )d 2 (x 2 ) -d 1 (x 2 )d 2 (x 1 ) = 0, E 2 (x 1 , x 2 ) = d 0 (x 1 )d 2 (x 2 ) -d 0 (x 2 )d 2 (x 1 ) = 0, (3.4)
and remark that if d 2 (x 1 ) vanishes, then any root of d 2 is also a common root of E 1 (x 1 , •) and

E 2 (x 1 , •).
Using evaluation / interpolation techniques, we can directly avoid these parasites by evaluating R(a 1 ) = Res In [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF], it was further noticed that d 2 has the form f 3 δ 2 , with f the defining polynomial of the hyperelliptic curve. This also results in parasites that can be eliminated, albeit with a less spectacular decrease of deg( R) by roughly 4 /4.

x 2 (E 1 (a 1 , x 2 ), E 2 (a 1 , x 2 ))/d 2 (a 1 )

Resymmetrization

Since the -torsion has size 4 , we know that R still has about three times more parasitic factor than factors coming from actual torsion points. Notice that System 3.1 is symmetric in the variables x 1 and x 2 . In [START_REF] Gaudry | Construction of secure random curves of genus 2 over prime fields[END_REF] the symmetry is used and the change of variables U 1 = -(x 1 + x 2 ) and U 0 = x 1 x 2 allows to halve the degrees of the input system. Moreover, the parasites of the previous paragraph can still be tracked after resymmetrization so that an additional factor 2 is gained in the degree of R.

Further optimization

Lifting the -torsion

The cost of computing χ mod for an additional being in O( 6 log q), one may wish that there were "more small primes" to retrieve modular information. The idea behind Algorithm 4 still works when replacing by k . Indeed, for k > 1 we may try to find a generic k -torsion divisor D k and test whether χ(D k ) = 0. The modelling is done iteratively by solving systems of the form D = D k-1 with D k-1 an k-1 -torsion divisor found previously and D a divisor whose coordinates are the indeterminates. This was introduced in [57] for = 2 and then extended for primes up to 7 in [START_REF] Gaudry | Construction of secure random curves of genus 2 over prime fields[END_REF][START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF]. In [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF], the largest was constrained by memory and powers of small were used until the computations became too heavy. Today, the memory is no longer a problem but running practical tests seems to be the only way of making one's mind on the subject as it is hard to assess the difference between going for k or trying an additional prime of similar size. Since we do not use the torsion lifting technique thoroughly in the remainder of this thesis, we do not detail this further and refer to [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF]Sec. 4] for more information.

Eliminating unpredictable parasites

Even after resymmetrization and removal of predictable parasites, deg R is still almost twice larger than what it should be. To eliminate the remaining parasites, it is possible to compute a third equation E 3 involving the v-coordinates of the respective Mumford forms of (P i -P ∞ ) as in [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF], compute its resultant R 1 with either E 1 or E 2 and then the GCD of R and R 1 , which is of the right degree ( 4 -1) in practice. Back then, it was unclear whether this step was preferable to searching directly factors in R with risks of useless computations leading to parasite solutions, or "cleaning" R before factorization to ensure that no parasite remains, at the cost of almost doubling the running time. This was ruled out in [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF]Sec. 3.4] by using an alternative strategy involving the recovery of a Gröbner basis for the whole symmetrized torsion ideal, and by designing another way of cleaning the parasites.

Let S = S 0 /S 1 mod R, and let us consider the algebra B = F q [U 1 , X]/ R(U 1 ), X 2 + U 1 X + S(U 1 ) . Let P 1 and P 2 be points of respective abscissae X 1 = X and X 2 = -U 1 -X, and compute (P 1 -P ∞ ) and (P 2 -P ∞ ) in the algebra B. Note that we can handle these scalar multiplications without having to worry about the ordinates and only dealing with their respective squares f (X 1 ) and f (X 2 ). Ultimately, we want (P 1 -P ∞ ) = -(P 2 -P ∞ ) so that the v coordinates of their Mumford forms have to be opposite. Denote

v 1i X + v 0i such Mumford forms. We must have v 2 11 = v 2 12 for D = P 1 + P 2 -2P ∞ to be an -torsion element. Experimentally, R = gcd( R, v 2 11 -v 2 12
) has no remaining parasite factor. Let us now explain how to recover χ as in the non-resymmetrized case. Let us consider

D = X 2 + U 1 X + U 0 , V 1 X + V 0 , a generic divisor in F q [U 1 , U 0 , V 1 , V 0 ]
. The first equations that D must satisfy to be an -torsion divisor are R(U 1 ) = 0 and U 0 = S(U 1 ), which determine its u-coordinate. Now, remark that writing

D = P 1 + P 2 as above, the coordinate V 1 must be (Y 1 -Y 2 )/(X 1 -X 2 ) and the quotient V 0 /V 1 must be (X 1 Y 1 Y 2 -X 2 f (X 1 ))/(Y 1 Y 2 -f (X 2 )
). We can actually find expressions involving only the X-coordinates for Y 1 Y 2 and for Y 2 i = f (X i ). For the V 1 -coordinate, however, we have to consider its square which we express as

f (X 1 ) + f (X 2 ) -2Y 1 Y 2 (X 1 -X 2 ) 2 .
Plugging back the expressions of the X i 's in terms of the U i 's, we end up with expressions of the coordinates of D involving only U 1 and U 2 , which yield the following Gröbner basis for the torsion ideal

I ⊂ F q [X 1 , X 2 , V 1 , V 0 ]: V 0 -V 1 Z(U 1 ) V 2 1 -W (U 1 ) U 0 -S(U 1 ) R(U 1 )
with all the polynomials R, S, W, Z of degrees ≤ ( 4 -1)/2. We refer to [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF]Sec. 3] for more information about this process.

Once given such a representation, we likewise avoid the factorization of R, and directly test the equation

χ(D ) = 0 in F q [U 1 , U 0 , V 1 , V 0 ]
/I , using the D5 strategy to avoid division by any non-invertible element in that algebra.

Final collision search

In Section 1.2.2, we mentioned the fact that it is possible to directly test the characteristic equation of the Frobenius in the whole Jacobian to compute (s 1 , s 2 ). Although the complexity of such an approach is exponential, it is still very efficient in practice. Moreover, it can benefit from the knowledge of (s 1 , s 2 ) modulo an integer m and it can also be run in parallel. A onedimensional approach when looking only for #J is to take random divisors D ∈ J and compute their orders to deduce factors of #J until only one possibility remains in the Hasse-Weil interval. Since Jacobians of hyperelliptic curves are often "almost cyclic", a random D has a large order and only a few random D are expected to be necessary to determine #J. This method a priori gives the exponent of the group rather than its order, but it can be adjusted to deduce the actual order of the group, as presented in [START_REF] Cohen | A course in computational algebraic number theory[END_REF][Algorithm 5.4.1]. Note that this requires bounds on the cardinal of the input group, which is not a problem in our case since they are provided by the Weil bounds.

Using a birthday paradox approach, one expect to find (s 1 , s 2 ) with running time and memory requirement in O(q 3/4 ). If s 1 and s 2 are already known modulo an integer m, then the searchspace is reduced by a factor m 2 and the complexity by a factor m. An idea introduced in [START_REF] Matsuo | An improved baby step giant step algorithm for point counting of hyperelliptic curves over finite fields[END_REF] is to split the characteristic equation into two parts: one depending only on a parameter derived from s 2 and the other depending on two parameters derived from s 1 and s 2 . Then, instead of directly trying random values for these 3 parameters, one stores all the possible values for the first part, and deduces bounds for the two other before performing a random collision search to determine the remaining two parameters. The main drawback of these methods is the storage requirement.

The key to avoiding storage is to look for collision of deterministic sequences which are assumed to behave as pseudo-random sequences in the complexity analysis (an assumption that is backed by practical evidence). This is inspired by Pollard's kangaroos method. To simplify the exposition, let us first assume that m ≥ 8 √ q, so that s 1 is already completely determined and we only look for the right value of s 2 . Let us split s 2 = s2 + m s2 with s2 already known.

Denote by K = q 2 + 1 -s 1 (q + 1) + s2 so that #J = K + m s2 . From the bounds on s 2 we deduce bounds on s2 and we actually substract from K some multiple of m and s2 by some constant to make these bounds of the form | s2 | ≤ B. Let us pick a random D ∈ J and define the "wild" and "tamed kangaroos" as

W = {(K + mσ 2 )D | |σ 2 | ≤ B} and T = {mσ 2 D | |σ 2 | ≤ B}.
When an element of W ∩ T is found, we are able to compute s2 . Using a birthday paradox approach, we want to compute random elements in each set until we find an element in the intersection. But we need a way of storing some elements in order to detect such a collision. Storing any of the two sets in totality is excluded since it would entail memory requirements comparable to the algorithm of [START_REF] Matsuo | An improved baby step giant step algorithm for point counting of hyperelliptic curves over finite fields[END_REF]. A workaround is to use distinguished points, i.e. elements of J with a particular feature, such has having the 20 last bits of their u 0 coordinate equal to zero. We now fix a hash function on divisors and perform pseudo-random walks (D i ) such that D i+1 is determined by the hash of D i and decide to stop the pseudo-random walk whenever it hits a distinguished divisor. We perform many such walks in W and T and only store one element per walk i.e. the final distinguished divisor. Due to the deterministic design of the pseudo-random walks, if a walk in W collides with a walk in T , then they keep colliding until the end. Hence, the distinguished divisor that is stored is also a point in W ∩ T , which is the reason why only the last element of the walk has to be stored. We redirect to [START_REF] Gaudry | Construction of secure random curves of genus 2 over prime fields[END_REF] for complexity analysis and optimization of the parameters. Note that similarly to the one-dimensional approach we a priori only get s 2 modulo the order of D, but once again this can be fixed using [START_REF] Cohen | A course in computational algebraic number theory[END_REF][Algorithm 5.4.1].

In the general case, however, both s 1 and s 2 are not completely known and the previous collision has to be sought in intersecting rectangles instead of intervals. Each step is made in a plane instead of a line although in practice it is better to impose a fixed proportion of onedimensional steps in the direction corresponding to s 2 , as it is much larger than s 1 . Indeed, our rectangles are really flat because of the Weil bounds in O( √ q) for s 1 and in O(q) for s 2 . To perform the pseudo-random walk, D i+1 is computed from D i by adding an offset of the form (-1) b α(q + 1)mD + βmD, where b, α and β depend on the hash of D i . These quantities are initially taken uniformly at random respectively in {0, 1}, [0, 2L 1 ] and [0, 2L 2 ] with the L i 's being parameters. Note that once each tuple (b, α, β) is associated to a value of the hash function, it remains the same in order to keep our walks deterministic.

Let us now discuss on the parameters involved. First, let N be the number of points in the rectangle

{(s 1 , s 2 ) | b 1 ≤ s 1 ≤ B 1 , b 2 ≤ s 2 ≤ B 2 }.
Let C be the number of chains to create: this is fixed by the user and must be large enough to avoid each chain being too long but small enough not to require too much memory. We expect to construct O( √ N ) points before a collision, and the user can estimate an actual value λ for this quantity. We must now decide of the probability p D for a random divisor to be distinguished: too small will imply a larger running time while too large will be too demanding on memory. We can actually relate it to C: if we are too compute about λ points divided into C chains, then we expect each chain to have a length about λ/C. Since a chain ends when it reaches a distinguished point, its expected length is 1/p D . Equating the two quantities yields p D = C/λ. To fix the parameters L 1 and L 2 , let us observe that we do not want the chains to leave the intersection of the rectangles, because there is no hope to find a collision outside. On average, each chain goes a distance L 2 /p D from the center along the s 2 -axis so we want L 2 /p D to be small enough compared to B 2 -b 2 , for example one tenth of it. We do the same for L 1 but warn that along the s 1 -axis, the chains can move in both directions because of the sign (-1) b . In that case, by the central limit theorem we expect the chains to be at distance 2 2/3πL 1 / √ p D of the center along the s 1 -axis. Setting L 1 to be about one tenth of the limit and approximating the previous term, one can set

L 1 = (B 1 -b 1 )
√ p D /9. Once again, we refer to [START_REF] Gaudry | Construction of secure random curves of genus 2 over prime fields[END_REF] for a heuristic complexity analysis and discussion on the choice of parameters. We give more details about that in Chapter 6 in the tridimensional case. Note that the running time of Gaudry and Schost's algorithm for one-and two-dimensional collision search depends on the overlap between the sets T and W . In [START_REF] Galbraith | An improvement to the Gaudry-Schost algorithm for multidimensional discrete logarithm problems[END_REF], Galbraith and Ruprai propose a more detailed complexity analysis as well as an improved version of the algorithm in which the size of W ∩ T is constant.

A cryptographic genus-2 curve

In [62, Sec. 5], a cryptographic genus-2 curve is found after large scale computations involving a million CPU hours. More precisely, this curve is defined over F 2 127 -1 and both its Jacobian and that of its quadratic twist have order 16 times a large prime. Further properties ensuring efficiency of the group law of the associated Kummer surface are imposed but we do not describe all the details here. In particular, these conditions entail some rationality conditions that are responsible for the factor 16 in the cardinality of the Jacobian. To find a "random" curve in the sense that it has no additional remarkable property which could decrease its security level, many curves are generated and those among them who do not satisfy the requirements are discarded until one suitable curve is found. The Kummer surfaces associated to these curves can be parametrized by four parameters called theta constants. The starting set was chosen to be the set of curves whose associated theta constants have squares between -40 and 40. Among them, 83639 lead to Kummer surfaces with nice arithmetic properties.

Then, Schoof's algorithm is applied to all these curves but with an early-abort strategy ensuring that we first compute the order of J modulo small primes and discard curves such that #J mod = 0. Filtering out with = 3 and = 5 leaves "only" 21201 candidates. Computing #J mod 32 and #J mod 7 reduce that number to 3608. Schoof's algorithm was continued using this early abort approach until = 31, for which #J is known modulo 2 30 . Back then, memory requirements were too high to go further and powers of primes were used up to 2 17 , 3 7 , 5 4 and 7 2 , allowing knowledge of #J modulo N 2 77 . In the end, the actual (s 1 , s 2 ) of 586 curves were computed for a total time of roughly 1000 CPU hours per curve, using the collision search algorithm described in Section 3.2.3. The 128-bit security level Jacobian that was retained corresponds to a hyperelliptic curve defined over F 2 127 -1 by the equation

y 2 =x 5 + 64408548613810695909971240431892164827x 4 + 76637216448498510246042731975843417626 x 3 + 154735094972565041023366918099598639851 x 2 + 9855732443590990513334918966847277222 x + 81689052950067229064357938692912969725.
It has since been used in various cryptographic implementations and records such as [START_REF] Renes | µKummer: Efficient hyperelliptic signatures and key exchange on microcontrollers[END_REF][START_REF] Daniel | Kummer strikes back: new DH speed records[END_REF][START_REF] Renes | qDSA: Small and secure digital signatures with curvebased Diffie-Hellman key pairs[END_REF].

To our knowledge, this example is still the only random 128-bit secure genus-2 curve in the literature and this is no wonder because of the efforts required to achieve it. Worse, to hope for a higher security level, one needs to compute modular information for larger , for a complexity in O( 6 log q). The goal of the next section is to survey the prospects for larger cryptographic genus-2 Jacobians. Note that there are other ways of finding such Jacobians by using the CM method or by restricting to curves with RM, but one could prefer a less structured curve as additional properties might well lead to faster attacks on the DLP, although none have been published yet.

Prospective improvements

Feasability of a cryptographic 384-bit Jacobian

In [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF], when looking for a 256-bit Jacobian of a genus-2 curve, the Schoof-like part had to be halted at = 31 and further modular information up to 77 bits was extracted from non-prime torsion. Counting points on a single curve over a 192-bit field without using additional prime would require a collision search over a space of size about 2 140 and thus about 2 70 operations. As this task has to be repeated over several hundred curves, this would not be reasonable.

On the other hand, counting points on a curve over a 192-bit field without using an exponential step would require to perform Schoof's algorithm up to = 149, or = 109 if we manage to recover the same amount of information as [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF] by lifting the -torsion. Assuming that the collision search algorithm brings about 2 50 bits of information on (s 1 , s 2 ), we can decrease the largest to 79 or 73.

The previous limit was set at = 31 because of a lack of memory. Since time complexity grows in O( 6 log q) while memory grows in O( 4 log q) when grows, we expect the memory requirements to be less of a concern. It seems to be the case indeed as our simulations lead to estimate the memory requirements to be under 500 GB even for an as large as 83. The running time, however, quickly grows beyond control as, for instance, we expect that the computation of (s 1 , s 2 ) modulo primes up to 73 would require about 10000 CPU days.

Even up to = 53, such computations would take about 1000 CPU days, more than 80 times the whole time needed to compute the previous cryptographic Jacobian. Worse, even assuming the modular knowledge up to = 53 and torsion lifting identical to [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF], the collision search would still have to cope with a search space of size 2 95 .

In practice, almost all the running time would be spent doing either evaluations using resultant computations or collision search. These two steps being parallelizable, such computations may not be completely impossible. However, we question the point of spending conspicuous amounts of computational power that might even not be negligible compared to the cost of discrete logarithm computations in the secure curve.

Unless further improvements are made, it seems that the only plausible alternatives for safe genus-2 curves come from RM curves or from the CM-method. Indeed, in [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF] counting points on a RM-curve defined over a 512-bit prime field is done in about 80 CPU days. When using the CM-method, the order of the Jacobian is almost already determined and the bulk of the computations is actually to find suitable fields K and F p and recover an equation of a curve C over F p with CM by the ring of integers of K. When the CM-field K has a small class number as in [START_REF] Weng | Constructing hyperelliptic curves of genus 2 suitable for cryptography[END_REF], Jacobians of genus-2 curves offering a 128-bit security level can be computed in a matter of minutes. Later on, further examples with fields of larger class numbers were constructed in [START_REF] Enge | Computing class polynomials for abelian surfaces[END_REF], the largest one being the field K = Q[X]/(X 4 + 1357X 2 + 3299), with class number 40032. In the next two subsections, we discuss research areas that could help make random genus-2 curves competitive again.

Further improvements

For prime numbers larger than 30, we observe that computing the bivariate resultant represents more than 90% of the running time of Algorithm 4, which is no surprise since we expected it to be the bottleneck asymptotically. Therefore, to improve the running-time of this algorithm, one must either reduce the size of the input system or find a faster way of computing the resultants. Efficient computation of resultants is a problem that has drawn a lot of attention in the past decades and for which there has been no significant improvement in the previous years. Recently, however, Villard proposed a faster algorithm [START_REF] Villard | On computing the resultant of generic bivariate polynomials[END_REF] for computing bivariate resultants that we already mentioned at the end of Section 2.3. Using this algorithm, the cost of the computation of bivariate resultants could be decreased to O( 6-2/ω+o (1) ), which represents an improvement by a factor at least (log q) 2/3 in the final complexity. Recall that ω is the exponent from linear algebra, which was proven to be smaller than 2.38. In practice however, we expect to be using Strassen's algorithm for matrix multiplication and thus have a value of approximately 2.8 for ω. Also note that Villard's algorithm relies on some genericity assumption which may prevent us from using it in our case.

In order to reduce the size of the bivariate equations, a possibility could be to forecast and remove additional parasites. This approach, however, seems to have been fully explored in [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF]. Note that since deg R is reduced to about 2 4 in [START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF] and has to be at least 4 /2 to encode the whole -torsion, no more than a factor 4 can be saved anyway. Another way to reduce the degrees of our equations could be to consider less than the full torsion, as in the SEA algorithm for which factors of division polynomials of degree O( ) are considered instead. While we still lack the tools to make this technique a reality in genus 2, the next section reviews ongoing research in that direction.

Generalization of the Elkies-Atkin improvements

In the elliptic case, Schoof's algorithm has been improved by Elkies and Atkin, as detailed in [START_REF] Schoof | Counting points on elliptic curves over finite fields[END_REF]. Both improvements involve the so-called modular polynomial Φ (X, Y ) which is a bivariate polynomial defined by the property Φ (j(E 1 ), j(E 2 )) = 0 if and only if the curves E 1 and E 2 are -isogenous.

Given a curve E, the univariate polynomial Φ (j(E), X) has a very constrained factorization pattern in F q [X]. Indeed, only three possibilities occur for the degrees of the irreducible factor-ization Φ (j(E), X) = f 1 • • • f s . We denote by (δ 1 , . . . , δ s ) the tuple formed by the degrees of the f i 's rearranged in non-decreasing order and we use the terminology of [START_REF] Ballentine | Isogenies for point counting on genus two hyperelliptic curves with maximal real multiplication[END_REF] to classify the primes according to the tuple associated to Φ (j(E), X):

• if it is (1, )
, we say that is a volcanic prime

• if it is (1, 1, r, .
. . , r), we say that is an Elkies prime

• if it is (r, r, . . . , r), we say that is an Atkin prime

The improvement by Atkin allows to deduce information on χ mod from this factorization pattern: it does not change the asymptotic complexity of Schoof's algorithm, but provides a significant speed-up. Indeed, we have χ(X) = X 2 -tX + q and Atkin proved that t 2 mod is either 4q mod in the volcanic case or (ζ + ζ -1 + 2)q mod in the other two cases, with ζ a primitive e-root of unity, for e dividing either + 1 if is an Atkin prime or -1 if is an Elkies prime.

The improvement due to Elkies consists of determining t mod by replacing the test χ(P ) = 0 in E[ ] by the test π(P ) = λP in the kernel of an -isogeny determined by the factorization of Φ (j(E), X). Since the kernel is given by a polynomial of degree ( + 1)/2 versus ( 2 -1)/2 for the -division polynomial, this decreases the complexity of computing χ mod by a factor O( ) provided that there exists an -isogeny. This is the case when is either a volcanic or an Elkies prime but in the first case we already know much about χ mod . Heuristically, we expect Elkies and Atkin primes to represent both about 50% of all primes, but we cannot invoke the Chebotarev density theorem since we do not work in a fixed number field. Under this heuristic, by considering only Elkies primes, we expect the largest to be in O(log q). Therefore, the SEA algorithm has a heuristic complexity of O(log 4 q). However, although this heuristic complexity is backed by numerical experiments, Satoh and Galbraith showed in [125, Appendix A] that under GRH, the largest to consider in the SEA algorithm is in O((log q) 2+ε ).

In order to extend these improvements to point-counting in genus 2, analogues of modular polynomials were introduced in [START_REF] Gaudry | Construction of secure random curves of genus 2 over prime fields[END_REF] along with an algorithm to compute them and experiments on their factorization patterns. Unfortunalety, the complexity estimate to obtain these polynomials is in O( 8 log q) bit operations, which is more costly than the natural extension of Schoof's algorithm. In some favorable cases, i.e. when the curve has RM by a small quadratic order, Milio and Martindale [START_REF] Milio | Calcul de polynômes modulaires en dimension 2[END_REF][START_REF] Martindale | Isogeny graphs, modular polynomials, and applications[END_REF] have computed analogues of modular polynomials which could be exploited to mimic the Atkin improvement. By computing modular correspondences between Abelian varieties equipped with a theta-structure, Faugère, Lubicz and Robert propose another extension of modular polynomials in higher dimension [START_REF] Faugère | Computing modular correspondences for abelian varieties[END_REF]. In order to extend the Elkies improvement to the genus-2 case, current work by Couveignes and Ezome and implementations by Milio [START_REF] Milio | Computing isogenies between Jacobian of curves of genus 2 and 3[END_REF][START_REF] Couveignes | Computing functions on Jacobians and their quotients[END_REF] involve computing ( , )-isogenies from their kernels, which solves a part of the problem, but we still lack an algorithm to compute the kernel itself. We also refer to the AVIsogenies software [START_REF] Bisson | Magma package for explicit isogenies between abelian varieties[END_REF] for ongoing work in that direction although it requires hypotheses on the rationality of 2-and 4-torsion, and therefore in most cases to accept working in a significant extension of the base field.

Chapter 4

Cantor's division polynomials

As explained in Chapter 1, we compute a low-degree representation of the Frobenius endomorphism by successive squarings and reductions in the -torsion ideal. To make these reductions possible, we compute the equations of the torsion ideal by formally equating D = 0 for D a generic divisor and put them in a "nice" form by solving a polynomial system derived from D = 0. This has a complexity cost which has to be controlled, and which depends on parameters such as the degree of the ideal, the number of variables and the degrees of the equations, as detailed in Chapter 2.

Given a generic point P = (x, y) on an imaginary hyperelliptic curve, we show in this chapter that the divisor P has coordinates that are rational fractions in x and y and bound their degrees. This is used in Chapters 3 to 6 to bound the degrees of polynomial systems involved in the modelling of the torsion subgroups.

These hyperelliptic counterparts to division polynomials were first described by Cantor in [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF], although an alternative strategy was suggested at the same time in Kampkötter's thesis [START_REF] Kampkötter | Explizite gleichungen für Jacobische varietäten hyperelliptischer kurven[END_REF] to compute scalar multiplications. Cantor's paper is quite long and technical, so we do not attempt to make this chapter self-contained and advise the meticulous reader to keep it handy while browsing through our proofs. Still, in Section 4.1 we give details on how Cantor's paper works as well as some intuition behind the objects that we define to make this chapter as understandable as possible without previous knowledge of Cantor's polynomials. More precisely, we have tried to make this whole chapter self contained for the reader willing to accept statements from [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF] without proof but unwilling to read the paper. Lastly, we emphasize that this section is purely technical and can easily be skipped without jeopardizing the reader's understanding of this thesis, as we only reuse the main statements proven in Sections 4.2 and 4.3.

While the description of P using 2g + 2 polynomials was established in Cantor's original paper [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF], the degrees of only two of these polynomials were actually computed, whereas the polynomial systems of Chapters 3 to 6 involve all the 2g + 2 polynomials. In genus 2, the degrees of all these polynomials were computed precisely as seen in Proposition 3.1 but no result was published in larger genus, although numerical evidence suggests that the degrees are quadratic in . In Section 4.2, we prove a bound in O g ( 3 ) for the degrees of Cantor's -division polynomials in arbitrary genus. In Section 4.3, we prove that in genus 3, Cantor's polynomials have degrees in O( 2). These two sections are joint work with Pierrick Gaudry and Pierre-Jean Spaenlehauer and are to appear as [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF]Sec. 6] and [2, Sec. 6].

Overview on division polynomials

As seen in Section 1.1.4, given a point of coordinates (x, y) on an elliptic curve and an integer > 1, explicit formulas for the coordinates of the point P have been known for long and can be described using the so-called division polynomials ψ . Recall that these polynomials follow a recurrence formula which we restate in a different form:

∀ s ≥ r ≥ 1, ψ s-r ψ s+r = det ψ s-1 ψ r ψ s ψ r-1 ψ s ψ r-1 ψ s+1 ψ r ,
and that deg ψ = ( 2 -1)/2. We can already illustrate why those degrees are important: in Schoof's algorithm they determine the size of the quotient ring in which we compute the Frobenius, and therefore the cost of each operation. Theorem 4.1 ([28], Th. 8.35). Let C be a hyperelliptic curve given of genus g by an equation of the form Y 2 = F (X) with F monic of degree 2g + 1. Let P be the generic point on C, (x, y) be its coordinates and let D = P -P ∞ be the associated divisor.

For ≥ g, there exists two polynomials δ (X) and ε (X) of respective degrees g and g -1

such that the non-normalized Mumford form of D is δ x -X 4y 2 , ε x -X 4y 2 .
Furthermore, the coefficients of δ are polynomials in x. And those of ε /y are rational fractions whose numerators and common denominator are also polynomials in x.

By non-normalized Mumford form, we mean that the polynomial δ is not monic, contrary to Definition 1.29. This is the only difference and it allows us to have polynomials as coefficients of δ . Definition 4.2. Let ≥ g, the g + 1 coefficients of the polynomials δ , the g numerators and the common denominator of the coefficients of ε /y are called Cantor's -division polynomials, and we omit the when there is no ambiguity on it.

In this chapter, we study the degrees in x of these polynomials, and notably their dependency in . For a polynomial P whose coefficients are rational fractions, we denote by degmax(P ) the maximum of the degrees of the numerators and denominators of its coefficients. In the remainder of the chapter, we aim to bound degmax(δ ) and degmax(ε /y).

Warning: Instead of the coefficients of δ , we may also consider those of δ ((x -X)/(4y 2 )) or more often the 2g + 2 polynomials (d i ) 0≤i≤g and (e i ) 0≤i≤g such that

D = X g + g-1 i=0 d i (x) d g (x) X i , y g-1 i=0 e i (x) e g (x) X i .
The second family of polynomials is deduced from the first after developping (x -X)/(4y 2 ), and the third comes from the second after simplifying the rational fractions. For simplicity, all of them are called division polynomials, but there is little ambiguity on their respective occurrences: the last one is the only form appearing in our systems and in practice, while we mostly focus on the first one when proving bounds on degrees. However, the difference of degrees between them only depends on g and can readily be computed.

To simplify the exposition, the first step is a change of variable X = x -z from the point P = (x, y) on the curve Y 2 = F (X) to the point P 0 = (0, (-1) g+1 y) on the curve C of equation

Y 2 = E(z) with E(z) = F (x -z).
The choice of the sign of the ordinate of P 0 is well-motivated in [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF], but since we ultimately only focus on the degrees of Cantor's polynomials, we prefer not to linger on signs. Denote E(z) the formal power series which is the Taylor series of the square root of E around z = 0 with constant term (-1) g+1 y. Following Cantor, we first define unnormalized division polynomials as A , B , C and D , then we normalize them by the right power of 2y and we invert the change of variables to recover the normalized polynomials α , β , γ and δ . Lastly, the polynomial ε is deduced from δ , δ -1 and δ +1 .

Let us now consider the curve C , mapped in its Jacobian J by P → P -P ∞ . Let A (z) and B (z) be polynomials such that

• z divides A (z) -B (z) E(z), • 2 deg A ≤ + g and 2 deg B + 2g + 1 ≤ + g.
We are not sure yet whether they exist and how to compute them, but this will be dealt with once their definition becomes more natural and relevant to the initial problem.

Indeed, the function on the curve C given by A (z) -Y B (z) has + h poles at infinity with h ≤ g. Then, denote D the associated principal divisor, we have D = D + P 0 -( + h)P ∞ where D is an effective degree-h divisor, since z divides A (z) -Y B (z). Now, this principal divisor has to be zero in the Jacobian J , so we end up with D -hP ∞ = -(P 0 -P ∞ ).

For > g define

D (z) = -(A (z) 2 -B (z) 2 E(z))/z (4.1)
as in [28, 2.3]. This definition is natural in the sense that D is the Mumford u-coordinate of D . Then, we define Ē (z) to be the corresponding v-coordinate of the Mumford form, that is deg Ē < deg D and Ē (z) 2 -E(z) ≡ 0 mod D . This gives the intuition on the construction of the non-normalized division polynomials, but deeper understanding is required to define them rigorously, which actually comes with the existence and definition of A and B . The first condition on these polynomials amounts to homogeneous linear conditions on their (unknown) coefficients. The degree conditions only allows for deg A + deg B to be -1 so there is a total of exactly +1 coefficients to be determined to completely fix those two polynomials. In other terms, A and B are defined as Padé-Hermite approximants of the series E(z) modulo z . Thus, by unicity of the Padé-Hermite approximants, either there is no solution, or there is a unique solution for A and B up to multiplication by a scalar. There exist algorithms to compute these Padé approximants, and the condition for their existence is the non-nullity of some Hankel determinants.

For brevity, let us define the power series S(z) = E(z), denote s j being either the j-th coefficient of S or 0 if j ≤ 0. For m ≥ 0 and n ≥ 1 let us define the following Hankel matrix as

H mn (S) =         s m-n+1 s m-n+2 • • • s m s m-n+2 s m-n+3 • • • s m+1 . . . . . . . . . . . . s m-1 s m • • • s m+n-2 s m s m+1 • • • s m+n-1        
, and h mn (S) its determinant with the convention h mn (S) = 1 if n = 0 and h mn (S) = 0 if n ≤ -1.

The non-nullity of these h mn guarantees the existence of solutions to the Padé approximation problem, as stated in [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF]Th. (3.5)]. These solutions are actually (up to a constant) determinants of matrices similar to H mn . We do not restate them since that would not be enlightening, but properties of Padé approximants allow to define the polynomials A (z), B (z) as well as two other quantities which will play a crucial role: the series C (z) such that

A (z) -B (z)S(z) = -z C (z),
and the f which are polynomials in x, defined as h n +1 m +1 where n and m are some indices depending on and g which we do not detail. We will see later that these f are actually non normalized versions of polynomials ψ that extend the elliptic division polynomials in some natural way [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF]Cor. 8.34].

Using properties of Padé approximants called Frobenius identities in [74, Eq. (2.5)], one can derive the following recurrence formulas:

Proposition 4.3 ([28], 3.14). For ≥ g + 1, f -1 A +1 (z) = f A (z) -zf +1 A -1 (z), f -1 B +1 (z) = f B (z) -zf +1 B -1 (z), f -1 C +1 (z) = (f C (z) -f +1 C -1 (z))/z.
Along with initial values given in [28, 3.10], these identities allow to compute the A, B, C and f inductively without having to compute the determinants. More importantly for our purpose, they allow to inductively bound degmax(A), degmax(B) and degmax(C) once the degrees of the f i are known. In Section 4.2, we transcript them into recurrence relations involving the normalized counterparts α, β, γ and ψ of Definition 4.4 instead of directly studying the non normalized objects. This is done for a pragmatic reason: to avoid duplicating proofs and results in Cantor's paper, the non-normalized objects are used to simplify technical proofs but final results are only given in normalized form.

Let us introduce some notation: for S(z) a formal power series, we denote S[ι n ] the polynomial of degree ≤ n obtained by truncation, i.e. n k=0 s k z k and S[n] the n-th term of the series, that is s n z n .

We restate the dictionary to switch from the non-normalized to the normalized world.

ψ = (2y) ν f , α (z) = 2(2y) ν -1 -1 f A (4y 2 z){ι g }, β (z) = (2y) ν -1 f B (4y 2 z){ι g }, γ (z) = (2y) ν +1 f C (4y 2 z){ι g }, δ (z) = (2y) 2ν D (4y 2 z), ε (z) = Ē (4y 2 z).
From the non-normalized conditions of the Mumford form, we get the following alternative expression for ε , which allows us to focus on ψ and δ (z). Proposition 4.5 ([28], 8.13). For > g,

ε (z) = y z(ψ 2 -1 δ 2 +1 (z) -ψ 2 +1 δ -1 (z)) ψ -1 ψ 2 ψ +1 mod δ (z).
The five polynomials α to ε have degrees at most g in z, but their coefficients are a priori rational fractions in x and y. The following theorem clarifies the situation: Theorem 4.6 ([28], 8.15). If -g is even, then ψ is a polynomial in x, and α (z)/(2y) g , β (z)/(2y) g and γ (z)/(2y) g are polynomials in z with coefficients that are polynomials in x. If -g is odd, then ψ /(2y) g is a polynomial in x, and α (z), β (z) and γ (z) are polynomials in z with coefficients that are polynomials in x. Definition 4.7 ([28], 8.16). Let us now define P as ψ if -g is even, and ψ /(2y) g otherwise, so that P is always a polynomial in x.

Both its degree and leading coefficient are given but we only restate the result on the degree. Theorem 4.8 ([28], 8.17). The polynomial P has degree

       g( 2 -g 2 ) 2 if -g is even, g( 2 -g 2 ) -g(2g + 1) 2 if -g is odd.
Using the fact that y 2 = F (x), we can rephrase this by a formula which we often use to prove the following theorems: deg(ψ 2 ) = g( 2 -g 2 ). We now have all the necessary ingredients for Section 4.2 but we present alternative recurrence formulas that are more similar to the elliptic case, and that also allow for sharper bounds in the genus-3 case. This is studied in [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF]Sec. 6 & 8], respectively in the non-normalized and normalized cases. Once again, the idea is to use properties of Padé approximants and translate them into recurrence relations. We focus on the results and refer to Cantor's paper for proofs, hence we restrict to the normalized case. We restate the relations [28, 8.31 to 8.33] that allow to express α , γ and ψ in terms of determinants involving the polynomials α r , γ r and ψ r for several values of r that are close to /2. Definition 4.9 ([28], 8.30). Let s ≥ r ≥ 2g -1 and h ≤ g, define the (g + 1) × (g + 1) matrix

E rs [h] =       α r-g (z)α s (z)[ι g-2 ] ψ r-g ψ s γ r-s (z)γ s (z)[h] α r-g+1 (z)α s-1 (z)[ι g-2 ] ψ r-g+1 ψ s-1 γ r-g+1 (z)γ s-1 (z)[h] . . . . . . . . . α r (z)α s-g (z)[ι g-2 ] ψ r ψ s-g γ r (z)γ s-g (z)[h]      
. Definition 4.10 ([28], 8.32). Let s ≥ r ≥ 2g -1 and h ≤ g, define the (g + 1) × (g + 1) matrix

F rs [h] =       α r-g (z)α s (z)[h] ψ r-g ψ s γ r-s (z)γ s (z)[ι g-2 ] α r-g+1 (z)α s-1 (z)[h] ψ r-g+1 ψ s-1 γ r-g+1 (z)γ s-1 (z)[ι g-2 ] . . . . . . . . . α r (z)α s-g (z)[h] ψ r ψ s-g γ r (z)γ s-g (z)[ι g-2 ]       .
Recall that, using previous notation, the first matrix involves g -1 terms in α and one term in γ while the second one involves g -1 terms in γ and one in α. We restate recurrence relations based on the determinants of these matrices: Proposition 4.11 ([28], 8.31). For s ≥ r ≥ 2g -1 and h ≤ g, we have

det E rs [h] = (-1) ( g+1 2 ) γ r+s-2g+1 [h]ψ s-r g-1 k=1
ψ r-g+k ψ s-g+k .

Proposition 4.12 ([28], 8.33). For s ≥ r ≥ 2g -1 and h ≤ g, we have

det F rs [h] = (-1) ( g+1 2 ) α r+s-2g+1 [h]ψ s-r g-1 k=1
ψ r-g+k ψ s-g+k .

When g = 2, and for s ≥ r ≥ 3 these formulas yield

ψ s ψ r ψ s+r ψ s-r = det    ψ s-2 ψ r ψ s-1 ψ r+1 ψ s ψ r+2 ψ s-1 ψ r+1 ψ s ψ r ψ s+1 ψ r+1 ψ s ψ r+2 ψ s+1 ψ r-1 ψ s+2 ψ r    .
This can be used to compute the exact degrees of Cantor's division polynomials in genus 2, which is used in Chapter 3. Another important remark is that when g = 1 they give exactly the same recurrence as the one satisfied by the division polynomials, and the immediate corollary is that in genus 1 the ψ coincide with the previously known division polynomials.

To our knowledge, apart from the leading and constant coefficients of δ , which Cantor proved to be respectively -(4y 2 ) g ψ 2 and (-1) g+1 ψ -1 ψ +1 even in arbitrary genus, no additional proven result was published for g ≥ 3. In Section 4.3, we instantiate these recurrence formulas in genus 3 and use them to prove a quadratic bound in on the degrees of all the 8 analogues of division polynomials. We also explain why we are not very optimistic about that approach compared to the first one when g is larger.

A cubic bound in any genus

We prove the following: Theorem 4.13. For any integer > g, the polynomial δ (X) of degree g in X has coefficients in F q [x] whose degrees in x are bounded by g 3 /3 + O g ( 2 ); the polynomial ε (X)/y has coefficients in F q (x) such that the degrees of the numerators and the denominators have degrees bounded by 2g 3 /3 + O g ( 2 ). Furthermore, the roots of the denominators are roots of the leading coefficient of δ (X).

Proof. Technicalities arise from the normalizations required to manipulate entities that are polynomials in x (and not rational fractions), without odd power of y involved. In Cantor's article, this normalization often depends on the parity of -g. We will concentrate on the case where g is even; for the other case some formulas must be adapted, multiplying or dividing by 2y at various places.

We recall that ν = ( 2 --g 2 + g)/2 as defined in (8.7), so that ν = ν -1 + -1. By combining Definition 4.4 and 4.1, we obtain

δ (z) = (2y) 2ν (4y 2 z) A (4y 2 z) 2 -B (4y 2 z) 2 E(4y 2 z) ,
where A and B are unnormalized versions of α and β given in Definition 4.4 and E(z) is defined by E(z) = f (x -z). For our purpose, it is easier to deal with non-truncated versions of α and β . Let us then introduce the following quantities, inspired by Definition 4.4: ᾱ (z) = 2(2y) ν -1 -1 A (4y 2 z), and β (z) = (2y) ν -1 B (4y 2 z), so that δ can be rewritten as

δ (z) = 1 4z ᾱ (z) 2 - 1 y 2 β (z) 2 E(4y 2 z) .
By Theorem 4.6, the coefficients of α (z) and β (z) are polynomials in F q [x], and the proof is also valid for the non-truncated versions ᾱ (z) and β (z). Note that here we use the fact that g is even, so that the potential adjusting factor (2y) g is an even power of y that can be rewritten in terms of F (x). The polynomial E(4y 2 z) has coefficients which are polynomials in x of degree bounded by (2g + 1) 2 . Therefore, in order to obtain a degree bound for the coefficients of δ (z), it is sufficient to bound the coefficients of ᾱ (z) and β (z).

We are interested in a bound for fixed genus g and when grows to infinity and we use the O g notation as a O notation which also hides factor depending only on g (and not on ). For k in [1, ], we will use an induction to bound degmax(ᾱ k (z)) and degmax( βk (z)). For k ≤ g + 1, none of these quantities depends on , so that all the degrees can be bounded by an expression in g only, i.e. in O g [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF]. For k ≥ g + 1, we start from Proposition 4.3 where we substitute k for , we evaluate it at 4y 2 z, and we multiply by (2y) 2ν k -1 , so that we obtain:

(2y) ν k f k-1 ᾱk+1 (z) = (2y) ν k +k-1 f k ᾱk (z) -(2y) ν k +2k-1 f k+1 z ᾱk-1 (z),
where all the polynomials have coefficients in F q [x]. The expression for βk is exactly the same, but we have to multiply the expression in Proposition 4.3 by (2y) 2ν k in that case. By Definitions 4.4 and 4.7 plus Theorems 4.6 and 4.8, for any k, the quantity (2y) ν k f k is a polynomial in x of degree g(k 2 -g 2 )/2. Therefore the right-hand-side of the recurrence relation has coefficients with degrees bounded by an expression of the form max degmax( ᾱk (z)), degmax( ᾱk-1 (z)) + gk 2 /2, up to a term linear in k and cubic in g. We finally get:

degmax(ᾱ k+1 (z)) ≤ max degmax(ᾱ k (z)), degmax(ᾱ k-1 (z)) + gk 2 /2 + Err g (k),
where Err g (k) is a polynomial linear in k and cubic in g. Again, this inequality is also valid for βk . By induction, we then get the following bounds:

degmax(ᾱ (z)) ≤ g 3 6 + O g ( 2 )
, and degmax( β (z)) ≤

g 3 6 + O g ( 2 ).
We can then propagate these bounds in the expression of δ and we get degmax(δ (z)) ≤ max(2 degmax(ᾱ (z)), 2 degmax( β (z)) + degmax(E(4y 2 z)), so that we get the claimed result concerning δ .

The fact that ε (z)/y has coefficients in F q (x) follows directly from Proposition 4.5 that we recall here:

ε (z) = y z ψ 2 -1 δ +1 (z) -ψ 2 +1 δ -1 (z) ψ -1 ψ 2 ψ +1 mod δ (z).
As stated in [28, 8.11], the leading coefficient of δ (z) is -(4y 2 ) g ψ 2 , so that the property on the denominator of ε can not be easily deduced from this equation, due to the presence of ψ -1 and ψ +1 before the reduction modulo δ (z) occurs. We will prove it below, with a direct geometric argument, but we first give bounds on the degrees of the coefficients of the numerator and the denominator.

The polynomial δ (z) is of degree g in z, so that at most two steps of reduction are required to reduce the degree of ε to strictly less than g. In fact, it can be checked that LT(ψ 2 -1 δ +1 (z)) = LT(ψ 2 +1 δ -1 (z)), so that there is at most only one reduction step. This reduction accounts for an increase of the coefficients' degrees in x by at most degmax(δ ) in the numerator and an increase of the degree of the leading coefficient of δ in the denominator. Since deg ψ = g 2 /2 + O g ( ), the degrees of the coefficients of the numerator of ε (z) are bounded by 2 3 g 3 + O g ( 2 ), and the degree of the denominator is bounded by 3g 2 + O g ( ).

It remains to prove the claim on the roots of the denominator of the coefficients of ε (z)/y. For this, we consider the map from the affine part of the curve C aff to J seen as a projective Abelian variety, that sends a point (x, y) to [ ]((x, y) -∞). One of the main points of Cantor's article is that if ψ (x) = 0, then the image by this map is in J \ Θ, where Θ ⊂ J is the subvariety of elements of weight less than g (i.e. divisors that are sums of less than g points). On this open subset, Mumford coordinates with a monic u of degree g and v of degree at most g -1 give a local set of coordinates that we use to describe the map. The i-th coefficient of v is y times a rational fraction c i in x that gives a finite value at any x for which ψ (x) = 0. Therefore, any root of the denominator of c i is a root of ψ . By Theorem 4.1, the Mumford v-polynomial that we are considering is ε up to a renormalization that will only introduce additional powers of 4y 2 in the denominator. Therefore, any root of the denominator of the coefficients of ε is a root of ψ or of 4y 2 , and both divide the leading coefficient of δ , which is -(4y 2 ) g ψ 2 .

Remark. The bounds that we obtain are not tight: from [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF], we know that the leading and constant coefficients are in O g ( 2 ) instead of O g ( 3 ). We ran experiments that allow us to conjecture precise degrees for the other coefficients. In these experiments, instead of developing δ x-X 4y 2 and ε x-X 4y 2 to compute the d i 's and e i 's, we computed ((x, y)-∞) over the function field of the curve. This does not exactly yield the d i 's and e i 's because we actually get d i /d g and e i /e g , thus possibly missing a common factor in all the d i 's and e i 's. We denote di and ẽi the numerators and denominators of the aforementioned fractions, and we compute their degrees for each pair (g, ) with g ≤ 8 and g < ≤ g + 20 (which includes non prime values of ). We found that the degrees of the di are consecutive from deg( dg ) up to deg( d0 ) = deg( dg ) + g, with the following values for deg( d0 ).

g 2 -g 3 + g if g -is even g 2 -g 3 + 2g 2 -1 if g -is odd
Concerning the ẽi , the degrees are consecutive from deg(ẽ g-1 ) up to deg(ẽ 0 ) = deg(ẽ g ), the latter being equal to

3(g 2 -g 3 )/2 + 2g 2 -g -1 if g -is even 3(g 2 -g 3 )/2 + 3g 2 -g/2 -1 if g -is odd
Cantor [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF] gave simple expressions for the leading term and constant term of δ (respectively -(4y 2 ) g ψ 2 and (-1) g+1 ψ -1 ψ +1 ), from which we can deduce the degrees of d 0 and d g by evaluating δ at (x -X)/4y 2 . Assuming that there is no common factor to all the d i 's when g -is even, while the GCD of all the d i 's is f g-1 when g -is odd, these theoretical degrees are consistent with our experiments.

A quadratic bound in genus 3

The previous cubic bound was sufficient because its error only affects the final complexity bound by a constant in some O(). In genus 3, however, we want to compute the exact exponent of log q in the complexity so we need a bound that is quadratic in . We do so by using other induction formulas.

Theorem 4.14. In genus 3, the degrees of Cantor's -division polynomials are bounded by O( 2 ).

We first prove a bound on the degrees of the coefficients of the quantities α r and γ r defined in [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF], from which the wanted bounds will follow. The key tools are Propositions 4.11 and 4.12 that relate quantities at index to quantities at index around /2, in a similar fashion as for the division polynomials of elliptic curves. More precisely, the following lemma shows that when the index is (roughly) doubled, degmax α and degmax γ are roughly multiplied by 4, which leads to the expected quadratic growth. Proof. We first deal with the bound on degmax γ . Let us consider r and s around /2 such that = r + s -5: we take either r = s -3 = /2 + 1 if is even, or r = s -4 = ( + 1)/2 otherwise.

From Definition 4.9 and Proposition 4.11, the degree of γ [h]ψ s-r ψ r-2 ψ s-2 ψ r-1 ψ s-1 is that of the determinant of the matrix E rs [h] defined by:

E rs [h] =      α r-3 α s [0] α r-3 α s [1] ψ r-3 ψ s γ r-3 γ s [h] α r-2 α s-1 [0] α r-2 α s-1 [1] ψ r-2 ψ s-1 γ r-2 γ s-1 [h] α r-1 α s-2 [0] α r-1 α s-2 [1] ψ r-1 ψ s-2 γ r-1 γ s-2 [h] α r α s-3 [0] α r α s-3 [1] ψ r ψ s-3 γ r γ s-3 [h]     
.

Therefore we have an expression for the degrees of the coefficients of γ in terms of objects at index around r and s:

deg γ [h] ≤ deg det E rs [h] -deg(ψ r-2 ψ s-2 ψ r-1 ψ s-1 ).
In this last formula, the factor ψ s-r has been omitted, because s -r is either 3 or 4, and by Theorem 4.8 this has non-negative degree in any case. Thus, we simply bounded it below by 0 in the previous inequality. Before entering a more detailed analysis, we use the fact that α k (0) = ψ k-1 and γ k (0) = ψ k+1 (this is [28, (8.8)]) to rewrite the first column with expressions for which we have exact formulas for the degree:

E rs [h] =      ψ r-4 ψ s-1 α r-3 α s [1] ψ r-3 ψ s γ r-3 γ s [h] ψ r-3 ψ s-2 α r-2 α s-1 [1] ψ r-2 ψ s-1 γ r-2 γ s-1 [h] ψ r-2 ψ s-3 α r-1 α s-2 [1] ψ r-1 ψ s-2 γ r-1 γ s-2 [h] ψ r-1 ψ s-4 α r α s-3 [1] ψ r ψ s-3 γ r γ s-3 [h]     
.

The determinant of E rs [h] is the sum of products of 4 ψ factors and 4 α or γ factors. The degrees of the former are explicitly known, while by hypothesis we have upper bounds on the latter, since all the indices are at most ( + 9)/2. We can then deduce an upper bound on the degree of this determinant. All the ψ i have indices with i in the range [r -4, s] (remember that r ≤ s), and since their degrees increase with the indices, we can upper bound the degree of the products of the four ψ factors by 4 deg ψ s . Therefore we have

deg det E rs [h] ≤ 4(deg ψ s + C).
In order to deduce an upper bound on degmax γ , it remains to get a lower bound on the degree of the deg(ψ r-2 ψ s-2 ψ r-1 ψ s-1 ) term, and again by monotonicity of the degree in the index, it is bounded below by [START_REF] Adleman | Primality testing and Abelian varieties over finite fields[END_REF] Finally, the bound ≥ 10 is sufficient to ensure that the quantities r and s are at least 5, as required to apply Propositions 4.11 and 4.12. This condition would still hold for as small as 8 but our recurrence needs > 9 to propagate, or else ( + 9)/2 would be greater or equal to .

We can now finish the proof of Theorem 4.14. We define two sequences ( i ) i≥0 and (C i ) i≥0 as follows: let 0 = 10 and let C 0 be a bound on the degrees of the coefficients of all the α i and γ i for i ≤ 0 . Then for all i ≥ 1, we define the sequences inductively by

i+1 = 2 i -9 C i+1 = 4C i + 36 i+1 + 108.
By Lemma 4.15, for all i, and all ≤ i , the degrees degmax α and degmax γ are bounded by C i . The expression i = ( 0 -9)2 i + 9 = 3 • 2 i + 9 can be derived directly from the definition and substituted in the recurrence formula of C i+1 to get C i+1 = 4C i + 216 • 2 i + 432. This recurrence can be solved by setting Γ i = C i + 108 • 2 i + 144, so that Γ i+1 = 4 Γ i , and we obtain

C i = (C 0 + 252) 4 i -108 • 2 i -144.
Finally, for any , we select the smallest i such that ≤ i . This value of i is log 2 (( -9)/3) . The corresponding bound for degmax α and degmax γ is then C i , which grows like O( 2 ) (and we remark that the effect of the ceiling can make the constant hidden in the O() expression grow by a factor at most 3). Using [28, Eq. 8.10], i.e. δ (z) = α (z)γ (z){ι g }, we have degmax δ ≤ degmax α +degmax γ , and therefore the bound O( 2 ) also applies to the degrees of the coefficients of δ . And by Proposition 4.5, the same holds as well for the coefficients of /y. This concludes the proof of Theorem 4.14.

Remark. One could try to extend this method to larger g in the hope of getting a better bound than the cubic one proven in the previous section. In a nutshell, the quadratic bound was achieved because the 4 × 4 determinants involve 2 terms in either α 2 or γ 2 and 2 terms in ψ 2 . This led to a bound on the degrees of α and γ that was mutiplied by 4 each time was multiplied by 2. In larger genus, however, the balance between the two types of terms is broken because the (g + 1) × (g + 1) determinant is made up of (g -1) terms in α 2 and β 2 . A direct generalization of our method would therefore give a bound B on the degrees of α and β that is multiplied by 2(g -1) each time is multiplied by 2. In particular, for g ≥ 5, the growth of B seems already worse than cubic.

Chapter 5

Asymptotic complexity bounds in arbitrary genus

Let C be a hyperelliptic curve of genus g over a finite field F q of characteristic p and denote by J its Jacobian. In this chapter, we present a Las Vegas algorithm derived from Schoof and Pila's approaches to count points on hyperelliptic curves that achieves a time complexity in O((log q) cg ) for c a constant and g fixed with q growing and p large enough. This is joint work with Pierrick Gaudry and Pierre-Jean Spaenlehauer and most of this chapter is to appear as [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF].

Organization of the chapter. Section 5.1 describes a general algorithm for point-counting on Abelian varieties along with its complexity, assuming that the -torsion can be efficiently computed. Section 5.2 establishes the complexity result for multi-homogeneous polynomial systems that is required to obtain our claimed complexity bound. Section 5.3 contains the modelling of the -torsion under some mild assumptions on its structure. Finally, Section 5.4 describes the complete modelling of the -torsion, which is faithful even if the assumptions required in Section 5.3 are not satisfied.

Overview

This chapter aims to give a proof of the following result:

Theorem 5.1. There exists an explicitly computable constant c such that for all genus g, there exists an integer q 0 (g) such that for all prime power q = p n larger than q 0 (g) with p ≥ (log q) cg and for all imaginary hyperelliptic curves C of genus g defined over F q , the numerator L of the local zeta function of C from Proposition 1.42 can be computed with a probabilistic algorithm in expected time bounded by (log q) cg .

This complexity result is summarized by the notation O g ((log q) O(g) ), keeping in mind that g is fixed and q grows to infinity. Indeed, such a complexity statement can hide any factor that depends only on g: a running time in f (g)(log q) cg can be transformed into (log q) c g by taking a value c larger than c and adjusting q 0 (g), so that |f (g)| ≤ (log q 0 (g)) (c -c)g .

A typical example is the multiplication of two polynomials of degree d = (log q) O(g) . Using FFT-based techniques, this can be done in O(d) operations, which can be rewritten as (log q) O(g) (log((log q) O(g) )) k for some constant k and is therefore again in O g (log(q) O(g) ). Here the function f (g) that has been hidden in the operation is polynomial in g, but we will have cases where it is a combinatorial factor that grows very quickly with g and we make no effort to optimize it.

The algorithm that allows to prove the theorem is essentially the same as the one proposed by Pila for Abelian varieties, which is itself inspired by Schoof's algorithm for counting points on elliptic curves. Pila's algorithm reconstructs the numerator of the local zeta function of C by computing the action of the Frobenius on the -torsion for sufficiently-many prime numbers and by using the Chinese Remainder Theorem. A bird's eye view of this algorithm is given in Algorithm 6. The main difficulty resides in the step where one computes an explicit description of J[ ]. Since J[ ] is a 0-dimensional variety of degree 2g , what we will compute is a geometric resolution of the corresponding radical ideal, that is a univariate squarefree polynomial F (T ), together with 2g coordinate polynomials γ i (T ), such that the coordinates of the -torsion elements are the evaluations of the vector (γ 1 (T ), . . . , γ 2g (T )) at the roots of F . input : q ∈ Z >0 a prime power, and f ∈ F q [X] a monic squarefree of degree 2g + 1. output: The characteristic polynomial χ ∈ Z[T ] of the Frobenius endomorphism on the Jacobian J of the hyperelliptic curve defined over F q with Weierstrass form

Y 2 = f (X). ← 1; R ← 1; while R ≤ 2 2g
g q g + 1 do ←NextPrime( ); if divides q then ←NextPrime( ); end Compute a description of J[ ]; Compute a 2g × 2g matrix F with coefficients in Z / Z representing the action of the Frobenius on J[ ] ∼ = (Z / Z) 2g ; Compute the characteristic polynomial χ mod of the matrix F ; R ← R • ; end Reconstruct χ using the Chinese Remainder Theorem. Algorithm 6: A bird's eye view of Pila's point counting algorithm for hyperelliptic curves.

To be more precise, the Mumford coordinates are in fact a set of g affine systems of coordinates, each corresponding to a different weight of the represented divisor (the definition is recalled in Section 5.3). The variety J[ ] will accordingly be represented by a set of g geometric resolutions, each encoding -torsion divisors of a given weight w ∈ [1, g]. Generically, we expect that all the elements in J[ ] have weight g, except for the neutral element which has weight 0. Most of the chapter is dedicated to computing efficiently this representation for J[ ]. The cornerstone of the proof of Theorem 5.1 relies on the following statement. Proposition 5.2. Let C be a hyperelliptic curve of genus g over F q with Weierstrass form Y 2 = f (X) (f monic squarefree of degree 2g + 1) and J be its Jacobian variety. Let > g be a prime not dividing q. Assuming that the characteristic of F q is sufficiently large as in Theorem 5.1, there is a Las Vegas probabilistic algorithm which takes as input q, , f and which computes geometric resolutions for the varieties {J w [ ]} w∈ [1,g] of -torsion points of weight w in the Jacobian variety. This algorithm can be implemented by a Turing machine with space and expected time O g ( log q) O(g) .

Assuming this complexity bound, performing a complexity analysis as done in [START_REF] Pila | Frobenius maps of Abelian varieties and finding roots of unity in finite fields[END_REF] leads to a complexity bound for Algorithm 6 that corresponds to Theorem 5.1. We recall it here for completeness, with some simplifications due to the fact that we consider a probabilistic algorithm, so we can factor polynomials using Cantor-Zassenhaus' algorithm.

Proof of Theorem 5.1 assuming Proposition 5.2. By Weil's bounds, the absolute values of the coefficients of the characteristic polynomial χ are bounded by 2g g q g . Therefore at the end of the loop of Algorithm 6, these coefficients are completely determined by their values modulo all the primes that have been explored. It follows from [START_REF] Tenenbaum | Introduction to analytic and probabilistic number theory[END_REF]Cor. 10.1] that the largest in the loop is at most linear in g log q. From this and Proposition 5.2, computing the description of J[ ] as a union of geometric resolutions for all the J w [ ] can be achieved within expected complexity O g (log q) O(g) .

Factoring the univariate polynomials involved in the geometric resolutions can be done within the same time bound O g (log q) O(g) , since the sum of their degrees is 2g and factoring polynomials in finite fields can be done in time linear in log(q) and quasi-quadratic in the degree [START_REF] Von | Modern computer algebra[END_REF]Thm. 14.14]. Therefore, it is possible to construct a Mumford representation for each -torsion divisor within the same complexity, each of them possibly defined over a different extension of F q . In fact, due to the rationality of the group law that acts on J[ ], one of these extensions of F q contains all the others.

Using elementary linear algebra for the Frobenius endomorphism ϕ acting on J[ ] (seen as an F -vector space), we can deduce χ = χ mod . We first compute a basis of J[ ] by brute force and a dictionary of how all elements decompose on it. Then, the action of ϕ on the basis elements can be computed and the result is a matrix whose characteristic polynomial is χ . All of this fits in the O g ((log q) O(g) ) complexity bound. The loop is repeated O g (log q) times, and this additional factor does not affect the overall complexity.

Computing geometric resolutions

Main complexity result

The following proposition is a cornerstone of our complexity result for computing the -torsion of the Jacobian of a hyperelliptic curve. The statement and its proof combine three main ingredients: (1) the geometric resolution algorithm [START_REF] Giusti | A Gröbner free alternative for polynomial system solving[END_REF] and its version for finite fields [START_REF] Cafure | Fast computation of a rational point of a variety over a finite field[END_REF], which are methods for solving polynomial systems detailed in Section 2.4 whose complexity depends mainly on geometric degrees; (2) the multi-homogeneous Bézout bound presented in Section 2.4.1 which allows us to control the geometric degrees by separating the variables in our modelling in two blocks, where the block supporting most of the degrees has small cardinality;

(3) a variant of Bertini's theorem to process our polynomial system into a reduced regular sequence which is a valid input for the geometric resolution algorithm.

As we shall see in the next sections, our polynomial system modelling the -torsion will have two blocks of variables. The first block occurs with large degree O (1) but it has a very small cardinality in O(g). The second block has a larger cardinality, but the degrees of the equations with respect to this block do not depend on , but only on g. Taking this bi-homogeneous structure into account is crucial to reach our claimed complexity bound. The following proposition provides a bound on the complexity of solving polynomial systems having this structure, and the remainder of this section is dedicated to its proof. This section is devoted to describing tools that we will use to estimate the complexity of computing a convenient representation of the -torsion of the Jacobian of hyperelliptic curves.

Let us recall the notation of Section 2.4.1: if f ∈ F q [X 1 , . . . , X nx , Y 1 , . . . , Y ny ], then we let deg x (f ) (resp. deg y (f )) denote the degree of f (X 1 , . . . , X nx , y 1 , . . . , y ny ) ∈ F q [X 1 , . . . , X nx ] (resp. f (x 1 , . . . , x nx , Y 1 , . . . , Y ny ) ∈ F q [Y 1 , . . . , Y ny ]), where y 1 , . . . , y ny (resp. x 1 , . . . , x nx ) are generic values in F q . Proposition 5.3. There exists a probabilistic Turing machine T which takes as input polynomial systems with coefficients in a finite field F q and which satisfies the following property. For any function h : Z >0 → Z >0 , for any positive number C > 0 and for any ε > 0, there exists a function ν : Z >0 → Z >0 and a positive number D > 0 such that for all positive integers g, , n x , n y , d x , d y , m > 0 such that n x < C g, n y < h(g), d x < h(g) C , d y < h(g), m < h(g), for any prime power q such that the prime number p dividing q satisfies 2 nx+ny d nx x d ny y < p, and for

any polynomial system f 1 , . . . , f m ∈ F q [X 1 , . . . , X nx , Y 1 , . . . , Y ny ] such that • for all i ∈ [1, m], deg x (f i ) ≤ d x and deg y (f i ) ≤ d y ,
• the ideal I = f 1 , . . . , f m has dimension 0 and is radical, the Turing machine T with input f 1 , . . . , f m returns an F q ν(g) log -geometric resolution of the

variety {x ∈ F q | f 1 (x) = • • • = f m (x) = 0}
with probability at least 5/6, using space and time bounded above by ν(g) D g (log q) 2+ε .

Proof. Postponed to Subsection 5.2.3.

Input preparation

Since the geometric resolution requires its input to be a reduced regular sequence, we first need to ensure that we can construct such a sequence from our input system. A classical way to achieve this is to replace the input system by a generic linear combination of the polynomials. If the ideal generated by the input system is 0-dimensional and radical, then a variant of Bertini's theorem ensures that the obtained sequence is regular and reduced in the sense of Definitions 2.26 and 2.47. Proposition 5.4. [START_REF] Sommese | The numerical solution of systems of polynomials arising in engineering and science[END_REF]Thm. A.8.7] Let (f 1 , . . . , f m ) ∈ F q [X 1 , . . . , X nx , Y 1 , . . . , Y ny ] m be polynomials such that the ideal I = f 1 , . . . , f m has dimension 0 and is radical. Let d x , d y be two integers such that deg

x (f i ) ≤ d x , deg y (f i ) ≤ d y for all i ∈ [1, m].
Let p be the characteristic of F q , and assume that 2 nx+ny d nx x d ny y < p. For M an (n x + n y ) × m matrix with entries in F q , let (f

(M ) 1 , . . . , f (M ) nx+ny ) ∈ F q [X 1 , . . . , X nx , Y 1 , . . . , Y ny ] nx+ny be defined as        f (M ) 1 f (M ) 2 . . . f (M ) nx+ny        = M •       f 1 f 2 . . . f m       .
Then there exists a nonempty open subset O ⊂ F q (nx+ny)×m of the space of (n x + n y ) × m matrices such that for any M ∈ O, for any s ∈ [1, n x + n y ], and at any point (x, y) ∈ F q nx+ny such that f

(M ) 1 (x, y) = • • • = f (M ) s (x, y) = 0, the derivatives Df (M ) 1
(x, y), . . . , Df (M ) s (x, y) are linearly independent over F q . In particular, for any M ∈ O, the sequence (f

(M ) 1 , . . . , f (M ) nx+ny ) is reduced and regular.
Proof. This is a reformulation of [START_REF] Sommese | The numerical solution of systems of polynomials arising in engineering and science[END_REF]Thm. A.8.7] in the case of finite fields. In [START_REF] Sommese | The numerical solution of systems of polynomials arising in engineering and science[END_REF]Thm. A.8.7], this result is stated over the field C, but this statement holds over any field k, provided that an extra separability assumption is satisfied. More precisely, set n = n x + n y and let

V s ⊂ k n × k n m
be the variety of pairs ((x, y), M ) such that f

(M ) 1 (x, y) = • • • = f (M ) s (x, y) = 0.
In this setting, the extra condition that is required for the proposition to hold is that the projection π of V s to k n m must be separable for all s ∈ [1, n] (this is always true in characteristic 0). We refer to [START_REF] Steven | Bertini and his two fundamental theorems[END_REF]Thm. 4.2] for more details on this separability argument. In our setting, the degree of a generic fiber of π is bounded by 2 n d nx x d ny y < p using the multi-homogeneous Bézout bound (see e.g. Proposition 2.48) and hence the separability condition is satisfied.

Since we are looking at polynomial systems over finite fields, we must estimate the size of the extension of the base field that is required to find with sufficiently large probability a matrix M such that f

(M ) 1 , . . . , f (M )
nx+ny is reduced and regular. Lemma 5.5. Let (f 1 , . . . , f m ) ∈ F q [X 1 , . . . , X nx , Y 1 , . . . , Y ny ] m be polynomials satisfying the assumptions of Proposition 5.4 and such that their total degree is bounded above by d ∈ Z ≥0 . Set n = n x + n y and e = (2n + 1) log q (d + 1) + log q [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF] .

If M is an n × m matrix with entries in F q e picked uniformly at random, then the probability that (f

(M ) 1 , . . . , f (M ) n
) is a reduced regular sequence is bounded below by 10/11.

Proof

   F 1 (Λ, X, Y ) . . . F n (Λ, X, Y )    = Λ •    f 1 (X, Y ) . . . f m (X, Y )    .
For s ∈ [1, n], we consider the s × m matrix Λ (s) obtained by truncating Λ to its s first rows, a new set of variables {µ 1 , . . . , µ s-1 } and the following polynomial system:

F 1 (Λ (s) , X, Y ) = • • • = F s (Λ (s) , X, Y ) = 0 µ 1 • • • µ s-1 1 •         ∂F 1 ∂X 1 • • • ∂F 1 ∂X nx ∂F 1 ∂Y 1 • • • ∂F 1 ∂Y ny . . . . . . . . . . . . . . . . . . ∂F s ∂X 1 • • • ∂F s ∂X nx ∂F s ∂Y 1 • • • ∂F s ∂Y ny         = 0 • • • 0
This is a system of n + s polynomials of degree bounded above by d + 1 in n + s -1 + ms variables. By Bézout inequality (see e.g. [72, Thm. 1]), this system defines a variety V s which is either empty, or its degree is at most (d + 1) n+s . We remark that if V s is not empty, then it has dimension at least ms -1 since its vanishing ideal is generated by n + s elements. The Zariski closure of its projection W s to the space F q sm of matrices Λ (s) is either empty, the whole space or a proper sub-variety. By Proposition 5.4, it must be empty or a proper sub-variety. Next, we remark that the degree of the image of a variety by a linear projection cannot increase. Therefore, the sum of the degrees of the irreducible components of W s is also bounded by

(d + 1) n+s if W s = ∅.
In what follows, we let h s (λ 11 , . . . , λ sm ) denote a polynomial vanishing on W s of degree bounded by (d + 1) n+s (we set h s (λ 11 , . . . , λ sm ) = 1 if W s = ∅).

The Schwartz-Zippel Lemma implies that the cardinality of the set

E =         M 11 • • • M 1m . . . . . . . . . M n1 • • • M nm    ∈ F nm q e | h 1 (M 11 , . . . , M 1m ) • • • h n (M 11 , . . . , M nm ) = 0     
is bounded above by q e /11, for the value of e given in the statement. The proof is concluded by noticing that for any M ∈ E, for any s ∈ [1, n], and for any (x, y) ∈ F q n such that f

(M ) 1 (x, y) = • • • = f (M ) s
(x, y) = 0 the derivatives Df M 1 (x, y), . . . , Df (M ) s (x, y) span the normal space at (x, y) to the variety associated with f

(M ) 1 , . . . , f (M ) s . Hence, f (M ) 1 , . . . , f (M ) n is a reduced regular sequence.
Once we have a reduced regular sequence, we can use Theorem 2.53 to solve the system. We note that in [START_REF] Cafure | Fast computation of a rational point of a variety over a finite field[END_REF] there is a general assumption that for all s ∈ [1, n] the intermediate ideals f

(M ) 1 , . . . , f (M ) s
define absolutely irreducible varieties. However, the proof of Theorem 2.53 does not require this assumption (this assumption is only required in algorithms for finding a rational point in [START_REF] Cafure | Fast computation of a rational point of a variety over a finite field[END_REF]Section 6]). To apply the theorem, we need our input to be represented by division-free straight line programms (DFSLP) as in Definition 2.49 and we can bound the size of such SLP using Lemma 2.50.

The last ingredient to derive Proposition 5.3 from Theorem 2.53 is an upper bound on δ = max i deg f 1 , . . . , f i which was given in Proposition 2.48. Let us now complete the proof of Proposition 5.3.

Proof of the main complexity result

Proof of Proposition 5.3. Set n = n x + n y . First, we note that if f 1 , . . . , f m ∈ F q [X 1 , . . . , X nx , Y 1 , . . . , Y ny ] is represented by a straight-line program over F q with space S and time T , then for any e ∈ Z ≥0 and any m × n matrix M with entries in F q e , the sequence f

(M ) 1 , . . . , f (M ) n ∈ F q e [X 1 , . . . , X nx , Y 1 , . . . , Y ny ]
can be represented by a straight-line program over F q e with space S and time T , where S = O(S) and T = O(T + m n). We consider the probabilistic Turing machine which performs the following steps:

1. It chooses an m × n matrix uniformly at random with entries in F q e , with e = max (2n + 1) log q (d + 1) + log q (11) , log q (60 n 4 d δ) ,

where d = d x + d y = ( C + 1) h(g), n = n x + n y = Cg + h(g), δ = 2 n d nx x d ny y = (2h(g)) Cg+h(g) C 2 g . Using the inequalities n x < C g, n y < h(g), d x < h(g) C , d y < h(g), we get that e = O g (log q ); 2. It constructs the straight-line program representing f (M ) 1 , . . . , f (M ) n with space S = O(S) and time T = O(T + m n); have ((x, y) -∞) = δ x -X 4y 2 , ε x -X 4y 2 .
Let us now restate Theorem 4.13, which is proven in Section 4.2 of Chapter 4 :

The polynomial δ (X) has degree g and its coefficients are polynomials in F q [x] of degree bounded by 1 3 g 3 +O g ( 2 ). The polynomial ε (X)/y has degree less than g and its coefficients are rational fractions in F q (x). The degrees of the numerators and denominators of these coefficients are bounded by 2 3 g 3 + O g ( 2 ). Furthermore, any root of a denominator is also a root of the leading coefficient of δ (X).

Remark that this result is also proven for any non-prime > g, it will be used in Section 5.4 where we handle non-generic situations. However, we will also need to define analogues of these polynomials to describe P when P is not generic. This is done in Definition 5.9 and we also remark later on that the previous degree bounds still apply to non generic division polynomials.

Later on, we will need explicit names for these coefficients of δ and ε , so we define the univariate polynomials d i and e i (the notation does not show the dependence on for simplicity) such that, after clearing denominators we have:

δ x -X 4y 2 = g i=0 d i (x)X i , and ε x -X 4y 2 = y g-1 i=0 e i (x) e g (x) X i . Definition 5.6.
In what follows, we shall say that an element of J is -generic if it has weight g and the corresponding reduced divisor g i=1 (P i -∞) satisfies the following two properties:

• For any i, the u-coordinate of the divisor (P i -∞) in Mumford form has degree g;

• For any i = j, the u-coordinates of the divisors (P i -∞) and (P j -∞) are coprime.

This implies that the P i are distinct, and that if an affine point P occurs in the support of a (P i -∞) then neither P nor -P appears in the support of another (P j -∞).

Proposition 5.7. For any ε > 0, there is a constant D such that for all prime > g coprime to the base field characteristic, there is a Monte Carlo algorithm which computes an F q egeometric resolution of the sub-variety of J[ ] consisting of -generic -torsion elements, where e = O g (log ). The time and space complexities of this algorithm are bounded by O g ( Dg (log q) 2+ε ) and it returns the correct result with probability at least 5/6.

Proof. Let D = g i=1 (P i -∞) be an -generic divisor in J. We shall consider a system equivalent to D = 0 but let us first introduce some notation. For each point P i = (x i , y i ) in the support of D, we denote by u i , v i the Mumford form of (P i -∞) and by (α ij , β ij ) 1≤j≤g the coordinates of the g points in its support counted with multiplicities, which means that for any i the g roots of u i are exactly the α ij , and that for any j, β ij = v i (α ij ). Note that using the previous notation,

u i (X) = δ x i -X 4y 2 i and v i (X) = ε x i -X 4y 2 i .
We have D = 0 if and only if the sum of the divisors g i=1 (P i -∞) is a principal divisor. The only pole is at infinity, so this is equivalent to the existence of a non-zero function ϕ ∈ F q (C) of the form P (X) + Y Q(X) with P and Q two polynomials such that the g 2 points (α ij , β ij ) are the zeros of ϕ, with multiplicities. Since we want ϕ to have g 2 affine points of intersection with the curve C (once again, counted with multiplicities), the polynomial Res Y (Y 2 -f, P + Y Q) = P 2 -f Q 2 must have degree g 2 which yields 2 deg(P ) ≤ g 2 and 2 deg(Q) ≤ g 2 -2g -1. Exactly one of those two bounds is even (it depends on the parity of g), and for this particular bound, the inequality must be an equality, otherwise the degree of the resultant would not be g 2 . Since the function ϕ is defined up to a multiplicative constant, we can normalize it so that the polynomial P 2 + f Q 2 is monic, which is equivalent to enforce that either P or Q is monic depending on the parity of g.

For a fixed i ∈ [1, g], requiring the (α ij , β ij ) to be zeros of ϕ amounts to asking for the α ij to be roots of P (X) + Q(X)v i (X), with multiplicities. Since the α ij are by definition the roots of the u i , D = 0 is equivalent to g congruence relations P + Qv i ≡ 0 mod u i which we can rephrase using Cantor's polynomials:

P (X) + ε x i -X 4y 2 i Q(X) ≡ 0 mod δ x i -X 4y 2 i . (5.1)
Thus, for any -generic divisor, D = 0 is equivalent to the existence of P and Q satisfying the above g congruence relations.

The variables are the coefficients of P and Q, as well as the x i and y i . With the degree conditions and the normalization, we have g 2 -g variables coming from P and Q. Adding the 2g variables x i and y i , we get a total of g 2 + g variables. Each one of the g congruence relations (5.1) amounts to g equations providing a total of g 2 conditions on the coefficients of P and Q. The fact that the (x i , y i ) are points of the curve yields the g additional equations

y 2 i = f (x i )
. Finally, we have to enforce the -genericity of the solutions, which can be done by requiring that i d g (x i ) i<j Res(u i , u j ) = 0. Therefore, we get a polynomial system with g 2 + g equations in g 2 + g variables, together with an inequality. We remark that in principle, the denominators e g (x i ) involved in ε would generate additional conditions, but by Theorem 4.13 this is already covered by the condition d g (x i ) = 0.

In order to apply Proposition 5.3, we now estimate the degrees to which the variables occur in the equations. We start with the equations coming from (5.1). Each congruence relation is obtained by reducing P + Qv i , which is a polynomial of degree O(g 2 ) in X, by u i which is of degree g. We can do it by repeatedly replacing X g by -j<g (d j (x i )/d g (x i ))X j , which we will have to do at most O(g 2 ) times. Since by Theorem 4.13 the d j have degree in O g ( 3 ) in x i the fully reduced polynomial will have coefficients that are fractions for which the degrees of the numerators and of the denominators are at most O g ( 3 ) in the x i variables. In these equations, the degree in the y i variables and in the variables for the coefficients of P and Q is 1. The degrees in x i and y i in the curve equations are 2g + 1 and 2 respectively.

It remains to study the degree of the inequality. Each resultant is the determinant of a 2g × 2g Sylvester matrix whose coefficients are the d i , which have degrees bounded by O g ( 3 ). Since for any i there are exactly g resultants involving x i in the product, the degree of this inequality in any x i is in O g ( 3 ), and it does not involve the other variables. In order to be able to use Proposition 5.3, we must model this inequality by an equation, which is done classically by introducing a new variable T and by using the equation

T • i d g (x i ) i<j Res(u i , u j ) = 1.
To conclude, we have a polynomial system with two blocks of variables: the 2g variables x i and y i and the g 2 -g variables coming from the coefficients of P and Q. The degree of the equations in the first block of variables grows cubically in , while the degree in the other block of variables depends only on g. The system therefore verifies the conditions of Proposition 5.3 and the complexity follows, provided that we can show that the system is 0-dimensional and radical.

Let us consider the sub-variety S ⊂ J[ ] consisting of -generic -torsion elements, and I the corresponding ideal. More precisely, we see I as the ideal of a sub-scheme of the -torsion scheme, which is the kernel of a finite and étale map because is coprime to the characteristic. Therefore I is 0-dimensional and radical. Since all the elements in S have the same weight g we can use the Mumford coordinates u(X), v(X) with deg u = g and deg v < g -1 as a local system of coordinates to represent them. But the polynomial system that we have built is with the (x i , y i ) coordinates, that is, it generates the ideal I unsym obtained by adjoining to the equations defining I the 2g equations coming from u(X) = (X -x i ) and y i = v(x i ). Then we have deg I unsym = g! deg I. By the -genericity condition, all the fibers in the variety have exactly g! distinct points corresponding to permuting the (x i , y i ) which are all distinct. Therefore the radicality of I implies the radicality of I unsym and we can apply Proposition 5.3 to our polynomial system.

We emphasize that, although the algorithm in Proposition 5.7 is Monte Carlo, we expect that it returns a correct and verifiable result in most of the cases. Indeed, if all the 2g -1 nonzero -torsion elements are -generic (which is the situation that we expect to happen in most of the cases) and if the algorithm returns the correct result, then we can check that these elements are indeed -torsion elements, and that we have all of them. In that favorable case, the proof of Proposition 5.2 is completed.

Non-generic cases

For most of the curves, we expect that for all the primes considered in Algorithm 6 the set J[ ] contains only -generic elements (apart from 0), so that the result of the previous section is sufficient. If this is not the case, then it is very likely that the orbit under the Frobenius endomorphism of the -torsion elements computed contains an F -basis of J[ ], so that we can easily recover the missing elements using the group law or the Frobenius. Still, unless we could prove otherwise, we can not exclude the case where the set of -generic -torsion elements generate a proper subgroup of J[ ] which is stable under the action of ϕ. In that unlikely case, we would maybe not be able to deduce χ . An option is then to skip this unlucky and proceed with the algorithm; this would only marginally increase the largest considered . But then, we would be left to prove that the number of unlucky 's is small enough, which seems as hard.

Our only remaining option is to perform a tedious, systematic study of all the non-generic cases and to show that they can all be modelled by polynomial systems that can be solved within the target complexity. The number of these systems must also be bounded independently of , so that with our setting where g is fixed and q grows to infinity the global complexity remains the same. All this is the purpose of Subsection 5.4.2. As a warm-up, we will first describe some simple degeneracy cases and, informally, how to deal with them. Since several causes of non-genericity may simultaneously appear, we then describe a data structure to encode all the possible non-generic cases. Then, we detail how to build a polynomial system modelling each of these cases. Note that all these systems will have more equations (O(g 4 ), see Table 5.2) than variables (O(g 2 ), see Table 5.1), which is no wonder since we expect them to have no solution in general.

Lastly, we point out that Subsections 5.4.1 and 5.4.2 can easily be skipped at first reading as it is only devoted to proving the main theorem of the chapter and will not be used in other chapters or sections of this thesis.

Simple degeneracies

Case 1: Low weight -torsion elements. In order to compute the -torsion elements that satisfy all the conditions of -genericity except that their weight is less than g, we can proceed as in the proof of Proposition 5.7 with the following modifications. This time, D = w i=1 (P i -∞), and the only difference is that there are w points instead of g. Following the same method, we search ϕ of the form P (X) + Y Q(X) such that the points in the reduced divisor (P i -∞) are exactly the zeros of ϕ. We now want ϕ to have gw points of intersection with C instead of g 2 , and we similarly deduce 2 deg(P ) ≤ gw and 2 deg(Q) ≤ gw -2g -1. By similar parity considerations we deduce that exactly one of these bounds is even, and the corresponding polynomial will be made monic to normalize the function. The number of variables from P and Q is thus gw -g, and after adding the 2w variables x i and y i , we have a total of (g + 1)w + w -g variables. As for the number of equations, the number of congruence relations is now w but the relations themselves remain unchanged, and we get a total of (g + 1)w equations after adding the w equations y 2 i = f (x i ). Since we keep the degrees unchanged but reduce the number of variables, the complexity bounds are still valid in this case.

Case 2: Multiple points in the -torsion divisor. It may happen that the reduced forms of -torsion divisors contain multiple points. In that case, the u-coordinate in the Mumford representation of such a point is not squarefree. Although the modelling by the polynomial system described in Section 5.3 is still faithful, such multiple points will induce multiplicities since what we actually compute is the variety describing the points in the reduced divisor. Therefore, the ideal generated by the polynomial system is not radical in this case. We use the following workaround: For λ = (λ 1 , . . . , λ k ) a partition of w, we write a polynomial system generating a radical ideal whose solutions represent the reduced divisors of the form

D = λ 1 P 1 + • • • + λ k P k - w ∞.
To build this polynomial system, we do as if we were looking for elements of weight k, but instead of multiplying P i by , we multiply it by λ i , using Cantor's polynomials δ λ i and ε λ i . This system has the same number of variables and equations as if we were looking for elements of weight k. Since λ i is bounded above by g, the degrees of the equations are multiplied by a quantity which depends only on g but not on . Consequently, the complexity bounds are still valid in this case. To avoid multiplicity problems that could arise from subpartitions of λ, we add the inequalities x i = x j for i = j, where x i is the x-coordinate of P i . Again, this does not change our complexity estimate.

Case 3: Low weight after multiplication by .

We study here the case where thegenericity property that is not verified is that the (P i -∞) are of weight g, all the others being satisfied. We denote by w i ≤ g the weight of (P i -∞). Then each u i will have degree w i , so that each congruence relation (5.1) yields only w i equations instead of g. In Cantor's article (on top of page 141 in [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF]), it is stated that • (P i -∞) is of weight w i if and only if for any k such that w i < k ≤ g we have ψ -k+w i +1 (x i ) = 0 and ψ -g+w i (x i ) = 0, where the polynomials ψ i are efficiently computable and of degrees bounded by O g ( 2 ). Therefore the total number of equations is unchanged. Since the function ϕ will have to vanish at i w i points instead of g 2 , we also reduce the degree of P and Q accordingly. The number of variables from P and Q thus becomes i w i -g which is smaller than in the generic case, while the number of equations remains the same, and their degrees are also smaller. Thus we can still describe this non-generic situation with systems that can be handled within the same complexity bounds.

Case 4: Non semi-reduced principal divisor. We now consider the case where thegenericity property fails due to the presence of a point of abscissa ξ which appears with positive multiplicity ν i in an (P i -∞) and with a negative multiplicity -ν j in another (P j -∞). Let ν = min(ν i , ν j ). This event implies that (X -ξ) ν divides both P and Q so that we can write ϕ(X, Y ) = (X -ξ) ν ( P (X) + Y Q(X)), with P coprime to Q. The number of variables coming from ϕ is reduced compared to the generic case: we add one (the variable ξ), but the number of coefficients in P is reduced by ν compared to P , and the same is true for Q and Q. To write the conditions on ϕ, we write the congruences exactly like in the generic case and we add conditions to ensure that the multiplicities are respected. Namely, u i , u j and v i + v j must all be divisible by (X -ξ) ν , which adds 3ν ≤ 3g equations. The degree in ξ in these equations is bounded by g 2 . Since this does not depend on , the complexity result is maintained. The general study will cover the case where there are several ξ's at which the semi-reduction genericity assumption fails. Also, there is no reason why such a root ξ should occur in only two of the (P i -∞)'s. Such a situation will be also taken into account in Section 5.4.2.

Case 5: Multiplicity in D. The last situation that could lead to not satisfying -genericity is when the same point is shared within different (P i -∞), which causes some trouble as the congruence relations of the generic case will not be able to handle the subsequent multiplicity. Note that if the multiplicity occurs only within a single (P i -∞) this is already dealt within the generic case. One can view our method as using the Chinese remainder theorem on the modular conditions (5.1) to see that multiplicities within a single congruence is handled whereas common factors within different u i -polynomials are an obstacle that needs special strategies. There is some similarities with the previous case that also implies a common factor between two different u i 's.

We devise the following workaround: instead of considering the congruences modulo the u i 's separately, we group them into a single congruence of the form P + QV ≡ 0 mod U , with U = i u i and V a polynomial whose coefficients shall be new variables such that V ≡ v i mod u i for all i. Note that if some non semi-reduced case occurs simultaneously, U must actually be divided by the aforementioned X -ξ; such situations will be dealt with later, in the general study (Section 5.4.2). In order for V to encode enough information and ensure that the condition P + QV ≡ 0 mod U enforces a function with exactly the correct principal divisor, we have to follow Mumford's representation and add the condition U |V 2 -f , with deg V < deg U . Together with the other conditions on U and V , we then have existence and unicity (up to a constant factor): they are the result of Cantor's composition algorithm.

In order to write the polynomial system modelling this situation, some care must be taken so as to stay within the scope of Proposition 5.3. The polynomial U is of degree g 2 and its coefficients are polynomials in the x i 's of degrees bounded by O g ( 3 ). New variables are added for the coordinates of V . For each i, the condition V ≡ v i mod u i is converted in O(g) equations, with degrees O g ( 3 ) in x i and 1 in the coordinates of V . The condition U |V 2 -f contributes to O(g 2 ) additional equations, each of them of degree 2 in the coordinates of V , and degree O g ( 3 ) in the coordinates x i . And finally, the equation P + QV ≡ 0 mod U , contributes also to O(g 2 ) equations, each of them of degree 1 in the coordinates of V , P and Q, and of degree O g ( 3 ) in the coordinates x i . Skipping the details, we can again apply Proposition 5.3 and get the expected complexity.

Combining all possible degeneracies

A data structure to describe each type of non-genericity. We want to describe a family of polynomial systems that covers all the possible non-generic cases, possibly mixing all kind of problems that have been listed. We begin by grouping together non-genericity situations that can be covered by the same polynomial system.

We consider an -torsion divisor D of weight w ≤ g (like in case 1). Next, a partition λ = (λ 1 , . . . , λ k ) of w is picked to represent the multiplicity pattern in the u-coordinate of the -torsion divisor, as in case 2 so that D = k i=1 λ i (P i -∞). Then, a vector t = (t 1 , . . . , t k ) is chosen, to represent the weights of the P i after multiplication by λ i as in case 3: For i in [1, k], the reduced divisor λ i (P i -∞) is of weight t i . Then, we need to consider how many common or opposite points these divisors are in their support to take into account the cases 4 and 5. We denote by Q 1 , . . . , Q s the points in the union of the supports of all the reduced divisors λ i (P i -∞), keeping only one point in each orbit under the hyperelliptic involution. We represent the non-genericity by a k × s matrix M such that its non-zero entries

m ij satisfy m ij = ord Q j (λ i (P i -∞)) when Q j is in the support of λ i (P i -∞) or m ij = -ord Q j (λ i (P i -∞)) when the hyperelliptic conjugate Q j of Q j is
in the support. Note that this matrix, that we shall call the matrix of shared points, represents both multiplicities and non-semi-reduction. Since the row i represents what happens with points in the support of λ i (P i -∞), which is of weight t i , the sum of the absolute values of the entries of the row i of M is equal to t i . Also, by construction, in each column, there is at least one non-zero entry. An additional complication arises when one of the P i is a ramification point, i.e. when its y-coordinate is zero, because this would cause multiplicities if care is not taken, leading to non-radicality of the polynomial system we build. Since this corresponds to P i -∞ being of order 2, the weight t i is equal to λ i mod 2, namely 0 or 1. If t i = 0, then the divisor D -λ i (P i -∞) is also an -torsion divisor of weight w -λ i , so that we can reconstruct D from another polynomial system. There is however no obvious way to preclude the possibility t i = 1. Therefore, we will encode the fact that P i is a ramification point by a bit i that can be set only in the cases where t i = 1 and λ i = 1.

A tuple (w, λ = (λ 1 , . . . , λ k ), t = (t 1 , . . . , t k ), = ( 1 , . . . , k ), M ) is from now on the piece of data with which we represent a non-generic situation, and a polynomial system will be associated to each tuple. Changing the order of the columns of M amounts to permuting the points Q j . Also, changing the sign of all the entries of a column j corresponds to taking the opposite of the point Q j . While it would not change the final complexity not to do so, it therefore makes sense to consider only normalized tuples, in the sense that the columns of M are sorted in lexicographical order, and the choice between a point Q j and its opposite is done so that the sum of all elements in the corresponding column is nonnegative. We remark that this is not enough to guarantee that two normalized tuples do not describe similar situations. For instance, if λ = (1, . . . , 1) and two t i values are equal, then permuting the two corresponding rows could lead to another normalized matrix that would describe the same situation. This is not a problem for the general algorithm: we might get the same -torsion elements from two different systems, but what is important to us is non-multiplicity (i.e. radicality of the ideal) in each individual system. Definition 5.8. A normalized non-genericity tuple is a tuple (w, λ, t, , M ), where 1 ≤ w ≤ g is an integer, λ = (λ 1 , . . . , λ k ) is a partition of w, t and are vectors t = (t 1 , . . . , t k ) and = ( 1 , . . . , k ) of the same length as λ with 1 ≤ t i ≤ g and i ∈ {0, 1}, where i can be 1 only if t i = 1 and λ i = 1, and finally M is a matrix with k rows and s columns, where 0 ≤ s ≤ g k, and its entries are integers such that:

• For all 1 ≤ i ≤ k, the sum of the absolute values of the entries on the row i is equal to t i ;

• The columns are sorted in lexicographical order;

• The sum of the rows of the matrix is a vector whose coordinates are nonnegative.

From the discussion above, any -torsion element is described by (at least) one normalized non-genericity tuple. In the following we will give a polynomial system for each normalized non-genericity tuple, so that all -torsion elements described by it are modelled by this system. Furthermore, the system will have the properties required to apply Proposition 5.3, so that the complexity result will follow.

Before starting this, we discuss briefly a bound on the number of normalized non-genericity tuples. Assuming everything is always of maximal size, and not sorted, we have g choices for w, then at most g g choices for λ and t, at most 2 g choices for , and finally at most (g 2g+1 ) g 2 choices for M , which gives g O(g 3 ) . As bad as it is, such a factor that depends only on g will not hinder the final complexity estimate in O g (log q) O(g) , as explained in Section 5.1.

Non-generic division polynomials.

The expression of λ i • (P i -∞) in Mumford representation will be the same as in the generic case when its weight t i is equal to g and Theorem 4.13 can be applied. But when t i is strictly less than g, the weight-g coordinate system is no longer available; this is explicitly visible by the fact that the denominator e g (x i ) of the coefficients of the v-polynomial vanishes.

Therefore we need to use a weight-t coordinate system for describing a non-generic divisor λ i • (P i -∞) in Mumford representation. In this paragraph, in order to keep simple notation, we will work with (P i -∞), keeping in mind that we do not impose any condition on , so that we can later replace by λ i .

We consider, for 1 ≤ t < g, the set V ,t of points of the curve which are mapped to a weight-t divisor after multiplication by :

V ,t = {(x, y) ∈ C | • ((x, y) -∞) is of weight t} .
This is a (possibly empty) variety of dimension 0 that can be described with the classical (generic) division polynomials of Cantor: we define ∆ ,t = GCD(ψ (x), ψ -1 (x), . . . , +ψ -g+t+1 (x)), so that V ,t is precisely the set of points (x, y) for which ∆ ,t (x) = 0 and ψ -g+t (x) = 0, as stated by Cantor in [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF] on page 141. The polynomial ψ is essentially the square root of the leading coefficient of δ . It can be computed efficiently and has degree in O g ( 2 ) by Theorem 8.17 of [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF]. To avoid multiplicities, we define ∆ ,t (x) the square-free polynomial whose roots are exactly the roots of ∆ ,t (x) that are not roots of ψ -g+t (x). The degree of ∆ ,t (x) is again bounded by O g ( 2 ). Furthermore since the points of V ,t come in pairs of conjugate points sharing the same x-value, the degree of V ,t is 2 deg ∆ ,t (x). Definition 5.9. The non-generic division polynomials u ,t and v ,t are the polynomials in X with coefficients in

F p [x, y]/( ∆ ,t (x), y 2 -f (x)) such that • ((x, y) -∞) = u ,t (X), v ,t (X) , in weight-t Mumford representation: u ,t (X) is monic of degree t, v ,t (X) is of degree at most t -1 and they satisfy u ,t | v 2 ,t -f .
Just like for the classical division polynomials, the coefficients of u ,t (X) and of 1 y v ,t (X) are in F p [x]/ ∆ ,t (x) (they do not depend on y) and we can choose representatives of them that are polynomials of degree less than deg ∆ ,t (x). Hence, the bounds given in Theorem 4.13 are also valid for the non-generic division polynomials; and since there are no denominators in the coefficients of v ,t (X), the other part of Theorem 4.13 also holds trivially.

The non-generic division polynomials can be computed efficiently, once the classical division polynomials are known: the polynomial ∆ ,t (x) can be easily deduced, and then working in the quotient algebra yields the result in a time O g ( 2 ), which is negligible compared to the other parts of the algorithm.

Polynomial system derived from a normalized non-genericity tuple.

We now want to write a polynomial system whose solutions are the -torsion elements following a given normalized non-genericity tuple (w, λ, t, , M ).

First, we need variables for the coordinates of the P i such that the -torsion element is D = k i=1 λ i (P i -∞), with P i = ±P j for all i = j. As a consequence, we introduce 2k variables for the coordinates (x i , y i ) of all the points P i . Since these points are on the curve, they satisfy y 2 i = f (x i ), however if P i is a ramification point this can be simplified into y i = 0 = f (x i ), which avoids the multiplicities. We get a first set of equations

y 2 i = f (x i ) = 0, for all i in [1, k] such that i = 0, y i = f (x i ) = 0, for all i in [1, k] such that i = 1. (Sys.1)
As we just discussed, we must model the fact that P i = ±P j for i = j. This is done via the following set of inequalities:

x i = x j , for all i, j in [1, k] such that i = j. (Sys.2)
The next step is to enforce the fact that the element λ i (P i -∞) is of weight t i . For the indices for which t i < g, this is encoded by the equation defining V λ i ,t i :

∆λ i ,t i (x i ) = 0, d t i (x i ) = 0, for all i in [1, k] such that t i < g, (Sys.3)
while for the indices for which t i = g, this is encoded by the non-vanishing of the leading coefficient of the Cantor polynomial in degree λ i :

d g (x i ) = 0, for all i in [1, k] such that t i = g. (Sys.4)
We now need to model the fact that the λ i (P i -∞) satisfy the conditions given by the matrix M . We write λ i (P i -∞) = u i (X), v i (X) in Mumford representation, where u i (X) and v i (X) are Cantor's classical division polynomials in degree λ i if t i = g or the non-generic division polynomials u λ i ,t i and v λ i ,t i , if t i < g. In both cases, these are polynomials in X whose coefficients are polynomials in x i and y i . Recall that the entries of M , denoted by (m ij ) i∈ [1,k],j∈ [1,s] , are such that m ij is the order of Q j in λ i (P i -∞) if it is positive, or the opposite of the order of Q j if it is negative. To this effect, we introduce s new variables ξ j for the abscissae of the Q j , and the following equations enforce the multiplicities:

u (n) i (ξ j ) = 0, for all i, j in [1, k] × [1, s] and for all n ≤ |m ij | -1 (Sys.5) u (|m ij |) i (ξ j ) = 0, for all i, j in [1, k] × [1, s] (Sys.6) v i (ξ j ) -v i (ξ j ) = 0, for all i, i , j such that m ij m i j > 0 (Sys.7) v i (ξ j ) + v i (ξ j ) = 0, for all i, i , j such that m ij m i j < 0 (Sys.8)
ξ j = ξ j , for all j = j . (Sys.9)

In Equations Sys.5 and Sys.6, the notation u

(n) i
is for the n-th derivative of u i . This simple way of describing multiple roots is valid because the characteristic is large enough.

The next step of the construction is to consider a semi-reduced version of the divisor D = k i=1 λ i (P i -∞). This semi-reduction process can be described directly on the matrix M : if two entries in a same column have opposite signs, a semi-reduction can occur (corresponding to subtracting the principal divisor of the function (x -ξ j )), thus reducing the difference between these entries. This semi-reduction can continue until one of these two entries reaches zero. This whole process can be repeated as long as there are still columns containing entries with opposite signs. This is formalized in Algorithm 7, which takes as input a matrix M and returns a matrix M with the same dimensions such that if M describes all the multiplicities in a divisor, then M describes all the multiplicities of a semi-reduced divisor equivalent to the input divisor. More precisely, the matrix M satisfies the following properties: [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF] In each column, all elements are nonnegative; [START_REF] Abelard | Counting points on genus-3 hyperelliptic curves with explicit real multiplication[END_REF] The sum of the rows of M equals the sum of the rows of M ; (3) For all i, j such that M i,j is nonnegative,

M ij ≤ M ij .
Data: M the k × s matrix of shared points of the system Result: M , the matrix after semi-reduction M ← k × s zero matrix for j from 1 to s do

µ j ← k i=1 M ij for i from 1 to k do if M ij > 0 then M ij ← min(M ij , µ j ) µ j ← µ j -M ij else M ij ← 0 end end end return M
Algorithm 7: Reducing the matrix of shared points

The function ϕ that we will use to model the principality of the divisor D will have two parts: a product of "vertical lines" corresponding to semi-reductions, and a part of the form P (X)+Y Q(X), where P and Q are coprime. Modelling the existence of this second part requires to introduce new entities u i that are the u i polynomials from which we remove the linear factors coming from semi-reduction as described by M . Formally, we have the following equations, defining u i :

u i (X) = u i (X) s j=1 (X -ξ j ) |m ij |-m ij , for all i ∈ [1, k].
(Sys.10) Indeed, by definition of the matrix M , the factor (X -ξ j ) |m ij | divides exactly u i (X), and the factor (X -ξ j ) m ij divides exactly u i (X). In order to express these conditions efficiently in the polynomial system, we introduce new variables for the coefficients of the u i polynomials.

Since we are now dealing with a semi-reduced divisor, we can consider its Mumford representation, i.e. two polynomials U and V with the following properties:

U = k i=1 u i , U |V 2 -f, (Sys.11) V ≡ v i mod u i , for all i ∈ [1, k]. (Sys.12)
The expression of U is simple enough, so we do not have to introduce new variables for its coefficients. However, this will be necessary for the coefficients of the V polynomial. Finally, in order to impose that the semi-reduced part of ϕ has exactly the zeros described by this divisor, we have the equation

P + QV ≡ 0 mod U, (Sys.13)
which is expressed with new variables for the coefficients of P and Q.

In Table 5.1, we summarize all the variables used in the polynomial system and count them. A key quantity for this count is the degree of U which is the sum of the degrees of the u i 's. It can be computed directly from the tuple (w, λ, t, , M ). Then, to ensure existence and unicity of the V polynomial to represent the semi-reduced divisor, we have to impose that deg V < deg U , so that we have exactly deg U variables for the coefficients of V . For the polynomials P and Q, we need the degree of P 2 -Q 2 f to be exactly deg U . After a normalization like in Section 5.3 depending on the parity of deg U , we get deg U -g variables for their coefficients.

Variables

Number of variables Bound Coordinates (x i , y i ) of P i 2k 2g Abscissae ξ j of shared points s, column-size of the matrix M g 2 Coefficients of the u i polynomials deg

U = i (t i -j (|m ij | -m ij )) g 2 Coefficients of the V polynomial deg U g 2 Coefficients of the P and Q polynomials deg U -g g 2 -g Total s + 2k + 3 deg U -g 4g 2 + g Table 5
.1: Summary of the variables in the polynomial system corresponding to a normalized non-genericity tuple (w, λ, t, , M ).

In order to apply Proposition 5.3, we need to evaluate the degrees of all the equations and inequalities that we have listed, with respect to two groups of variables: The first group contains just the variables x i and y i , and we will denote deg 1 (f ) the degree of a polynomial f with respect to those variables (said otherwise, deg 1 (f ) is the degree of f if we consider only the symbols x i , y i as variables, and all the other indeterminates are considered as parameters). The second group of variables contains all the other indeterminates and the degree with respect to this group is denoted by deg 2 .

The crucial point is to ensure that each polynomial equation has a deg 1 bounded by O g ( 3 ), while deg 2 is bounded by O g [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF]. For the inequalities, we require the same degree conditions: Indeed, an inequality f = 0 can be modeled by the equality T • f -1 = 0, where T is a fresh variable that belongs to our second group of variables. This trick requires only one more variable for each inequality and the degree of the equation T • f -1 = 0 is only one more than the degree of the inequality. Since the number of inequalities is bounded by O g [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF], the number of extra variables required in the second group will not impact the asymptotic complexity (the second group already contains O g (1) variables). We remark that the input of the geometric resolution algorithm over fields of characteristic 0 in [START_REF] Giusti | A Gröbner free alternative for polynomial system solving[END_REF] allows inequalities. However, we use the aforementioned trick to model inequalities by equalities since the solving method that we use is the variant for positive characteristic whose complexity analysis is given in [START_REF] Cafure | Fast computation of a rational point of a variety over a finite field[END_REF]Thm. 4.8].

The number of equations and inequalities and their degrees with respect to the two groups of variables can be easily checked and are summarized in Table 5

( 3 ) 0 InEq. Sys.4 ≤ g O g ( 3 ) 0 Eq. Sys.5 k i=1 s j=1 |m ij | ≤ g 4 O g ( 3 ) ≤ g InEq. Sys.6 ks ≤ g 3 O g ( 3 ) ≤ g Eq. Sys.7 and Sys.8 ≤ k 2 s ≤ g 4 O g ( 3 ) ≤ g InEq. Sys.9 ≤ s 2 ≤ g 4 0 1 Eq. Sys.10 k i=1 t i ≤ g 2 O g ( 3 ) ≤ g Eq. Sys.11 deg U ≤ g 2 0 O(g 3 ) Eq. Sys.12 k i=1 deg u i ≤ g 2 O g ( 3 ) O(g 2 ) Eq. Sys.13 deg U ≤ g 2 0 O(g 3 )
Table 5.2: Summary of the degrees of the equations in the polynomial system corresponding to a normalized non-genericity tuple (w, λ, t, , M ).

Finally, since we have been very careful in describing elements that are -torsion points on J, without room for parasite solutions or multiplicities, we can again appeal to the finite and étale property of multiplication by in J to deduce that the system is 0-dimensional and radical. Therefore, by Proposition 5.3, each system can be solved in the claimed complexity bound. To conclude the proof of Proposition 5.2, and hence of our main result, we need a few more observations.

First, notice that the solutions of our polynomial systems can be grouped by weight of the -torsion divisor: once geometric resolutions of two 0-dimensional sets V 1 and V 2 are known, a geometric resolution of V 1 ∪V 2 can be computed very efficiently. The strategy to do so is to change the primitive element of the geometric resolutions for a random element, so that both resolution share the same primitive element. This can done within complexity linear in the number of variables and polynomial in deg(V 1 ∪ V 2 ) using Algorithm 6 in [START_REF] Giusti | A Gröbner free alternative for polynomial system solving[END_REF]. Then, computing the LCM of the univariate polynomials of the geometric resolutions and interpolating the parametrization provides a geometric resolution of V 1 ∪ V 2 . Using this procedure for regrouping the solutions of all the systems derived from the non-degeneracy tuples with the same weight w provides geometric solutions of J w [ ] within the claimed complexity.

Finally, we need to transform the Monte Carlo algorithm from Proposition 5.3 in a Las Vegas algorithm. This can be easily achieved since the probability that the Monte Carlo algorithm succeeds is bounded below by a quantity which does not depend on the input size, and the output can be verified since we know that the sum of the degrees of the varieties J w [ ] for w ∈ [1, g] must equal 2g -1. Consequently, once all polynomial systems corresponding to non-generic situations have been solved, it is easy to count the number of -torsion elements found and to check that none of them is missing by comparing their number with the theoretical value 2g -1. The Las Vegas algorithm consists in repeating the Monte Carlo algorithm until the result is verified and is correct (i.e. all elements found are -torsion elements and none of them is missing). The expected complexity of the Las Vegas variant equals the complexity of the Monte Carlo variant up to multiplication by a constant. This concludes the proof of Proposition 5.2.

Chapter 6

The case of genus-3 hyperelliptic curves with RM Contrary to p-adic methods that have been adapted to any genus, implementations of -adic point-counting algorithms were limited to genus 1 and 2, probably because of the lack of cryptographic applications of genus-3 curves but also because such an algorithm would very likely have a prohibitive complexity that would impede any practical attempt. In fact, the complexity of a genus-3 analogue of Schoof's algorithm is subject to speculations as mentioned in [START_REF] Harvey | Computing Hasse-Witt matrices of hyperelliptic curves in average polynomial time[END_REF] with an estimation in O(log 12 q) that is prohibitive indeed. However, as in genus 2, we may try to find easier instances and in particular consider the RM case. The aim of this chapter is thus to show -both with theoretical proofs and practical experiments -that the complexity of -adic methods for genus-3 hyperelliptic curves can be dramatically decreased as soon as an explicitly computable non-integer endomorphism η ∈ End(Jac(C)) is known. More precisely, we consider C a genus-3 hyperelliptic curve with explicit RM by Z[η] in the sense of Definition 3.3. This means that we have explicit formulas describing η(P -P ∞ ) for P a generic point of C. By explicit formulas, we mean polynomials (η

(u) i (x, y)) i∈{0,1,2,3} and (η (v) i (x, y)) i∈{0,1,2,3} in F q [x,
y], such that, when C is given in odd-degree Weierstrass form, the Mumford coordinates of η(x, y) are

3 i=0 η (u) i (x, y)X i , 2 i=0 η (v) i (x, y)/η (v)
3 (x, y) X i , where (x, y) is the generic point of the curve. In cases where C does not have an odd-degree Weierstrass model, we can work in an extension of degree at most 8 of the base field in order to ensure the existence of a rational Weierstrass point.

Examples of curves with RM are given by modular curves. For instance, the genus-3 curve

y 2 = x 7 + 3x 6 + 2x 5 -x 4 -2x 3 -2x 2 -x -1 is
a quotient of X 0 (284) and therefore has real multiplication by an element of Q[x]/(x 3 -3x -1). This follows from the properties of the Hecke operators as explained in [START_REF] Shimura | Introduction to the arithmetic theory of automorphic functions[END_REF]Chapter 7]. Based on this theory, algorithms for constructing such curves are explained in [START_REF] Frey | Arithmetic of modular curves and applications[END_REF]; however the explicit expression for the real endomorphism is not given. We expect that tracking the Hecke correspondences along their construction, and using techniques like in [START_REF] Paul Van Wamelen | Proving that a genus 2 curve has complex multiplication[END_REF] to reconstruct the rational fractions describing the real endomorphism could solve this question. In any case, these are only isolated points in the moduli space. Larger families are obtained from cyclotomic covering. This line of research has produced several families of hyperelliptic genus-3 curves having explicit RM by Z[2 cos(2π/7)]. In particular, such explicit families are given in [START_REF] Mestre | Familles de courbes hyperelliptiques à multiplications réelles[END_REF] and [START_REF] Tautz | Explicit hyperelliptic curves with real multiplication and permutation polynomials[END_REF], and explicit formulas for their RM endomorphism are obtained in [START_REF] Kohel | Efficiently computable endomorphisms for hyperelliptic curves[END_REF]. We use the 1-dimensional family of curves from [138, Theorem 1 with p = 7] for our experiments. Other families of genus-3 curves (but not necessarily hyperelliptic) with RM have been made explicit in [START_REF] Boyer | Variétés abéliennes et jacobiennes de courbes hyperelliptiques, en particulier à multiplication réelle ou complexe[END_REF]Chapter 2], following [START_REF] Ellenberg | Endomorphism algebras of Jacobians[END_REF]. We would like to point out that within the moduli space of complex polarized abelian varieties of dimension 3, those with RM by a fixed order in a cubic field form a moduli space of codimension 3 [19, Sec. 9.2]. Since Jacobians of hyperelliptic curves form a codimension 1 space, we would expect the moduli space of hyperelliptic curves of genus 3 with RM by a given cubic order to have dimension 2.

We insist on the fact that all the O() and the O() notation used throughout the chapter should be understood up to a multiplicative constant which may depend on the ring Z[η] and on the degrees of the polynomials η (u) i and η

(v)

i . There are natural families of curves for which these degrees are bounded by an absolute constant and for which Z[η] is fixed: reductions at primes (of good reduction) of a hyperelliptic curve with explicit RM defined over a number field. Most of this chapter is joint work with Pierrick Gaudry and Pierre-Jean Spaenlehauer and is to appear as [START_REF] Abelard | Counting points on genus-3 hyperelliptic curves with explicit real multiplication[END_REF].

Organization of the chapter. In Section 6.1 we give an overview of both our algorithm and its complexity. The main task is the computation of kernels of some endomorphisms detailed in Section 6.3. This is achieved by solving a polynomial system using resultants. Section 6.4 is devoted to implementation of the algorithm using Gröbner bases instead of resultants and ending with an exponential collision search which can be run massively in parallel. Indeed, although using Gröbner bases seems to be more efficient in practice, we do not see any hope of proving with rigorous arguments that it is asymptotically competitive.

Overview of the algorithm

Let C be a genus-3 hyperelliptic curve over a finite field F q with explicit RM, and let η be the given explicit endomorphism. We denote by µ 0 , µ 1 , µ 2 the coefficients of the minimal polynomial T 3 + µ 2 T 2 + µ 1 T + µ 0 of η over Q.

The characteristic equation of the Frobenius

The characteristic polynomial of the Frobenius endomorphism π is of the form χ π (T ) = T 6 -

σ 1 T 5 + σ 2 T 4 -σ 3 T 3 + qσ 2 T 2 -q 2 σ 1 T + q 3 ,
and Weil's bounds give

|σ 1 | ≤ 6 √ q, |σ 2 | ≤ 15q, |σ 3 | ≤ 20q 3/2 .
In order to take advantage of the explicit RM, we consider the endomorphism ψ = π + π ∨ , for which we can derive the real Weil polynomial

χ ψ (T ) = T 3 -σ 1 T 2 + (σ 2 -3q)T -(σ 3 -2qσ 1 )
, which corresponds to the characteristic polynomial of ψ viewed as an element of the real subfield of End(Jac(C)) ⊗ Q. The endomorphism ψ belongs to the ring of integers of Q(η). The ring Z[η] might be a proper sub-order of the ring of integers, so let us call ∆ its index, so that ψ can be written ψ = a + bη + cη 2 , where a, b, c are rationals with a denominator that divides ∆. By computing formally the characteristic polynomial of a + bη + cη 2 in Q(η) and by equating it with the expression for the characteristic polynomial of χ ψ (T ) , we obtain a direct way to compute σ 1 , σ 2 and σ 3 in terms of a, b, c:

σ 1 = 3 a -b µ 2 -2 c µ 1 + c µ 2 2 , σ 2 -3q = 3 a 2 -2 a b µ 2 + 2 a c (µ 2 2 -2µ 1 ) + b 2 µ 1 + 3 b c µ 0 -b c µ 1 µ 2 - c 2 (2 µ 0 µ 2 + µ 2 1 ) , σ 3 -2qσ 1 = a 3 -a 2 b µ 2 + a 2 c (µ 2 2 -2µ 1 ) + a b 2 µ 1 + a b c (3 µ 0 -µ 1 µ 2 ) + a c 2 (µ 2 1 -2 µ 0 µ 2 ) -b 3 µ 0 + b 2 c µ 0 µ 2 -b c 2 µ 0 µ 1 + c 3 µ 2 0 . ( 6.1)
In Section 6.2.1, it is shown that the coefficients a, b and c can be bounded in O( √ q). More precisely, we denote by C abc a constant that depends only on η such that their absolute values are bounded by C abc √ q. Since these bounds are much smaller than the bounds for σ 1 , σ 2 , σ 3 , it makes sense to design an algorithm that reconstruct these coefficients of ψ instead of the coefficients of χ π as in the classical Schoof algorithm, and this is what we are going to do later on.

Another important bound that we need concerns the size of small elements that can be found in ideals of Z[η]. Let be a prime that splits completely in Z[η], so that we can write = p 1 p 2 p 3 , where the p i 's are distinct prime ideals of norm . In Section 6.2.2, it is shown that each p i contains a non-zero element

α i = a i + b i η + c i η 2
, where a i , b i and c i are integers and are bounded in absolute value by O( 1/3 ).

A point-counting algorithm

Our genus-3 RM point counting algorithm is Algorithm 8. We give a description of it, allowing some black-box primitives that will be detailed in dedicated sections. As mentioned above, we will work with the a, b, c coefficients of the ψ endomorphism. More precisely, we compute their values modulo sufficiently many completely split primes until we can deduce their values from the bounds of Lemma 6.1 from Section 6.2.1 by the Chinese Remainder Theorem, taking into account their potential denominator ∆. Then the coefficients of χ π are deduced by Equations (6.1).

We now explain how the algorithm works for a given split . First its decomposition as a product of prime ideals Z[η] = p 1 p 2 p 3 is computed, and for each prime ideal p i , a non-zero element α i of p i is found with a small representation α i = a i + b i η + c i η 2 as in Lemma 6.2 of Section 6.2.2. The kernel of α i is denoted by J[α i ] and it contains a subgroup G i isomorphic to Z / Z × Z / Z, since the norm of α i is a small multiple of . We further denote by λ i the eigenvalue of η in J[ ] such that p i is the ideal ( , η -λ i ).

On G i ⊂ J[α i ], the endomorphism η acts as the multiplication by λ i . Therefore, ψ = a + bη + cη 2 also acts as a scalar multiplication on this 2-dimensional space, and we write k i ∈ Z / Z the corresponding eigenvalue: for any D i in G i , we have ψ(D i ) = k i D i . On the other hand, from the definition of ψ, it follows that ψπ = π 2 + q. Therefore, if such a D i is known, we can test which value of

k i ∈ Z / Z satisfies k i π(D i ) = π 2 (D i ) + qD i . (6.2)
Since is a prime and D i is of order exactly , this is also the case for π(D i ). Finding k i can then be seen as a discrete logarithm problem in the subgroup of order generated by π(D i ); hence the solution is unique. Equating the two expressions for ψ, we get explicit relations between a, b, c modulo : a + bλ i + cλ 2 i ≡ k i mod . Therefore we have a linear system of three equations in three unknowns, the determinant of which is the Vandermonde determinant of the λ i , which are distinct by hypothesis. Hence the system can be solved and it has a unique solution modulo .

It remains to show how to construct a divisor D i in G i , i.e. an element of order in the kernel J[α i ]. Since an explicit expression of η as an endomorphism of the Jacobian of C is known, an explicit expression can be deduced for α i , using the explicit group law. The coordinates of the elements of this kernel are solutions of a polynomial system that can be directly derived from this expression of α i . Using standard techniques, it is possible to find the solutions of this The bottleneck of the algorithm is the computation of a non-zero element of order in the kernel J[α i ] of α i . This part will be treated in detail in Section 6.3, where it is shown to be feasible in O( 4 ) operations in F q . The output is a divisor D i of order in J[α i ] that is defined over an extension field F q δ , where δ is in O( 2).

In order to check Equation (6.2), we first need to compute π(D i ) and π 2 (D i ) which amounts to raising the coordinates to the q-th power. The cost is in O( 2 log q) operations in F q . Then, each Jacobian operation in the group generated by π(D i ) costs O( 2 ) operations in the base field, and we need O( √ ) of them to solve the discrete logarithm problem given by Equation (6.2). The overall cost of finding k i , once D i is known is therefore O( 2 ( √ + log q)) operations in F q . Finally, the amount of work performed for each is O( 2 ( 2 + log q)) operations in the base field F q . Summing up for all the primes, and taking into account the cost of the operations in F q , we obtain a global bit-complexity of O((log q) 6 ).

Bounds for Algorithm 8 6.2.1 Bounds on the coefficients of ψ

The system of equations (6.1) giving σ 1 , σ 2 and σ 3 in terms of a, b, c is homogeneous if we put weight 1/2 to a, b, c and σ 1 , weight 1 to q and σ 2 , weight 3/2 to σ 3 , and weight 0 to µ 0 , µ 1 , and µ 2 so any polynomial in a reduced Gröbner basis of the corresponding ideal will have the same property. Computing such a Gröbner basis with the lexicographical ordering

a > b > c > σ 1 > σ 2 > σ 3 > µ 0 > µ 1 > µ 2 > q (we
did this computation with the Magma V2.23-4 software), we get a polynomial Ψ c of degree 6 in c that does not involve a or b, and which has the following form:

Ψ c (q, c, σ 1 , σ 2 , σ 3 , µ 0 , µ 1 , µ 2 ) = D(µ 0 , µ 1 , µ 2 ) 3 c 6 + 5 i=0 ψ (i) c (q, σ 1 , σ 2 , σ 3 , µ 0 , µ 1 , µ 2 ) c i , where D(µ 0 , µ 1 , µ 2 ) = -27 µ 2 0 + 18 µ 0 µ 1 µ 2 -4 µ 0 µ 3 2 -4 µ 3 1 + µ 2 1 µ 2 2 is the discriminant of the polynomial T 3 + µ 2 T 2 + µ 1 T + µ 0 .
By computing Gröbner bases for other lexicographical orderings (with

a > c > b > σ 1 > σ 2 > σ 3 > µ 0 > µ 1 > µ 2 > q and b > c > a > σ 1 > σ 2 > σ 3 > µ 0 > µ 1 > µ 2 > q respectively),
we obtain that polynomials of the following form also belong to the ideal generated by the polynomials in the system of equations (6.1):

Ψ b (q, b, σ 1 , σ 2 , σ 3 , µ 0 , µ 1 , µ 2 ) = D(µ 0 , µ 1 , µ 2 ) 3 b 6 + 5 i=0 ψ (i) b (q, σ 1 , σ 2 , σ 3 , µ 0 , µ 1 , µ 2 ) b i , Ψ a (q, a, σ 1 , σ 2 , σ 3 , µ 0 , µ 1 , µ 2 ) = D(µ 0 , µ 1 , µ 2 ) 3 a 6 + 5 i=0 ψ (i) a (q, σ 1 , σ 2 , σ 3 , µ 0 , µ 1 , µ 2 ) a i . The polynomials ψ (i) a , ψ (i) b and ψ (i)
c are homogeneous of weighted degree 3 -i/2 with respect to the grading given above. Lemma 6.1. The absolute values of the coefficients a, b, c of ψ = a + bη + cη 2 are bounded above by O(q 1/2 ).

Proof. First, we consider the equation Ψ c = 0. We write c = c q 1/2 , σ 1 = σ 1 q 1/2 , σ 2 = σ 2 q, σ 3 = σ 3 q 3/2 . Since ψ (i) c is homogeneous and has weighted degree 3 -i/2, there is a polynomial θ

(i) c ( σ 1 , σ 2 , σ 3 , µ 0 , µ 1 , µ 2 ) such that ψ (i) c (q, σ 1 , σ 2 , σ 3 , µ 0 , µ 1 , µ 2 ) • c i = q 3 c i θ (i) c ( σ 1 , σ 2 , σ 3 , µ 0 , µ 1 , µ 2 ). (6.3)
Weil's bounds imply that | σ i | = O(1) for i ∈ {1, 2, 3}. Therefore, for all i ∈ {0, . . . , 5}, we obtain that |θ

(i) c ( σ 1 , σ 2 , σ 3 , µ 0 , µ 1 , µ 2 )| = O(1). For fixed µ 0 , µ 1 , µ 2 ∈ Q such that µ 0 + µ 1 T + µ 2 T 2 + T 3
is the minimal polynomial of a totally real algebraic number, the discriminant D(µ 0 , µ 1 , µ 2 ) must be nonzero. Equations Ψ c = 0 and (6.3) imply the following inequality:

| c| 6 - 5 i=0 |θ (i) c ( σ 1 , σ 2 , σ 3 , µ 0 , µ 1 , µ 2 )| |D(µ 0 , µ 1 , µ 2 )| 3 | c| i ≤ 0.
Then | c| must be smaller or equal to the largest root of this polynomial inequality, which can itself be bounded, for instance, with Cauchy's bound 1), and hence |c| = O(q 1/2 ). The proof for the bounds on |a| and |b| are similar, using the equations Ψ a = 0 and Ψ b = 0.

| c| ≤ 1 + max 0≤i≤5 |θ (i) c ( σ 1 , σ 2 , σ 3 , µ 0 , µ 1 , µ 2 )| |D(µ 0 , µ 1 , µ 2 )| 3 , which shows that | c| = O(

Small elements in ideals of Z[η]

We first recall that we consider only primes that do not divide the discriminant of the minimal polynomial of η (Condition (C2)). Hence, if Z[η] is not the maximal order of Q(η), this has no consequence on the factorization properties of . Lemma 6.2. For any prime that splits completely in Z[η], each prime ideal p i above contains a non-zero element α i of the form

α i = a i + b i η + c i η 2 , where |a i |, |b i | and |c i | are integers in O( 1/3 ), and the norm of α i is in O( ).
Proof. The coefficients of the elements of the ideal p i represented by polynomials in η form a lattice. Applying Minkowski's bound to this lattice, we obtain the existence of a non-zero element

α i = a i + b i η + c i η 2 , in p i for which the L 2 -norm of (a i , b i , c i ) is in O( 1/3
). From this bound on the L 2 -norm, we derive a bound on the L ∞ -norm, and finally on the norm of α i as an algebraic number. At each step, the constant hidden in the O() gets worse but still depends only on Z[η].

For any given η, it is not difficult to make the constants in the O() fully explicit. We do it in the particular case of Z[η 7 ], with η 7 = 2 cos(2π/7), which is the RM used in our practical experiments. Since Z[η 7 ] is a principal ring, a more direct approach leads to bounds for a generator that are tighter than what would be obtained by a naive application of the previous lemma.

Lemma 6.3. Every ideal

p i of norm in Z[η 7 ] has a generator α i of the form a i + b i η 7 + c i η 2 7 , where a i , b i , c i ∈ Z satisfy |a i | < 2.415 • 1/3 ; |b i | < 1.850 • 1/3 ; |c i | < 1.764 • 1/3 .
Proof. By abuse of notation, we identify Q(η 7 ) with the algebraic number field Q[X]/(X 3 +X 2 -2X -1) and we let σ 1 , σ 2 , σ 3 be the three real embeddings of Q(η 7 ) in R and let 1 = 1 -η 2 7 and 2 = 1 + η 7 be a pair of fundamental units. Let µ i be a generator of p i . The logarithmic embedding ϕ : x → (log|σ 1 (x)|, log|σ 2 (x)|, log|σ 3 (x)|) sends the set of generators of p i to the lattice generated by ϕ( 1 ) and ϕ( 2 ) translated by ϕ(µ i ). Solving a CVP for the projection of ϕ(µ i ) on the plane where the 3 coordinates sum-up to zero, we deduce a unit ξ i such that α i = ξ i µ i is a generator whose real embeddings are bounded by

|σ 1 (α i )| ≤ 2.247 • 1/3 , |σ 2 (α i )| ≤ 1.803 • 1/3 , |σ 3 (α i )| ≤ 2.247 • 1/3 . Writing α i = a i +b i η 7 +c i η 2
7 , the real embeddings can also be expressed as (σ

1 (α i ), σ 2 (α i ), σ 3 (α i )) T = V • (a i , b i , c i ) T ,
where V is the Vandermonde matrix of (σ 1 (η 7 ), σ 2 (η 7 ), σ 3 (η 7 )). A numerical evaluation of its inverse allows to translate the bounds on σ 1 (α i ), σ 2 (α i ), σ 3 (α i ) into the claimed bounds on a i , b i , c i .

Computing kernels of endomorphisms 6.3.1 Modelling the kernel computation by a polynomial system

Let α be an explicit endomorphism of degree O( 2) on the Jacobian of C, which satisfies the properties of Lemma 6.2. We want to compute a triangular polynomial system that describes the kernel J[α] of α. This will provide us with a nice description of a subgroup of thetorsion on which we will be able to test the action of ψ = π + π ∨ and deduce a, b, c such that ψ = a + bη + cη 2 mod .

We first model J[α] by a system of polynomial equations that we will then put in triangular form. To do so, we consider a generic divisor D = P 1 + P 2 + P 3 -3∞, where P i is an affine point of C of coordinates (x i , y i ). We then write α(D) = 0, i.e α(P 1 -∞) + α(P 2 -∞) = -α(P 3 -∞). Generically, we expect each α(P i -∞) to be of weight 3, and we write u i , v i for its Mumford form. We derive our equations by computing the Mumford form u 12 , v 12 of α(P 1 -∞) + α(P 2 -∞) and then writing coefficient-wise the conditions u 12 = u 3 and v 12 = -v 3 . The case where the genericity conditions are not satisfied is discussed at the end of the section.

Similarly to the Schoof-Pila algorithm, we define polynomials -which are equivalent to Cantor's division polynomials -by the formulas

u 12 (X) = X 3 + 2 i=0 di (x 1 , x 2 , y 1 , y 2 ) d3 (x 1 , x 2 ) X i , v 12 (X) = 2 i=0 ẽi (x 1 , x 2 , y 1 , y 2 ) ẽ3 (x 1 , x 2 ) X i , u 3 (X) = X 3 + 2 i=0 d i (x 3 ) d 3 (x 3 ) X i , v 3 (X) = y 3 2 i=0 e i (x 3 ) e 3 (x 3 ) X i .
Lemma 6.4. For any i ∈ {1, 2, 3}, the degrees of di , ẽi , d i and e i are in O( 2/3 ).

Proof. Let us first remark that the di 's and ẽi 's are obtained after adding two divisors u 1 , v 1 and u 2 , v 2 such that the coefficients of the u i and v i are respectively the d j /d 3 and y i e j /e 3 evaluated at x i . Thus, since this application of the group law involves a number of operations that is bounded independently of and q, the degree stays within a constant multiplicative factor, which is captured by the O(). Therefore it is enough to prove the result for the d i 's and e i 's. Since the endomorphism α satisfies the properties of Lemma 6.2, it is a linear combination of 1, η and η 2 with coefficients of size O( 1/3 ). Using the same argument about the group law, we can further reduce our proof to the case where α = nη k , with k ∈ {0, 1, 2} and n an integer in O( 1/3 ). But once again, η k does not depend on so that, provided we can prove that Cantor's n-division polynomials have degrees in O(n 2 ), we have proven that nη k (P -∞) = η k (n(P -∞)) have coefficients whose degrees are in O(n 2 ), and then so does α(P -∞). This quadratic bound on the degrees of Cantor's division polynomials in genus 3 is precisely Theorem 4.14, whose proof is done in Section 4.3.

Solving the system with resultants

Typical tools for solving a polynomial system are the F4 algorithm, methods based on geometric resolution, or homotopy techniques. To obtain reasonable complexity bounds, they all require some knowledge of the properties of the system, and this might be hard to prove. Since we have a system in essentially 3 variables (in fact, there are six variables x 1 , x 2 , x 3 , y 1 , y 2 , y 3 , but the y i variables can be directly eliminated by using the equation defining the curve), we prefer to stick to an approach based on resultants. It ends up having a complexity that is quasi-quadratic in the degree of the ideal, which is the best that can be hoped for anyway for all of the advanced techniques, and the complexity analysis requires only elementary tools. A complication that can occur with resultants is that Res x (f, g) is identically zero when f and g have a nonconstant GCD. This is not a problem in our case since we can divide polynomials f and g by their GCD, by factoring them at the cost of O(max(deg(f ), deg(g)) ω ) field operations -where ω < 2.38 is the exponent of linear algebra -using the bivariate recombination methods in [START_REF] Bostan | Complexity issues in bivariate polynomial factorization[END_REF] (the trivariate case can be reduced to the bivariate case by using the techniques in [START_REF] Zippel | Effective polynomial computation[END_REF]Sec. 21.2]). In what follows, the complexities of computing the resultants are larger than O(max(deg(f ), deg(g)) ω ), so we can forget about this complication.

Following our modelling, the equality of the u-coordinates gives three equations

∀i ∈ {0, 1, 2}, di (x 1 , x 2 , y 1 , y 2 )d 3 (x 3 ) = d3 (x 1 , x 2 )d i (x 3 ), (6.4)
of degree O( 2/3 ) in the x i 's. By computing resultants with the equations y 2 i = f (x i ), we derive three equations E i (x 1 , x 2 , x 3 ) = 0 whose degrees are still in O( 2/3 ).

We then eliminate x 1 by computing 3 trivariate resultants R i (between the two equations E j with j = i). We get three equations R i (x 2 , x 3 ) = 0 of degrees O( 4/3 ) within a complexity in O( 10/3 ) field operations, as proven in Proposition 2. [START_REF] Della | About a new method for computing in algebraic number fields[END_REF].

Then, we compute bivariate resultants S i (between the two equations R j with j = i) to eliminate x 2 . From Proposition 2.39, we get three univariate equations S i (x 3 ) = 0 of degree bounded by O( 8/3 ) for a complexity in O( 4 ) field operations. And we compute the polynomial S(x 3 ) as the GCD of the S i (x 3 ), which belongs to the ideal defined by our original system.

The bound on the degree of S is much larger than 2 -1, the expected degree of the kernel. Although we can expect the actual degree to be in O( 2), we need to add the constraints coming from the v-coordinates to be able to prove it.

The polynomial system coming from v 12 = -v 3 has the same characteristics as the one coming from the u-coordinates. Therefore, we can proceed in a similar way and deduce, at a cost of O( 4) operations another univariate polynomial S(x 3 ) belonging to the ideal. Now, since all the original equations have been taken into account all common roots of S and S will correspond to a solution of the original system for which we know that there are O( 2 ) solutions. Therefore taking the squarefree part of the GCD of S and S yields a polynomial of degree O( 2).

This univariate polynomial can be factored at a cost of O( 4) operations in F q with standard algorithms [START_REF] Von | Modern computer algebra[END_REF] (there exist asymptotically faster algorithms, but we already fit in our target complexity). We then deal with each irreducible factor in turn, until one is found that leads to a genuine solution of the original system. Let δ be the degree of such an irreducible factor φ(x 3 ). In the field extension F q δ = F q [x 3 ]/(φ(x 3 )), we have by construction a root x 3 of φ. We then solve again the original polynomial system where x 3 is instantiated with this root. This system is bivariate in x 1 and x 2 and there are O(1) solutions, that possibly live in another finite extension F q δ of F q δ . Since the degrees of the bivariate polynomials are in O( 2/3 ), by Proposition 2.39, this system solving costs O( 2 ) operations in F q δ . A solution obtained in this way must be checked, because it could come from a vanishing denominator that has been cleared when constructing the system or from non-generic situations. But given a set of candidate coordinates for a D i element of J[α i ], it is cheap to check that this is indeed an element of the Jacobian and that it is killed by α i . Also, if α i is not a generator of p i , it is necessary to check the order of D i : if this is a multiple of , then multiplying D i by the cofactor gives an order-element. But it is also possible to get an unlucky element that is of a small order coprime to , and then we have to take another solution of the system. Since an operation in F q δ requires a number of operations in F q that is quasi-linear in δ, and since the sum of all the degrees δ of the irreducible factors of GCD(S, S) is in O( 2), the amortized cost is O( 4 ) operations in F q to deduce a divisor D i in J[α i ].

Note that using the algorithm of Villard mentioned at the end of Section 2.3 for bivariate resultants, the complexity is lowered as follows. First, to compute trivariate resultants of polynomials whose degrees are bounded by d, we perform a Kronecker substitution and compute bivariate resultants of equations of degrees d x ≤ d 3 and d y ≤ d. Since d = 2/3 , we end up with a complexity in O( 2/3(2-1/ω)+2+o (1) ), which is dominated by 3+1/9 . Once this is done, it remains to compute bivariate resultants of equations with degrees in x and y both smaller than 2d 2 . This yields a complexity in O( 4/3(2-1/ω) 4/3+o (1) ) field operations. This is dominated by O( 3+5/9 ). It follows from our complexity analysis that the overall complexity of Algorithm 8 is thus decreased by a factor (log q) 4/9 at least.

Remarks

In Section 6.3, the algorithms work by evaluation / interpolation, which requires to have enough elements in the base field. Were it not the case, we simply take a field extension F q δ of F q , that will add a factor O(δ) to the complexity. The complexity of the algorithms will be polynomial in the number of evaluation points, therefore, δ will be logarithmic in the final complexity, so that the cost of taking a field extension will be hidden in the O() notation.

Another difficulty is that an evaluation / interpolation strategy assumes that the points of evaluation are generic enough, so that all the degrees after evaluation are generic. This is again guaranteed by taking a large enough base field. Still, the algorithm remains a Monte-Carlo one. However, the ultimate goal is to construct kernel elements, which is an easily verified property. Turning this into a Las Vegas algorithm can therefore be done with standard techniques.

Last but not least, our analysis assumes in the first place that the -torsion elements are generic in a rather strong sense, as in Definition 5.6. This is expected to be the case with overwhelming probability, when the base field is large enough and the curve is taken at random in a large family. However, to obtain a proven complexity we must also consider the cases where there exist -torsion elements that are non-generic. We follow the strategy of Section 5.4 where another polynomial system is designed and solved for each non-generic situation, for instance the fact that an -torsion divisor is of weight less than 3, or that some points involved in the modelling are not distinct while they generically are. We do not give all the details, but the number of polynomial systems to consider is bounded by a constant, and each of these polynomial systems describes a situation that is smaller than the generic one in the sense that it has either less variables or a lower degree, so that the complexity bound is maintained.

Practical results

In this section, we compute the zeta function of a genus 3 hyperelliptic curve with explicit RM defined over F p with p = 2 64 -59. To our knowledge the largest genus-3 computation that had been achieved previously was the computation of the zeta function of a hyperelliptic curve defined over F p with p = 2 61 -1, done by Sutherland [START_REF] Sutherland | A generic approach to searching for Jacobians[END_REF] using generic group algorithms.

In order to evaluate the practicality of our algorithm, we have tested it on one of the families of genus-3 hyperelliptic curves having explicit RM given in [START_REF] Tautz | Explicit hyperelliptic curves with real multiplication and permutation polynomials[END_REF]Theorem 1]. Formulas for their RM endomorphisms are described in [START_REF] Kohel | Efficiently computable endomorphisms for hyperelliptic curves[END_REF]: for t = ±2, the curve C t with equation

y 2 = x 7 -7x 5 + 14x 3 -7x + t,
admits an endomorphism given in Mumford representation by

η 7 (x, y) = X 2 + 11 xX/2 + x 2 -16/9, y .
The fact that this expression has degree 2 while one would generically expect a degree 3 is no accident: it comes from the construction in [START_REF] Tautz | Explicit hyperelliptic curves with real multiplication and permutation polynomials[END_REF] of the endomorphism as a sum of two automorphisms on a double cover of the curve. We have η 3 7 + η 2 7 -2η 7 -1 = 0, so that the ring Z[η 7 ] is isomorphic to the ring of integers Z[2 cos(2π/7)] of the real subfield of the cyclotomic field Q(e 2iπ/7 ). All the numerical data in this section have been obtained for the parameter t = 42, on the prime field F p with p = 2 64 -59.

In our practical computations, the main differences with the theoretical description are the following: we use Gröbner basis algorithms instead of resultants, we consider also small non-split primes and small powers, and we finish the computation with a parallel collision search. The source code for our experiments is available at https://members.loria.fr/SAbelard/RMg3. tgz.

Retrieving modular information

Although the polynomial system resolution using resultants has a complexity in O( 4), the real cost for small values of is already pretty large. In the resolution method described in Section 2.3, each bivariate resultant is computed by evaluation / interpolation and hence requires the computation of many univariate resultants. We illustrate this by counting the number of univariate resultants to perform and their degrees for the main step of the resolution (the part that reaches the peak complexity). We also measure the cost of such resultant computations using the NTL 10.5.0 and FLINT 2.5.2 libraries, both linked against GMP 6, when the base field is F 2 64 -59 . These costs do not include the evaluation / interpolation steps which might also be problematic for large instances, because they are hard to parallelize.

#res

Deg Cost (NTL) Cost (FLINT) 13 525M 16,000 1,850 days 735 days 29 12.8G 80,000 310,000 days 190,000 days

We were more successful with the direct approach using Gröbner bases that we now describe. For computing the kernel of a given endomorphism, we computed a Gröbner basis of the system (6.4) with some small modifications. First, we observe that the only occurrences of y 1 and y 2 are within the monomial y 1 y 2 . Consequently, we can remove one variable by replacing each occurrence of y 1 y 2 by a fresh variable y. Next, we need to make the system 0-dimensional by encoding the fact that d 3 (x 3 ) and d 3 (x 1 , x 2 ) are nonzero. This is done by introducing another fresh variable t and by adding the polynomial S(x 1 , x 2 , x 3 )t-1 to the system, where S(x 1 , x 2 , x 3 ) is the squarefree part of d 3 (x 3 ) d 3 (x 1 , x 2 ). Finally, it appears that each polynomial is symmetric with respect to the transposition of the variables x 1 and x 2 . Consequently, we can rewrite the equations using the symmetric polynomials s 1 = x 1 + x 2 and s 2 = x 1 x 2 . This divides by two the degree in x 1 and x 2 of the equations. We end-up with a system in 5 variables.

The whole construction can be slightly modified to compute the pre-image of a given divisor by the endomorphism: to model α(D) = Q -P ∞ , we write D = P 1 + P 2 + P 3 -3P ∞ and solve for α(P 1 -P ∞ ) + α(P 2 -P ∞ ) = Q -P ∞ -α(P 3 -P ∞ ). In that case, the variable y 3 gets involved in all the equations, so that we get a system in 6 variables.

For = 2, the 2-torsion elements are easily deduced from the factorization of f , and by computing a pre-image of a 2-torsion divisor, we got a point in J [START_REF] Adleman | Primality testing and Abelian varieties over finite fields[END_REF] from which we could deduce a, b, c mod 4. Dividing again by 2 was too costly, due to the fact that the 4-torsion point was in an extension of degree 4. For = 3, which is an inert prime, we ran the kernel computation for the multiplication-by-3 endomorphism, without using the RM property. The norm being 27, this is the largest modular computation that we performed (and the most costly in terms of time and memory). The prime = 7 ramifies in Z[η 7 ] as the cube of the ideal generated by α 7 = -2 -η 7 + η 2 7 . The kernel of α 7 can be computed but it yields only one linear relation in a, b, c mod 7. Dividing the kernel elements by α 7 would give more information, but again, this computation did not finish due to the field extension in which the divisors are defined. The first split prime is = 13. We use the following small generators: ( 13

) = (2 -η 7 -2η 2 7 )(-2 + 2η 7 + η 2 7 )(3 + η 7 -η 2 7
), which seem to produce the polynomial systems with the smallest degrees. For instance, the apparently smaller element 1 + η 2 7 of norm 13 yields equations of much higher degrees 7, 71, 72, 73, 72. The next split prime is 29, which would maybe have been feasible, but was not necessary for our setting. In the following table, we summarize the data for these systems, that were obtained with Magma V2. [START_REF] Boyer | Variétés abéliennes et jacobiennes de courbes hyperelliptiques, en particulier à multiplication réelle ou complexe[END_REF]

Final collision search

The classical square-root-complexity search in genus 3 requires O(q) group operations [START_REF] Elkies | Elliptic and modular curves over finite fields and related computational issues[END_REF]. For RM curves, this can be improved by searching for the coefficients a, b, c

of ψ = π + π ∨ in Z[η].
This readily yields a complexity in O(q 3/4 ), using the equation aD + bη(D) + cη 2 (D) = (q + 1)D, that must be satisfied for any rational divisor D. While a baby-step giant-step approach is immediate to design, it needs O(q 3/4 ) space and this is the bottleneck. A low-memory, parallel version of this search can be obtained with the algorithm of [START_REF] Gaudry | A low-memory parallel version of Matsuo, Chao and Tsujii's algorithm[END_REF], where the details are given only for a 2-dimensional problem, while here this is a 3-dimensional problem. We explain below how we modified this algorithm to fit our needs. Just like in [START_REF] Gaudry | A low-memory parallel version of Matsuo, Chao and Tsujii's algorithm[END_REF], including some anterior modular knowledge is straightforward: if a, b, c are known modulo m, the expected time is in O(q 3/4 /m 3/2 ). This time, the search was performed in a cuboid instead of a rectangle. Contrary to the general genus-2 case, this time the cuboid is not flat since a, b and c have the same order of magnitude. Let us start by picking a random divisor D in J and set

K D = [a mod m]D + [b mod m]η(D) + [c mod m]η 2 (D).
As in Section 3.2.3, we look for a collision between two sets

T = {s 1 mD + s 2 mη(D) + s 3 mη 2 (D) | (s 1 , s 2 , s 3 ) ∈ [-B/m, B/m] 3 }, and
W = {K D + s 1 mD + s 2 mη(D) + s 3 mη 2 (D) | (s 1 , s 2 , s 3 ) ∈ [-B/m, B/m] 3 }.
From the relations (6.1) between the coefficients of ψ and the coefficients of χ π , one could translate the Weil bounds into precise bounds in the coefficients a, b and c. Instead, we set an ad hoc bound B = 5

√ q for their respective absolute values. Our choice was satisfactory and we did not encounter any problem so we did not modify it, although fine tuning this parameter would certainly reduce the average running time.

Each chain consists in a pseudo-random deterministic walk in either W or T that stops whenever it encounters a distinguished point, which is the only information stored from each chain. Indeed, the deterministic nature of the process guarantees that any collision between two chains will propagate to their last point. This increases the running time compared to the babystep giant-step approach but allows for negligible memory requirements, as explained in 3.2.3. While the probability p D of being distinguished is an important parameter, the distinguishing feature itself is not. For instance, we say that an element is distinguished if thelog 2 p D bits of low weight of its Mumford representation are equal to 0. By the birthday paradox, we expect a collision to be found after browsing through (2B/m) 3/2 points in the searchspace. Denoting by C the number of chains, we therefore expect each chain to be of length (2B/m) 3/2 /C, and since each chain stops whenever it hits a distinguished element, p D is precisely the inverse of this quantity. In our experiments, we set p D = 50000(B/m) -3/2 , thus expecting the number of chains to be about 140000 before a collision occurs. Recall that the number of chains must be small enough to keep the memory requirements reasonable, but large enough to avoid taking too much time.

To design the deterministic walks, we start each chain by an element of either T or W defined by a triple (s 1 , s 2 , s 3 ) taken uniformly at random in [-B/m, B/m] 3 . Then, given a divisor D in a chain, the next one is computed as D + O h( D) , where the O's are a set of 120 precomputed offsets and h a hash function mapping D into a triple (b 1 , b 2 , i) ∈ {0, 1} 2 × {1, 2, . . . , 30}. The offset corresponding to that triple is

α i mD + (-1) b 1 β i mη(D) + (-1) b 2 γ i mη 2 (D),
where α i , β i and γ i are integers respectively taken uniformly at random in {1, 2, . . . , 2L i } and then fixed during the whole search. The L i 's are chosen to reduce the risk of a chain exiting the cuboid and considering points on which collisions are impossible. This could actually even lead to a neverending chain which is why some bound can be set to discard any chain whose length is much longer than expected, but a convenient choice for the L i 's make this extremely unlikely. Our practical choice followed the genus-2 case and set the L i 's such that, on average, each chain terminates on a point whose coordinates are ten times smaller than the size of the cuboid. In the first direction, our offset is always positive and the expected length of a chain is 1/p D , so that the expected distance in the first direction is L 1 /p D and we choose L 1 = 2Bp D /10. For the two other directions, the offsets have changing signs so that we bound the distance reached using the central limit theorem. This yields an expected distance in 2 2/3πL 2 / √ p D as in the genus-2 case. This is not surprising because since we study the problem dimension by dimension, we always consider one-dimensional random walks no matter the dimension of the searchspace. Approximating 2 2/3π by 9/10 and dividing by 10, we choose L 2 and L 3 both equal to 2B √ p D /10.

We wrote a dedicated C implementation with a few lines of assembly to speed-up the additions and multiplications in F p , taking advantage of the special form of p. This implementation performs 10.7M operations in the Jacobian per second using 32 (hyperthreaded) threads of a 16core bi-Xeon E5-2650 at 2 GHz. We used the knowledge of ψ modulo 156 but not of the known relation modulo 7 for simplicity (there is no obstruction to using it and saving an additional 7 1/2 factor).

After computing about 190,000 chains of average length 32,000,000, we got a collision, from which we deduced

ψ = 2551309006 + 2431319810 η 7 -847267802 η 2 7 ,
and the coefficients of the characteristic polynomial χ π of the Frobenius are then

σ 1 = 986268198, σ 2 = 35389772484832465583, σ 3 = 10956052862104236818770212244.
The number of group operations that were done is slightly less than 43 (p 3/4 /156 3/2 ). This factor 43 is close to the average that we observed in our numerous experiments with smaller sizes. Scaled on a single (physical) core, we can estimate the cost of this collision search to be 105 core-days.

Chapter 7

Counting points on hyperelliptic curves with explicit RM

In this chapter, we study the benefits of real multiplication in arbitrary genus. We extend the process of Chapter 6 and Section 3.1.2 for (families of) hyperelliptic curves with RM by an order Z[η]. For primes that split into g i=1 p i in Z[η], we split J[ ] into a direct sum of g subspaces J[p i ] isomorphic to (Z / Z) 2 . One can therefore expect that for RM curves, Algorithm 6 detailed in Chapter 5 can be adapted to find non-zero elements of J[p i ] instead of J[ ] with a complexity bound in O η (log q) O( 1) instead of O g (log q) O(g) . Note that we do not use the O g ()-notation because, as in Chapter 6, there is an additional dependency in η. Since g is nothing more than the degree of the algebraic number η, we replace the O g ()-notation by the O η ()-notation which takes into account both dependencies on g and η.

Using a theoretical machinery similar to that of Chapter 5, we will prove that it is indeed the case. However, we warn the reader that this complexity is still exponential in g. Even though each of the ideals J[α i ] has degree independent of g, we model them by polynomial systems whose multihomogeneous Bézout bounds involve a combinatorial factor of the form g 2 +g g . Since the complexity of the geometric resolution algorithm is quadratic in the multihomogeneous Bézout bound, this exponential factor also appears in the overall complexity of our algorithm.

Organization. In Section 7.1, we give an overview of our point-counting algorithm, along with an example of families of hyperelliptic curves of arbitrary high genus with RM by a real subfield of a cyclotomic field. In particular, we prove a bound on the size and number of primes to consider in our algorithm. Section 7.2 focuses on the main primitive of our algorithm: the computation of a non-zero element in the kernel of an endomorphism α whose degree is a small multiple of 2 . This section adapts methods and results of Chapter 5 to design structured polynomial systems whose solution sets are subsets of J[α]. Section 7.3 concludes on the complexity of solving these systems, and on the overall complexity of our point-counting algorithm. We also present an analysis on the exponent of g in the final complexity, investigating the various places where exponential factors may occur and how to avoid them when it is possible.

Overview

The main result of this chapter can be summarized by the following theorem, in which we give more precision on the notation O η (log c q) for our complexity result, and make the dependency in η explicit. In Section 7.3, we also bound c by 8 and conjecture that it should be 6. Note that whenever we give a bound with an explicit constant, we can no longer hide the polylogarithmic factor in the exponent, so we use the notation O η () to hide both factors depending only on η and factors that are polylogarithmic in q. Theorem 7.1. For any g and any η ∈ Q such that Q(η) is a totally-real number field of degree g, there exists an explicitly computable c(η) > 0 such that there is an integer q 0 (g, η) such that for all prime power q = p n larger than q 0 (g, η) with p ≥ (log q) c(η) and for all genus-g hyperelliptic curves C with explicit RM by Z[η] defined over F q , the local zeta function of C can be computed with a probabilistic algorithm in expected time bounded by (log q) c(η) .

Families of RM curves

We present one-dimensional families of hyperelliptic curves from [START_REF] Tautz | Explicit hyperelliptic curves with real multiplication and permutation polynomials[END_REF], constructed via cyclotomic covers. They have an affine model C n,t : Y 2 = D n (X)+t, where t is a parameter and D n is the n-th Dickson polynomial with parameter 1 defined inductively by D 0 (X) = 2, D 1 (X) = X, and

D n (X) = XD n-1 (X) -D n-2 (X).
Since D n (X) has degree n, setting n = 2g + 1 for odd n yields a one-dimensional family C n,t of genus g hyperelliptic curves given by an odd-degree Weierstrass model. Their Jacobians all have an explicit endomorphism η, and when n is prime, Proposition 2 of [START_REF] Kohel | Efficiently computable endomorphisms for hyperelliptic curves[END_REF] shows that

Z[η] ∼ = Z[ζ n + ζ -1 n ]
, where ζ n is a primitive n-th root of unity over Q. Another family based on Artin-Schreier covering is detailed in the same paper but these curves have genus (p-1)/2 where p is the characteristic of the base field, so that our complexity study using the O η () notation would be pointless in that case. Since g becomes much larger than log p in that case, it would be more efficient to use p-adic algorithms anyway.

Let C be a hyperelliptic curve of genus in the family C 2g+1,t . In [START_REF] Kohel | Efficiently computable endomorphisms for hyperelliptic curves[END_REF], Kohel and Smith compute formulas for the Mumford form of η ((x, y) -P ∞ ), where (x, y) is the generic point on C. These formulas are given explicitly for some examples in genus 2 and 3, and an algorithm [START_REF] Kohel | Efficiently computable endomorphisms for hyperelliptic curves[END_REF]Algorithm 5] is presented to compute them for any C. This algorithm has a time complexity in O(g 2 ) and requires to store O(g 3 ) field elements. Thus, given a curve from that family as input, an explicit endomorphism of its Jacobian can be computed once and for all in O(g 3 log q) time and space complexity, which is negligible compared to the cost of counting points on the curve.

The characteristic equation

As in genus 3, let us consider ψ = π + π ∨ and recall that ψ ∈ Q[η]. We still have ψπ = π 2 + q and once again, we test this equation to determine ψ instead of the characteristic equation of π. The link between ψ and π needs to be made explicit, which is the aim of the present section.

Since χ π is a Weil polynomial, we can write χ π (X) = g i=0 (-1) i σ i (X 2g-i + q g-i X i ), with σ 0 = 1 and the convention that σ g is actually twice smaller than the g-th coefficient of χ π . By the Cayley-Hamilton theorem, we have q -g (π ∨ ) g χ π (π) = 0. Using the fact that ππ ∨ = q, we rewrite that as

g i=0 (-1) g-i σ g-i (π i + (π ∨ ) i ) = 0.
Our plan is to compute χ π mod by determining ψ . Let us write ψ = g-1 i=0 a i η i , the goal of the section is to prove bounds on the coefficients a i , so that we can estimate the number and maximal size of primes required to compute ψ without ambiguity. Note that ψ is in the maximal order of Q(η), but not necessarily in Z[η]. However, as in the genus-3 case, Z[η] has finite index ∆ in the maximal order and the possible common denominator of the a i 's has to divide ∆. This denominator entails that additional primes may be required to fully determine ψ, however ∆ depends only on η so that it will disappear in the O η -notation of our complexity estimates. Therefore, we do not detail further this subtlety and assume for simplicity that the a i 's are integers, which we wish to bound by O η ( √ q).

Let us first express the quantities π i + (π ∨ ) i in terms of powers of ψ as a first step towards expressing the σ i 's as functions of the a i 's. Lemma 7.2. For any i ∈ {1, . . . , g}, there exist integers (α i,j ) 0≤j<i such that α i,j = O(q (i-j)/2 ) and

π i + (π ∨ ) i = ψ i + i-1 j=0 α i,j ψ j .
Proof. The statement holds for i = 1 with α 1,0 by the definition of ψ. For i = 2, we have ψ 2 = π 2 + (π ∨ ) 2 + 2ππ ∨ , so that we have the result with α 2,0 = -2q and α 2,1 = 0.

In this proof, we set the convention α i,i = 1 to simplify our recurrence relations.

Let us now assume the lemma holds for any positive integer no greater than a certain i. We therefore have

ψ i+1 = (π + π ∨ )ψ i = (π + π ∨ )   (π i + (π ∨ ) i ) - i-1 j=0 α i,j ψ j   .
The first term is equal to π i+1 + (π ∨ ) i+1 + q(π i-1 + (π ∨ ) i-1 ) so that we can use the lemma once again for i -1 and get

ψ i+1 = π i+1 + (π ∨ ) i+1 -α i,i-1 ψ i + qα i-1,0 + i-1 j=1 (qα i-1,j -α i,j-1 )ψ j .
Thus, we have computed the α i+1,j given by

α i+1,j =        α i,i-1 if j = i, -qα i-1,0 if j = 0, α i,j-1 -qα i-1,j else.
Let us now study the order of magnitude of the α i+1,j : from the recurrence hypothesis on both i and i -1,

α i,i-1 = α i+1,i is in O( √ q), α i-1,0 is in O(q (i-1)/2 ) so that α i+1,0 is in O(q (i+1)/2 ),
and both qα i-1,j and α i,j-1 are in O(q (i+1-j)/2 ), which proves the result for any other α i+1,j . By induction, the lemma is proven.

Note that our O-notation in the previous statement and proof can be a bit misleading as there may not be an absolute constant bounding all the α i,j /q (i-j)/2 . However, from the recurrence relation between the a i,j 's, one sees that each α i,j is equal to q (i-j)/2 plus an error term that is in O η (q (i-j-1)/2 ) and at worst quadratic in g, hence the error term is negligible compared to q (i-j)/2 . Proposition 7.3. Let the a i 's be the coefficients of ψ in the basis (1, η, . . . , η g-1 ) and σ i be the i-th coefficient of χ π , or half this coefficient if i = g. Then χ π is uniquely determined by the a i 's and there exists C η > 0 depending only on g and η such that for any i ∈ {0, . . . , g -1}, we have

|a i | ≤ C η √ q.
input : q an odd prime power, and f ∈ F q [X] a monic squarefree polynomial of degree 2g + 1 such that the curve Y

i ∈ Z / Z such that k i π(D i ) = π 2 (D i ) + qD i ; end
Find the unique tuple (a 0 , . . . , a g-1 ) in (Z / Z) g such that g-1 j=0 a j λ j i = k i , for i in {1, . . . , g} ; w ← w • ; end Reconstruct (a 0 , . . . , a g-1 ) using the Chinese Remainder Theorem ; Deduce χ π from ψ.

Algorithm 9: Overview of our RM point-counting algorithm contains a subgroup G i isomorphic to Z / Z × Z / Z, since the norm of α i is a multiple of . The two-element representation ( , η -λ i ) of the ideal p i implies that λ i is an eigenvalue of η viewed as an endomorphism of J[ ] ∼ = (Z/ Z) 2g .

On G i ⊂ J[α i ], the endomorphism η acts as the multiplication by λ i . Therefore, the endomorphism ψ = g-1 i=0 a i η i also acts as a scalar multiplication on this 2-dimensional space, and we write k i ∈ Z / Z the corresponding eigenvalue: for any D i in G i , we have ψ(D i ) = k i D i . On the other hand, from the definition of ψ, it follows that ψπ = π 2 + q. Therefore, if such a D i is known, we can test which value of k i ∈ Z / Z satisfies

k i π(D i ) = π 2 (D i ) + qD i . (7.1)
Since is a prime and D i is of order exactly , this is also the case for π(D i ). Finding k i can then be seen as a discrete logarithm problem in the subgroup of order generated by π(D i ); hence the solution is unique. Equating the two expressions for ψ, we get explicit relations between the a j 's modulo :

g-1 j=0 a j λ j i ≡ k i mod .
Therefore we have a linear system of g equations in g unknowns, the determinant of which is the Vandermonde determinant of the λ i , which are distinct by hypothesis. Hence the system can be solved and it has a unique solution modulo . It remains to show how to construct a divisor D i in G i , i.e. an element of order in the kernel J[α i ]. Since an explicit expression of η as an endomorphism of the Jacobian of C is known, an explicit expression can be deduced for α i , using the explicit group law. The coordinates of the elements of this kernel are solutions of a polynomial system that can be directly derived from this expression of α i , using a modelling similar to that of Chapter 5. Likewise, we use the geometric resolution algorithm to find the solutions of this system, perhaps in a finite extension of the base field, from which divisors in J[α i ] can be constructed. Multiplying by the appropriate cofactor, we can reach all the elements of G i ; but we stop as soon as we get a non-trivial one.

We summarize the conditions that must be satisfied by the primes that we work with:

(C1) must be different from the characteristic of the base field;

(C2) must be coprime to the discriminant of the minimal polynomial of η;

(C3) there must exist α i ∈ p i as in Lemma 7.4 below with norm non-divisible by 3 for i ∈ {1, . . . g};

(C4) the ideal Z[η] must split completely.

The first 3 conditions eliminate only a finite number of 's that depends only on η. The condition (C3) implies that there is a unique subgroup

G i of order 2 in J[α i ].
Given a genus-g curve C with RM by Z[η], by Chebotarev's density theorem, the proportion of primes satisfying the last condition is at least 1/# Gal(Q(η)/ Q), which is bounded below by 1/(g!). To count points on C, we need to find L a set of primes satisfying all the above conditions and such that ∈L > 2∆C η √ q. By the prime number theorem, both the number and size of the primes contained in L are in O((g!) log(C g q)). In some particular cases, the proportion of "nice" primes may be much larger: for instance when the RM field is the totally real subfield of a cyclotomic field. In the field Q(ζ n + ζ -1 n ), a prime totally splits if and only if ≡ ±1 mod n, and therefore condition (C4) is satisfied by a proportion of primes equal to 2/(n -1) = 1/g. Lemma 7.4. For any prime that splits completely in Z[η], each prime ideal p above contains a non-zero element α of the form α = g-1 i=0 α i η i , where the |α i | are integers smaller than ∆ 1/g 1/g , where ∆ is the index O

Q(η) : Z[η] .
Proof. The coefficients of the elements of the ideal p represented by polynomials in η form a lattice L of dimension g. In Z[η], its volume is the norm of p, i.e. . Thus, its actual volume in R g is ∆. Let us consider C = {x ∈ R g | ||x|| ∞ ≤ ∆ 1/g 1/g }. The volume of the convex C is 2 g ∆ . Since g is the dimension of L and ∆ its volume, Minkowski's theorem guarantees the existence of a non-zero element v of L belonging to C. By definition, v = g-1 i=0 v i η i is an element of p whose coordinates v i 's are integers of absolute values bounded by ∆ 1/g 1/g , which concludes the proof.

Since we know it exists, given one of the ideals p i , we can find α i a small element of p i as in Lemma 7.4 by exhaustive search in at most 2 g ∆ operations in Z[η]. Note that there is an extensive litterature on finding short vectors in a lattice of dimension d, motivated for instance by cryptographic applications. An example is the quantum algorithm of [START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF] which computes a 2 O( √ d) -approximation of the shortest non-zero vector in time polynomial in d. Restricting to classical algorithms, the best option in general is the BKZ algorithm [START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems[END_REF] that computes a 2 O(d α ) -approximation in time 2 O(d 1-α ) , for any α ∈ [0, 1]. In our case however, the existence of a very short vector is already known and, more importantly, the factor 2 g due to the dimension is acceptable since it vanishes in the O η -notation.

Modelling kernels of endomorphisms

Let α be an explicit endomorphism of degree O( 2 ) on the Jacobian of C, which satisfies the properties of Lemma 7.4. We want to compute a polynomial system that describes the kernel J[α] of α, and then solve it. The resultant-based approach of Chapter 6 cannot be used as the degrees are squared each time we eliminate a variable, causing an exponential dependency in g in the exponent of . Instead, we use the modelling techniques from Chapter 5, where the endomorphism α replaces the multiplication by . This time, the g variables of large degrees have degrees in O η ( 3/g ) instead of O η ( 3 ) so that the final complexity bound for computing the kernel α is in O η ( c ), with c an absolute constant.

The main change between this section and Sections 5.3 and 5.4 is that the d i and e i no longer denote -division but α-division polynomials, and the polynomials u j and v j intervening in the Mumford representation of the candidate kernel element are modified accordingly. The structure of our modelling is very similar but require some adaptations at various places, which is the reason why we repeat the analysis in the generic case. In the non-generic case, we restate the main results of Section 5.4 but only detail the parts requiring adjustments.

The generic case

Let us first recall the definition of Cantor's -division polynomials, the coefficients of the polynomials δ (X) and ε (X) such that, for (x, y) a generic point of the curve and > g, we have

((x, y) -P ∞ ) = δ x -X 4y 2 , ε x -X 4y 2 .
We recall Theorem 4.13 proven in Chapter 4: For any integer > g, the polynomial δ (X) of degree g in X has coefficients in F q [x] whose degrees in x are bounded by g 3 /3 + O g ( 2 ); the polynomial ε (X)/y has coefficients in F q (x) such that the degrees of the numerators and the denominators have degrees bounded by 2g 3 /3 + O g ( 2 ). Furthermore, the roots of the denominators are roots of the leading coefficient of δ (X).

These polynomials describe the multiplication by , but for our purpose we need to define the α-division polynomials d i and e i such that, denoting by P = (x, y) the generic point of C, the non-normalized Mumford form of α(P -P ∞ ) is equal to

g i=0 d i (x)X i , y g-1 i=0 e i (x) e g (x) X i . By Lemma 7.4, we know that α = g-1 i=0 α i η i with |α i | = O η ( 1/g ).
Since the degrees of the η i (P -P ∞ ) do not depend on , by Theorem 4.13 applied to Cantor's α i -division polynomials we prove that the degrees of the d i 's and e i 's are in O η ( 3/g ).

Definition 7.5.

In what follows, we will say that an element of J is α-generic if it has weight g and the corresponding reduced divisor g i=1 (P i -P ∞ ) satisfies the following two properties:

• For any i, the u-coordinate of the divisor α(P i -P ∞ ) in Mumford form has degree g;

• For any i = j, the u-coordinates of the divisors α(P i -P ∞ ) and α(P j -P ∞ ) are coprime.

This implies that if an affine point P occurs in the support of a α(P i -P ∞ ) then neither P nor -P appears in the support of another α(P j -P ∞ ).

Let D = g i=1 (P i -P ∞ ) be an α-generic divisor in J. We shall consider a system equivalent to α(D) = 0 but let us first introduce some notation. For each point P i = (x i , y i ) in the support of D, we denote u i , v i the Mumford form of α(P i -P ∞ ) and (a ij , b ij ) 1≤j≤g the coordinates of the g points in its support counted with multiplicities, which means that for any i the g roots of u i are exactly the a ij , and that for any j, b ij = v i (a ij ). Proposition 7.6. We can model the set of generic α-division elements as the solution set of a bihomogeneous polynomial system consisting of O(g 2 ) equations in F q [X 1 , . . . , X g , Y 1 , . . . , Y ny ] such that n y = O(g 2 ) and the degrees in the X i 's and Y j 's are respectively in O η ( 3/g ) and O η [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF].

Proof. Following the modelling of Section 5.3, we have α(D) = 0 if and only if the sum of the divisors g i=1 α(P i -P ∞ ) is a principal divisor. The only pole is at infinity, so this is equivalent to the existence of a non-zero function ϕ ∈ F q (C) of the form P (X) + Y Q(X) with P and Q two polynomials such that the g 2 points (a ij , b ij ) are the zeros of ϕ, with multiplicities. Since we want ϕ to have g 2 affine points of intersection with the curve C (once again, counted with multiplicities), the polynomial Res Y (Y 2 -f, P + Y Q) = P 2 -f Q 2 must have degree g 2 which yields 2 deg(P ) ≤ g 2 and 2 deg(Q) ≤ g 2 -2g -1. Exactly one of those two bounds is even (it depends on the parity of g), and for this particular bound, the inequality must be an equality, otherwise the degree of the resultant would not be g 2 . Since the function ϕ is defined up to a multiplicative constant, we can normalize it so that the polynomial P 2 + f Q 2 is monic, which is equivalent to enforce that either P or Q is monic depending on the parity of g.

For a fixed i ∈ [1, g], requiring the (a ij , b ij ) to be zeros of ϕ amounts to asking for the a ij to be roots of P (X) + Q(X)v i (X), with multiplicities. Since the a ij are by definition the roots of the u i , α(D) = 0 is equivalent to g congruence relations P + Qv i ≡ 0 mod u i . Thus, for any α-generic divisor, α(D) = 0 is equivalent to the existence of P and Q satisfying the above g congruence relations.

The variables are the coefficients of P and Q, as well as the x i and y i . With the degree conditions and the normalization, we have g 2 -g variables coming from P and Q. Adding the 2g variables x i and y i , we get a total of g 2 + g variables. Each one of the g congruence relations amounts to g equations providing a total of g 2 conditions on the coefficients of P and Q. The fact that the (x i , y i ) are points of the curve yields the g additional equations y 2 i = f (x i ). Finally, we have to enforce the α-genericity of the solutions, which can be done by requiring that i d g (x i )e g (x i ) i<j Res(u i , u j ) = 0. Note that we do not extend Theorem 4.13 but instead add the non-vanishing condition for the denominator of the v-coordinate of α(D). Still, we get a polynomial system with g 2 + g equations in g 2 + g variables, together with an inequality.

We now estimate the degrees to which the variables occur in the equations. Each congruence relation is obtained by reducing P +Qv i , which is a polynomial of degree O(g 2 ) in X, by u i which is of degree g. We can do it by repeatedly replacing X g by -j<g (d j (x i )/d g (x i ))X j , which we will have to do at most O(g 2 ) times. Since the d j have degree in O η ( 3/g ) in x i , the fully reduced polynomial will have coefficients that are fractions for which the degrees of the numerators and of the denominators are at most O η ( 3/g ) in the x i variables. In these equations, the degree in the y i variables and in the variables for the coefficients of P and Q is 1. The degrees in x i and y i in the curve equations are 2g + 1 and 2 respectively.

It remains to study the degree of the inequality. Each resultant is the determinant of a 2g×2g Sylvester matrix whose coefficients are the d i , which have degrees bounded by O η ( 3/g ). Since for any i there are exactly g resultants involving x i in the product, the degree of this inequality in any x i is in O η ( 3/g ), and it does not involve the other variables. In order to be able to use Proposition 5.3, we must model this inequality by an equation, which is done classically by introducing a new variable T and by using the equation T

• i d g (x i )e g (x i ) i<j Res(u i , u j ) = 1.
To conclude, we have a polynomial system with two blocks of variables: the g variables x i on the one hand and the g 2 -g variables coming from the coefficients of P and Q, along with the g variables y i on the other hand. The degree of the equations in the first block of variables grows cubically in 1/g , while the degree in the other block of variables depends only on g (and η).

Non-generic kernel elements

As in Section 5.3, apart from the neutral element, we expect to capture the whole kernel of the endomorphism α by using the modelling of Section 7.2.1. Contrary to Chapter 5, Algorithm 9 does not require us to find a basis of J[α] because the determination of the k i 's does only require a single non-zero element in each J[α i ]. Thus, a study of non-generic elements in J[α] is necessary only if there is no α-generic element in J[α]. Such a case happens if and only if the polynomial g i=1 d g (x i )e g (x i ) i =j Res(u i , u j ) in the variables x 1 , . . . , x g vanishes on J[α]. It seems very unlikely that the whole set J[α] lives in such a hypersurface, and if it happens, one can discard the for which we fail to find an α-generic element. Although it seems even more unlikely that this situation could happen for sufficiently many so as to threaten the validity of our complexity bound, we are far from a proven statement and do not exclude it might be possible to design a highly non-generic curve providing a counterexample.

Therefore, we follow the non-genericity analysis of Section 5.4 except that we consider u i and v i defined as the Mumford form of α(P i -P ∞ ) instead of (P i -P ∞ ). Let us briefly review the non-generic situations that one can encounter, following Section 5.4.1 and keeping the same numbering.

Case 1: Modelling a kernel element of weight w < g. We write D = w i=1 (P i -P ∞ ) and look for a ϕ = P (X) + Y Q(X) vanishing at each point of each reduced divisor α(P i -P ∞ ). This is similar to the Case 1 of Section 5.4.1.

Case 2: Modelling a kernel element with multiple points. It may happen that the element we are looking for is D = w i=1 (P i -P ∞ ) but not all the P i 's are distinct. In that case, we rewrite it as D = s j=1 λ j (P j -P ∞ ) such that the P j 's are distinct and look for a ϕ = P (X) + Y Q(X) vanishing at each point of each reduced divisor λ j α(P j -P ∞ ). Apart from the modification of u i and v i , the modelling is identical to that of Chapter 5.

Case 4: Modelling a kernel element after reduction. Even if all the α(P i -P ∞ ) had full weight, there still may be less than g 2 points in the union of their supports due to possible cancellations of points appearing in the supports of several α(P i -P ∞ ) with different signs. Exactly as in Section 5.4.1, if P appears within α(P i -P ∞ ) and α(P j -P ∞ ) with respective multiplicities ν i and ν j of opposite signs, this is modelled by ensuring that the corresponding u i , u j , and v i + v j share a common factor (X -ξ) ν where ν = max(|ν i |, |ν j |). In that case, we look for ϕ(X, Y ) = (X -ξ) ν ( P (X) + Y Q(X)), with P coprime to Q. Once modified the values of the u i and v i , nothing changes from Chapter 5.

Case 5: Modelling a kernel element with multiplicity. Conversely, α(P i -P ∞ ) and α(P j -P ∞ ) can also share the same point with multiplicities of identical sign, leading to multiplicities in the reduced divisor α(D). Similarly to what was done in the Case 5 of Section 5.4.1, we can group the corresponding u i , u j , v i and v j in polynomials U and V such that U |V

k i=1 t i ≤ g 2 O η ( 3/g ) ≤ g Eq. Sys.11 deg U ≤ g 2 0 O(g 3 ) Eq. Sys.12 k i=1 deg u i ≤ g 2 O η ( 3/g ) O(g 2 ) Eq. Sys.13 deg U ≤ g 2 0 O(g 3 )
Table 7.1: Summary of the degrees of the equations in the polynomial system corresponding to a normalized non-genericity tuple (w, λ, t, , M ).

Carlo algorithm which computes an F q e -geometric resolution of the sub-variety of J[α] consisting of α-generic α-torsion elements, where e = O η (log ). The time and space complexities of this algorithm are bounded by O η ( D (log q) 2+ε ) and it returns the correct result with probability at least 5/6.

Proof. Let us consider the sub-variety S ⊂ J[α] consisting of α-generic elements, and I the corresponding ideal. More precisely, we see I as the ideal of a sub-scheme of the scheme J[α], itself subscheme of J[deg α], which is the kernel of a finite and étale map because deg α is a small multiple of and is hence coprime to the characteristic p thanks to our assumptions on the size of p in the statement of Theorem 7.1. Therefore, I is 0-dimensional and radical. Since all the elements in S have the same weight g we can use the Mumford coordinates u(X), v(X) with deg u = g and deg v < g -1 as a local system of coordinates to represent them. But the polynomial system that we have built is with the (x i , y i ) coordinates, that is, it generates the ideal I unsym obtained by adjoining to the equations defining I the 2g equations coming from u(X) = (X -x i ) and y i = v(x i ). Then we have deg I unsym = g! deg I. By the α-genericity condition, all the fibers in the variety have exactly g! distinct points corresponding to permuting the (x i , y i ) which are all distinct. Therefore the radicality of I implies the radicality of I unsym and we can apply a modified version of Proposition 5.3 to our polynomial system. Indeed, by Proposition 7.6 we now have a function h and a constant C such that d x ≤ h(g) C/g instead of h(g) C . This propagates in the proof of Proposition 5.3, and since the power of only comes from the bound on d x , we can also replace by 1/g in the final result, so that we can compute an F q e -geometric resolution of S in time and space bounded by O η ( D (log q) 2+ε ), with e = O η (log ).

Following the same proof but invoking Proposition 7.7 instead of Proposition 7.6, the same complexity bound holds for solving the polynomial system associated to any non-genericity tuple. Even if a non-zero α-torsion element is only found after solving all the systems associated to non-genericity tuples, the cost for computing ψ mod is only multiplied by a factor in O η [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF].

We have proven that there exists a constant c such that for any prime satisfying conditions (C1) to (C4), computing χ π mod is achieved within O η ( c ) field operations. Taking into account the size of the largest to consider and the cost of field operations, the overall complexity of our point-counting algorithm is in O η ((log q) c+2 ). The bottleneck is computing geometric resolutions of polynomial systems which is quadratic in their respective multihomogeneous Bézout bounds, up to a factor in O η [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF]. Still neglecting factors in O η (1), the multihomogeneous Bézout bound itself boils down to O η (deg g 1 ) by Definition 2.44. As shown in Table 7.1, deg 1 = O η ( 3/g ) so we deduce that c = 6 and get an overall complexity bound in O η (log 8 q).

Note that our bound on deg 1 is pessimistic because we used the proven cubic bound for the degrees of Cantor's division polynomials while we expect them to be actually quadratic. Under this assumption, deg 1 is reduced to O η ( 2/g ) and the overall complexity would therefore be in O η (log 6 q) for any g. Apart from the part depending on g, this conjectural result is identical to what we proved for genus 3. In the next section, we push the analysis forward by investigating the dependency on g.

Dependency on g of the complexity

The goal of this section is to assess the potential of our algorithm to achieve a polynomial-time complexity both in g and log q on some family of curves. To this end, we review our complexity analysis with additional attention given to the factors that previously vanished in the O η .

Dependency on g of the largest

Let us first come back to the constant C g of Section 7.1.2. We have seen that the only non-polynomial dependency on g came from the matrix norm when inverting the linear change of variables ψ k = g-1 i=0 a i η i k , which is described by the Vandermonde matrix of the g conjugates of η, denoted by η k for k ∈ {1, . . . , g}. Let B the inverse of this matrix, then we have . Thus, the constant C g can be bounded by g 2 c g , where c has a polynomial dependency on η and its conjugates. By the prime number theorem, the set L of primes such that ∈L > 2C g √ q is such that the number and size of primes in L is in O(g) log q/ log log q. As we already mentioned, the primes to consider must satisfy the conditions (C1) to (C4) and that may cause them to be larger by a factor depending exponentially on g a priori. Since the complexity of computing χ π mod is polynomial in , this implies that the overall complexity depends exponentially on g in general.

B ij = 1≤k 1 <•••<k g-j <g k 1 ,...,k g-j =i (-1) j-1 η k 1 • • • η k g-j η i k =i (η k -η i ) . Let E = max k (|η
However, a curve in the family C n,t introduced in Section 7.1.1 has RM by the real subfield of Q(ζ n ), for which we know that the proportion of split primes is 2/(n -1) = 1/g. Therefore, this first obstacle due to the size of primes to consider can be overcome provided that we further strengthen the assumptions on the RM-curves we consider.

Finding small elements in lattices This time, the exhaustive search is no longer sufficient for our need because of the factor 2 g in the size of the ball v | ||v|| ∞ ≤ ∆ 1/g 1/g . Unfortunately, the current best known algorithms for finding short vectors in time subexponential in the dimension of the lattice have a drawback that makes them unusable in our point-counting algorithm. Indeed, although they run faster than the naive approach, they do not necessarily output the shortest non-zero vector in the lattice, but an approximation that may be greater by a factor which is also subexponential in the dimension. The size of the short vector plays a prominent role in the complexity analysis of our point-counting algorithm as it gives a bound on the degrees of the equations modelling J [α]. Even if we find an α whose coordinates are in g 1/g instead of c 1/g , the factor g will cause a factor g g in the multihomogeneous Bézout bound, and hence in the final complexity of solving the polynomial systems.

Although finding short generators of ideals in number fields is believed to be hard in general, we may still expect to further restrict the RM curves we consider so as to fall in a case for which the complexity of such task becomes affordable. Examples are given in [START_REF] Bauch | Short generators without quantum computers: the case of multiquadratics[END_REF], where a classical algorithm is shown to compute short generators of principal ideals in particular number fields called multiquadratics, i.e. fields of the form Q

( √ d 1 , . . . , √ d n ).
While we acknowledge that it is quite speculative to hope for families of curves of arbitrary high genus with RM by a Z[η] satisfying all the previous hypotheses, we do not linger on this because the next point is much more of a concern anyway.

Solving polynomial systems

Using the strategy of Section 7.2, the complexity is polynomial in the multihomogeneous Bézout bound, itself including a combinatorial factor in g g 2 . Indeed, although the ideals of α-torsion have degree 2 independent of g, this is not true for the number of variables involved in our modelling, which is at least g 2 in the generic case. Worse than that, the size of the polynomial systems modelling the set of generic α-torsion elements is already exponential in g. Indeed, following the proof of Lemma 2.50, one sees that the number of monomials has a factor nx+dx nx and our modelling is such that n x = g and d x ≥ g 2/g so that nx+dx nx ≥ (n x + d x ) nx /n nx x is bounded below by g g . Thus, there is no hope of turning our algorithm into something subexponential in g in its current state. Possible workarounds could be looking for easier instances in which we could model the α-torsion by even smaller polynomial systems, or cases for which there are simpler ways of obtaining a generic α-torsion divisor than the one we used.

Conclusion

In this thesis, we focus on point-counting on hyperelliptic curves over finite fields using methods derived from Schoof and Pila's algorithms. We have studied the asymptotic complexity of this task for curves of arbitrary genus defined over a sufficiently large field. In particular, the power of log q in the complexity has been reduced from O(g 2 log g) to O(g) in Chapter 5. For families of curves equipped with an explict RM, we have further reduced this power to a constant in Chapter 7, and proved that our algorithm computes the zeta function of genus-g hyperelliptic curves with explicit RM in time bounded by O η (log 8 q). Conjecturally, we actually expect this complexity to be in O η (log 6 q).

Instanciating our general methods in small genus

It is natural to wonder whether the algorithm we described in Chapter 5 to establish those complexity bounds, or rather their instantiations for curves of small genus, are competitive with the previously existing extensions of Schoof's algorithm in terms of complexity. In genus 2, our general method cannot improve on the complexity in O(log 8 q) of the Gaudry-Harley-Schost algorithm based on resultants, which can actually be further reduced to O (log q) 8-2/ω+ε using the algorithm of Villard [START_REF] Villard | On computing the resultant of generic bivariate polynomials[END_REF] for bivariate resultants. Indeed, the -torsion ideals involved have degrees in O( 4), so that our algorithm based on geometric resolution requires a number of field operations at least quadratic in that degree, i.e. an overall cost of at least O(log 10 q) because of the number and sizes of primes to consider.

In genus 3, no previous instantiation of the Schoof-Pila algorithm had been presented and the complexity of a potential extension was subject to speculation. Since the -torsion ideals have degrees in O( 6), we expect our general algorithm to have a complexity at least in O(log 14 q). Extending the resultant-based elimination scheme of Gaudry-Harley-Schost, we obtained a proven complexity in O(log 14 q) in Chapter 6. In fact, using the algorithm of Villard for computing bivariate resultants, the complexity of the resultant-based approach can be decreased to O (log q) 14-4/ω+ε , which is also less than quadratic in the degree of the -torsion.

Still in genus 3 but for hyperelliptic curves with explicit RM, we have to solve systems of much smaller degrees, and we turned this into a point-counting algorithm of complexity O(log 6 q). Setting g = 3 in the general counterpart to this algorithm designed in Chapter 7, we achieve a similar complexity because for g ≤ 3 the conjectural result leading to the O η (log 6 q) is actually proven. However, using Villard's algorithm for bivariate resultants, the resultant-based algorithm of Chapter 6 reaches a complexity in O((log q) 6-4/(3ω)+ε ) which is once again better than the general approach. We sum up all these results in Table 2. O(log 14 q) O(log 6 q) O(log 6 q)

Chapters 3 and 6 O(log 8 q) O(log 14 q) O(log 5 q) O(log 6 q)

Using [START_REF] Villard | On computing the resultant of generic bivariate polynomials[END_REF] O((log q) 8-2/ω+ε ) O((log q) 14-4/ω+ε ) O((log q) 5-1/ω+ε ) O((log q) 6-4/(3ω)+ε )

Practical experiments

In practice, we expect our general methods to be no match for the tailor-made algorithms in genus ≤ 3, not only because their complexities are lower, but also because the general approaches hide constants that we expect to be much larger. However, a comparison based on practical experiments in full generality is unrealistic in genus ≥ 3 because of the prohibitive complexities of both the algorithms of Chapters 5 and 7.

For practical experiments in genus 3, we considered the easier case of curves with explicit real multiplication, an approach that had previously been studied with benefit in genus 2. We were able to successfully count points on a genus-3 curve defined over F 2 64 -59 . This is comparable in size with previous record computations due to Sutherland using generic group methods which also take advantage of particularities of the input curves, although such peculiar curves are more frequent than curves with explicit RM. In our practical experiments, we used a trivariate elimination scheme except that we computed Gröbner bases instead of trivariate resultants.

The complexity estimate in O η (log 6 q) conjectured in Chapter 7 could give hope of pushing practical experiments to higher genus, since the exponent of log q is independent of g. However, considering the RM families we presented and the conditions on primes , the smallest example available in genus larger than 3 is the computation of the 23-torsion of a hyperelliptic curve of genus 5. Even over a relatively small finite field, this is unrealistic because the systems to solve would have 5 variables with "large" degrees (estimated to be at least 10) and at least 25 variables with degree 1.

Prospective

A natural question that applies to all of our contributions is the possibility of extending our complexity bounds to non-hyperelliptic curves. Even if the Mumford representation allows for a much more straightforward representation of elements and simpler conditions to express the nullity of an element, this is not an absolute necessity. The most important result is that the degree of the -torsion ideal is still 2g in any Jacobian of a genus-g curve. Provided that we can model this ideal by a polynomial system with a number of variables that depends only on its dimension g and such that "only" O(g c ) of them have degrees actually depending on , then the geometric resolution algorithm yields a point-counting algorithm running in time O g (log q) O(g c ) . Controlling the constant c and giving an explicit bound would already improve the result of Adleman and Huang [START_REF] Adleman | Counting points on curves and Abelian varieties over finite fields[END_REF], but we expect that it should be possible to prove that c = 1 as we did in the hyperelliptic case, at least for Jacobians of plane curves.

In Chapter 5, we perform a tedious analysis of how to handle non-generic elements in the torsion subgroups. It is quite unsatisfactory that such amount of work is performed for cases which are supposed not to happen, or with an incredibly low probability. Actually, while we consider many cases, we do not even prove that they happen. Therefore, one could wonder whether all those non-genericities are possible. In Chapter 7, non-genericities are even less likely to become a nuisance since it is sufficient to have only one generic element in the kernel of our endomorphisms. Even better, one could try to completely remove the non-genericity analysis by proving for instance that given a curve, the proportion of primes for which non-genericity occurs is finite or sufficiently small. Conversely, a skeptical reader could attempt to create pathological curves such that avoiding all the "bad" primes would entail considering primes sufficiently large to hamper our complexity result. Note that because of our bounds, this would require finding a family of curves such that the largest required prime grows faster than any power of log q.

The question of finding a classical point-counting algorithm running in time polynomial in both g and log q being open, we wonder whether the approach of Chapter 7 has the potential for providing a small yet non-trivial family of curves for which such an algorithm exists. The first reason why the algorithm presented in Chapter 7 is exponential in g is that the multihomogeneous Bézout bound has a combinatorial factor in O(g g 2 ). Indeed, even though we manage to decrease the degrees of the equations by splitting the -torsion into a direct sum of kernels of endomorphisms of degree 2 , our systems still have O(g 2 ) variables. We have reviewed the other sources of factors exponential in g, and remarked that the polynomial systems appearing in the modelling come both in number and size exponential in g. Therefore, our approach needs further insight before turning into an algorithm running in time subexponential in g, even on a particular subset of curves.

Résumé en Français

Courbes algébriques sur les corps finis et applications

Les courbes algébriques font partie du paysage mathématique depuis plus de 2000 ans, depuis l'Antiquité et les fondements de la Géométrie jusqu'à la preuve du dernier théorème de Fermat dans les années 1990. De telles courbes sont souvent décrites comme le lieu des solutions d'un systèmes polynomial et modélisent de nombreuses situations, d'où leur vaste domaine d'application y compris en dehors des Mathématiques. Dans cette thèse, nous nous concentrons sur les courbes algébriques planes, c'est-à-dire des courbes données par une équation de la forme f (x, y) = 0, avec f un polynome bivarié. Un point de la courbe correspond à une solution de son équation, mais il faut s'accorder sur le sens à donner à la notion de solution. Les mathématiciens grecs de l'Antiquité en savent quelque chose puisqu'ils ont dû faire face au fait que même des équations à coefficients entiers peuvent avoir des solutions irrationnelles. Il nous faut donc préciser le corps dans lequel vivent les coefficients du polynôme f , que nous appellerons le corps de base de la courbe, et considérer les points de la courbe dans la clôture algébrique de ce corps. Rien ne s'oppose toutefois à ce que certains d'entre eux appartiennent bien au corps de base, et nous les qualifierons de rationnels. Bien que le corps des réels semble particulièrement naturel (sans mauvais jeu de mots) pour étudier les corps et en particulier pour les tracer, les courbes définies sur les corps finis sont également sources d'intérêt pour leurs multiples applications. Dans cette thèse, nous considérons presque exclusivement des courbes définies sur un corps fini de caractéristique impaire, bien que nous profitons parfois de propriétés de certaines courbes qui sont des réductions modulo un nombre premier de courbes définies sur Q.

Les courbes sur les corps finis ont historiquement trouvé leurs premières applications en théorie des nombres, et plus particulièrement pour factoriser des entiers ou tester leur primalité. En effet, l'algorithme ECM [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] est toujours compétitif par rapport aux algorithmes basé sur le crible sur les corps de nombres (NFS) pour trouver des "petits" facteurs (de taille inférieure à 83 bits). L'algorithme ECPP introduit par Goldwasser et Kilian, puis amélioré par Atkin et Morain [START_REF] Goldwasser | Almost all primes can be quickly certified[END_REF][START_REF] Morain | Primality proving using elliptic curves: an update[END_REF] est encore aujourd'hui parmi les plus rapides pour générer des certificats de primalité, il a même récemment été utilisé pour prouver la primalité d'un entier de 34987 bits [START_REF] Kaiser | Greatest numbers certified with Primo[END_REF]. Si son efficacité n'est plus à prouver, la complexité de cet algorithme reste cependant heuristique. Toujours en utilisant des courbes algébriques, de genre 2 cette fois-ci, Adleman et Huang [START_REF] Adleman | Primality testing and Abelian varieties over finite fields[END_REF] ont pu construire un algorithme de Las-Vegas pour prouver la primalité en temps polynomial. Une approche basée sur des courbes encore plus générales est évoquée pour parvenir à un algorithme de factorisation de polynômes sur des corps finis qui soit à la fois déterministe et de complexité polynomiale. On peut également mentionner l'utilisation de techniques d'interpolation sur des courbes algébriques par Chudnovsky et Chudnovsky [START_REF] Volfovich | Algebraic complexities and algebraic curves over finite fields[END_REF] dans les années 1980 pour étudier la complexité du produit de deux polynômes sur des corps finis. Cette approche est toujours d'actualité et il existe une littérature abondante et récente [START_REF] Rambaud | Finding optimal Chudnovsky-Chudnovsky multiplication algorithms[END_REF][START_REF] Ballet | On some bounds for symmetric tensor rank of multiplication in finite fields[END_REF] visant à construire les meilleures courbes possibles dans cette optique. En particulier, on recherche des courbes avec autant de points rationnels que possible, par exemple les courbes regroupées dans la base de donnée libre [START_REF] Van Der Geer | Tables of curves with many points[END_REF].

Il en va de même pour l'algorithme ECM dont on souhaite améliorer les performances en choisissant des familles de courbes particulièrement adéquates, soit parce qu'elles ont plus de chances d'avoir un nombre de points friable [START_REF] Oliver | Finding suitable curves for the elliptic curve method of factorization[END_REF][START_REF] Barbulescu | Finding ECM-friendly curves through a study of Galois properties[END_REF], ou parce qu'elles permettent une arithmétique plus rapide [START_REF] Peter | Speeding the Pollard and elliptic curve methods of factorization[END_REF][START_REF] Bernstein | ECM using Edwards curves[END_REF]. Si la factorisation d'entiers intéresse fortement les cryptanalystes, les courbes algébriques et notamment les courbes elliptiques ont également des applications constructives en cryptographie. En effet, le groupe des points rationnels d'une courbe elliptique sur un corps fini est un parfait exemple de groupe dans lequel calculer des logarithmes discrets est difficile. Contrairement à RSA et au logarithme discret dans le groupe multiplicatif des corps finis, il n'existe pas pour le moment d'attaque sous-exponentielle, ce qui permet d'opter pour des clés bien plus petites. Cela dit, même un algorithme exponentiel peut être efficace si le groupe utilisé est de petite taille ou si son cardinal est très friable [START_REF] Pohlig | An improved algorithm for computing logarithms over GF(p) and its cryptographic significance (corresp.)[END_REF]. Compter le nombre de points rationnels d'une courbe est donc une étape essentielle avant de décider ou non si elle respecte l'exigence de sécurité que l'on se fixe.

À mesure que l'étude des courbes se développait, d'autres objets mathématiques associés furent introduits, à l'image des nombreuses fonctions L et zeta qui occupent aujourd'hui une place centrale dans la théorie des nombres moderne. Ainsi, on trouve plusieurs exemples d'énoncés de théorie des nombres qui furent établis en prouvant des résultats de nature analytique sur des fonctions complexes, comme par exemple la conjecture de Sato -Tate. Cette conjecture concerne la distribution du nombre de points rationnels de la réduction modulo p d'une courbe elliptique définie sur Q lorsque p varie, et fut prouvée autour de 2005 [START_REF] Harris | A family of Calabi-Yau varieties and potential automorphy[END_REF][START_REF] Clozel | Automorphy for some -adic lifts of automorphic mod Galois representations[END_REF][START_REF] Taylor | Automorphy for some -adic lifts of automorphic mod Galois representations[END_REF]. Des travaux sont en cours pour formuler des conjectures similaires dans des cas plus généraux, notamment en genre 2 et 3 [START_REF] Fité | Sato-Tate distributions and Galois endomorphism modules in genus 2[END_REF]. Pour ce faire, des algorithmes de comptage de points comme celui d'Harvey [START_REF] Harvey | Computing Hasse-Witt matrices of hyperelliptic curves in average polynomial time II[END_REF] sont au coeur d'expériences numériques impliquant une puissance de calcul considérable.

Chacune de ces applications a son propre contexte, de la nature des courbes utilisées à la taille du corps de définition. Dans cette thèse, nous considérons exclusivement des courbes hyperelliptiques données par un modèle imaginaire y 2 = f (x), avec f un polynôme unitaire sans carré de degré impair. Le degré deg f = 2g + 1 détermine le genre g de la courbe associée, qui est un paramètre important dans tout le manuscrit. Deux paramètres supplémentaires p et n déterminent la caractéristique p et la taille q = p n du corps de base de la courbe. Dans tout le manuscrit, nous utilisons la notation standard O(), la notation O() lorsque nous omettons les termes polylogarithmiques, et la notation O g quand nous omettons également tous les termes dépendant uniquement de g (et indépendants de q). En utilisant des algorithmes rapides (voir par exemple [START_REF] Brent | Modern computer arithmetic[END_REF]), nous partons du principe que chaque opération dans le corps fini F q a un coût en O(log q). comptage de points dont la complexité est polynomiale en log q [START_REF] Schoof | Elliptic curves over finite fields and the computation of square roots mod p[END_REF]. Bien qu'à cette époque son algorithme ne soit pas considéré suffisamment efficace pour une utilisation pratique, il a ouvert la voie à de nombreuses améliorations et généralisations aujourd'hui regroupées sous le terme de méthodes -adiques. Quelques années plus tard, Elkies et Atkin conçurent des améliorations [START_REF] Schoof | Counting points on elliptic curves over finite fields[END_REF] qui en firent un algorithme utilisable et remarquablement efficace. Sous le nom SEA (Schoof-Elkies-Atkin), cette variante de l'algorithme de Schoof permet aujourd'hui de compter les points d'une courbe elliptique et de générer des courbes cryptographiques de manière plus que satisfaisante. L'idée de l'algorithme de Schoof est de calculer le nombre de points rationnels modulo des nombres premiers jusqu'à ce que la valeur exacte puisse être déduite en appliquant le théorème des restes chinois. En effet, les bornes de Weil impliquent que ce nombre se trouve dans un intervalle de taille 4

√ q et donc que le nombre et la taille du plus grand à considérer sont tous les deux en O(log q). Pour obtenir l'information modulo , Schoof fait agir l'endomorphisme de Frobenius π : (x, y) → (x q , y q ) sur la -torsion, c'est-à-dire l'ensemble des points P tels que P est le point à l'infini, qui est l'élément neutre pour l'addition sur les points de la courbe. Pour premier différent de la caractéristique, la torsion est en fait un espace vectoriel isomorphe à (Z / Z) 2 . L'action de l'endomorphisme de Frobenius est alors représentée par une matrice 2 × 2 dont la trace détermine le nombre de points rationnels modulo . L'étape la plus coûteuse dans cet algorithme est le calcul de π dans la -torsion, qui coûte O( 2 log q) opérations dans le corps de base. En prenant en compte le coût de telles opérations, la taille du plus grand et le nombre de premiers à considérer, la complexité totale de l'algorithme de Schoof est en O(log 5 q). Dans l'algorithme SEA, le gain de complexité est réalisé en remplaçant la -torsion par un sous groupe isomorphe à Z / Z dans lequel chaque opération coûte O( log q) opérations dans le corps de base, ce qui donne une complexité en O(log 4 q) pour l'algorithme SEA.

Jacobiennes de courbes

Pour des applications telles que la construction de groupes cryptographiques, la notion qui généralise une courbe elliptique n'est pas directement une courbe de genre plus grand, parce que ses points rationnels ne forment pas nécessairement un groupe. Les jacobiennes de telles courbes représentent un objet plus adapté car elles ont une structure de groupe (plus précisément de variété abélienne). Il en va de même pour la -torsion qui est celle de la jacobienne et non plus de la courbe elle-même. Nous verrons qu'en genre plus grand que 2, la détermination de la -torsion surpasse l'application du Frobenius et devient l'étape dominante dans la complexité. Cette étape repose de manière cruciale sur l'arithmétique de la jacobienne.

Bien qu'il existe des algorithmes permettant d'effectuer des additions dans des jacobiennes de courbes non-hyperelliptiques, par exemple [START_REF] Hess | Computing Riemann-Roch spaces in algebraic function fields and related topics[END_REF][START_REF] Khuri-Makdisi | Linear algebra algorithms for divisors on an algebraic curve[END_REF], cette thèse se concentre sur le cas hyperelliptique parce que cela simplifie grandement l'arithmétique dans les jacobiennes associées, et notamment la façon dont on parvient à décrire la -torsion. Les éléments de jacobiennes de courbes hyperelliptiques de genre g peuvent être représentés par leurs coordonnées de Mumford, c'est-à-dire par une paire de polynômes de degrés respectifs bornés par g et g -1. L'addition de deux éléments sous cette forme est réalisée avec l'algorithme de Cantor [START_REF] Cantor | Computing in the Jacobian of a hyperelliptic curve[END_REF], avec une complexité en temps et en mémoire qui est quasi-linéaire en g log q. Via une exponentiation binaire, on déduit de cet algorithme un moyen efficace de multiplier des éléments d'une jacobienne hyperelliptique par des scalaires.

Comptage de points sur des courbes

Dans les années 1990, Pila [START_REF] Pila | Frobenius maps of Abelian varieties and finding roots of unity in finite fields[END_REF] constate que les résultats théoriques sur lesquels repose l'algorithme de Schoof sont valides bien au-delà des courbes elliptiques. Il étend ainsi l'algorithme de Schoof au cas des variétés abéliennes et en particulier des (jacobiennes de) courbes algébriques. L'algorithme de Pila ne se contente pas de renvoyer le nombre de points rationnels, mais le polynôme caractéristique de l'endomorphisme de Frobenius ou, de manière équivalente, la fonction zeta locale de la courbe. Comme l'algorithme de Schoof, l'algorithme de Pila est polynomial en log q mais il dépend en plus de paramètres comme le genre (la dimension) de la courbe, et d'une manière exponentielle. Cet algorithme n'a pas été conçu pour être directement implémentable, mais dans le cas particulier des courbes hyperelliptiques de genre 2, l'emploi de techniques issues du calcul formel pour décrire les sous-groupes de torsion et l'action du Frobenius sur ces sousgroupes a permis à Gaudry et Harley [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF] de créer et d'implémenter un analogue de l'algorithme de Schoof. Cet algorithme fut ensuite amélioré par Gaudry et Schost au point d'être suffisamment efficace pour générer une jacobienne de courbe de genre 2 de taille cryptographique [START_REF] Gaudry | Construction of secure random curves of genus 2 over prime fields[END_REF][START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF]. Notons que comme en genre 1, il est toujours possible de créer des jacobiennes avec un nombre de points fixé à l'avance via la méthode CM [START_REF] Weng | Constructing hyperelliptic curves of genus 2 suitable for cryptography[END_REF][START_REF] Sutherland | Accelerating the CM method[END_REF][START_REF] Enge | Computing class polynomials for abelian surfaces[END_REF].

Au début des années 2000, d'autres méthodes également basées sur le calcul de l'action (d'une approximation p-adique) du Frobenius ont été développées, d'abord par Satoh [START_REF] Satoh | On p-adic point counting algorithms for elliptic curves over finite fields[END_REF] dans le cas elliptique. Cette méthode a ensuite été étendue dans un contexte bien plus général et de nombreux algorithmes, regroupés sous le noms de méthodes p-adiques, ont vu le jour. Ces différents algorithmes considèrent différents relèvements du Frobenius agissant sur différents espaces, comme par exemple celui de Kedlaya [START_REF] Kiran | Counting points on hyperelliptic curves using Monsky-Washnitzer cohomology[END_REF] basé sur la cohomologie de Monsky-Washnitzer qui s'applique à des courbes hyperelliptiques de genre quelconque, et son analogue en caractéristique 2 par Denef et Vercauteren [START_REF] Denef | An extension of Kedlaya's algorithm to hyperelliptic curves in characteristic 2[END_REF]. D'autres extensions à des courbes de plus en plus générales ont ensuite été proposées [START_REF] Castryck | Computing zeta functions in families of C a,b curves using deformation[END_REF][START_REF] Castryck | Computing zeta functions of nondegenerate curves[END_REF][START_REF] Tuitman | Counting points on curves using a map to P 1 , II[END_REF] et font toujours l'objet d'une recherche active. En caractéristique 2, une variante de l'agorithme de Satoh fut proposée indépendamment par Mestre [START_REF] Mestre | Lettre adressée à Gaudry et Harley[END_REF] qui propose une expression du Frobenius en termes de suite artihmético-géométrique et qui représente aujourd'hui la méthode la plus rapide pour compter les points de courbes elliptiques définies sur F 2 n . Toujours dans [START_REF] Mestre | Lettre adressée à Gaudry et Harley[END_REF], Mestre propose une généralisation de sa méthode en genre 2, et d'autres travaux l'ont ensuite étendue dans deux directions : soit en choisissant un corps de (petite) caractéristique impaire [START_REF] Lercier | Counting points on elliptic curves over finite fields of small characteristic in quasi quadratic time[END_REF], soit en considérant des courbes de genre plus grand [START_REF] Ritzenthaler | Point counting on genus 3 non hyperelliptic curves[END_REF][START_REF] Lercier | A quasi quadratic time algorithm for hyperelliptic curve point counting[END_REF].

Ces méthodes fournissent des algorithmes utilisables en pratique, et dont la complexité est polynomiale en g et en n, mais exponentielle en log p, de sorte que les méthodes p-adiques et -adiques sont complémentaires lorsque l'un des deux paramètres g et p est petit. En revanche, il n'existe pas d'algorithme classique de comptage de points dont la complexité est polynomiale en ces deux paramètres. Notons toutefois que Kedlaya [START_REF] Kiran | Quantum computation of zeta functions of curves[END_REF] a proposé un tel algorithme en exploitant des primitives quantiques et que pour une courbe définie sur Q, Harvey [START_REF] Harvey | Computing Hasse-Witt matrices of hyperelliptic curves in average polynomial time[END_REF] parvient à compter les points de ses réductions modulo tous les nombres premiers p inférieurs à une borne N en temps quasi-linéaire en N , ce qui veut dire que la complexité moyenne par p est polynomiale en p. Bien que cela ne s'applique qu'à des réductions d'une même courbe sur Q, ces algorithmes sont particulièrement adaptés pour formuler des généralisations de la conjecture de Sato -Tate.

Dans cette thèse, lorsque nous parlons de compter les points d'une courbe ou de sa jacobienne, nous parlons en réalité de résoudre le problème suivant.

Calcul de la fonction zeta d'une courbe hyperelliptique. Étant donné q une puissance d'un nombre premier impair, un entier g ≤ 1 et un polynôme univarié f ∈ F q [X] de degré 2 g + 1, soit C la courbe hyperelliptique associée au modèle de Weierstrass Y 2 = f (X). Calculer le numérateur P C ∈ Z[T ] de la fonction zeta locale de C:

Z(C/F q , T ) = exp ∞ i=1 #C(F q i ) • T i i = P C (T ) (1 -T )(1 -qT ) .
Avec C(F q i ) l'ensemble des points C dont les coordonnée sont dans F q i .

Sous-groupes de torsion

Une étape clé dans les méthodes -adiques est la détermination de l'action du Frobenius sur les sous-groupes de -torsion. Dans l'algorithme de Schoof, la -torsion de la courbe est l'ensemble des points dont l'abscisse annule des polynômes ψ de degrés ( 2 -1)/2 que l'on appelle polynômes de -division. Ainsi l'action du Frobenius π : (x, y) → (x q , y q ) peut être calculée en répétant des étapes d'exponentiation et de réduction par les équations définissant la -torsion : y 2 = f (x) et ψ (x) = 0. Dans un contexte plus général, Pila appelle cette étape le calcul d'une représentation de bas degré du Frobenius. Pour les courbes elliptiques, les polynômes de division donnent une représentation simple et manipulable de la -torsion. Pour des courbes de genre supérieur, a priori, nous ne pouvons pas calculer de représentation de bas degré du Frobenius comme dans l'algorithme de Schoof car nous n'avons de telle description pour la -torsion. Il faut donc calculer une telle représentation, par exemple en calculant une base de Gröbner de l'idéal de torsion, avant de pouvoir réduire le Frobenius.

Dans cette thèse, nous suivons l'approche de Gaudry-Harley-Schost [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF][START_REF] Gaudry | Construction of secure random curves of genus 2 over prime fields[END_REF][START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF] et commençons par écrire l'équation D = 0 dans la jacobienne. Pour ce faire, nous avons besoin d'une description de la multiplication par en tant qu'application rationnelle. Pour P un point d'une courbe hyperelliptique, il existe 2g + 2 polynômes décrivant les coordonnées de Mumford du diviseur (P -P ∞ ). Ces polynômes ont été introduits par Cantor [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF] et nommés d'après lui. En écrivant un élément D de la jacobienne comme somme formelle de points, on peut ainsi déduire une première description de la -torsion en tant qu'ensemble des solutions du système D = 0.

Une fois ce système calculé, nous le résolvons afin d'avoir une représentation de la -torsion nous permettant de réduire le Frobenius. Cette étape est la plus coûteuse dans nos algorithmes, à la fois en théorie et en pratique. Nous apportons ainsi un soin particulier à la façon dont nous modélisons la -torsion par des systèmes polynomiaux et aux techniques de résolution que nous utilisons car elles ont un impact significatif sur les complexités et les temps de calcul de nos algorithmes de comptage de points.

Résolution de systèmes polynomiaux

Étant donnés des polynômes multivariés f 1 , . . . , f m dans K[x 1 , . . . , x n ], nous voulons trouver des équations définissant l'idéal I = f 1 , . . . , f m et telles qu'il soit possible d'effectuer des opérations arithmétiques dans K[x 1 , . . . , x n ]/I. Dans cette thèse, nous nous acquittons de cette tâche pour I = I , l'idéal de -torsion d'une jacobienne de courbe hyperelliptique, soit en mettant sous forme triangulaire le système f 1 = 0, . . . , f m = 0, ou en calculant une résolution géométrique de ce système, c'est-à-dire une paramétrisation des coordonnées de ses solutions par les racines d'un polynôme univarié. Dans les deux cas, nous appelons cette opération "résoudre le système". La littérature propose de nombreuses façons de résoudre des systèmes polynomiaux et nous en utiliserons 3 selon leur complexité asymptotique ou leur efficacité pratique. Cela dépend de nombreux paramètres comme le nombre de variables ou le degré des équations définissant notre système, mais aussi de propriétés moins évidentes comme la dimension de l'idéal, son degré (le nombre de solutions dans la clôture algébrique s'il est fini), ainsi que d'éventuelles particularités structurelles du système. Dans cette thèse, nous résolvons des systèmes qui modélisent des sousensembles de la -torsion, donc nous savons à l'avance qu'ils sont zéro-dimensionnels et que leur degré est borné par 2g .

La torsion des courbes de genre 2, par exemple, est représentée par un système d'équations en deux variables, que l'on peut mettre sous forme triangulaire en calculant des résultants bivariés, qui représentent actuellement la meilleure option à la fois en termes d'efficacité et de complexité asymptotique. Dans le chapitre 6, nous modélisons la -torsion d'une jacobienne de courbe hyperelliptique de genre 3 par un système polynomial trivarié que nous mettons en forme triangulaire en calculant des résultants. Bien que cette approche donne une complexité asymptotique satisfaisante, calculer une base de Gröbner du système via l'algorithme F4 [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF] s'avère bien plus efficace en pratique, aussi est-ce l'approche choisie dans nos expériences. Cela dit, bien que la complexité des algorithmes F4 et F5 [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF][START_REF] Faugère | A new efficient algorithm for computing Gröbner bases without reduction to zero (F5)[END_REF] ait été intensément étudiée [START_REF] Bardet | Étude des systèmes algébriques surdéterminés[END_REF][START_REF] Bardet | On the complexity of the F5 Gröbner basis algorithm[END_REF], aucune borne de complexité présente dans la littérature n'est assez fine pour nous permettre d'utiliser ces algorithmes en théorie et en pratique.

Dans le chapitre 5, nous modélisons d'une autre manière la -torsion de courbes hyperelliptiques de genre quelconque en faisant intervenir O(g 2 ) variables au lieu de g. Cependant, il n'y a toujours que g variables dont le degré dépend de , toutes les autres ayant un degré en O g [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF]. Dans ce cas, l'emploi de l'algorithme de résolution géométrique de [START_REF] Cafure | An effective Bertini theorem and the number of rational points of a normal complete intersection over a finite field[END_REF][START_REF] Giusti | A Gröbner free alternative for polynomial system solving[END_REF] est dicté par la nécessité d'invoquer des résultats de complexité qui prennent en compte cette structure multihomogène si particulière.

Contributions

Dans cette thèse, nous étudions les méthodes -adiques dérivées des algorithmes de Schoof et Pila. La complexité de tels algorithmes est au coeur de ce manuscrit, et notamment la dépendance en g dans l'exposant de log q. La première contribution, publiée en tant que [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF], propose un algorithme de comptage de points sur les courbes hyperelliptiques en grande caractéristique dont on borne la complexité par une puissance de log q qui croît linéairement en g. Ce résultat s'inscrit dans la continuité des travaux d'Adleman et Huang [START_REF] Adleman | Counting points on curves and Abelian varieties over finite fields[END_REF] qui ont établi que cet exposant était polynomial en g dans le cas général, et quasi-quadratique dans le cas hyperelliptique. L'état de l'art concernant cet exposant est résumé dans la table 3. Pour atteindre une telle complexité, notre algorithme n'est guère différent de celui de Pila, mais notre analyse de complexité fait intervenir une nouvelle modélisation de la -torsion par un système polynomial structuré, comme expliqué plus haut. Cette structure est la clé de voûte de notre résultat, et l'on remarque d'ailleurs qu'en suivant notre raisonnement sans l'exploiter, on retrouve un résultat similaire à celui d'Adleman et Huang en O (log q) O(g 2 log g) . Si l'idée est naturelle, son exécution nécessite de surmonter quelques obstacles techniques et notamment de s'assurer que le système polynomial que l'on considère vérifie bien des hypothèses de généricité sur lesquelles reposent les résultats de complexité pour le calcul de résolution géométrique. Un autre obstacle est qu'en réalité notre modélisation fait intervenir un grand nombre de systèmes polynômiaux pour capturer toute la -torsion, y compris certains éléments "spéciaux". Un autre aspect que nous étudions concerne l'utilisation pratique d'algorithmes inspirés par Schoof et Pila lorsque le genre est petit, ce qui va de pair avec la valeur exacte de l'exposant de log q à genre fixé. Bien que l'algorithme de Pila ne soit pas adapté à une implémentation directe, ce que Pila appelle une représentation réduite du Frobenius, c'est-à-dire la réduction du Frobenius modulo l'idéal de -torsion peut être calculé en pratique à l'aide de techniques standard issues du calcul formel. En genre 2, c'est précisément ce qui a été réalisé et implémenté par Gaudry, Harley et Schost dans [START_REF] Gaudry | Counting points on hyperelliptic curves over finite fields[END_REF][START_REF] Gaudry | Construction of secure random curves of genus 2 over prime fields[END_REF][START_REF] Gaudry | Genus 2 point counting over prime fields[END_REF]. Si la taille des objets à manipuler est sensiblement plus grande que dans le cas elliptique, cette approche est suffisamment efficace pour permettre la construction d'une courbe cryptographique de genre 2 définie sur un corps premier de taille 128 bits. Dans cette thèse, nous proposons une analyse heuristique concernant la faisabilité d'une telle courbe sur un corps de taille 192 bits, qui nous paraît peu probable en l'état actuel des choses. Les courbes à multiplication réelle (RM) explicite possèdent une structure supplémentaire qui permet, en genre 2, de ramener l'exposant de log q de 8 à 5 [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF], atteignant ainsi une complexité semblable à l'algorithme de Schoof.

Une autre contribution de ce manuscrit s'intéresse ainsi aux courbes hyperelliptiques de genre 3 [START_REF] Abelard | Counting points on genus-3 hyperelliptic curves with explicit real multiplication[END_REF]. Cette fois, la taille de la -torsion rend les expériences pratiquement impossibles dès lors que dépasse 3. Cependant, pour des courbes munies d'une multiplication réelle explicite, les travaux de [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF] s'étendent, moyennant quelques subtilités supplémentaires, avec une complexité asymptotique en O(log 6 q), donc inférieure à celle du cas général en genre 2. Comme on pouvait s'y attendre avec une telle complexité, cet algorithme est utilisable en pratique, après quelques modifications. En particulier, nous calculons la fonction zeta locale d'une courbe hyperelliptique de genre 3 à multiplication réelle définie sur le corps premier F 2 64 -59 , qui a donc une jacobienne de 192 bits. Notre algorithme s'adapte aisément en un algorithme de comptage de points sur des courbes sans multiplication réelle explicite, au prix d'une complexité bien plus grande en O(log 14 q), ce qui donne une réponse partielle aux interrogations sur la complexité de l'algorithme de Schoof-Pila en genre 3. Comme en genre 2, l'étape la plus coûteuse est la résolution du système polynomial décrivant la -torsion. Ce système est trivarié mais l'élimination successive à base de résultants est toujours suffisante pour atteindre une complexité quadratique en le degré de l'idéal. En pratique, cependant, nous mettons le système sous forme triangulaire en calculant une base de Gröbner avec les algorithme F4 [START_REF] Faugère | A new efficient algorithm for computing Gröbner bases (F4)[END_REF] et FGLM [START_REF] Faugère | Efficient computation of zero-dimensional Gröbner bases by change of ordering[END_REF]. Cette approche est bien plus

Definition 1 . 20 .

 120 0 C ([34, Prop. 4.104]), which allows the following definition: Let L be an intermediate field between K and K, we define the degree-zero Picard group of C as the quotient Pic 0 C (L) = Div 0 C (L)/ Pr C (L). Definition 1.21. Let D be a divisor. We define the associated Riemann-Roch space as

Definition 1 . 45 .

 145 Let (G, ⊕) be a cyclic group of order M and P a generator of G. The discrete logarithm problem (DLP) in the group G is the problem of recovering the integer n ≤ M from the element nP = P ⊕ • • • ⊕ P n times .

  and deg y (µ) ≤ d y . We consider the DFSLP which starts by evaluating these monomials. This costs less than nx+dx nx ny+dy ny (d x + d y -1) multiplications, using a naive algorithm. Then we multiply each of these monomials by the corresponding coefficients, and we sum. This costs m

Theorem 3 . 5 .

 35 [START_REF] Gaudry | Counting points on genus 2 curves with real multiplication[END_REF] Th. 1] Algorithm 5 has a complexity in O(log 5 q) bit operations.

  2 2 -2 and then reconstruct R by interpolation. Knowing the degrees of the d i , we see that deg R = 4 4 -10 2 + 6 is about twice smaller than deg R. The computation of R representing most of the time spent by the algorithm, this trick almost halves the running time.

Definition 4 . 4 (

 44 [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF], 8.7). Let ≥ g + 1 and ν = ( 2 --g 2 + g)/2, we define

Lemma 4 . 15 .

 415 Let ≥ 10, and assume that for all i ≤ ( + 9)/2 the degrees degmax α i and degmax γ i are bounded by C, then degmax α and degmax γ are bounded by 4C + 36 + 108.

Table 2 :

 2 Asymptotic complexities for computing the local zeta function of hyperelliptic curves of genus ≤ 3

	Genus	Complexity	Authors (year)
	g = 1	O(log 5 q)	Schoof [127] (1985)
	g = 1	O(log 4 q)

  Definition 1.15. Let C be a smooth projective and absolutely irreducible curve over K. The free Abelian group with basis C( K) is called the divisor group of C, written Div C . An element D of Div C has the form D =

P ∈C( K) n P P, where the n P are integers such that only a finite number of them are non-zero. We define Supp(D) the support of D as the set of points P such that n P = 0 and the degree of D as deg D = P ∈C( K) n P . Definition 1.16. The set of degree-zero divisors forms a subgroup of Div C that we denote Div 0 C . Definition 1.17. A divisor D = P ∈C( K) n P P is said to be effective if for all P we have n P ≥ 0, and for D and E two divisors, we write D ≥ E if D -E is effective. Definition 1.18. Let L be an intermediate field between K and K, the action of Gal( K/L) on C( K) induces an action on Div C (resp. Div 0 C

Definition 2.5. A monomial

  x α in K[x 1 , . . . , x n ] is an element x α 1 1 . . . x αnn with α = (α 1 , . . . , α n ) a tuple of nonnegative integers. The total degree of such a monomial is the sum |α| = n i=1 α i .

	Definition 2.6. A monomial ordering on K[x 1 , . . . , x n ] is a relation

Definition 2.22. Let

  f 1 , . . . f n be generic homogeneous polynomials of respective degrees d i in the variables x 1 , . . . , x n such that the variables appearing as coefficients of the f i are all distinct.

	The Macaulay resultant of the f i 's is the GCD of all the minors of maximal size of the degree-d
	Macaulay matrix, with d = n i=1 (d i -1) + 1.

Proposition 2.23. [97

  ] The Macaulay resultant R is a homogeneous polynomial, irreducible and of degree D i = j =i d j in the coefficients of f i . The system {f 1 , . . . , f n } has a non-trivial solution if and only if R vanishes.

1 . Definition 2.27. [11

  , Def.1.7.2] Let f 1 , . . . , f m be a sequence of polynomials in K[x 1 , . . . , x n ]. , . . . , f m be a sequence of elements in K[x 1 , . . . , x n ] with m ≤ n and d i the degree of f i . Let us fix the monomial ordering grevlex with x n ≺ • • • ≺ x 1 and make the following hypotheses:

	Denote by f h i the homogeneous part of highest degree in f i . We say that the sequence f 1 , . . . , f m is regular if the sequence of homogeneous polynomials f h 1 , . . . , f h m is regular.
	Definition 2.28 (Noether position). A homogeneous ideal I of K[x 1 , . . . , x n ] is in Noether
	position if there exists r ≤ n such that I ∩ K[x 1 , . . . , x r ] = (0) and K[x 1 , . . . , x n ]/I is an integral
	extension of K[x 1 , . . . , x r ].
	Let f 1

  Proposition 2.39.[START_REF] Von | Modern computer algebra[END_REF] Thm. 6.22 and Cor. 11.21] Let P (x, y) and Q(x, y) be two polynomials whose degrees in x and y are bounded by d x and d y respectively. Then, R(y) = Res x (P, Q) can be computed in O(d 2x d y ) field operations, and the degree of R is bounded by 2d x d y .

Proposition 2.40. Let P (x, y, z) and Q(x, y, z) be two polynomials whose degrees in each variable are bounded by d. Then, R(y, z) = Res x (P, Q) can be computed in O(d 5 ) field operations, and the degree of R in each variable is bounded by 2d 2 .

  be represented by a DFSLP with time and space O (d x + d y + m) nx+dx

		nx	ny+dy ny	.
	Proof. There are nx+dx nx	ny+dy ny

  deg ψ r-2 . So finally, we get The proof for degmax α follows the same line. Using the matrix F rs [h] of Definition 4.10 in a similar way as we used the matrix E rs [h] and with the help of Proposition 4.12, we end up with the following bounds

	degmax γ ≤ 4C + (deg ψ 4 s -deg ψ 4 r-2 ).
	Using Definition 4.7 and Theorem 4.8, we deduce that for all k, we have deg(ψ 2 k ) = 3(k 2 -9)
	and substituting this value and the expression of r -2 and s in term of , we obtain
	deg ψ 4 s -deg ψ 4 r-2 =	30 + 90 if is even, 36 + 108 if is odd,
	and the result follows for degmax γ .
	degmax α ≤	4C + 30 -30 if is even, 4C + 36 -36 if is odd,
	which are stricter than our target.

  .2.

	Equations reference Number of equations (and bound) deg 1	deg 2
	Eq. and Ineq. Sys.1 2k ≤ 2g	2g + 1 0
	InEq. Sys.2	k(k -1)/2 ≤ g(g -1)/2	1	0
	Eq. and Ineq. Sys.3 ≤ 2g	O g

  2 = f (X) has explicit RM by Z[η]. output: The characteristic polynomial χ π ∈ Z[T ] of the Frobenius endomorphism on the Jacobian J of the curve. = p 1 • • • p g , corresponding to the eigenvalues λ 1 , . . . , λ g of η in J[ ] ; for i ← 1 to g do Compute a small element α i of p i as in Lemma 7.4; Compute a non-zero element D i of order in J[α i ] ; Find the unique k

	w ← 1;
	Define C g as in Prop. 7.3; while w ≤ 2 ∆C g √ q + 1 do
	Pick the next prime that satisfies conditions (C1) to (C4);
	Compute the ideal decomposition Z[η]

Table 2 :

 2 Asymptotic complexities for counting points on hyperelliptic curves of genus ≤ 3

	Approach	g = 2	g = 3	g = 2 with RM	g = 3 with RM
	Chapters 5 and 7	O(log 10 q)

Table 3 :

 3 Complexité asymptotique pour calculer la fonction zeta locale d'une variété abélienne de dimension g sur F q

	Auteurs (année)	Complexité	Contexte
	Pila (1990)	O (log q) g O(g)	Variétés abéliennes
	Huang-Ierardi (1998)	O (log q) g O(1)	Courbes planes
	Adleman-Huang (2001) O (log q) g O(1)	Variétés abéliennes
	Adleman-Huang (2001) O (log q) O(g 2 log g)	Courbes hyperelliptiques
	Chapitre 5 (2017)	O g (

log q) O(g) Courbes hyperelliptiques Chapitre 7 (2018) O η (log q) 8 Courbes hyp. avec RM

, . . . , dim V (I) ) is a finite dimensional K-vector space of constant dimension, which is called the degree of I.

Remerciements

We want to define polynomials ∆ α,t and Γ α,t such that a point is in V α,w if and only if ∆ α,w (x) = 0 and Γ α,w-1 (x) = 0 iteratively. First, ∆ α,g-1 = GCD(d g , e g ), so that the points (x, y) of V α,g-1 satisfy ∆ α,g-1 (x, y) = 0. Assuming that for k < g we have already constructed a squarefree polynomial ∆ α,k vanishing on the abscissae of points in V α,k , then one can compute α ((x, y) -P ∞ ) over F p [x, y]/(∆ α,k (x), y 2 -f (x)). By our recurrence hypothesis, the Mumford form of the result is u, v , with u of degree k and v of degree k -1. Let Γ α,k-1 be the product of LC(u) with the denominator of LC(v), then V α,k is the set of points (x, y) such that ∆ α,k (x) = 0 and Γ α,k-1 (x) = 0. Furthermore, ∆ α,k-1 = GCD(∆ α,k , Γ α,k-1 ) vanishes on the points of V α,k-1 .

To avoid multiplicities, we replace ∆ α,t (x) by the square-free polynomial whose roots are exactly the roots of ∆ α,t (x) that are not roots of Γ α,t-1 (x) when it is necessary. Note that the degrees of the ∆ and Γ are by construction bounded by deg ∆ α,g-1 ≤ deg d g with deg d g itself bounded by O η ( 1/g ). This way, we state an analogue of Definition 5.9 for non-generic α-division polynomials:

L'algorithme de Schoof

Nous venons de voir plusieurs raisons pour lesquelles connaître le nombre de points rationnels d'une courbe elliptique peut être capital. Pour ce faire, une approche est de construire des courbes ayant un nombre de points spécifié à l'avance, par exemple avec la méthode CM de [6] qui fut utilisée en cryptographie [86]. Une autre façon de procéder consiste à considérer des courbes au hasard, compter leurs points rationnels et répéter tant que le résultat n'est pas satisfaisant. Bien qu'il existe des approches élémentaires pour réaliser cette tâche, comme par exemple tester toutes les paires (x, y) ∈ F q pour vérifier si elles satisfont l'équation de la courbe, leur complexité les rend inadaptées dans la plupart des cas. En 1985, Schoof propose le premier algorithme de

(X) = 0; By Theorem 2.53, it returns a geometric resolution (( 1 , . . . , n ), q(T ), (q 1 (T ), . . . , q n (T ))) with probability 11/12, provided that f (M ) 1 (X), . . . , f (M ) n (X) is a reduced regular sequence; 4. It computes λ(T ) = GCD(q(T ), f 1 (q 1 (T ), . . . , q n (T )), . . . , f m (q 1 (T ), . . . , q n (T ))); 5. It computes ν 1 (T ) = q 1 (T ) mod λ(T ), . . . , ν n (T ) = q n (T ) mod λ(T ) and returns the geometric resolution (( 1 , . . . , n ), λ(T ), (ν 1 (T ), . . . , ν n (T ))).

We start by showing that the output of this algorithm is indeed a geometric resolution of the algebraic set

, assuming that the probabilistic algorithm in Step 3 returns the correct result and that (f

) is a reduced regular sequence. Let W be the algebraic set {x ∈ F q n | f

⊂ f 1 , . . . , f m , we have V ⊂ W . By construction, the algebraic set defined by the geometric resolution (( 1 , . . . , n ), λ(T ), (ν 1 (T ), . . . , ν n (T ))) is precisely the subset of W where all polynomials f 1 , . . . , f m simultaneously vanish.

It remains to prove that this Turing machine runs within the desired complexity. Steps 1 and 2 require negligible time. Step 3 is done within space O((S + n + d)δ 2 log(q e δ)) and time O((nT + n 5 )δ(dδ + log(q e δ)) log(q e δ)) (Theorem 2.53), provided that δ is an upper bound on the degrees of the intermediate ideals.

Step 4 is done within space and time bounded by O(δ e log q(T + m)) by evaluating the SLP modulo q(T ) (whose degree is bounded by δ) and then by computing m GCD using a quasi-linear algorithm. Finally, Step 5 can be done within time and space O(δ e log q). Then, Proposition 2.48 shows that δ is an upper bound on the degrees of the intermediate ideals. Using the facts that nx+dx dx ≤ (n x +d x ) nx = O g ( C 2 g ) and ny+dy dy ≤ (n y +d y ) ny = O g (1), Lemma 2.50 provides bounds on S and T . Summing these complexities leads to the claimed complexity estimate. Finally, the probability of success is bounded below by the probability that the sequence f

Computing generic -torsion points

Let C be a hyperelliptic curve of genus g over F q with Weierstrass form Y 2 = f (X) (f monic, squarefree, and deg(f ) = 2g + 1) and let J be its Jacobian. Let > g be a prime not dividing q. In this section, we define a notion of genericity for -torsion elements in J and we show that a geometric resolution for the variety they form can be computed efficiently using the tools described in Section 5.2. Our starting point is the modelling of the -torsion sketched by Cantor in the point (5) of Section 9 of [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF]. This section and the next one that deals with the non-generic cases rely heavily on the Mumford representation detailed in Theorem 1. [START_REF] Castryck | Computing zeta functions of nondegenerate curves[END_REF].

In what follows, we often also call Mumford representation a pair of polynomials where u is not monic. In that case, unicity of the representation is no longer guaranteed, but there is no ambiguity on the element of J represented this way.

In genus 1, the -torsion points are the points whose abscissae are the roots of the -division polynomial, which has degree O( 2 ). For higher genera, Cantor [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF] described analogous polynomials δ and ε . By Theorem 4.1, for (x, y) the generic point of the curve and > g, we input : q an odd prime power, and f ∈ F q [X] a monic squarefree polynomial of degree

b, c) using the Chinese Remainder Theorem ; Deduce χ π from Equations (6.1).

Algorithm 8: Overview of our genus-3 RM point-counting algorithm system, perhaps in a finite extension of the base field (of degree bounded by the degree of the ideal generated by the system, i.e. in O( 2)), from which divisors in J[α i ] can be constructed. Multiplying by the appropriate cofactor, we can reach all the elements of G i ; but we stop as soon as we get a non-trivial one.

We summarize the conditions that must be satisfied by the primes that we work with:

(C1) must be different from the characteristic of the base field;

(C2) must be coprime to the discriminant of the minimal polynomial of η;

(C3) there must exist α i ∈ p i as in Lemma 6.2 with norm non-divisible by 3 for i ∈ {1, 2, 3};

(C4) the ideal Z[η] must split completely.

The first 3 conditions eliminate only a finite number of 's that depends only on η, while the last one eliminates a constant proportion. The condition (C3) implies that there is a unique subgroup G i of order 2 in J[α i ] (our description of the algorithm could actually be adapted to handle the cases where this is not true).

Complexity overview

The field Q(η) is of degree 3, so its Galois group has order at most 6 and by Chebotarev's density theorem the density of primes that split completely is at least 1/6. Therefore the main loop is done O(log q/ log log q) times, with primes that are in O(log q). All the steps that take place in the number field take a negligible time. For instance, a small generator like in Lemma 6.2 can be found by exhaustive search: only O( ) trials are needed since we are searching over all elements of the form a + bη + cη 2 , with |a|, |b|, |c| in O( 1/3 ).

Proof. Using Lemma 7.2 for any i ∈ {1, . . . , g} and setting α i,i = 1, we have

Invoking the Weil conjectures for the σ g-i 's and Lemma 7.2 for the α i,j , one concludes that each s i is in O(q (g-i)/2 ). Furthermore, the expressions of the s i 's in terms of the σ i 's form a linear triangular system whose determinant equals 1, so that there is an efficiently computable one-toone correspondence between χ ψ and χ π .

Let us now make explicit the link between the coordinates a i of ψ = g-1 i=0 a i η i and the coefficients s i of χ ψ . For instance, s g-1 = -Tr(ψ) = -g-1 i=0 a i Tr(η i ). To get the other relations, let us now order the g conjugates of η (possibly in the Galois-closure of Q(η)), numbering them from η 1 to η g , and proceed to the linear change of variables ψ k = g-1 i=0 a i η i k for any k in {1, . . . , g}. The matrix associated to this linear transformation is the Vandermonde matrix of the conjugates η k 's. This matrix is invertible because η is separable so that the η i are all distinct reals.

Note that χ ψ is a degree-g monic polynomial vanishing on ψ, and it is therefore its characteristic polynomial. Since the ψ k are exactly the real roots (possibly in the Galois-closure of Q(η)) of χ ψ , by Vieta's formula they satisfy the g equations

where the S i 's are the elementary symmetric polynomials in g variables. Thus, once the a i 's are known, the values for ψ and its conjugates are known and a unique value for each s i is deduced. Furthermore, the Fujiwara bounds from [START_REF] Fujiwara | Über die obere schranke des absoluten betrages der wurzeln einer algebraischen gleichung[END_REF] imply that for any k ∈ {1, . . . , g} we have

We already know that |s g-k | = O( √ q k ), so we deduce that the |ψ k | are in O( √ q). Then, inverting the linear change of variable, we prove that the a i are also in O η ( √ q) since the matrix norm of the inverse of the Vandermonde matrix only depends on η.

Our algorithm is based on determining the a i 's modulo for sufficiently many until they are known without ambiguity and we can deduce χ π . While the Weil bounds on the σ i 's are enough for our purpose, we have proven that the a i 's are in O g ( √ q) as in the genus-3 case. The next section details the process of recovering such modular information on the a i 's.

Overview of our algorithm

The general RM point counting algorithm is Algorithm 9. As mentioned above, we want to compute the coefficients a 0 , . . . , a g-1 of the endomorphism ψ. More precisely, we compute their values modulo sufficiently many totally-split primes until we can deduce their values from the bounds of Prop 7.3 and the Chinese Remainder Theorem. Then, the coefficients of χ π are deduced from the a i 's. We now explain how the algorithm works for a given split . First its decomposition as a product of prime ideals Z[η] = p 1 • • • p g is computed, and for each prime ideal p i , a non-zero element α i in p i is found with a small representation as in Lemma 7.4 below. In fact, p i is not necessarily principal and α i need not generate p i . The kernel of α i is denoted by J[α i ] and it and deg V < deg U , and then look for ϕ = P (X) + Y Q(X) such that P + QV ≡ 0 mod U . Once again, nothing changes apart from the definition of the u i 's and v i 's.

Case 3: Low weight after applying α. We kept this case for the end because it is not a straightforward extension of the Case 3 appearing in Section 5.4.1. Until now, we assumed that all the P i 's in the support of D were such that α(P i -P ∞ ) had weight g, i.e. d g (x i ) = 0. We now want to model the case where D = w i=1 (P i -P ∞ ) such that each α(P i -P ∞ ) has weight w i . In Chapter 5, this was done using a result from [START_REF] Cantor | On the analogue of the division polynomials for hyperelliptic curves[END_REF] giving a necessary and sufficient condition for (P i -P ∞ ) to be of weight w i . When α is an endomorphism other than scalar multiplication, no such result holds a priori. In what follows, we solve this issue by designing non-generic α-division polynomials Γ α,t and ∆ α,t such that α ((x, y) -P ∞ ) has weight w if and only if ∆ α,w (x) = 0 and Γ α,w-1 (x) = 0.

Combining all degeneracies.

As in Section 5.4.2, we have to consider situations in which several of the previous cases occur simultaneously. Note that while we wanted to compute the whole -torsion in Chapter 5, we now only need one kernel element per endomorphism α i to determine χ π mod . Therefore, after finding a non-zero solution to any of the subsequent systems, one need not consider the others. Once again, we will not perform a complete analysis as in Section 5.4.2 but rather detail when modifying the values of u i and v i is not sufficient. We also update the analysis on the numbers and degrees of equations and variables. The aim of the Section is to prove the following proposition.

Proposition 7.7. We can model the set of non-generic elements of J[α] as the solution set of O η (1) bihomogeneous polynomial systems each consisting of O(g

) and the degrees in the X i 's and Y j 's are respectively in O η ( 3/g ) and O η [START_REF] Abelard | Improved complexity bounds for counting points on hyperelliptic curves[END_REF].

Proof. We similarly encode each situation by a non-genericity tuple (w, λ, τ, ε, M ) in the sense of Definition 5.8, and derive an associated polynomial system whose solution set corresponds to elements D ∈ J[α] such that:

• the reduced divisor D of weight w has the form k i=1 λ i P i with distinct P i 's,

• each λ i α(P i -P ∞ ) has weight τ i ,

• each ε i is in {0, 1} and such that ε i = 1 if and only if τ i = λ i = 1.

• the k × s matrix M represents the points shared by the λ i α(P i -P ∞ ) as in Section 5.4.2, with s ≤ gk.

We can follow the analysis of Section 5.4.2 to describe more explicitly the equations and their degrees / number of variables, and remark that the only part that does not generalize readily is the definition of non-generic α-division polynomials, as in the Case 3 above. Let us first fix this issue.

When the weight t i of λ i α(P i -P ∞ ) is strictly smaller than g, the usual coordinate system given by the Mumford form is no longer available, due to the vanishing of the denominator e g (x i ). We define an adequate coordinate system to describe non-generic elements of weight t. Let us consider the variety

Definition 7.8. The non-generic α-division polynomials u α,t and v α,t are the polynomials in X with coefficients in

α,t -f . All the equations associated to a non-genericity tuple (w, λ, t, , M ) are merely identical to those of Section 5.4.2 except that the d i , e i and have different definitions and that ∆ α,t replaces ∆ ,t so that Equation (Sys.3) now reads

While turning the systems describing J[ ] into systems describing J[α], we did not add any variable, so that the study of Section 5.4.2 presented in Table 5.1 is still valid and we just recall that the total number of variables is bounded by 4g 2 + g.

As for the number of equations and their respective degrees, the only change comes from the fact that the coefficients of the u i and v i have degrees in the x i bounded by O η ( 3/g ) instead of O η ( 3 ), and Table 5.2 becomes Table 7.1.

Table 7.1 shows that any system corresponding to a non-genericity tuple satisfies the degree conditions of Proposition 7.7. As in the non-RM case, the number of such tuples is bounded by g O(g 3 ) and Proposition 7.7 is proved.

Complexity analysis

Now that we have modelled subsets of J[α] by polynomial systems whose size in terms of equations, variables and degrees have been carefully bounded, we apply the geometric resolution algorithm and bound its complexity using analogues of Proposition 5.3.

Solving the polynomial systems modelling J[α]

Proposition 7.9. For any ε > 0, there is a constant D such that for any endomorphism α ∈ Z[η] of norm a multiple of > g coprime to the base field characteristic, there is a Monte efficace en pratique, malgré des bornes de complexité théoriques bien plus difficiles à contrôler. Puisque la littérature présente de nombreux exemples de (familles de) courbes à multiplication réelle en genre quelconque [START_REF] Kohel | Efficiently computable endomorphisms for hyperelliptic curves[END_REF][START_REF] Boyer | Variétés abéliennes et jacobiennes de courbes hyperelliptiques, en particulier à multiplication réelle ou complexe[END_REF][START_REF] Ellenberg | Endomorphism algebras of Jacobians[END_REF][START_REF] Mestre | Familles de courbes hyperelliptiques à multiplications réelles[END_REF][START_REF] Tautz | Explicit hyperelliptic curves with real multiplication and permutation polynomials[END_REF], il est naturel de se demander quelles améliorations cette structure supplémentaire apporte à la complexité asymptotique lorsque g croît. Nous avons ainsi étendu les méthodes et les résultats obtenus en genre 2 et 3 pour créer un algorithm de comptage de points sur des courbes hyperelliptiques à multiplication réelle de genre arbitrairement grand. L'étape essentielle consiste à calculer non plus des résultants mais une résolution géométrique des noyaux d'endomorphismes de degré 2 . Pour ce faire, nous adaptons la technique du Chapitre 5 qui était alors appliquée au noyau de la multiplication par , elle-même de degré 2g en tant qu'endomorphisme. Cette différence affecte notre modélisation en réduisant les degrés des équations de O g ( 3 ) à O g ( 3/g ). Ainsi, après vérification que les hypothèses sont toujours vérifiées et application de l'algorithme de résolution géométrique, nous atteignons une complexité en O η ((log q) c ), avec c une constante absolue et O η dissimulant un terme dépendant de l'ordre par lequel la courbe a multiplication réelle (et donc également de g). Cela dit, nous insistons sur le fait que notre algorithme n'est pas polynomial en g et en log q parce que ce terme reste exponentiel en g. Nous analysons justement les raisons de cette dépendance exponentielle en g en espérant que de futurs travaux permettront de donner des bornes plus fines ou de remplacer ces étapes.

Résumé

Le comptage de points de courbes algébriques est une primitive essentielle en théorie des nombres, avec des applications en cryptographie, en géométrie arithmétique et pour les codes correcteurs. Dans cette thèse, nous nous intéressons plus particulièrement au cas de courbes hyperelliptiques définies sur des corps finis de grande caractéristique p. Dans ce cas de figure, les algorithmes dérivés de ceux de Schoof et Pila sont actuellement les plus adaptés car leur complexité est polynomiale en log p. En revanche, la dépendance en le genre g de la courbe est exponentielle et se fait cruellement sentir même pour g = 3.

Nos contributions consistent principalement à obtenir de nouvelles bornes pour la dépendance en g de l'exposant de log p. Dans le cas de courbes hyperelliptiques, de précédents travaux donnaient une borne quasi-quadratique que nous avons pu ramener à linéaire, et même constante dans le cas très particuliers de familles de courbes dites à multiplication réelle (RM).

En genre 3, nous avons proposé un algorithme inspiré de ceux de Schoof et de Gaudry-Harley-Schost dont la complexité, en général prohibitive, devient très raisonnable dans le cas de courbes RM. Nous avons ainsi pu réaliser des expériences pratiques et compter les points d'une courbe hyperelliptique de genre 3 pour un p de 64 bits.

Mots-clés:

Courbes hyperelliptiques, comptage de points, méthodes -adiques.

Abstract

Counting points on algebraic curves has drawn a lot of attention due to its many applications from number theory and arithmetic geometry to cryptography and coding theory. In this thesis, we focus on counting points on hyperelliptic curves over finite fields of large characteristic p. In this setting, the most suitable algorithms are currently those of Schoof and Pila, because their complexities are polynomial in log q. However, their dependency in the genus g of the curve is exponential, and this is already painful even in genus 3.

Our contributions mainly consist of establishing new complexity bounds with a smaller dependency in g of the exponent of log p. For hyperelliptic curves, previous work showed that it was quasi-quadratic, and we reduced it to a linear dependency. Restricting to more special families of hyperelliptic curves with explicit real multiplication (RM), we obtained a constant bound for this exponent.

In genus 3, we proposed an algorithm based on those of Schoof and Gaudry-Harley-Schost whose complexity is prohibitive in general, but turns out to be reasonable when the input curves have explicit RM. In this more favorable case, we were able to count points on a hyperelliptic curve defined over a 64-bit prime field. Keywords: Hyperelliptic curves, point counting, -adic methods.