Special Jacobian orders unlock scalar inversion

Scalar multiplication can be inverted without computing a discrete logarithm when the finite group’s order is known and coprime to the scalar. Special parameters can make this order computable even when a generic calculation is expensive.

Research anchor and scope

CryptoHack’s Hyper Metroid discussion supplies the twist-dependent Jacobi-sum norm and generalized Mersenne shortcut below. These apply to the specified family, not arbitrary hyperelliptic curves. The calculation concerns the Jacobian, whose divisor classes form the group; ordinary higher-genus curve points do not have the same group law.

Compute the order with consistent conventions

Use odd prime n = 2g+1, prime p != n, and an order-n multiplicative character chi into K = Q(zeta), where zeta is a primitive nth root of unity. Set chi(0)=0; choose alpha with chi(alpha)=zeta and a nonsquare beta. The family is:

C(i,j): v² + v + (1-beta^i)/4 = beta^i * alpha^j * u^n
Jchi = sum over t in F_p of chi(t) * chi(1-t)
N(i,j) = Norm_K/Q(Jchi + (-1)^i * zeta^j)

Here i is 0 or 1, and j ranges from 0 to n-1. The norm multiplies the n-1 conjugates obtained by replacing zeta with zeta^r, for r=1,...,n-1. Thus a curve with coefficient alpha and no quadratic twist uses (i,j)=(0,1), not (0,0).

For p=(a^n-1)/(a-1), normalize the character by chi(t)=zeta^k when t^((p-1)/n)=a^k mod p. The shortcut is:

Jchi = epsilon * product(r=1,...,g)(a - zeta^(inverse(r) mod n))
epsilon in {+zeta^k, -zeta^k}; choose Jchi = -1 mod (zeta-1)^2

The congruence is ideal divisibility in Z[zeta], not a floating-point comparison. The exponent uses a modular inverse of r; it is not a rational power 1/r. If the chosen coefficient has another character value, determine its j instead of assuming the same twist.

Independently checked small instance

Take n=5, a=2, p=31, and alpha=2; indeed 2^6=2 mod 31. In the cyclotomic field defined by zeta^4+zeta^3+zeta^2+zeta+1=0, the normalized shortcut gives:

Jchi = -zeta^4 * (2-zeta) * (2-zeta^3)
     = 3*zeta^3 + 6*zeta^2 + 4*zeta + 6
N(0,1) = Norm(Jchi + zeta) = 955

Enumerating all 31 character terms independently gives the same Jchi. A second check counts the curve v²+v=2*u^5 over fields of sizes 31 and 961, including its point at infinity: c1=33, c2=883. For genus two, set A1=c1-p-1=1 and A2=(c2-p²-1+A1²)/2=-39. The Jacobian order is 1+A1+A2+p*A1+p²=955. This also demonstrates why the curve count 33 is not the required group order.

Finish only after validation

If ciphertext is Q=e*P and gcd(e,N)=1, compute d=e^-1 mod N, then d*Q=P. Failure of coprimality can make the operation noninvertible. An order multiple can annihilate test elements, so that check alone does not establish the exact order. Keep character normalization, twist selection, order computation, scalar inversion, and message embedding separately verified. Arithmetic software may serialize divisor classes as polynomial pairs; reconstruct those in the correct field before multiplication.