Let $E_i\!: y_i^2 = x_i^3 + a_4x_i + a_6$ be two copies ($i = 1$, $2$) of a supersingular elliptic curve over a finite field $\mathbb{F}_{p^2}$, for odd prime $p > 3$. Consider the Kummer surface $K = \mathrm{Kum}(A)$ for the superspecial abelian surface $A = E_1\times E_2$. Katsura and Schütt proved in the articles "Generalized Kummer surfaces and their unirationality in characteristic p (1987)" and "Zariski K3 surfaces (2017)" that the surface $K$ is a Zariski surface, i.e., there is a purely inseparable covering $\mathbb{A}^2 \to K$ over $\overline{\mathbb{F}_p}$, where $p \not\equiv 1$ (mod $12$). Is it still true over $\mathbb{F}_{p^2}$ at least for some supersingular elliptic curve and some $p$?

A positive answer to this question may have value for cryptography :) If $K$ is a Zariski surface over $\mathbb{F}_{p^2}$, then we have a method to compress a pair $(P_1, P_2) \in A(\mathbb{F}_{p^2})$ by computation of a map from $A$ to the affine plane $\mathbb{A}^2$ (through $K$) of separable degree 2. This is very compact and efficient method, because for decompression we need to solve only one quadratic equation. Computation of a preimage for a purely inseparable map is very fast. People usually take two projections on x-coordinates for $P_1$ and $P_2$ independently, hence they should solve two quadratic equations. The state of the art for this part of cryptography is represented, for example, in the article https://eprint.iacr.org/2017/1143.

  • 2
    $\begingroup$ What's the cryptographic context? (Crypto or no, it looks like a natural enough question in arthmetic geometry) $\endgroup$ May 23, 2018 at 12:37
  • $\begingroup$ I added cryptographic comments. $\endgroup$ May 23, 2018 at 16:45

1 Answer 1


See Proposition 4.5 of my paper with D. Abramovich, "Lang’s Conjectures, Fibered Powers, and Uniformity", New York J. Math. 2 (1996) 20–34.

A supersingular elliptic curve in characteristic $p>2$ will always be covered by the hyperelliptic curve $y^2=x^p-x$ as the Jacobian of the latter is isogenous to a product of supersingular elliptic curves. When $p \equiv 2 \pmod{3}$ this can be made very explicit for $y^2=x^3-1$, which is covered by $y^2=x^{p+1}-1$ in the obvious way and $y^2=x^{p+1}-1$ is isomorphic to $y^2=x^p-x$ by sending a Weierstrass point to infinity.

  • $\begingroup$ How can we explicitly find a purely inseparable part $S \to K$ of the map $\mathbb{A}^2 \to K$, where $S$ is some "intermediate" surface? $\endgroup$ May 23, 2018 at 19:26
  • 1
    $\begingroup$ @DimaKoshelev I missed the fact you wanted purely inseparable. But if $\mathbb{A}^2 \to X \to K$ and $X \to K$ is Galois, you can try to lift the Galois action to $\mathbb{A}^2$ and take the quotient, which will also be a rational surface. $\endgroup$ May 23, 2018 at 19:53
  • 1
    $\begingroup$ Likewise for $p \equiv 3 \bmod 4$ by sending $y^2 = x^{p+1} - 1$ to $y^2 = X^4 - 1$ where $X = x^{(p+1)/4}$. $\endgroup$ May 23, 2018 at 20:45
  • $\begingroup$ However this quotient is a priori rational only over the algebraic closure. Am I right? $\endgroup$ May 24, 2018 at 6:16
  • $\begingroup$ @DimaKoshelev Yes, a priori, only over the algebraic closure. I believe the cases of $p \equiv 2 \pmod{3}, p \equiv 3 \pmod{4}$ already mentioned will be quite explicit and can be checked directly. Shioda's paper Math. Ann. 211 (1974), 233–236, does the Fermat surface of degree $p+1$ explicitly and shows it's a Zariski surface over $\mathbb{F}_{p^2}$. $\endgroup$ May 24, 2018 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.