New Research Solves Longstanding Mystery in Superspecial Isogeny Cryptography and Humbert Surfaces

In a significant development for both algebraic geometry and post-quantum cryptography, researcher Tanush Shaska of Oakland University has released a comprehensive paper resolving the exact probability of $(N,N)$-splitting for superspecial principally polarized abelian surfaces. The research, detailed in Paper 2026/2522 on the Cryptology ePrint Archive, moves a critical metric from the realm of experimental observation and one-sided bounds into exact mathematical certainty.

The paper, titled "Superspecial points on Humbert surfaces and the probability of (N,N)-splitting," provides a rigorous framework that determines—to first order in $1/p$ with an explicit error bound—the proportion of these geometric structures over algebraic closures of finite fields. For the cryptographic community, this breakthrough carries immediate relevance, as this exact proportion serves as the stationary target density of the splitting-detection attack deployed against the superspecial isogeny problem in dimension two.

To understand the weight of this new finding, one must examine the geometric objects at the heart of Shaska’s work. Let $p$ be a prime congruent to 3 modulo 4, and let $N$ be an integer greater than or equal to 2. The research investigates superspecial principally polarized abelian surfaces defined over $overlinemathbbF_p$, which are weighted by the reciprocals of their automorphism orders—a mathematical formulation that naturally acts as the stationary measure of the Richelot random walk.

Prior to this work, the proportion of these surfaces that are optimally $(N,N)$-split was known primarily through empirical experiments or limited one-sided theoretical bounds. Shaska’s new theorems replace estimation with exact formulas.

The main theorem established in the paper outlines that for primes where $p$ does not divide $N$, the expected number of optimal $(N,N)$-splittings of a surface is precisely equal to $5NJ_2(N)(p-1)/(p^2+1)$, where $J_2$ denotes Jordan’s totient function. Furthermore, the research demonstrates that for primes strictly greater than twice the square of $N$ ($p > 2N^2$), the second factorial moment is given by $c_N/(p^2+1)$, with the constants $c_N$ remaining entirely independent of the prime $p$.

Consequently, for a fixed integer $N$, the overall proportion of split surfaces is established as $5NJ_2(N)/p$ plus an error term of order $O_N(p^-2)$. To ground these theoretical values in concrete reality, the constants $c_N$ are determined explicitly for all integer values of $N$ ranging from 2 to 7. Every single formula presented in the work was additionally cross-confirmed and validated through exact computations executed at twelve distinct primes.

The methodological engine driving these proofs represents a major technical advance. Shaska demonstrates that superspecial surfaces effectively sample the genus of their refined Humbert invariants, utilizing Siegel’s weights to do so. This crucial bridge makes Siegel’s classical theorem on genus averages directly available to modern researchers working in positive characteristic geometry.

Beyond resolving the primary question of $(N,N)$-splitting probabilities, this innovative methodological approach unlocks several broader mathematical rewards. The same underlying technique successfully yields the first moment of primitive representations for every discriminant prime to $p$, provides mixed moments operating across several levels, establishes an exact probability value specifically at level 2, and rigorously proves that the geometric upper bound suggested by earlier historical work indeed possesses the correct leading term.

The findings are expected to have a stabilizing and clarifying effect on the security analysis of isogeny-based cryptographic protocols in dimension two, where understanding the landscape of superspecial abelian surfaces and their splitting behavior is paramount. By substituting empirical guesswork with definitive asymptotic and exact formulas, Shaska’s paper provides a firm mathematical foundation for future developments in both theoretical algebraic geometry and applied cryptographic cryptanalysis.