COMPUTING TORSION POINTS ON CURVES

BJORN POONEN

Abstract. Let X be a curve of genus g ≥ 2 over a field k of characteristic zero. Let X ↪ A be an Albanese map associated to a point P_{0} on X. The Manin-Mumford conjecture, first proved by Raynaud, asserts that the set T of points in X(\overline{k}) mapping to torsion points on A is finite. Using a p-adic approach, we develop an algorithm to compute T, and implement it in the case where k = Q, g = 2, and P_{0} is a Weierstrass point. Improved bounds on #T are also proved: for instance, in the context of the previous sentence, if moreover X has good reduction at a prime p ≥ 5, then #T ≤ 2p^{3} + 2p^{2} + 2p + 8.

1. Introduction

Let X be a curve of genus g ≥ 2 over a field k of characteristic zero. Suppose that X is embedded in its Jacobian A by the Albanese map ι associated to a basepoint P_{0} ∈ X(k). We write X ∩ A_{tors} for X(\overline{k}) ∩ A(\overline{k})_{tors}, where A(\overline{k})_{tors} is the set of points of finite order in the group A(\overline{k}) of geometric points of A. If we define an equivalence relation on X(\overline{k}) by writing P ∼ Q if and only if there exists n ≥ 1 such that the divisor n(P − Q) is principal, then X ∩ A_{tors} is the equivalence class of P_{0}; it is called a torsion packet.

The Manin-Mumford conjecture, first proved by Raynaud [Ra] in 1983, asserts that X ∩ A_{tors} is finite. Many different proofs were given later, by Coleman [Co3], Hindry [Hi], Hrushovski [Hr], Buium [Bu], Ullmo [Ul], and Ribet [Ri]. All the known proofs use Galois action in some way, the rough idea being that if a torsion point P lies on X, then X must pass through all Galois conjugates of P as well, which contradicts the geometry in some way if the orbit is “large.” In the proofs of Raynaud, Coleman, Hrushovski, and Buium, p-adic methods also play a significant role. In Ullmo’s proof, the Manin-Mumford conjecture is a corollary of the more general “Bogomolov conjecture” about points of small height on curves; here the Galois ingredient is the “equidistribution of small points” proved by Szpiro, Ullmo, and Zhang [SUZ]. The Manin-Mumford conjecture has been generalized in many directions; see [Po1] or the detailed survey [Tz], for instance.

Our goal is to describe an algorithm for computing X ∩ A_{tors}, when X is presented by explicit equations over a number field k. We make the algorithm explicit enough in the case that k = Q, g = 2, and P_{0} is a Weierstrass point, that it can be programmed in the GP-PARI language. The algorithm is in the spirit of the proofs of Raynaud and Buium: after using Coleman’s study of ramified torsion points on curves [Co3], we bound the residue classes modulo p^{2} on the curve in which torsion points might lie. The technical ingredients include the Greenberg functor [Gr1],[Gr2] and Coleman’s p-adic abelian integrals [Co1].

Date: March 26, 2001.

1991 Mathematics Subject Classification. Primary 11G30; Secondary 14H25, 14K15, 14K20, 11G10.

Key words and phrases. torsion packet, torsion point, Manin-Mumford conjecture, Greenberg functor, Greenberg transform, p-adic integrals, hyperelliptic torsion packet, cuspidal torsion packet, Kummer surface.

This research was supported by NSF grant DMS-9801104, a Sloan Fellowship, and a Packard Fellowship.

Part of it was done at the Isaac Newton Institute, where the author was supported by a Rosenbaum Fellowship. This paper has appeared in Experimental Math. 10 (2001), no. 3, 449–465, \begin{matrix}c \\ ◯ \end{matrix}2001 by A. K. Peters Ltd.

There have been many efforts to compute X ∩ A_{tors} for various curves: modular curves [CKR],[Ba], Fermat curves [Co2], [CTT], abelian étale coverings of P^{1} \ {0, 1, ∞} [Co4] and other isolated low genus curves [Vo],[BG]. Our approach, which is partly inspired by a calculation of Voloch [Vo] for a special situation, has the advantage of being less reliant on special properties of the curve, so that it is easier to automate. Our computer program succeeded in computing X∩A_{tors} for all curves attempted except one: see Section 14. Perhaps even that one would have succumbed if we had had a little more memory at our disposal, or if we had used a package with a more memory-efficient approach to factoring high degree polynomials over small finite fields.

The sections up to Section 4 outline the theoretical basis for the algorithm. Sections 5 through 11 are concerned with making the method explicit and efficient. Section 12 gives some general bounds for torsion points on genus 2 curves in terms of only a prime of good reduction. The existence of such bounds in theory, for every genus, was already known to Raynaud (see the bottom of p. 208 in [Ra]), and explicit bounds were given by Buium [Bu], but the bounds are enough improved here that they can actually be used to simplify the computation; this is explained in Section 13. Finally, we end in Section 14 with a list of curves whose torsion packets were computed by our program.

2. Notation

For any scheme X over Z_{p}, let X_{s} := X × F_{p} denote the special fiber.

For any commutative group variety G over F_{p}, let F = F_{G} denote the Frobenius endomorphism. Let V = V_{G} denote Verschiebung, the unique endomorphism satisfying F V = V F = p in End G. For instance, if G is a g-dimensional abelian variety, then F and V are isogenies of degree p^{g}. If ϕ ∈ End G, then G[ϕ] denotes the group scheme kernel of ϕ, and #G[ϕ] denotes its order as a group scheme.

3. Greenberg transform

Let k be a perfect field of characteristic p > 0. The Greenberg functor Gr_{n} of level n takes a scheme X locally of finite type over the ring W_{n}(k) of length n Witt vectors, and associates to it a scheme X locally of finite type over k, such that X(W_{n}(L)) = X (L) for any k-algebra L, functorially in X and L. We call X the level n Greenberg transform of X. See page 276 of [BLR] for a brief exposition, or see Greenberg’s original papers [Gr1], [Gr2] for more details. Also see [Bu], where the Greenberg transform is related to “p-jet spaces.” The construction is similar to that of “Weil restriction of scalars.” If X is smooth of relative dimension d over W_{n}(k), then X is smooth of relative dimension nd over k. Furthermore, Gr_{n} respects open and closed immersions. An example: if X is the curve f(x, y) = 0 in A_{W_{2}(k)}^{2}, then X = Gr_{2}(X) is the subscheme of A_{k}^{4} defined by the two Witt coordinate equations in x_{0}, x_{1}, y_{0}, y_{1} obtained when x and y are replaced by length-2 Witt vectors [x_{0}, x_{1}] and [y_{0}, y_{1}], and f([x_{0}, x_{1}], [y_{0}, y_{1}]) = 0 is expanded using the rules for Witt vector arithmetic.

Now suppose that A is an abelian scheme of relative dimension g over Z_{p}, and let A_{s} denote its special fiber. (We could work with more general base rings, but Z_{p} will suffice for our intended application.) Let A = Gr_{2}(A × Z/p^{2}). The functoriality of Gr_{2} gives A the structure of an algebraic group over F_{p}, but A is not an abelian variety. Instead A fits into an exact sequence of algebraic groups

(1)  0 → L → A → A_{s} → 0

where L, the “kernel of reduction,” is the vectorial group associated to the pullback of the tangent bundle of A_{s} by the absolute Frobenius morphism. (This is a special case of Proposition 2.4 in [Bu].) We have L ≅ G_{a}^{g} over F_{p}, but the isomorphism depends on a choice of basis for Lie(A_{s}), or dually, on a choice of basis for H^{0}(A_{s}, Ω_{A_{s}/F_{p}}^{1}). In particular, dim A = 2g. The exact sequence (1) does not split in general, and the class of the extension in Ext(A_{s}, L) depends on A × Z/p^{2}, not only on A_{s}.

Let Z_{p}^{unr} denote the valuation ring of the maximal unramified extension Q_{p}^{unr} of Q_{p}. Define the “mod p^{2} reduction homomorphism” π as the composition

π : A(Q_{p}^{unr}) = A(Z_{p}^{unr}) → A(Z_{p}^{unr}/p^{2}) ≅ A(\overline{F}_{p}),

We obtain a similar function π : X(Q_{p}^{unr}) → X (\overline{F}_{p}) for any proper scheme X over Z_{p}.

4. Summary of proof of the Manin-Mumford Conjecture

In this section, we sketch a p-adic proof of the Manin-Mumford Conjecture, mainly following [Bu]. The Galois ingredient is a ramification-bounding result of Coleman [Co3]. Our treatment borrows also a little from [Hr] and we paraphrase to suit our purposes.

Let X be a smooth, projective, geometrically integral curve of genus g ≥ 2 over a field k of characteristic zero. Suppose that X is embedded in its Jacobian A using a basepoint P_{0} ∈ X(k). We write X ∩ A_{tors} for X(\overline{k}) ∩ A(\overline{k})_{tors}. and we wish to prove that this set is finite. Eventually we hope to calculate it.

We may assume that k is finitely generated over Q. By specialization, we may assume that [k : Q] < ∞. We may then find a degree 1 place k → Q_{p} for some p > 2g, at which X has good reduction. For most of the rest of this paper, we denote by X and A the resulting models over Z_{p}. Let X = Gr_{2}(X × Z/p^{2}) and A = Gr_{2}(A × Z/p^{2}). The embedding X ↪ A and the functoriality of Gr_{2} let us regard X as a closed subscheme of A.

The finiteness of X ∩ A_{tors} clearly follows from the four lemmas below. The first, which is also the hardest, is a special case of a theorem of Coleman [Co3]: Lemma 1. If X is a curve of genus g over Q_{p} with good reduction and p > 2g, then X ∩A_{tors} is unramified, i.e., contained in A(Q_{p}^{unr})_{tors}. Lemma 2. The restriction of π to A(Q_{p}^{unr})_{tors} is injective. Lemma 3. There exists a surjective homomorphism Φ : A → G_{a}^{g} such that π(A(Q_{p}^{unr})_{tors}) ⊆ ker Φ. Lemma 4. If Φ : A → G_{a}^{g} is a surjective homomorphism, then X ∩ ker Φ is finite (over Spec F_{p}).

Lemma 2 follows from formal group considerations. If p > 2, we have the well-known stronger result (proved in the same way; see the appendix of [Ka]) that the reduction map A(Q_{p}^{unr})_{tors} → A_{s}(\overline{F}_{p}) on unramified torsion is injective.

We will give a short proof of Lemma 3 here, using an idea of Hrushovski [Hr]. This proof has the additional advantage of presenting Φ very explicitly. Later, for the sake of computational efficiency, we will reprove the lemma (in a manner closer to Buium’s proof), giving a Φ for which the intersection in Lemma 4 will be much smaller.

Proof of Lemma 3. Let P (x) ∈ Z[x] be the characteristic polynomial of Frobenius acting on the Tate module T_{ℓ}A_{s} for some prime ℓ ≠ p. The fact that P (F_{A_{s}}) = 0 implies that P (F_{A}) ∈ End A maps A into L ≅ G_{a}^{g}. The composite map L ↪ A → L is surjective, since if we write L as a product of factors isomorphic to G_{a}, then P (F_{A}) acts as a nonzero polynomial

x ↦ x^{p^{2g}} + a_{1}x^{p^{2g−1}} + ⋯ + a_{2g}x

on each one.

We claim that Φ := P (F_{A}) ∈ Hom(A, G_{a}^{g}) satisfies the requirements. Let Frob denote the abstract group endomorphism of A(Q_{p}^{unr}) induced by the Frobenius automorphism in Gal(Q_{p}^{unr}/Q_{p}). Then P (Frob) maps A(Q_{p}^{unr})_{tors} into the kernel of reduction. But p > 2 (we assumed p > 2g), so as remarked above, there is no nontrivial unramified torsion in the kernel of reduction. Hence P (Frob) kills A(Q_{p}^{unr})_{tors}, and P (F_{A}) kills its image in A. □

Lemma 4 should not be too surprising, since X and ker Φ are subschemes of dimensions 2 and g respectively, in a variety of dimension 2g.

Proof of Lemma 4. Dimension of maximal connected linear subgroup is additive in exact sequences of commutative algebraic groups; hence from 0 → ker Φ → A → G_{a}^{g} → 0 we see that ker Φ is proper over F_{p}. On the other hand, since g ≥ 2, Proposition 1.10 of [Bu] shows that X is affine! Since ker Φ and X are both closed subschemes of A, their intersection is proper and affine, hence finite. □

5. Other maps to the Jacobian

For the computations to come, we will want p to be as small as possible. Given X over Q, a smaller p can sometimes be used if we do not insist on the existence of a point P_{0} ∈ X(Q_{p}). If instead we suppose an element D ∈ Pic(X × Q_{p}) of degree δ prime to p is given, we may use the morphism ι : X → A that sends a point Q ∈ X(\overline{Q}_{p}) to the class of δQ − D. Denote also by ι the induced morphism X → A.

We observe now that the proof of the previous section can be adapted to this situation. By the main theorem of [Co3], the torsion packet ι^{−1}(A_{tors}) is contained in X(Q_{p}^{unr}): this is the needed extension of Lemma 1. Lemmas 2 and 3 do not need to be extended. We now extend Lemma 4 by proving that (Φ ∘ ι)^{−1}(O) is finite. Since X has good reduction, the Weil bounds and Hensel’s Lemma produce Q_{p}-rational divisors on X of any sufficiently large degree, and in particular, we may find D_{1} ∈ Pic(X × Q_{p}) of degree 1. The embedding determined by D_{1} induces a closed immersion β : X → A. The composition Φ ∘ ι equals Ψ ∘ β where Ψ is δΦ followed by a translation. But δΦ is another surjective homomorphism A → G_{a}^{g}, so the fibers of Ψ are proper, as in the proof of Lemma 4, and we conclude as before that (Φ ∘ ι)^{−1}(O) is both affine and proper, making it finite. Remark. We will eventually be interested in the hyperelliptic torsion packet T of a hyperelliptic curve X: T consists of the points P ∈ X(\overline{Q}_{p}) such that the class of P − P_{0} in A(\overline{Q}_{p}) is torsion, for (any) fixed Weierstrass point P_{0} on X. Then T also equals ι^{−1}(A_{tors}), where ι is defined using the class D of 2P_{0}. Because D is the pullback of the unique degree 1 element of Pic(P^{1}) under the canonical map X → P^{1}, ι is defined over Q_{p} even though P_{0} might not be.

6. Improved homomorphisms

We can measure the complexity of a surjective homomorphism Φ : A → G_{a}^{g} by letting size(Φ) denote the degree of the finite composite morphism L ↪ A → G_{a}^{g}. For the sake of efficient computation, it will help to find Φ for which size(Φ) is as small as possible.

The homomorphism P (F) used in the proof of Lemma 3 has size p^{2g^{2}}, which is too large once g > 1. One can reduce this to p^{g^{2}} by using F^{−g}P (F) ∈ End A instead. (The divisibility of P (F) by F^{g} in End A follows from the p-power divisibility of the low order coefficients of P (x) forced by the functional equation of the zeta function.) But the size can be reduced further, at least when g > 1. The following bounds the size of the best possible Φ: Lemma 5. Let H be the Zariski closure of π(A(Q_{p}^{unr})_{tors}) in A. Then A/H ≅ G_{a}^{g}, and the quotient map Φ : A → A/H has size dividing p^{g}.

Proof. First we show that pA is a subgroup of finite index in H, and we bound the index by p^{k} := #A[p](Q_{p}^{unr}). Multiplication-by-p on A kills L, so the subgroup pA of A is a quotient of the abelian variety A_{s}. On the other hand, pA surjects onto pA_{s} = A_{s}, so pA must be an abelian variety isogenous to A_{s}. The subset π(pA(Q_{p}^{unr})_{tors}) of pA is Zariski dense, since by Lemma 2 it contains ℓ^{2g} points of order dividing ℓ for any integer ℓ prime to p, namely the points in π(A[ℓ](Q_{p}^{unr})). Any subgroup G ⊆ (Q/Z)^{2g} satisfies #(G/pG) ≤ #G[p]; applying this to A(Q_{p}^{unr})_{tors} ⊆ A(\overline{Q}_{p})_{tors} shows that pA(Q_{p}^{unr})_{tors} has index at most p^{k} in A(Q_{p}^{unr})_{tors}. Applying π and taking Zariski closures, we find that pA is of index at most p^{k} in H.

Next we bound # ker(L → A/pA). Verschiebung is zero on G_{a} and on L. Hence connecting two rows of (1) with vertical maps equal to V and applying the Snake Lemma yields an exact sequence

(2)  0 → L → A[V] → A_{s}[V] → L → A/V A → A_{s}/V A_{s} = 0,

which, together with V A = V (F A) = pA, yields

(3)  # ker(L → A/pA) = \frac{#A_{s}[V]}{# image(A[V] → A_{s}[V])} = \frac{p^{g}}{# image(A[V] → A_{s}[V])}.

Reduction mod p is injective on torsion, so the composition

A[p](Q_{p}^{unr}) →^{π} A[p](\overline{F}_{p}) = A[V](\overline{F}_{p}) → A_{s}[V]

is injective, and hence # image(A[V] → A_{s}[V]) ≥ p^{k}. Thus (3) gives # ker(L → A/pA) ≤ p^{g−k}.

Combining the previous two paragraphs shows that # ker(L → A/H) ≤ p^{k}p^{g−k} = p^{g}. Also, since pL = 0, the order of the kernel must be a power of p.

Finally, since # ker(L → A/pA) < ∞ and dim L = dim A/pA = g, the map L → A/pA is an isogeny (surjective with finite kernel). Since pA is of finite index in H, L → A/H is an isogeny too. Over a perfect field, any geometrically integral group variety isogenous to G_{a}^{g} is isomorphic to G_{a}^{g}, so A/H ≅ G_{a}^{g}. □

Corollary 6. There exists a homomorphism of algebraic groups Φ : A → G_{a}^{g} whose kernel contains π(A(Q_{p}^{unr})_{tors}), and which has size exactly p^{g}.

Proof. Compose the Φ given by Lemma 5 with an endomorphism of A/H ≅ G_{a}^{g} of suitable degree. □

Remark. We now indicate why the bound in Lemma 5 cannot be reduced further for general abelian varieties of dimension g. The deformation theory of p-divisible groups and abelian varieties lets one lift an ordinary g-dimensional abelian variety A_{s} to an abelian scheme A over Z_{p} such that the map A_{s}[V] → L in (2) coming from the extension (1) is injective. In this case,

# ker(L → A/pA = A/V A) = #A_{s}[V] = p^{g}

already, so the degree of L → A/H is at least p^{g}, hence by Lemma 5 equal to p^{g}.

On the other hand, there are special instances in which the size can be chosen much smaller. For example, if A is the canonical lift of an ordinary abelian variety over F_{p}, then the exact sequence (1) splits, and the splitting map A → L ≅ G_{a}^{g} is a homomorphism of the desired type, and of size 1. Remark. In [Bu], Buium uses the bound p^{2g} on the index of pA in H to prove that

#(X ∩ A_{tors}) ≤ p^{4g}3^{g} [p(2g − 2) + 6g] g!.

In the course of the proof of Lemma 6, we bounded the index by p^{k} := #A[p](Q_{p}^{unr}) ≤ #A_{s}[p](\overline{F}_{p}) ≤ p^{g}, and hence the p^{4g} in Buium’s bound can be improved to p^{3g}. In Section 12 we will obtain an even better bound in the case g = 2.

7. Relating the homomorphism and Coleman’s integrals

Let ϵ : Z → A denote the zero-section of A, so Z is a closed subscheme of A isomorphic to Spec Z_{p}. Let I ⊆ O_{A} denote the ideal sheaf of Z. Since A is smooth over Z_{p}, ϵ^{∗}Ω_{A/Z_{p}}^{1} ≅ I/I^{2} ≅ M̃, where M̃ is the free O_{Z}-module associated to a free Z_{p}-module M of rank g. Fix a system of local parameters; i.e., a g-tuple of sections t_{1}, …, t_{g} of I over an open neighborhood of Z whose images in I/I^{2} form a Z_{p}-basis for M.

Since A is an abelian scheme, the map

H^{0}(A, Ω_{A/Z_{p}}^{1}) →^{ϵ^{∗}} H^{0}(Z, ϵ^{∗}Ω_{A/Z_{p}}^{1})

is an isomorphism. The Z_{p}-basis ϵ^{∗}dt_{1}, …, ϵ^{∗}dt_{g} on the right corresponds to some Z_{p}-basis ω̃_{1}, …, ω̃_{g} for H^{0}(A, Ω_{A/Z_{p}}^{1}).

The functions t_{i} are regular on a dense open subset of A_{s} ⊆ A, so the rational map t_{i} : A −−→ A_{Z_{p}}^{1} gives rise to a rational map A −−→ A_{F_{p}}^{2}; i.e., to a pair of rational functions which may be interpreted as the first two Witt coordinates of t_{i}. Let z_{i} denote the second Witt coordinate of t_{i}. Since the t_{i} are regular in a neighborhood of Z, the z_{i} are regular on L. In fact, (z_{1}, …, z_{g}) : L → G_{a}^{g} is an isomorphism of group varieties over F_{p}, since the t_{i} induce functorial isomorphisms

ker [A(W_{2}(R)) → A_{s}(R)] → ker [W_{2}(R) → R]^{g}

for F_{p}-algebras R, related to the formal group obtained by expressing the group law of A analytically in the local parameters t_{i}.

A short argument using [Mi, Proposition 5.3(b)] shows that the morphism ι : X → A induces an isomorphism ι^{∗} : H^{0}(A, Ω_{A/Z_{p}}^{1}) → H^{0}(X, Ω_{X/Z_{p}}^{1}). (By considering the generic and special fibers, one reduces this statement to the analogous one for fields; then one may assume that the field is algebraically closed, and finally, one can relate the ι^{∗} for a degree-δ divisor to δ times the ι^{∗} for an Albanese embedding.) Define ω_{i} = ι^{∗}ω̃_{i}.

We will use Coleman’s p-adic abelian integrals [Co1]. Let O ∈ A(Q_{p}) be the identity. If Q ∈ A(Q_{p}^{unr}) reduces to 0 in A_{s}(\overline{F}_{p}), then ∫_{O}^{Q} ω̃_{i} ∈ pZ_{p}^{unr}, as we can see by using an analytic primitive of ω̃_{i}. More generally, if Q reduces to a point in A_{s}(\overline{F}_{p}) of order n prime to p, then the same is true, since ∫_{O}^{Q} ω̃ = n^{−1} ∫_{O}^{nQ} ω̃. For such Q we may define

η_{i}(Q) = (p^{−1} ∫_{O}^{Q} ω̃_{i})^{p} mod p ∈ \overline{F}_{p}.

Lemma 7. Let Q ∈ A(Q_{p}^{unr}) be a point reducing to 0 in A_{s}(\overline{F}_{p}), so that π(Q) ∈ L(\overline{F}_{p}). Then η_{i}(Q) = z_{i}(π(Q)).

Proof. The expansion of ω̃_{i} in a neighborhood of Z in terms of the local parameters t_{i} is given by

ω̃_{i} = dt_{i} + ∑_{j=1}^{g} h_{j}dt_{j}

where h_{j} ∈ Z_{p}[[t_{1}, …, t_{g}]] has zero constant coefficient. Integrating ω̃_{i} formally, and noting that p > 2 and t_{j}(Q) ≡ 0 (mod p) for each j, we find that

∫_{O}^{Q} ω̃_{i} ≡ t_{i}(Q) (mod p^{2}).

On the other hand, the first two Witt coordinates of t_{i}(Q) are 0 and z_{i}(π(Q)), by definition of z_{i}, so

t_{i}(Q) ≡ p(z_{i}(π(Q)))^{1/p} (mod p^{2}).

Combining these yields the result. □

As a corollary, we can use Coleman’s integrals to compute values of homomorphisms A → G_{a} at many points of A, namely those whose image in A_{s}(\overline{F}_{p}) are of order prime to p: Corollary 8. Let ϕ : A → G_{a} be a homomorphism, and let ψ(z_{1}, z_{2}, …, z_{g}) be the polynomial giving the restriction of ϕ to L. Suppose that Q ∈ A(Q_{p}^{unr}) reduces to a point in A_{s}(\overline{F}_{p}) of order prime to p. Then

ϕ(π(Q)) = ψ(η_{1}(Q), …, η_{g}(Q)).

Proof. Without loss of generality, replace Q by a prime-to-p multiple to assume that Q reduces to 0 in A_{s}(\overline{F}_{p}). Now apply Lemma 7. □

8. Computing the homomorphism on a hyperelliptic curve

We retain earlier notation, but from now on assume in addition that X is birational to the affine curve y^{2} = f(x, 1) where f(x, z) ∈ Z_{p}[x, z] is a homogeneous polynomial of degree 2g+2 whose mod p reduction f̄ has no repeated factors. Then X is hyperelliptic, and we define ι and the hyperelliptic torsion packet T = ι^{−1}(A_{tors}) as in the remark at the end of Section 5. By changing the original Z_{p}-basis for M if necessary, we may assume that ω_{i} = x^{i−1} dx/y. Let x_{0}, x_{1} denote the rational functions on X giving the first two Witt coordinates of the x-coordinate on X. Similarly define y_{0}, y_{1}. Lemma 9. Let ϕ and ψ be as in Corollary 8. Then as rational functions on X,

(4)  ϕ ∘ ι = \frac{G(x_{0})}{y_{0}^{p(deg ψ)}} + ψ (\frac{x_{1}}{y_{0}^{p}} , \frac{x_{0}^{p}x_{1}}{y_{0}^{p}} , …, \frac{x_{0}^{(g−1)p}x_{1}}{y_{0}^{p}} )

for some polynomial G ∈ F_{p}[x_{0}] of degree at most (g + 1)p(deg ψ).

By deg ψ, we mean the total degree. Since ψ : G_{a}^{g} → G_{a} is a homomorphism, deg ψ = p^{r} for some r ∈ Z_{≥0}.

Proof. We first show that the rational function

ξ := (ϕ ∘ ι) − ψ (\frac{x_{1}}{y_{0}^{p}} , \frac{x_{0}^{p}x_{1}}{y_{0}^{p}} , …, \frac{x_{0}^{(g−1)p}x_{1}}{y_{0}^{p}} )

on X is constant on infinitely many fibers of the F_{p}-morphism X → X_{s}. Let P, P′ be points in X(Q_{p}^{unr}) reducing to the same point in X_{s}(\overline{F}_{p}), and assume that the latter point is affine with nonzero y-coordinate. Define Q := ι(P′) − ι(P) ∈ A(Q_{p}^{unr}). Then

(5)  (ϕ ∘ ι)(π(P′)) − (ϕ ∘ ι)(π(P)) = ϕ(π(Q)) = ψ(η_{1}(Q), …, η_{g}(Q)),

by Corollary 8, and

η_{i}(Q) = (p^{−1} ∫_{O}^{Q} ω̃_{i})^{p} mod p

= (p^{−1} ∫_{ι(P)}^{ι(P′)} ω̃_{i})^{p} mod p

= (p^{−1} ∫_{P}^{P′} ω_{i})^{p} mod p (6)

= (p^{−1} ∫_{P}^{P′} \frac{x^{i−1} dx}{y})^{p} mod p.

By choice of P and P′, we may expand ω_{i} and its integral in terms of the uniformizing parameter x − x(P) at P:

ω_{i} = \frac{x^{i−1} dx}{y}

= (\frac{x(P)^{i−1}}{y(P)} + ∑_{j=1}^{∞} c_{j}(x − x(P))^{j}) dx,

for some c_{j} ∈ Z_{p}, and

∫_{P}^{P′} ω_{i} = \frac{x(P)^{i−1}}{y(P)} (x(P′) − x(P)) + ∑_{j=1}^{∞} c_{j} \frac{(x(P′) − x(P))^{j+1}}{j + 1} ,

≡ \frac{x(P)^{i−1}}{y(P)} (x(P′) − x(P)) (mod p^{2}), (since p > 2)

≡ p\frac{x̄_{0}^{i−1}}{ȳ_{0}} [(x̄′_{1})^{1/p} − x̄_{1}^{1/p}] (mod p^{2}),

where x̄_{0}, x̄_{1}, ȳ_{0} denote the values of the functions x_{0}, x_{1}, y_{0} at π(P) (i.e., the Witt coordinates of the coordinates of P), and x̄′_{1} is the value of x_{1} at π(P′). (To make sense of the previous equation, these quantities should be considered as elements of Z_{p}^{unr}, but it is only their residues modulo p that matter.) Substituting into (6) yields

η_{i}(Q) = \begin{matrix}x̄_{0}^{(i−1)p} & x̄_{1} \\ & ȳ_{0}^{p} \end{matrix} − \begin{matrix}x̄_{0}^{(i−1)p} & x̄′_{1} \\ & ȳ_{0}^{p} \end{matrix} mod p.

Substituting this into (5) and using the fact that ψ is a homomorphism shows that ξ is constant on each closed fiber of X → X_{s} above an affine point with nonzero y-coordinate. Thus ξ can be expressed as a rational function in x_{0} and y_{0} only.

Since ϕ ∘ ι is regular on all of X, the definition of ξ shows that y_{0}^{p(deg ψ)}ξ is regular on any open set where y_{0} is regular. Hence y_{0}^{p(deg ψ)}ξ can be expressed as a polynomial in x_{0} and y_{0}. The hyperelliptic involution on X is compatible with multiplication by −1 on A. Hence the induced involution on X transforms both y_{0}^{p(deg ψ)} and ξ to their negatives. Thus y_{0}^{p(deg ψ)}ξ = G(x_{0}) for some polynomial G.

We can bound deg G by studying the behavior of (4) at a point R ∈ X (\overline{F}_{p}) reducing to a point R̄ at infinity on X_{s}. The function x_{0}^{g+1}/y_{0} is nonvanishing at R̄ if it is regular at all, since its square equals x_{0}^{2g+2}/f̄(x_{0}, 1) and deg f̄(x_{0}, 1) ≤ deg f̄ = 2g + 2. Hence if deg G > (g + 1)p(deg ψ), then G(x_{0})/y_{0}^{p(deg ψ)} has a pole of some order at R̄ on X_{s}.

Let X_{0}, X_{1} be the first two Witt coordinates of the rational function 1/x. A Witt vector calculation yields x_{1} = −x_{0}^{2p}X_{1}. Hence

ξ = (ϕ ∘ ι) + ψ (\frac{x_{0}^{2p}}{y_{0}^{p}} X_{1}, \frac{x_{0}^{3p}}{y_{0}^{p}} X_{1}, …, \frac{x_{0}^{(g+1)p}}{y_{0}^{p}} X_{1}) .

But X_{1} and ϕ ∘ ι are regular at R, so the order of the pole (if there is any at all) of ξ at the point R̄ on X_{s} is at most the order of the pole of x_{0}^{(g+1)p(deg ψ)}/y_{0}^{p(deg ψ)}, which is strictly smaller than the order of the pole of G(x_{0})/y_{0}^{p(deg ψ)}. This contradicts ξ = G(x_{0})/y_{0}^{p(deg ψ)}. □

The degree bound in Lemma 9 makes it possible to compute G given ϕ using interpolation. Suppose, for example, that ϕ is the composition of P (F_{A}) : A → L and z_{1} : L → G_{a}. Then ψ(z_{1}, …, z_{g}) = P (F)(z_{1}), where P (F) should now be considered as an additive polynomial of degree p^{2g}. For many values x_{0} ∈ \overline{F}_{p} (say, all of a given degree over F_{p} that are not roots of f(x, 1)), check whether x_{0} is the x-coordinate of some R̄ ∈ X_{s}(\overline{F}_{p}) such that ι(R̄) is of order prime to p in A_{s}(\overline{F}_{p}). (In Section 11 we’ll show how to check this.) If moreover R̄ has nonzero y-coordinate, Hensel’s Lemma lets us lift R̄ to a point R ∈ X(Q_{p}^{unr}) whose x-coordinate mod p^{2} equals the Teichmüller lift of x_{0}. Setting Q = ι(R), we may then calculate η_{i}(Q) for each i (see Section 11 for details), and hence compute ϕ(π(Q)) from Corollary 8. On the other hand, (4) gives another expression for ϕ(π(Q)) = (ϕ ∘ ι)(π(R)), in which everything is known except the value of G. If we compute G(x_{0}) for enough values of x_{0} (more than the degree bound for G in Lemma 9), then the polynomial G can be computed by Lagrange interpolation.

Suppose now that we wish to use the improved homomorphism Φ of Corollary 6 instead of P (F_{A}). In this case, we need to get around the fact that we do not have a priori formulas for the restriction ψ : L → G_{a} to L of the composition of Φ with a projection G_{a}^{g} → G_{a}. Let I be the unknown ideal in F_{p}[z_{1}, …, z_{g}] defining the subscheme L ∩ ker Φ in L. Then #F_{p}[z_{1}, …, z_{g}]/I = #(L ∩ ker Φ) = p^{g}. Let W be the 2g-dimensional F_{p}-span of the z_{i} and z_{i}^{p} in F_{p}[z_{1}, …, z_{g}]. Then #(W ∩ I) ≥ p^{g}. If ψ is in W ∩ I, then ψ kills L ∩ ker Φ, so ψ factors through the restriction of Φ to L, which is a homomorphism L → G_{a}^{g}. Composing Φ with “the other factor”, the homomorphism G_{a}^{g} → G_{a}, yields a homomorphism A → G_{a} whose restriction to L is ϕ.

If we try to determine G for each ψ ∈ W, by interpolating several more values than the degree bound, then we will find for some ψ that the degree of G would have to exceed the degree bound; this means that ψ cannot possibly be the restriction of a homomorphism A → G_{a}. Let W′ denote the set of ψ for which the degree of the interpolated G is less than or equal to the bound; thus W′ is a subspace of W containing W ∩ I. If we find that dim W′ ≤ g, then W′ = W ∩ I and dim W′ = g, since dim(W ∩ I) ≥ g. If moreover the sub-group scheme L[W′] cut out by the polynomials in W′ is finite, then its order will be at most p^{g}, but on the other hand it must contain L ∩ ker Φ, so L[W′] = L ∩ ker Φ and the basis for W′ describes Φ : A → G_{a}^{g} up to an (irrelevant) automorphism of G_{a}^{g}.

If we are not so lucky, then we can simply try a different p. Naive heuristics suggest that the method above succeeds (i.e., dim W′ = g and L[W′] is finite) for at least a positive density of primes p, but it seems difficult to prove anything along these lines, since it is closely related to questions such as deciding, given an abelian variety A over Q, the finiteness or co-finiteness of the set of primes p for which A mod p^{2} is a canonical lift of A mod p.

(Alternatively, we could guarantee success by using Φ = P (F) instead of our improved Φ, but in practice this is usually more expensive, since the degree of G in Lemma 9 tends to be much larger.)

A computational improvement: instead of performing the interpolation for each of the p^{2g} elements of W, we can interpolate the η_{i} at points with x-coordinates that are Teichmüller lifts modulo p^{2}, to obtain elements of some quotient F_{p}[x_{0}]/h whose values at any root of h ∈ F_{p}[x_{0}] represent the value of η_{i} at the corresponding Teichmüller lift point, and evaluate the combinations needed in Corollary 8, as elements of F_{p}[x_{0}]/h. Here we should interpolate enough to obtain h of degree larger than the degree bound in Lemma 9, and enough larger that it becomes likely that the interpolation yields a G of degree below the degree bound only when ϕ actually comes from a homomorphism A → G_{a}.

9. Elimination of variables

Let us assume that we succeeded in Section 8 in computing the restriction of Φ to X, so that we now know g regular functions on X (right hand sides of (4)) whose common zero set is a finite subscheme containing π(X ∩A_{tors}). Multiplying each of these by a large odd power of y_{0} and replacing y_{0}^{2} by f̄(x_{0}), we obtain g polynomial equations in x_{0} and x_{1}. It is easy to eliminate x_{1} from these using p-resultants [Go, Section 1.5], since the exponents of x_{1} that appear are all powers of p. We end up with a single nonzero polynomial r(x_{0}) ∈ F_{p}[x_{0}] whose roots (together possibly with ∞) give the x-coordinates modulo p of the residue classes on X that could possibly contain elements of T. We factor r(x_{0}) over F_{p}. Remark. If g > 2, then the number of equations in x_{0} and x_{1} above exceeds the number of variables, so we expect heuristically that r(x_{0}) will have very small degree.

10. Lifting to characteristic zero and verification

Now we have a list of irreducible polynomials over F_{p} whose roots in \overline{F}_{p}, together with ∞ ∈ P^{1}(\overline{F}_{p}), contain the reductions of the x-coordinates of points of T. Let S denote the corresponding set of residue classes in X_{s}(\overline{F}_{p}). To finish, we need an algorithm that, given a point R̄ ∈ S, determines whether there exists a point R ∈ X(Q_{p}^{unr}) in its residue class with ι(R) torsion, and if so, finds it.

The computations done so far, which have narrowed our search to a finite set of candidates for R̄, have used only the equation of X mod p^{2}. For this, it did not matter whether X was defined over a number field or not. But from now on, we assume that the coefficients of the polynomial f(x, 1) defining X lie in a number field k ⊆ Q_{p}. Such an assumption lets us make sense of the problem of finding the points of T exactly: the answer can be the list of minimal polynomials over k satisfied by their x-coordinates.

The plan is to attempt to lift ι(R̄) to a torsion point R ∈ A(Q_{p}^{unr})_{tors} to high p-adic precision. By Lemma 2 there is at most one such R. Moreover, R is guaranteed to exist if ι(R̄) is of order prime to p. If we succeed in producing R, we check whether it lies on ι(X) up to the computed p-adic precision. Details of computing R and determining whether it lies on ι(X) up to a certain p-adic precision will be given in Section 11.

After doing this for each non-Weierstrass point R̄ ∈ S, we have a list of x-coordinates in P^{1}(Q_{p}^{unr}) which appear to be, to high p-adic precision, the complete list of x-coordinates of the non-Weierstrass points in T. In practice, if we go to high precision, we can be morally certain that these are approximations of the desired x-coordinates. We then construct the homogeneous polynomial g ∈ Z_{p}[x, z] vanishing at these points of P^{1}(Q_{p}^{unr}) to high precision, scaling it so that some coordinate is 1, and try to recognize these approximate coefficients of g as elements of k of small height. This can be done using p-adic continued fractions if k = Q; more generally, as we learned from Hendrik Lenstra, to recognize a number in Z_{p} (represented as an integer α modulo p^{n} for large n) as an algebraic number of degree d of small height, apply lattice basis reduction to find a short nonzero vector in the sublattice of vectors with last coordinate zero of the lattice in Z^{d+2} spanned by the rows of

[1 0 0 0 … 0 1 ; 0 1 0 0 … 0 α ; 0 0 1 0 … 0 α^{2} ; ⋮ ; 0 0 0 0 … 1 α^{d} ; 0 0 0 0 … 0 p^{n}] .

Finally, now that we have a homogeneous polynomial g ∈ k[x, z] whose roots r ∈ P^{1}(\overline{k}) we think are the x-coordinates of torsion points, for each root r let P_{r} be a point on X with x-coordinate r, and (using the methods of the next section) compute algebraically nι(P_{r}) for n = 1, 2, …, expecting to find 0 ∈ A eventually. If so for each r, we are done; otherwise we either compute more multiples or redo the entire computation to higher p-adic precision. (In practice, we have never needed to do the latter.) At the end we have a provably correct list of the x-coordinates of the points of T.

11. The Kummer surface

The most difficult computational ingredient in the algorithm described is an algorithm for group law computations on A and A. Although in theory the torsion packet calculating algorithm works for any g > 2, we restricted our implementation to the g = 2 case to avoid working too hard, the work having already been done by Cassels and Flynn in this case. (See [Fl] and [CF].) Moreover our implementation assumes that the genus 2 curve is defined over Q.

Suppose that A is the Jacobian of a curve X of genus g = 2 over a field k of characteristic not 2. The associated Kummer surface K is the quotient A/⟨±1⟩ where −1 acts on A as multiplication by −1. The multiplication by −1 on A has 16 geometric fixed points (the points of order 2); some authors blow these up on A before taking the quotient in order that the quotient be smooth, but we will not. We remark that if P ∈ X(k) is not a Weierstrass point, then the image of ι(P) in K is a nonsingular point, since otherwise 2P would be linearly equivalent to a sum of two Weierstrass points, and the difference of these divisors would be the divisor of a degree 2 function on X not preserved by the hyperelliptic involution, an impossibility.

A point in K(k) corresponds to a Gal(\overline{k}/k)-stable pair \{P, Q\} of points in A(\overline{k}) satisfying P = −Q. For n ∈ Z, the multiplication by n on A induces a morphism m_{n} : K → K taking {P, −P } to {nP, −nP }. The addition A×A → A does not induce a morphism K ×K → K. But instead there is a “addition-and-subtraction” morphism ϕ : K × K → Sym^{2}(K) taking ({P, −P }, {Q, −Q}) to {{P + Q, −(P + Q)}, {P − Q, −(P − Q)}}.

Cassels and Flynn observed that equations for the basic computations on K can be written down in a reasonable amount of space. These equations include: an explicit projective embedding for K, equations for the morphism ι′ : P^{1} → K induced by ι : X → A (P^{1} being the x-line), equations defining ϕ and recursive formulas defining m_{n} for n ≥ 1. These equations are much simpler than the analogous equations for A. Hence we will try to use computations with K in place of A wherever possible.

The variety K can be presented as a surface in P^{3} with homogeneous coordinates k_{1}, k_{2}, k_{3}, k_{4}. If P_{1} = (x_{1}, y_{1}) and P_{2} = (x_{2}, y_{2}), the map X × X → K taking (P_{1}, P_{2}) to the image of the divisor P_{1} + P_{2} − κ, κ being the canonical divisor, is given by [1, x_{1} + x_{2}, x_{1}x_{2}, h], where the final projective coordinate h is a rational function in all the variables x_{1}, y_{1}, x_{2}, y_{2}.

Let us recall what is needed.

(1) Evaluating p-adic integrals (Section 8): Given x_{0} ∈ \overline{F}_{p} with f(x_{0}, 1) ≠ 0, check if a point R̄ ∈ X_{s}(\overline{F}_{p}) is such that ι(R̄) has order prime to p in A_{s}(\overline{F}_{p}), and if so, lift R̄ to R ∈ X(W_{2}(\overline{F}_{p})) and compute η_{i}(ι(R)) ∈ \overline{F}_{p} for i = 1, 2, …, g.

(2) Lifting to torsion points (Section 10): Given R̄ ∈ X_{s}(\overline{F}_{p}) and a moderately large integer r (e.g. 30), either lift ι(R̄) to a point R ∈ A(W_{r}(\overline{F}_{p})) of the same order (a potential approximation to a torsion point), or prove that no such R exists.

(3) Deciding whether a point on the Jacobian lies on the image of the curve (Section 10): Given a point in A(W_{r}(\overline{F}_{p})) determine whether it lies on the image ι(X(W_{r}(\overline{F}_{p}))) of the curve (to p-adic precision p^{r}).

(4) Verifying torsion points (Section 10): If k is a number field, R ∈ X(k), and n ≥ 1, determine whether nι(R) = 0 in A(k).

Before describing the algorithms for these particular routines, let us remark that elements of W_{r}(F_{p^{d}}) are represented by polynomials of degree less than d in (Z/p^{r})[x] modulo a fixed monic polynomial in (Z/p^{r})[x] of degree d whose mod p reduction is irreducible. The characteristic polynomial P (x) (of Section 4) is computed from X(F_{p}) and X(F_{p^{2}}), which are computed naively by checking all possible x-coordinates. Then #A(F_{p^{d}}) is the norm from Z[x]/(P (x)) to Z of the image of x^{d} − 1. Similarly the order of the subgroup A(F_{q^{2d}})^{−} of A(F_{q^{2d}}) on which F^{d} acts as −1 is the norm of the image of x^{d} + 1.

11.1. Evaluating p-adic integrals. Let d be the degree of x_{0} over F_{p}. First compute f(x_{0}) and raise it to the (p^{d} − 1)/2 power to determine whether the y-coordinate y_{0} of a point R̄ ∈ X_{s}(\overline{F}_{p}) with x-coordinate x_{0} lies in F_{p^{d}} or in its quadratic extension. Let N = #A(F_{p^{d}}) in the first case, and let N = #A(F_{p^{2d}})^{−} in the second case, so that the order of ι(R̄) divides N. Let N′ be the largest prime-to-p divisor of N. Let N′′ = 2N′ if N′ ≡ 2 (mod p), and let N′′ = N′ otherwise. Calculate m_{N′′+1}(ι′(x_{0})), which is the image of (N′′ + 1)ι(R̄) ∈ A_{s}(\overline{F}_{p}) in K. If the order of R̄ in A_{s}(\overline{F}_{p}) is prime to p, then NR̄ = 0, so (N′′ + 1)R̄ = R̄ and m_{N′′+1}(ι′(x_{0})) = ι′(x_{0}). Conversely, if m_{N′′+1}(ι′(x_{0})) = ι′(x_{0}), then (N′′ + 1)R̄ = ±R̄, but N′′ and N′′ + 2 are both prime to p, so R̄ is of order prime to p.

We now assume we are in the case where R̄ is of order prime to p. The Teichmüller lift x′_{0} ∈ W_{2}(F_{p^{d}}) of x_{0} is computed by choosing an arbitrary lift and raising it to the p^{d} power. By Hensel’s Lemma, there is a point R ∈ X(Q_{p}^{unr}) with x-coordinate reducing to x′_{0} mod p^{2}. To compute η_{i}(ι(R)), we need to evaluate

∫_{0}^{ι(R)} ω̃_{i} = \frac{1}{N′′} ∫_{ι(R)}^{(N′′+1)ι(R)} ω̃_{i}.

Since we know (N′′ + 1)ι(R) only through its image in K, we must relate the latter integral to one on K.

Consider the sequence of morphisms

X →^{Δ} X × X →^{β} A →^{γ} K

where Δ is the diagonal, β maps (P, Q) to the class of P + Q − κ, and γ is the canonical quotient map. Since β^{∗}ω̃_{1} is a 1-form on X ×X symmetric under interchange of coordinates, such that α^{∗} pulls it back to dx/y, we must have

β^{∗}ω̃_{1} = \frac{1}{2} (\frac{dx_{1}}{y_{1}} + \frac{dx_{2}}{y_{2}} ) .

Similarly

β^{∗}ω̃_{2} = \frac{1}{2} (\frac{x_{1}dx_{1}}{y_{1}} + \frac{x_{2}dx_{2}}{y_{2}} ) .

In particular, β^{∗} is injective on meromorphic 1-forms. On the other hand the 1-forms μ_{1} := d(k_{2}/k_{1}) and μ_{2} := d(k_{3}/k_{1}) pull back to d(x_{1} +x_{2}) = dx_{1} +dx_{2} and d(x_{1}x_{2}) = x_{2}dx_{1} +x_{1}dx_{2} on X × X, respectively. Abusing notation by identifying each 1-form with its pullback to X × X, and solving for ω̃_{1} and ω̃_{2} in terms of μ_{1} and μ_{2}, we obtain

(7) ω̃_{1} = \frac{1}{2y_{1}y_{2}} [y_{1} − x_{1} (\frac{y_{2} − y_{1}}{x_{2} − x_{1}} )] μ_{1} + \frac{1}{2y_{1}y_{2}} (\frac{y_{2} − y_{1}}{x_{2} − x_{1}} ) μ_{2},
ω̃_{2} = \frac{1}{2y_{1}y_{2}} [(x_{1} + x_{2})y_{1} − x_{1}^{2} (\frac{y_{2} − y_{1}}{x_{2} − x_{1}} )] μ_{1} + \frac{1}{2y_{1}y_{2}} [−y_{1} + x_{1} (\frac{y_{2} − y_{1}}{x_{2} − x_{1}} )] μ_{2}.

To evaluate the integral μ_{1} and μ_{2} on K from the image of ι(R) to the image of (N′′ +1)ι(R), as elements of pZ_{p}^{unr} modulo p^{2}, is trivial, because we know the projective coordinates k_{1}, k_{2}, k_{3}, k_{4} of those two images, using the explicit map P^{1} → K and the recursively computed map m_{N′′+1} : K → K. Hence in order to compute ∫_{ι(R)}^{(N′′+1)ι(R)} ω̃_{i}, it suffices to know the values mod p at (R̄, R̄) of the four functions appearing as coefficients of μ_{1} and μ_{2} in the change of variable formulas (7). These functions can be evaluated directly, once we observe that

\frac{y_{2} − y_{1}}{x_{2} − x_{1}} = \frac{y_{2}^{2} − y_{1}^{2}}{(x_{2} − x_{1})(y_{1} + y_{2})} = \frac{f(x_{2}) − f(x_{1})}{(x_{2} − x_{1})(y_{1} + y_{2})}

evaluates to f′(x)/(2y) at an affine point where (x_{1}, y_{1}) = (x_{2}, y_{2}) = (x, y) and y ≠ 0 modulo p.

11.2. Lifting to torsion points. Define N as in the previous subsection, and suppose that p^{m} is the highest power of p dividing N. The 1-form calculations of the previous section show that k_{2}/k_{1} and k_{3}/k_{1} with constants subtracted serve as local parameters at the image of ι(R̄) on K, and they induce a bijection between the set of points of its residue disk in K(W (\overline{F}_{p})) and (pW (\overline{F}_{p}))^{⊕2}. We will find the image of a torsion point in this disk, if it exists, by a Newton-like method. Choose R_{1} in this residue disk, corresponding to (a_{1}, b_{1}). (Of course, the coordinates of R_{1} are given only to some finite p-adic precision.) By definition of N, m_{N+1}(R_{1}) maps to the same residue class; suppose it corresponds to (a_{N+1}, b_{N+1}). Let R_{0} ∈ K(W (\overline{F}_{p})) denote the point corresponding to

(a_{1} − \frac{a_{N+1} − a_{1}}{N} , b_{1} − \frac{b_{N+1} − b_{1}}{N} ) ,

provided that these coordinates belong to pW (\overline{F}_{p}). We claim that iterating this construction R_{1} ↦ R_{0} either terminates in failure if at some point the coordinates are no longer in pW (\overline{F}_{p}), in which case the conclusion is that there is no torsion point of A(W (\overline{F}_{p})) in the desired residue class, or else the sequence of iterates converges to the image of the desired torsion point. This follows from applying the following lemma with m = m_{N+1} and h the conversion to the formal coordinates obtained by integrating regular 1-forms. Lemma 10. Let V_{1} = V_{2} = (pW (\overline{F}_{p}))^{⊕2}. Let h : V_{1} → V_{2} be an analytic isomorphism. Under h, an endomorphism m : V_{1} → V_{1} corresponds to an affine linear function v ↦ (N + 1)v − ϵ on V_{2}. If ϵ/N ∈ V_{2}, then m has a unique fixed point v_{0} and for any starting point v ∈ V_{1}, iteration of ϕ(v) := v − (m(v) − v)/N converges to v_{0}. If ϵ/N ∉ V_{2}, then for any v ∈ V_{1}, (m(v) − v)/N ∉ V_{1}.

Proof. Let | | denote the p-adic absolute value on W (\overline{F}_{p}), and also the sup norm on V_{1} = V_{2} = (pW (\overline{F}_{p}))^{⊕2}. For u, u′ ∈ (pW (\overline{F}_{p}))^{⊕2}, let us write u ∼ u′ if |u − u′| < |u|.

The fixed points of m correspond under h to the fixed points of v ↦ (N + 1)v − ϵ; there is at most one, and one exists if and only ϵ/N ∈ V_{2}. We have

|m(v) − v| = |h(m(v)) − h(v)| = |(N + 1)h(v) − ϵ − h(v)| = |N(h(v) − ϵ/N)|.

Therefore ϕ is well-defined at v if and only if ϵ/N is in V_{2}.

It remains to show that if ϵ/N ∈ V_{2}, then iteration of ϕ converges to the fixed point v_{0} of m. Because the valuation on W (\overline{F}_{p}) is discrete, it suffices to prove |ϕ(v) − v_{0}| < |v − v_{0}| for v ≠ v_{0}. Composing the isomorphism h by translations on both sides, we may assume v_{0} = ϵ = 0. The derivative of h modulo p is a constant nonsingular matrix in GL_{2}(\overline{F}_{p}); by a linear change of variable, we may assume that it is the identity matrix mod p. The Taylor expansion of h around u shows that h(u′) − h(u) ∼ u′ − u for all u, u′ ∈ V_{1}.

Given v ≠ 0, let w = h(v), so h(m(v)) = (N +1)w. Then m(v)−v ∼ h(m(v))−h(v) = Nw, so (m(v) − v)/N ∼ w ∼ v. Thus |ϕ(v)| < |v| as desired. □

11.3. Deciding whether a point on the Jacobian lies on the image of the curve. This is simple to do with the Kummer surface: the image of the curve in K is the subvariety cut out by the equation k_{2}^{2} − k_{1}k_{3} = 0. In practice, one can check this relation as one goes along in the successive approximation of the previous subsection, to higher and higher precision, in hope of terminating the successive approximation early, as soon as one discovers that the torsion point (if it exists at all) is not on the curve.

11.4. Verifying torsion points. Apply ι′ to the x-coordinate of R to obtain the image of R in K, apply m_{n}, and see if the result is [0, 0, 0, 1], which is the image of 0 ∈ A in K.

12. Theoretical bounds for genus 2 curves

Now that we have finished describing the implementation, we will use the method to prove a bound for #T when g = 2. In the next section, we will show how this bound enables one to combine p-adic information for different primes p to speed up the computation. Lemma 11. Let K be a subgroup scheme of G_{a}^{2} = Spec F_{p}[z_{1}, z_{2}] of order p^{2}. Then there exist a, b, c, d ∈ F_{p} such that K is defined by one of the following three systems of equations:

I. z_{1}^{p} + az_{1} + bz_{2} = z_{2}^{p} + cz_{1} + dz_{2} = 0, II. z_{1}^{p^{2}} + az_{1}^{p} + bz_{1} = z_{2} + cz_{1} = 0, or III. z_{2}^{p^{2}} + az_{2}^{p} + bz_{2} = z_{1} + cz_{2} = 0.

Proof. For i = 1, 2, Let K_{i} denote the scheme-theoretic image of K under the i-th projection G_{a}^{2} → G_{a}. Clearly K_{i} is a subgroup scheme of G_{a} of order at most p^{2}.

Case 1: #K_{1} ≤ p and #K_{2} ≤ p. Since K ⊆ K_{1} × K_{2}, (#K_{1})(#K_{2}) ≥ p^{2}, so the only possibility is #K_{1} = #K_{2} = p and K = K_{1}×K_{2}. Every subgroup scheme of G_{a} of order p^{k} is cut out by an additive polynomial, so K is cut out by

z_{1}^{p} + az_{1} = z_{2}^{p} + dz_{2} = 0

for some a, d ∈ F_{p}, which is of type I.

Case 2: #K_{1} > p. Then #K_{1} = p^{2}, K_{1} is cut out by an equation

(8)  z_{1}^{p^{2}} + az_{1}^{p} + bz_{1} = 0,

and K is the graph of a homomorphism K_{1} → G_{a}. The homomorphism K_{1} is the restriction of a homomomorphism G_{a} → G_{a}, which is an additive polynomial, but since we may reduce this polynomial modulo (8), we may take it to be of the form cz_{1}^{p} + dz_{1}, with c, d ∈ F_{p}, and K is defined by (8) together with

(9)  z_{2} = cz_{1}^{p} + dz_{1}.

If c = 0, we are in type II.

Otherwise (9) expresses z_{1}^{p} as a combination of z_{1} and z_{2} while if we replace z_{1}^{p^{2}} in (8) by [c^{−1}(z_{2} − dz_{1})]^{p} and use (9) again to eliminate the z_{1}^{p}, we express z_{2}^{p} as a combination of z_{1} and z_{2}. The subgroup scheme K′ cut out by these two expressions, which are of type I, contains K but has order p^{2}, so K′ = K, and we are done.

Case 3: #K_{2} > p. This is the same as Case 2, but with coordinates reversed. □

Theorem 12. Let p ≥ 5 be prime. Let X be a curve of genus 2 over Q_{p} with good reduction at p. Then there are at most p^{3} + p^{2} + p + 7 distinct x-coordinates of points in X(\overline{Q}_{p}) in the hyperelliptic torsion packet T.

Proof. Let ϕ_{1} and ϕ_{2} be the components of the homomorphism Φ given by Corollary 6. Let ψ_{1} and ψ_{2} be their restrictions to L. Let K be the kernel of (ψ_{1}, ψ_{2}). Let ψ′_{1} and ψ′_{2} denote the homomorphisms G_{a}^{2} → G_{a} given by Lemma 11. Since (ψ′_{1}, ψ′_{2}) has the same kernel as (ψ_{1}, ψ_{2}), each can be obtained from the other by composing with an endomorphism of the target G_{a}^{2}. Hence, by composing Φ with an automorphism of G_{a}^{2}, we may assume that ψ_{1} and ψ_{2} are of one of the types in Lemma 11.

For i = 1, 2, let F_{i} be the regular function ϕ_{i} ∘ ι on X, which by Lemma 9 is of the form

F_{i} = H_{i} + ψ_{i}(w, x_{0}^{p}w)

where H_{i} is a rational function in x_{0}, y_{0} only, and w = x_{1}/y_{0}^{p}. Then the hyperelliptic torsion packet maps into the finite subscheme F_{1} = F_{2} = 0 of X.

We now eliminate w from the equations F_{1} = F_{2} = 0, as in Section 9. Suppose that ψ_{1} and ψ_{2} are of type I in Lemma 11. Then for some polynomials A, C, D in x_{0} of degrees at most p, p, p^{2} respectively, we have

F_{1} = H_{1} + Aw + w^{p}
F_{2} = H_{2} + Cw + Dw^{p}
F_{1}^{p} = H_{1}^{p} + A^{p}w^{p} + w^{p^{2}}
F_{2}^{p} = H_{2}^{p} + C^{p}w^{p} + D^{p}w^{p^{2}}.

This can be rewritten in terms of matrices:

(\begin{matrix}H_{1} − F_{1} & A & 1 & 0 \\ H_{2} − F_{2} & C & D & 0 \\ H_{1}^{p} − F_{1}^{p} & 0 & A^{p} & 1 \\ H_{2}^{p} − F_{2}^{p} & 0 & C^{p} & D^{p} \end{matrix}) (\begin{matrix}1 \\ w \\ w^{p} \\ w^{p^{2}} \end{matrix} ) = 0,

so the 4 × 4 matrix has zero determinant, and

det (\begin{matrix}H_{1} & A & 1 & 0 \\ H_{2} & C & D & 0 \\ H_{1}^{p} & 0 & A^{p} & 1 \\ H_{2}^{p} & 0 & C^{p} & D^{p} \end{matrix}) = det (\begin{matrix}F_{1} & A & 1 & 0 \\ F_{2} & C & D & 0 \\ F_{1}^{p} & 0 & A^{p} & 1 \\ F_{2}^{p} & 0 & C^{p} & D^{p} \end{matrix}) .

The entries of the second, third, and fourth columns are polynomials in x_{0} of degree at most p, p^{2}, and p^{3}, respectively. Expanding the right hand side in minors along the first column shows that it is a combination of the regular functions F_{1}, F_{2}, F_{1}^{p}, F_{2}^{p} on X weighted by polynomials in x_{0} of degree at most p^{3} +p^{2} +p. In particular it is regular wherever x_{0} is, and x_{0}^{−(p^{3}+p^{2}+p)} is regular along the polar divisor of x_{0} on X. But the left hand side is a rational function in x_{0}, y_{0} only, and is odd with respect to the hyperelliptic involution. Combining these observations shows that both sides equal I(x_{0})y_{0} for some polynomial I of degree at most p^{3} + p^{2} + p. The nonvanishing of I follows from the finiteness of the subscheme F of X cut out by F_{1} = F_{2} and the theory of p-resultants.

But by the right hand side definition of I(x_{0})y_{0}, I vanishes on the image of F (\overline{F}_{p}) in X_{s}(\overline{F}_{p}), except possibly at points where x_{0} fails to be regular or where y_{0} vanishes. Hence, since X ∩ A_{tors} injects into X_{s}(\overline{F}_{p}), the number of distinct x-coordinates in X(\overline{Q}_{p}) of torsion points on X is at most p^{3} + p^{2} + p + 7, where the +7 comes from the six Weierstrass x-coordinates, and x_{0} = ∞. □

Remark. The same proof, with the same bound, can be made to work for smooth genus 2 curves X over W (\overline{F}_{p}). Also, with a little more work, we could improve the bound slightly, by studying more carefully the valuation of I at ∞, and at the Weierstrass x-coordinates. But the main term, p^{3}, would be the same.

Corollary 13. Under the hypotheses of Theorem 12, the hyperelliptic torsion packet T contains at most 2p^{3} + 2p^{2} + 2p + 8 torsion points.

Proof. There are at most p^{3} + p^{2} + p + 1 non-Weierstrass x-coordinates (possibly including ∞), each giving rise to at most two points of the hyperelliptic torsion packet; there are also six Weierstrass points. □

Remark. The bound in Corollary 13 is a significant improvement over the bound #T ≤ 36p^{9} + 216p^{8} obtained by applying the general Theorem A of [Bu] to the case g = 2 with a Weierstrass point as basepoint.

13. Combining p-adic information for different primes p

As we will discuss in the next section, the running time of the algorithm varies widely with the curve. In the cases where the algorithm is slow, most of the time is spent in Section 11.2, where one has a large degree factor of the polynomial r(x_{0}), and tries to lift the corresponding point in A_{s}(\overline{F}_{p}) (or rather its image in the Kummer surface) to a torsion point in A(Q_{p}^{unr}) to higher p-adic precision.

There is sometimes a way to prove a priori that the roots of these large degree factors of r(x_{0}) cannot lift to x-coordinates of points in T, using the bound of Theorem 12 for a smaller prime ℓ. We illustrate this via an example.

Let X be the genus 2 modular curve X_{0}(31). Although X has good reduction at 5, the algorithm with the improved homomorphism fails for p = 5 because it turns out that dim W′ (see Section 8) is 3 instead of 2.

We try again using p = 7. This time the interpolation shows that dim W′ = 2 and L[W′] is finite, so the method will succeed, in theory. The degrees of the irreducible factors of the polynomial r(x_{0}) ∈ F_{7}[x_{0}] of Section 9 turn out to be 3, 3, 8, 67, and 272. The first two factors are from the Weierstrass points. A few seconds of computation show that a point in A_{s}(\overline{F}_{p}) corresponding to the degree 8 factor does not lift to a torsion point, and a 50-minute computation shows that the same holds for the degree 67 factor, but we run out of memory trying to prove the same for the degree 272 factor. If there actually were a point of T whose x-coordinate reduced modulo 7 to a root of this degree 272 factor, its degree over Q would be at least 272, however, and then the number of distinct x-coordinates of points in T would be at least 272, contradicting the bound 5^{3} + 5^{2} + 5 + 7 = 162 given by Theorem 12 for the prime 5. Thus the 5-adic bound lets us finish the 7-adic computation without examining the degree 272 factor.

14. Examples

Table 1 lists some genus 2 curves X over Q, specified by giving a separable quintic or sextic polynomial f(x) ∈ Q[x] such that X is birational to y^{2} = f(x). For each, we give

• the smallest prime p > 2g = 4 for which the method with the improved homomorphism worked,

• the number of points in the hyperelliptic torsion packet T, and

• a list of irreducible polynomials in Q[x] whose roots are a complete list of the xcoordinates of the non-Weierstrass points in T.

X  f(x)  p #T minimal polynomials of x-coordinates
X_{0}(22)  x^{6} − 4x^{4} + 20x^{3} − 40x^{2} + 48x − 32  7 10  ∞, x − 2
X_{0}(23)  x^{6} − 8x^{5} + 2x^{4} + 2x^{3} − 11x^{2} + 10x − 7  5  8  ∞
X_{0}(26)  x^{6} − 8x^{5} + 8x^{4} − 18x^{3} + 8x^{2} − 8x + 1  5 10  ∞, x
X_{0}(28)  x^{6} + 10x^{4} + 25x^{2} + 28  5 16  ∞, x − 1, x + 1, x^{2} + 3
X_{0}(29)  x^{6} − 4x^{5} − 12x^{4} + 2x^{3} + 8x^{2} + 8x − 7  5  8  ∞
X_{0}(31)  x^{6} − 8x^{5} + 6x^{4} + 18x^{3} − 11x^{2} − 14x − 3  7,5 8  ∞
X_{0}(37)  x^{6} + 8x^{5} − 20x^{4} + 28x^{3} − 24x^{2} + 12x − 4  5  6
X_{0}(50)  x^{6} − 4x^{5} − 10x^{3} − 4x + 1  7 20  ∞, x, x + 1, x^{4} − x^{3} + x^{2} − x + 1
X_{1}(13)  x^{6} + 2x^{5} + x^{4} + 2x^{3} + 6x^{2} + 4x + 1  5 22 ∞, x^{3} + 4x^{2} + x − 1, x^{2} + x + 1, x + 1, x
X_{1}(16)  −x^{5} + 2x^{4} + 2x^{2} + x  7 14  x − 1, x + 1, x^{2} + 2x − 1
X_{1}(18)  x^{6} + 2x^{5} + 5x^{4} + 10x^{3} + 10x^{2} + 4x + 1  5 22  ∞, x^{3} − 3x − 1, x^{2} + x + 1, x + 1, x
X_{0}^{+}(67)  x^{6} − 4x^{5} + 6x^{4} − 6x^{3} + 9x^{2} − 14x + 9  5  6
X_{0}^{+}(73)  x^{6} − 4x^{5} + 6x^{4} + 2x^{3} − 15x^{2} + 10x + 1  7,5 6
X_{0}^{+}(103)  x^{6} − 10x^{4} + 22x^{3} − 19x^{2} + 6x + 1  5  6
X_{0}^{+}(107) x^{6} − 4x^{5} + 10x^{4} − 18x^{3} + 17x^{2} − 10x + 1  5  6
X_{0}^{+}(167)  x^{6} − 4x^{5} + 2x^{4} − 2x^{3} − 3x^{2} + 2x − 3  5  6
X_{0}^{+}(191)  x^{6} + 2x^{4} + 2x^{3} + 5x^{2} − 6x + 1  7,5 6
C  x^{5} + 1  19 18  x, x^{5} − 4
V  x^{6} + 1  5 10  ∞, x
BG_{1}  x^{5} + x  5 22  x^{4} − 4x^{2} + 1, x^{4} + 4x^{2} + 1
BG_{2}  x^{5} + 5x^{3} + x  5  6
P  x^{5} − x + 1  5  6
B_{277}  x^{6} − 2x^{5} − x^{4} + 4x^{3} + 3x^{2} + 2x + 1  7,5 10  ∞, x
L_{29}  4x^{6} − 4x^{5} + x^{4} − 8x^{3} + 20x^{2} − 16x + 4  5 12  ∞, x − 1, x
HLP_{63} 897x^{6} − 197570x^{4} + 79136353x^{2} − 146398496 11,5 6

Table 1. Hyperelliptic torsion packets of genus 2 curves y^{2} = f(x).

We include ∞ in the latter list, if there are non-Weierstrass points in T with x = ∞. When there is more than one prime p listed, the algorithm was run using the first one, but using the Theorem 12 bound for the second prime to weed out large degree factors, as discussed in Section 13.

It is hard to predict in advance how long the program will take to compute T for a given curve. The running time depends on the size of the smallest usable p, but also can be dramatically reduced in certain favorable cases, for instance when the reduction X_{s} is superspecial, i.e., when the Cartier operator acts as zero on the space of regular differentials. The curves in the table taking the most and least time, respectively, were y^{2} = x^{5} + 1 (over 4 hours) and y^{2} = x^{6} + 1 (under 14 seconds). These timings were on a 300 MHz Sun Ultra 2.

14.1. Modular curves. The curve X_{0}(N) is the smooth projective model of the coarse moduli space over Q parameterizing pairs (E, C) where E is an elliptic curve and C is a cyclic subgroup of E of order N. The curve X_{1}(N) is the same, except parameterizing pairs (E, P) where P is a point on E of order N. For prime N, X_{0}^{+}(N) is the quotient of X_{0}(N) by the Atkin-Lehner involution W_{N}; it is the smooth projective model of the coarse moduli space parameterizing unordered pairs of N-isogenous elliptic curves. Many of the explicit equations for these modular curves are classical; in any case, we copied them from [Ha], with a change of variables in a few cases.

By [Og], X_{0}(N) is hyperelliptic (of genus at least 2) if and only if

N ∈ {22, 23, 26, 28, 29, 30, 31, 33, 35, 37, 39, 40, 41, 46, 47, 48, 50, 59, 71};

but, as was known much earlier, the only curves X_{0}(N) of genus 2 are the eight listed in Table 1. By [IM], X_{1}(N) is hyperelliptic if and only if N ∈ {13, 16, 18}; in each case the genus is 2. All the X_{0}^{+}(N) of genus 2 with N prime are listed in Table 1. Drinfel’d [Dr] generalized a result of Manin [Ma] to prove that the cusps on the quotient of the extended upper half plane by any congruence subgroup of SL_{2}(Z) lie in a single torsion packet. (For other proofs of this “Manin-Drinfel’d theorem,” see [El] or Theorem 3.1 in Chapter 5 of [KL].) We call this packet the cuspidal torsion packet; it coincides with the hyperelliptic torsion packet for all the X_{0}(N) and X_{1}(N) in the table except X_{0}(37), and for none of the X_{0}^{+}(N) in the table.

Suppose X = X_{0}(N) is of genus 2, and N is prime. Let C denote the set of cusps, and let H be the set of Weierstrass points (points fixed by the hyperelliptic involution) if X_{0}(N) is hyperelliptic and N ≠ 37, and let H = ∅ otherwise. Coleman, Kaskel, and Ribet [CKR] conjectured that the cuspidal torsion packet of X_{0}(N) equals C ∪ H. This was proved independently by M. Baker [Ba] and A. Tamagawa. Hence the only new results in the entries for X_{0}(N) in Table 1 are for composite N, and for N = 37. The paper [CKR] gives several proofs that the cuspidal torsion packet for X_{0}(37) consists of only the two cusps, while our computation shows that the hyperelliptic torsion packet consists only of the six Weierstrass points.

Coleman remarked on page 155 of [Co1] that X_{1}(13) has #T ≥ 22, because T contains at least 12 cusps, 6 Weierstrass points, and 4 points fixed by the order 3 diamond operator ⟨3⟩ ∈ Aut(X_{1}(13)). This was apparently the only known result on the torsion packets on X_{1}(N) before the present paper. Our program shows that T for X_{1}(13) contains no other points. For X_{1}(16), T equals the set of 14 cusps, which include the Weierstrass points. And for X_{1}(18), T is the union of the 16 cusps and the 6 Weierstrass points.

Baker [Ba] also proved that for all prime N, the cuspidal torsion packet of X_{0}^{+}(N) consists of only the one cusp. In the genus 2 cases, all of which are in Table 1, we find that the hyperelliptic torsion packet contains only the six Weierstrass points. In particular, the cuspidal and hyperelliptic torsion packets are distinct, so ι sends the cusp to a rational point of infinite order on the Jacobian.

14.2. Other curves of genus two. The literature contains a few other computations of T for genus 2 curves over Q. We succeeded in verifying all we could find, and we computed T for a few other curves.

Coleman, at the end of [Co2], worked 11-adically to prove that a curve isomorphic over \overline{Q} to C : y^{2} = x^{5} + 1 has #T = 18. Voloch [Vo] showed that V : y^{2} = x^{6} + 1 has #T = 10. He used a 7-adic method which can be viewed as a simplification of ours: it is simpler because he exploited the fact that its Jacobian modulo 7^{2} is a canonical lift, and that the Jacobian is isogenous over Q to a product of (equal) elliptic curves. Boxall and Grant [BG], in addition to giving a new calculation of T for C, determined T for the curves BG_{1} and BG_{2} in Table 1, by using the Galois action on torsion points. The curve P has no particularly special properties we know of; in addition to having trivial hyperelliptic torsion packet, its Jacobian A satisfies A(Q)_{tors} = \{0\} and End(A\overline{Q}) = Z (as computing the zeta functions over F_{3} and F_{7} shows), the typical situation. The smallest prime known to occur as the conductor of the Jacobian of a genus 2 curve over Q so far is 277; we learned of the existence of this curve from a talk of Brumer, and hence name it B_{277}. The largest positive integer (respectively, prime integer) known to occur as the order of a rational torsion point on a 2-dimensional Jacobian over Q so far is 63 (respectively, 29); the corresponding curves are HLP_{63} and L_{29}, from [HLP] and [Le].

The one curve we tried for which our algorithm failed was the curve

(10)  y^{2} = 278271081x^{6} − 5238713058x^{4} + 22999624761x^{2} − 229833600

of [KK] having 588 rational points, the current record for a genus 2 curve over Q. It was not the large coefficients that created the difficulty: the algorithm does not even see this for much of the time, while doing computations modulo p^{2} for a small prime p. (Indeed, adding one to the right hand side of (10) resulted in a curve for which T could be readily computed using p = 7.) Instead, the problem was that none of the first few primes was good for our method. Remarks.

(1) There are infinitely many genus 2 curves over C having #T = 22 [Po2] , but it is not known whether there is a single genus 2 curve over C with larger #T. It seems likely that there exists a uniform bound for #T for all genus 2 curves over C, but this too is not known.

(2) Table 1 shows that every even integer between 6 and 22 inclusive occurs as #T for a genus 2 curve over Q.

Acknowledgements

I thank E. V. Flynn for making his Kummer surface routines in Maple available electronically, and Michael Stoll for translating these routines from Maple into GP-PARI, which was the software package used to implement the algorithm of this paper.

References

[Ba] M. Baker, Torsion points on modular curves, Invent. Math. 140 (2000), no. 3, 487–509.

[BLR] S. Bosch, W. Lütkebohmert and M. Raynaud, Néron models, Springer, Berlin, 1990.

[BG] J. Boxall and D. Grant, Examples of torsion points on genus two curves, Trans. Amer. Math. Soc. 352 (2000), no. 10, 4533–4555.

[Bu] A. Buium, Geometry of p-jets, Duke Math. J. 82 (1996), no. 2, 349–367.

[CF] J. W. S. Cassels and E. V. Flynn, Prolegomena to a middlebrow arithmetic of curves of genus 2, London Mathematical Society Lecture Note Series, 230, Cambridge University Press, Cambridge, 1996.

[Co1] R. F. Coleman, Torsion points on curves and p-adic abelian integrals, Ann. of Math. (2) 121 (1985), no. 1, 111–168.

[Co2] R. F. Coleman, Torsion points on Fermat curves, Compositio Math. 58 (1986), no. 2, 191–208.

[Co3] R. F. Coleman, Ramified torsion points on curves, Duke Math. J. 54 (1987), no. 2, 615–640.

[Co4] R. F. Coleman, Torsion points on abelian étale coverings of P^{1} − {0, 1, ∞}, Trans. Amer. Math. Soc. 311 (1989), no. 1, 185–208.

[CKR] R. Coleman, B. Kaskel and K. A. Ribet, Torsion points on X_{0}(N), in Automorphic forms, automorphic representations, and arithmetic (Fort Worth, TX, 1996), 27–49, Proc. Sympos. Pure Math., Part 1, Amer. Math. Soc., Providence, RI, 1999.

[CTT] R. F. Coleman, A. Tamagawa and P. Tzermias, The cuspidal torsion packet on the Fermat curve, J. Reine Angew. Math. 496 (1998), 73–81.

[Dr] V. G. Drinfel’d, Two theorems on modular curves, Funkcional. Anal. i Priložen. 7 (1973), no. 2, 83–84. [English translation: Functional Anal. Appl. 7 (1973), 155–156.] [El] R. Elkik, Le théorème de Manin-Drinfel’d, Séminaire sur les Pinceaux de Courbes Elliptiques (Paris,

1988), Astérisque No. 183, (1990), 59–67.

[Fl] E. V. Flynn, The group law on the Jacobian of a curve of genus 2, J. Reine Angew. Math. 439 (1993), 45–69.

[Go] D. Goss, Basic structures of function field arithmetic, Springer, Berlin, 1996.

[Gr1] M. J. Greenberg, Schemata over local rings, Ann. of Math. (2) 73 (1961), 624–648.

[Gr2] M. J. Greenberg, Schemata over local rings. II, Ann. of Math. (2) 78 (1963), 256–266.

[Ha] Y. Hasegawa, Table of quotient curves of modular curves X_{0}(N) with genus 2, Proc. Japan Acad. Ser. A Math. Sci. 71 (1995), no. 10, 235–239.

[Hi] M. Hindry, Autour d’une conjecture de Serge Lang, Invent. Math. 94 (1988), no. 3, 575–603.

[HLP] E. Howe, F. Leprévost, and B. Poonen, Large torsion subgroups of split Jacobians of curves of genus two or three, Forum Math. 12 (2000), no. 3, 315–364.

[Hr] E. Hrushovski, The Manin-Mumford conjecture and the model theory of difference fields, to appear in Ann. Pure Appl. Logic.

[IM] N. Ishii and F. Momose, Hyperelliptic modular curves, Tsukuba J. Math. 15 (1991), no. 2, 413–423.

[Ka] N. M. Katz, Galois properties of torsion points on abelian varieties, Invent. Math. 62 (1981), no. 3, 481–502.

[KK] W. Keller and L. Kulesz, Courbes algébriques de genre 2 et 3 possedant de nombreux points rationnels, C. R. Acad. Sci. Paris Sér. I Math. 321 (1995), no. 11, 1469–1472.

[KL] D. S. Kubert and S. Lang, Modular units, Grundlehren der Mathematischen Wissenschaften 244, Springer-Verlag, New York-Berlin, 1981.

[Le] F. Leprévost, Points rationnels de torsion de jacobiennes de certaines courbes de genre 2, C. R. Acad. Sci. Paris Sér. I Math. 316 (1993), no. 8, 819–821.

[Ma] Ju. I. Manin, Parabolic points and zeta functions of modular curves, Izv. Akad. Nauk SSSR Ser. Mat. 36 (1972), 19–66. [English translation: Math. USSR-Izv. 6 (1972), 19–64.]

[Mi] J. S. Milne, Jacobian Varieties, in: G. Cornell, J. H. Silverman (eds.), Arithmetic geometry, 167–212, Springer-Verlag, New York, 1986.

[Og] A. P. Ogg, Hyperelliptic modular curves, Bull. Soc. Math. France 102 (1974), 449–462.

[Po1] B. Poonen, Mordell-Lang plus Bogomolov, Invent. Math. 137 (1999), no. 2, 413–425.

[Po2] B. Poonen, Genus-two curves with 22 torsion points, C. R. Acad. Sci. Paris Sér. I Math. 330 (2000), 573–576.

[Ra] M. Raynaud, Courbes sur une variété abélienne et points de torsion, Invent. Math. 71 (1983), no. 1, 207–233.

[Ri] K. A. Ribet, Almost rational torsion points, lectures at the University of Arizona, May 1999.

[SUZ] L. Szpiro, E. Ullmo, and S. Zhang, Équirépartition des petits points, Invent. Math. 127 (1997), no. 2, 337–347.

[Tz] P. Tzermias, The Manin-Mumford conjecture: a brief survey, Bull. London Math. Soc. 32 (2000), no. 6, 641–652.

[Ul] E. Ullmo, Positivité et discrétion des points algébriques des courbes, Ann. of Math. (2) 147 (1998), no. 1, 167–179.

[Vo] J. F. Voloch, Torsion points on y^{2} = x^{6} + 1, unpublished manuscript, 1997, available at http://www.ma.utexas.edu/users/voloch/preprint.html

Department of Mathematics, University of California, Berkeley, CA 94720-3840, USA

  E-mail address: poonen@math.berkeley.edu