A newly released research paper by Tanush Shaska of Oakland University has successfully resolved a longstanding open problem in arithmetic geometry and post-quantum cryptography, providing rigorous mathematical proofs for probabilities previously known only through empirical experiments or one-sided bounds. The paper, titled "Superspecial points on Humbert surfaces and the probability of (N,N)-splitting," was authored by Shaska and submitted to the cryptographic research community, offering profound implications for the theoretical foundations of superspecial isogeny-based cryptography in dimension two.
At the core of the new research is the mathematical behavior of superspecial principally polarized abelian surfaces defined over the algebraic closure of finite fields of characteristic $p$, where $p$ is a prime congruent to $3$ modulo $4$. For any integer $N$ greater than or equal to $2$, the study determines—to the first order in $1/p$ and backed by an explicit error bound—the precise proportion of these surfaces that are optimally $(N,N)$-split.
In this framework, the surfaces under investigation are weighted carefully by the reciprocals of their automorphism orders. This specific weighting mechanism is far from arbitrary; it serves directly as the stationary measure of the Richelot random walk, a fundamental stochastic process frequently utilized in computational algebraic geometry and cryptographic algorithms.
The primary theorem established in the work reveals a striking structural elegance. It demonstrates that for primes $p$ that do not divide $N$, the expected number of optimal $(N,N)$-splittings of a given surface is exactly $5NJ_2(N)(p-1)/(p^2+1)$, where $J_2$ denotes Jordan’s totient function. Furthermore, the research establishes that for primes $p$ strictly greater than $2N^2$, the second factorial moment evaluates to $c_N/(p^2+1)$, with the constant $c_N$ remaining entirely independent of the prime $p$.
Consequently, these derivations prove that for a fixed integer $N$, the overall proportion of split surfaces converges to $5NJ_2(N)/p$ with an error term of $O_N(p^-2)$. To ensure absolute reliability and bridge theoretical derivations with concrete values, the constants $c_N$ are explicitly determined for all integers $N$ ranging from $2$ to $7$, and every formula featured in the study was rigorously confirmed through exact computations performed at twelve distinct primes.
This newly uncovered proportion carries immense practical and theoretical weight because it represents the stationary target density of the splitting-detection attack, a vital analytical tool in evaluating the security of the superspecial isogeny problem in dimension two. Prior to Shaska’s work, cryptographers and mathematicians understood these densities primarily through laboratory experiments or constrained, one-sided mathematical bounds, leaving a notable gap in the rigorous security proofs required for modern cryptographic protocols.
To achieve these breakthroughs, the methodology employed in the paper bridges several sophisticated branches of mathematics. Shaska demonstrates that superspecial surfaces effectively sample the genus of their refined Humbert invariants in alignment with classical Siegel weights. By establishing this connection, the author successfully makes Siegel’s celebrated theorem on genus averages available for analysis in this modern cryptographic and geometric setting.
Beyond the primary theorem concerning $(N,N)$-splittings, this innovative methodological approach unlocks several secondary mathematical results. The same underlying technique successfully yields the first moment of primitive representations of every discriminant prime to $p$, provides mixed moments spanning several distinct levels, establishes an exact probability at level $2$, and delivers a definitive proof that the geometric upper bound derived in earlier foundational work indeed possesses the correct leading term.
The complete documentation, mathematical proofs, and reference materials for Paper 2026/2522 are publicly accessible via the Cryptology ePrint Archive under identifier 2026/2522, providing the broader academic and cryptographic research community with full access to the formal proofs and foundational constants.
