In a significant development for both algebraic geometry and post-quantum cryptography, researcher Tanush Shaska of Oakland University has released a comprehensive theoretical study determining the exact asymptotic proportions of optimally $(N,N)$-split superspecial principally polarized abelian surfaces. Published in the Cryptology ePrint Archive as Paper 2026/2522, the work—titled "Superspecial points on Humbert surfaces and the probability of (N,N)-splitting"—places several long-standing hypotheses regarding the superspecial isogeny problem onto rigorous mathematical footing.
For years, cryptographers studying high-dimensional isogeny-based cryptosystems—particularly those relying on Jacobians of curves and abelian surfaces in characteristic $p$—have relied heavily on experimental data or one-sided theoretical bounds to estimate the behavior of random walks and splitting phenomena. Shaska’s new paper successfully moves beyond these approximations by deploying deep arithmetic techniques involving Humbert surfaces, Siegel’s mass formula, and refined invariants. By rigorously establishing the first-order behavior and explicit error bounds for $(N,N)$-splittings, the research provides a precise mathematical foundation for analyzing the security and efficiency parameters of emerging cryptographic protocols.
The core of the investigation centers on abelian surfaces defined over the algebraic closure of a finite field of characteristic $p$, where $p$ is a prime congruent to $3$ modulo $4$, and an integer $N geq 2$ representing the level of the splitting. In this geometric landscape, superspecial principally polarized abelian surfaces serve as key nodes in cryptographic algorithms such as the Richelot random walk. To accurately model these random walks and evaluate the security of associated splitting-detection attacks, researchers must understand the stationary measure governing the distribution of these surfaces.
In Shaska’s formulation, the surfaces are weighted naturally by the reciprocals of their automorphism orders, matching the stationary measure of the Richelot random walk. The central theorem demonstrated in the paper establishes that for primes not dividing $N$, the expected number of optimal $(N,N)$-splittings of a given surface can be expressed precisely in terms of Jordan’s totient function and the underlying characteristic. Specifically, the expected value is shown to be $5NJ_2(N)(p-1)/(p^2+1)$, where $J_2$ denotes Jordan’s totient function.
Building upon this first-moment calculation, the research further investigates the second factorial moment to control the variance and distribution of the splittings. Shaska proves that for primes satisfying $p > 2N^2$, the second factorial moment takes the form of a constant divided by $p^2+1$, where the constant $c_N$ is entirely independent of the prime $p$. Consequently, for a fixed integer $N$, the overall proportion of split surfaces is established as $5NJ_2(N)/p$, accompanied by a rigorous error term of order $O_N(p^-2)$. To make these abstract constants concrete, the explicit values of $c_N$ are determined for all integers $N$ from $2$ through $7$, providing immediate benchmarks for computational applications.
These theoretical advancements carry direct implications for the security analysis of isogeny-based cryptographic schemes. The proportion calculated in Shaska’s work serves precisely as the stationary target density for the splitting-detection attack targeting the superspecial isogeny problem in dimension two. Prior to this study, cryptographers lacked a complete, two-sided proof of this density, having to navigate security estimates built upon unproven conjectures, empirical observation, or restricted one-sided bounds. By resolving these questions analytically, the work removes a layer of uncertainty in cryptographic design and complexity estimation.
The methodology deployed to achieve these results relies on bridging arithmetic geometry and classical analytic number theory. Shaska demonstrates that superspecial abelian surfaces effectively sample the genus of their refined Humbert invariants in accordance with Siegel’s weights. This crucial insight unlocks the powerful machinery of Siegel’s theorem on genus averages, allowing the author to evaluate global averages over moduli spaces by translating them into manageable local densities and mass formulas.
Beyond the primary results concerning $(N,N)$-splittings, this methodological framework yields several additional breakthroughs. The same analytical approach successfully produces the first moment of primitive representations of every discriminant prime to $p$, determines mixed moments across multiple levels, establishes an exact probability value specifically at level $2$, and provides a definitive proof that the geometric upper bounds suggested by earlier literature indeed possess the correct leading asymptotic term.
To ensure the absolute reliability of these theoretical formulas, every derived expression was subjected to rigorous verification through exact computation implemented across twelve distinct primes. This exhaustive empirical cross-checking confirms the accuracy of the constants $c_N$ and reinforces confidence in the broader asymptotic formulas.
Academic researchers and cryptologists interested in the complete proofs, explicit constant derivations, and technical formulations can access the full preprint through the Cryptology ePrint Archive under paper identifier 2026/2522, where the complete BibTeX reference is made available for academic citation.
