Hyperelliptic curves are a natural generalisation of elliptic curves, and it was suggested by Koblitz [298] that they might be useful for public key cryptography. Note that there is not a group law on the points of a hyperelliptic curve; instead, we use the divisor class group of the curve. The main goals of this chapter are to explain the geometry of hyperelliptic curves, to describe Cantor's algorithm [105] (and variants) to compute in the divisor class group of hyperelliptic curves and then to state some basic properties of the divisor class group.

Definition 10.0.1 Let k be a perfect field. Let H(x), F(x) ∈ k[x] (we stress that H(x) and F(x) are not assumed to be monic). An affine algebraic set of the form C : y2 + H(x)y = F(x) is called a hyperelliptic equation. The hyperelliptic involution ι : C → C is defined by ι(x, y) = (x, -y - H(x)).

Exercise 10.0.2 Let C be a hyperelliptic equation over k. Show that if P ∈ C(k) then ι(P) ∈ C(k).

When the projective closure of the algebraic set C in Definition 10.0.1 is irreducible, dimension 1, non-singular and of genus g ≥ 2, then we will call it a hyperelliptic curve. By definition, a curve is projective and non-singular. We will give conditions for when a hyperelliptic equation is non-singular. Exercise 10.1.15 will give a projective non-singular model, but, in practice, one can work with the affine hyperelliptic equation.