2-ADIC POINT COUNTING ON K3 SURFACES

ANDREAS-STEPHAN ELSENHANS AND JÖRG JAHNEL

Abstract. This article reports on an approach to point counting on algebraic varieties over finite fields that is based on a detailed investigation of the 2-adic orthogonal group. Combining the new approach with a p-adic method, we count the number of points on some K3 surfaces over the field 𝔽_{p}, for all primes p < 10^{8}.

1. Introduction

Counting points on algebraic varieties over finite fields is an important problem in algorithmic arithmetic geometry. When the Betti numbers of a variety are known, one has strong estimates on the number of points using étale cohomology. For example, in the case of a K3 surface S that is projective over a finite field 𝔽_{q}, the Lefschetz trace formula [SGA4^{1}⁄_{2}, Rapport, Théorème 3.2] reads

#S(𝔽_{q}) = q^{2} + Tr(Frob: H_{ét}^{2}(S_{\overline{𝔽}_{q}}, ℤ_{2}(1)) → H_{ét}^{2}(S_{\overline{𝔽}_{q}}, ℤ_{2}(1)))q + 1 .  (1)

Moreover, according to the Weil conjectures proven by P. Deligne [De74, Théorème 1.6], all eigenvalues of Frobenius are algebraic numbers of absolute value 1. As K3 surfaces have rk H_{ét}^{2}(S_{\overline{𝔽}_{q}}, ℤ_{2}(1)) = 22 and the hyperplane section causes one eigenvalue to be 1, the inequality

|#S(𝔽_{q}) − (q^{2} + q + 1)| ≤ 21q  (2)

results, which is of exactly the same form as the one formulated by P. Deligne for hypersurfaces [De74, Théorème 8.1]. In particular, one sees that it is sufficient to determine #S(𝔽_{q}) modulo some auxiliary integer that is larger than 42q.

Nowadays, the p-adic methods, as developed by K. Kedlaya, D. Harvey, and others, are frequently used for point counting, cf. [Ke, Ha, HS, EJ16]. They determine the number #S(𝔽_{q}), for q a power of the prime number p, by actually computing (#S(𝔽_{q}) mod p^{j}) , for a suitable value of the exponent j.

In this note, we are interested only in the number #S(𝔽_{p}) of points over the prime field 𝔽_{p}. Then the estimate (2) shows that, in most cases, (#S(𝔽_{p}) mod p^{2}) carries enough information. However, for most of the primes, even the modulus p^{2} is by far larger than necessary. Moreover, the p-adic methods are faster, at least by a factor of 10, when working only modulo p and not modulo p^{2}, cf. Remark 5.9. It is thus worth trying to use a p-adic method just for counting modulo p and to combine the result with the point count modulo some other small integer, which has to be obtained in a different way.

Date: June 28, 2022.

2010 Mathematics Subject Classification. Primary 14J28; Secondary 20G25, 14F20, 11G25.

Key words and phrases. K3 surface, point counting, 2-adic orthogonal group, 2-adic overdetermination.

l-adic point counting in general – Explicitisation of étale cohomology. Let l be a prime that is not the characteristic of the base field. Then, the essence of an l-adic point counting algorithm is to make the l-adic cohomology ℤ_{l}-module H_{ét}^{i}(S_{\overline{𝔽}_{p}}, ℤ_{l}) explicit, including the action of Frob, for the varieties of type considered.

A famous example is R. Schoof’s algorithm [Sch] for elliptic curves and its generalisation to abelian varieties [Pi]. Here, the l-adic cohomology may be explicitly described using torsion points. Another well-known example works for del Pezzo surfaces. Here, formula (1) holds, as well. Moreover, one has T(S_{\overline{𝔽}_{p}}, ℤ_{l}) = 0. In other words, H_{ét}^{2}(S_{\overline{𝔽}_{p}}, ℤ_{l}(1)) and the action of Frob upon it can be made explicit in terms of the geometric Picard group, cf. formula (7). This essentially breaks down to the computation of the exceptional curves, cf. [EJ20b, §2.5].

A 2-adic point counting method for K3 surfaces. Following these ideas, the algorithm we describe below relies on an explicitisation of T(S_{\overline{𝔽}_{p}}, ℤ_{2})/4 T(S_{\overline{𝔽}_{p}}, ℤ_{2}) for a particular family of K3 surfaces. This turns out to suffice for point counting modulo 16.

We assume that we are given a K3 surface that is presented as a double cover of P_{𝔽_{p}}^{2} , branched over six 𝔽_{p}-rational lines. This assumption is certainly more restrictive than necessary, but coincides with the generality, for which the algorithm is currently implemented. It coincides, too, with the generality, in which we describe the algorithm in Section 5. We indicate in Section 6 how to treat a slightly more general case and discuss the possibility of further generalisations in Section 7.

The very first step is to choose a lift to a flat ℤ-scheme S containing the given surface as the special fibre S_{𝔽_{p}} . Such a lift exists for any K3 surface, at least as long as p ≥ 5, as follows from [Og, Corollary 2.3], together with [Ch, Theorem 1], cf. [De81, Remarque 1.9]. In our situation, one simply needs to lift the coefficients of the linear forms defining the lines from 𝔽_{p} to ℤ. One then finds a double cover S of P_{ℤ}^{2}, branched over the union of six lines, each of which is defined over Spec ℤ. Then, for every good prime l ≠ 2 of S, in particular for l = p, one has an isomorphism of ℤ_{2}-modules

H_{ét}^{2}(S_{\overline{𝔽}_{l}}, ℤ_{2}(1)) ≅ H_{ét}^{2}(S\overline{ℚ} , ℤ_{2}(1)) ,

the action of Frob on the left agreeing with that of Frob_{l} on the right [SGA4, Exposé XVI, Corollaire 2.3].

The assumptions and preparations made up to here have two consequences, as explained in i) and ii), below. i) One has that rk Pic(S\overline{ℚ} ) ≥ 16. In fact, a sublattice of Pic(S\overline{ℚ} ) of rank 16 is explicitly known, which is a trivial Gal(\overline{ℚ} /ℚ) -module. Thus, there is an improvement over (2) implying that it is sufficient to count (#S(𝔽_{p}) mod 16p) , cf. Paragraph 2.5. Assuming that (#S(𝔽_{p}) mod p) is known, only the information about (#S(𝔽_{p}) mod 16) is missing. We assume that Pic(S\overline{ℚ} ) is a trivial Gal(\overline{ℚ} /ℚ) -module in the case rk Pic(S\overline{ℚ} ) > 16, as well. Then in order to count (#S(𝔽_{p}) mod 16) , it suffices to determine

(Tr(Frob_{p}: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2})) mod 16) ,

for T(S\overline{ℚ} , ℤ_{2}) ⊂ H_{ét}^{2}(S\overline{ℚ} , ℤ_{2}(1)) the transcendental lattice. Cf. Definition 3.1 and formula (8). ii) The Gal(\overline{ℚ} /ℚ) -module T(S\overline{ℚ} , ℤ_{2})/2 T(S\overline{ℚ} , ℤ_{2}) is trivial. Indeed, one has a canonical Gal(\overline{ℚ} /ℚ )-equivariant isomorphism Br(S\overline{ℚ} )_{2} ≅ Hom(T(S\overline{ℚ} , ℤ_{2}), ℤ/2ℤ) , cf. Theorem 3.5. Moreover, the 2-torsion of the geometric Brauer group is well understood for double covers, thanks to the work of A. N. Skorobogatov [Sk, Theorem 1.1].

Here, an important observation comes into play. The action of Gal(\overline{ℚ} /ℚ) on T(S\overline{ℚ} , ℤ_{2}) takes place via maps being orthogonal with respect to the cup product pairing (Cf. Section 3). And for the orthogonal group, a remarkable phenomenon of 2-adic overdetermination occurs. We discuss this in detail in Section 4, which is, from the technical point of view, the main part of this article. In fact, the following is true.

Theorem. Let n ∈ ℕ. With respect to a non-degenerate, symmetric bilinear form on ℚ_{2}^{n}, let U_{1}, U_{2} ∈ M_{n×n}(ℤ_{2}) be orthogonal matrices such that U_{1} ≡ U_{2} (mod 4). If U_{1} ≡ E_{n} (mod 2) then Tr(U_{1}) ≡ Tr(U_{2}) (mod 16).

In particular, for an orthogonal endomorphism a of T(S\overline{ℚ} , ℤ_{2}) such that a ≡ id (mod 2), the reduction (a mod 4) ∈ End(T(S\overline{ℚ} , ℤ_{2})/4 T(S\overline{ℚ} , ℤ_{2})) completely determines (Tr(a: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2})) mod 16) .

Moreover, {A ∈ GL_{n}(ℤ/4ℤ) |A ≡ E_{n} (mod 2)} is an elementary abelian 2-group. Therefore, the splitting field K of the Gal(\overline{ℚ} /ℚ) -action on T(S\overline{ℚ} , ℤ_{2})/4 T(S\overline{ℚ} , ℤ_{2}) is an abelian extension of ℚ of exponent 2. Furthermore, K is unramified at every good prime l ≠ 2 of S, so that one has K ⊆ ℚ(\sqrt{−1}, \sqrt{2}, \sqrt{d} | d bad prime of S) . Thus, in order to determine (Tr(Frob_{p}: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2})) mod 16) , it suffices i) to look for a small good prime l such that the action of Frob_{l} agrees with that of Frob_{p} on K = ℚ(\sqrt{−1}, \sqrt{2}, \sqrt{d} | d bad prime of S) and ii) to count #S(𝔽_{l}) by another method, either naive or p-adic, and to deduce Tr(Frob: T(S_{\overline{𝔽}_{l}}, ℤ_{2}) → T(S_{\overline{𝔽}_{l}}, ℤ_{2})) from that value. A situation, where this approach is particularly efficient, is when a ℤ-scheme S is given, the points on many special fibres S_{𝔽_{p}} of which are to be counted.

Practical experiments. We applied the 2-adic method, as described in combination with a p-adic method, to count the 𝔽_{p}-rational points on some K3 surfaces, for all primes p up to 10^{8}. All computations were done using magma [BCP].

Checks for correctness of the implementation. For each of the surfaces, we compared the output with the result of a completely naive algorithm, for all primes p < 1000, and with that of a p-adic method, counting modulo p^{2}, for all primes p < 100 000.

There is a further check as follows. The estimate (4) allows for #S(𝔽_{p}) an interval of length 12p. Thus, knowing (#S(𝔽_{p}) mod p), there are only twelve (or perhaps 13) options for #S(𝔽_{p}), which means that not all residues modulo 16 are permissible. At least a “random” bug would certainly produce such residue classes from time to time.

Code. On the web pages of either author, related to the project described in this article, the following code is publicly available.

i) Naive point counting, as used for initialisation and checks. ii) A Harvey style p-adic point counting method in p-adic precision 1 with remainder tree, for surfaces of the shape w^{2} = xyzf_{3}. It runs through all prime numbers p ≤ 10^{6} in a few minutes. iii) The initialisation following the more efficient approach, as described in Algorithm 5.1.A’) and A”). iv) Point counting modulo 16p, as described in Algorithm 5.1.B).

Terminology and Notation. i) For 𝒪 a commutative ring with 1 and n ∈ ℕ, we write GL_{n}(𝒪) := {A ∈ M_{n×n}(𝒪) | det A is a unit in 𝒪}. We let E_{n} be the n × n identity matrix. For any matrix A, we denote by A^{⊤} the transpose in the usual sense. Note that A^{⊤} is usually not the adjoint matrix in situations when the latter is defined. When φ: Γ → Γ′ is an 𝒪-linear map between free 𝒪-modules of finite rank with bases ℬ and ℬ′, respectively, then we denote by M_{ℬ}^{ℬ′} (φ) the matrix of φ with respect to ℬ and ℬ′. ii) By an 𝒪-lattice, we mean a free 𝒪-module Γ of finite rank equipped with a nondegenerate, symmetric 𝒪-bilinear form b: Γ × Γ → 𝒪. When there seems to be no danger of confusion, we simply write Γ instead of (Γ, b). An 𝒪-lattice (Γ, b) is called regular if b provides an isomorphism Γ → Hom_{𝒪} (Γ, 𝒪). iii) An 𝒪-linear map between 𝒪-lattices φ: (Γ, b) → (Γ′, b′) is called orthogonal if b′(φ(x), φ(y)) = b(x, y) holds for all x, y ∈ Γ. And similarly for m × n-matrices if Γ = 𝒪^{n} and Γ′ = 𝒪^{m}. iv) We let ℙ denote the set of all prime numbers.

v) For a ∈ ℚ_{2}, we let ν_{2}(a) ∈ ℤ ∪ {∞} be the 2-adic exponential valuation of a. I.e. the exponent of 2 in the unique factorisation a = u2^{ν_{2}(a)}, for u ∈ ℤ_{2} a unit. Putting ν_{2}(A) := min{ν_{2}(a_{ij}) | i = 1, …, m, j = 1, …, n} , we extend the 2-adic valuation from ℚ_{2} to matrices A = (a_{ij}) ∈ M_{m×n}(ℚ_{2}) . vi) A generic line on the projective plane P^{2} is denoted by l.

2. The surfaces studied

2.1. Let k be a field of characteristic ≠ 2 and l_{1}, …, l_{6} ∈ Γ(P2 ; \overline{k}, 𝒪(1)) six linear forms, such that the vanishing loci of any three of them do not have a geometric point in common. Suppose that \{l_{1}, …, l_{6}\} is a Gal(\overline{k}/k)-invariant set. Then the double cover S′ of P_{k}^{2}, given by

W^{2} = l_{1} ⋯ l_{6} ,  (3)

geometrically has 15 isolated singularities, which are ordinary double points. The minimal resolution of singularities is a surface S of type K3. This is, in fact, one of the most classical families of K3 surfaces, cf. [GH, Chapter 6, Section 2].

Examples 2.2. We actually work over ℤ and consider the double covers of P_{ℤ}^{2}, given by the equations below,

i) S′_{1} : W^{2} = T_{1}T_{2}T_{3}(T_{1} + T_{2} + T_{3})(3T_{1} + 5T_{2} + 7T_{3})(−5T_{1} + 11T_{2} − 2T_{3}), ii) S′_{2} : W^{2} = T_{1}T_{2}T_{3}(2T_{1} + 4T_{2} − 3T_{3})(T_{1} − 5T_{2} − 3T_{3})(T_{1} + 3T_{2} + 3T_{3}), iii) S′_{3} : W^{2} = T_{1}T_{2}T_{3}(4T_{1} + 9T_{2} + T_{3})(−T_{1} − T_{2} − 4T_{3})(16T_{1} + 25T_{2} + T_{3}), iv) S′_{4} : W^{2} = T_{1}T_{2}T_{3}(T_{1} + T_{2} + T_{3})(T_{1} + 2T_{2} + 3T_{3})(5T_{1} + 8T_{2} + 20T_{3}).

v) S′_{5} : W^{2} = T_{1}T_{2}(T_{1}^{4}−7T_{1}^{3}T_{2}−T_{1}^{3}T_{3}+19T_{1}^{2}T_{2}^{2}+4T_{1}^{2}T_{2}T_{3}+T_{1}^{2}T_{3}^{2}−23T_{1}T_{2}^{3}−7T_{1}T_{2}^{2}T_{3} − 6T_{1}T_{2}T_{3}^{2} − T_{1}T_{3}^{3} + 11T_{2}^{4} + 7T_{2}^{3}T_{3} + 9T_{2}^{2}T_{3}^{2} + 3T_{2}T_{3}^{3} + T_{3}^{4}).

Note that, in the equation for S′_{5}, the homogeneous degree four factor on the right hand side completely splits over the integer ring of the fifth cyclotomic field ℚ(ζ_{5}) , the irreducible factors being (T_{1} − (ζ_{5} + 2)T_{2} + ζ_{5}^{2}T_{3}) and its conjugates. In each case, we let S_{i} be the blowing-up of S′_{i} in the Zariski closure, equipped with the induced reduced scheme structure, of the singular locus of the generic fibre S′_{i,ℚ} . In particular, S_{i,ℚ} is the minimal resolution of singularities of S′_{i,ℚ} .

Remark 2.3. The surfaces above were investigated in detail in a project concerning the Frobenius trace distributions and the Sato–Tate conjecture for K3 surfaces. The efficient point counting algorithm described here was used in order to speed up the computations that led to the histograms presented there [EJ21].

Remarks 2.4. Let us recall from [EJ21, Section 5] the main properties of the surfaces S_{i}, for i = 1, …, 5.

a) (Geometric Picard ranks) In each case, the pull back of a general line on P2 ; \overline{ℚ} , together with the exceptional curves resulting from the resolution of singularities, generates a rank-16 sublattice in the geometric Picard group. The geometric Picard rank of each of the surfaces S_{1,ℚ} , S_{2,ℚ} , and S_{4,ℚ} is indeed equal to 16, while the surface S_{3,ℚ} is of geometric Picard rank 17.

b) (Bad primes) Aside from the prime 2, these are exactly the primes p such that, modulo p, some combination of three of the branch lines has at least one point in common. Thus, the bad primes could be determined by factoring the determinants det(l_{i} l_{i′} l_{i′′}), for {i, i′, i′′} ⊂ {1, …, 6} any subset of size three. The computation results in the sets {2, 3, 5, 7, 11, 13, 29}, {2, 3, 5, 7}, {2, 3, 5, 7, 11}, {2, 3, 5}, and {2, 5} of bad primes, for S_{1}, S_{2}, S_{3}, S_{4} and S_{5}, respectively.

c) (Special properties) The surface S_{1} is a generic surface with a branch locus of six lines, while S_{2} has a trivial jump character [CEJ]. The surface S_{3} has trivial jump character, too, but higher Picard rank. Finally, the surface S_{4}(ℂ) has complex multiplication by ℚ(\sqrt{−1}) and S_{5}(ℂ) is known to have real multiplication by ℚ(\sqrt{5}) .

2.5 (An improvement of Deligne’s general bound). As the K3 surfaces S_{i}, for i = 1, 2, 3, 4, are of geometric Picard rank ≥16 and Pic(S_{i,\overline{ℚ}} ) is a trivial Gal(\overline{ℚ} /ℚ) - module, the action of Frob on H_{ét}^{2}(S_{\overline{𝔽}_{q}}, ℤ_{2}(1)) is bound to have the eigenvalue 1 at least of multiplicity 16. Formula (1) therefore actually yields the sharper estimate

|#S_{i}(𝔽_{p}) − (p^{2} + 16p + 1)| ≤ 6p .  (4)

Thus, in each of these cases, it suffices to determine (#S_{i}(𝔽_{p}) mod 16p).

2.6. We explain the 2-adic method in Sections 3, 4, and 5 below, for K3 surfaces of type (3), of the kind that the linear forms l_{1}, …, l_{6} are defined over ℤ. This covers Examples 2.2.i), ii), iii), and iv), but not v), which is more advanced. We report on the modifications necessary in order to deal with S_{5} in Section 6.

3. Étale cohomology and the Brauer group

General K3 surfaces. Let S be a K3 surface over a field k. Then H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)) is a free ℤ_{2}-module of rank 22. Since H_{ét}^{3}(S\overline{k}, ℤ_{2}(1)) = 0, the change of coefficients map H_{ét}^{2}(S\overline{k}, ℤ_{2}(1))⊗_{ℤ_{2}} ℤ/2^{i}ℤ →^{≅} H_{ét}^{2}(S\overline{k}, μ_{2^{i}}) is an isomorphism, for any i ∈ ℕ.

Let us recall that there is the natural cup product pairing

⟨., .⟩: H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)) × H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)) → ℤ_{2}  (5)

that is non-degenerate and even perfect, by Poincaré duality [SGA4, Exposé XVIII, Théorème 3.2.5]. Moreover, we have at our disposal the Chern class homomorphism c_{1} : Pic(S\overline{k}) → H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)) [SGA5, Exposé VII, Section 3], under which the intersection pairing agrees with the cup product pairing.

Definition 3.1. Let S be a K3 surface over a field k.

a) Then, we write P(S\overline{k}, ℤ_{2}) := c_{1}(Pic(S\overline{k})).

b) The orthogonal complement T(S\overline{k}, ℤ_{2}) := P(S\overline{k}, ℤ_{2})^{⊥} ⊂ H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)) is called the transcendental lattice of S. Note that T(S\overline{k}, ℤ_{2}), as well as P(S\overline{k}, ℤ_{2}), is a ℤ_{2}- lattice.

According to this definition, T(S\overline{k}, ℤ_{2}) ⊂ H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)) clearly has no cotorsion. Let us note that P(S\overline{k}, ℤ_{2}) ⊂ H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)) has no cotorsion either. Indeed, suppose, for a certain ℒ ∈ Pic(S\overline{k}), that the Chern class c_{1}(ℒ) ∈ H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)) is divisible by 2. Then (c_{1}⊗_{ℤ_{2}} ℤ/2ℤ)(ℒ) = 0 ∈ H_{ét}^{2}(S\overline{k}, μ_{2}) and the exactness of the cohomology sequence Pic(S\overline{k}) →^{·2} Pic(S\overline{k}) → H_{ét}^{2}(S\overline{k}, μ_{2}), induced by the Kummer sequence, shows that ℒ is divisible by 2 itself.

Consequently, one has

P(S\overline{k}, ℤ_{2}) := T(S\overline{k}, ℤ_{2})^{⊥} ,  (6)

too. Indeed, the cup product pairing (5) is non-degenerate.

3.2. Let k be the finite field 𝔽_{q}. Then, in terms of the geometric Picard group and the transcendental lattice, the Lefschetz trace formula (1) takes the form

#S(𝔽_{q}) = q^{2} + Tr(Frob: Pic(S_{\overline{𝔽}_{q}})⊗_{ℤ} ℚ → Pic(S_{\overline{𝔽}_{q}})⊗_{ℤ} ℚ)q
+ Tr(Frob: T(S_{\overline{𝔽}_{q}}, ℤ_{2}) → T(S_{\overline{𝔽}_{q}}, ℤ_{2}))q + 1 . (7)

Similarly, for S a flat ℤ-scheme such that S_{ℚ} is a K3 surface and a prime p of good reduction, one has

#S(𝔽_{p}) = p^{2} + Tr(Frob_{p}: Pic(S\overline{ℚ} )⊗_{ℤ} ℚ → Pic(S\overline{ℚ} )⊗_{ℤ} ℚ)p
+ Tr(Frob_{p}: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2}))p + 1 . (8)

In particular, this means #S(𝔽_{p}) = p^{2}+rp+Tr(Frob_{p}: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2}))p+1 in the case that rk Pic(S_{ℚ} ) = rk Pic(S\overline{ℚ} ) = r.

3.3. On cohomology with 2-torsion coefficients, the cup product pairing induces a canonical Gal(\overline{k}/k)-equivariant isomorphism

H_{ét}^{2}(S\overline{k}, μ_{2}) ⟶^{≅} Hom(H_{ét}^{2}(S\overline{k}, μ_{2}), ℤ/2ℤ)
= Hom(H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)), ℤ/2ℤ) .

Restricting the domain on the right hand side from H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)) to the transcendental lattice, one obtains a canonical homomorphism

H_{ét}^{2}(S\overline{k}, μ_{2}) ⟶ Hom(T(S\overline{k}, ℤ_{2}), ℤ/2ℤ) ,  (9)

which is surjective, since T(S\overline{k}, ℤ_{2}) ⊂ H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)) has no cotorsion.

Lemma 3.4. Let S be a K3 surface over a field k. Then the kernel of the homomorphism (9) coincides with the image of c_{1}⊗_{ℤ_{2}} ℤ/2ℤ: Pic(S\overline{k}) → H_{ét}^{2}(S\overline{k}, μ_{2}) . Proof. “⊇” is clear. “⊆”: Let γ ∈ H_{ét}^{2}(S\overline{k}, μ_{2}) be in the kernel of (9). Lift γ to a class γ̃ ∈ H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)). Then, for every χ ∈ T(S\overline{k}, ℤ_{2}), one has that ⟨γ̃, χ⟩ ∈ ℤ_{2} is divisible by 2. Since T(S\overline{k}, ℤ_{2}) has no cotorsion and the pairing (5) is perfect, there exists a class κ ∈ H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)) of the kind that ⟨γ̃, χ⟩ = 2⟨κ, χ⟩, for any χ ∈ T(S\overline{k}, ℤ_{2}). In other words, γ̃ − 2κ ∈ T(S\overline{k}, ℤ_{2})^{⊥} = P(S\overline{k}, ℤ_{2}) , according to (6), which identifies γ as an element in the image of c_{1}⊗_{ℤ_{2}} ℤ/2ℤ. □

We denote by Br(S\overline{k}) := H_{ét}^{2}(S\overline{k}, 𝔾_{m}) the geometric Brauer group of S. A standard application of the Kummer sequence shows that the 2-torsion part is given by Br(S\overline{k})_{2} = H_{ét}^{2}(S\overline{k}, μ_{2})/ im(c_{1}⊗_{ℤ_{2}} ℤ/2ℤ).

Theorem 3.5. Let S be a K3 surface over a field k. Then the homomorphism (9) induces a canonical Gal(\overline{k}/k)-equivariant isomorphism

Br(S\overline{k})_{2} ⟶^{≅} Hom(T(S\overline{k}, ℤ_{2}), ℤ/2ℤ) .  (10)

Remark 3.6. In other words, the transcendental lattice modulo 2 is dual to the 2-torsion of the Brauer group. This has been known before, at least in the context of complex analytic K3 surfaces, cf. [vG, Paragraph 2.1].

Double covers of P^{2} branched over six lines. Let S be a K3 surface over a field k of the kind described in paragraph 2.1. Then S may be obtained as a double cover of B, the projective plane, blown up in the singular locus of V (l_{1} ⋯ l_{6}), which forms a reduced k-scheme of length 15. The branch locus of the double cover π: S → B is the strict transform of V (l_{1} ⋯ l_{6}). This is a disjoint union of six projective lines.

Theorem 3.7 (A. N. Skorobogatov). Let k be a field of characteristic not 2 and let S be a K3 surface over k as in 2.1. Then there is a Gal(\overline{k}/k)-equivariant isomorphism

Br(S\overline{k})_{2} ⟶^{≅} Pic(B\overline{k})^{even}/π_{∗} Pic(S\overline{k}) ,

for Pic(B\overline{k})^{even} ⊆ Pic(B\overline{k}) the subgroup formed by the classes having an even intersection number with each connected component of the branch locus. Proof. This is a particular case of A. N. Skorobogatov’s explicit description of Br(S\overline{k})_{2} for double covers [Sk, Theorem 1.1]. Note that the geometric Picard group of the branch locus has no torsion. □

The case of six k-rational lines.

Corollary 3.8. Let k be a field of characteristic not 2 and S a K3 surface over k as in 2.1. Suppose that l_{1}, …, l_{6} are defined over k.

a) Then the natural Gal(\overline{k}/k)-action on Br(S\overline{k})_{2} is trivial.

b) The natural Gal(\overline{k}/k)-action on T(S\overline{k}, ℤ_{2})/2 T(S\overline{k}, ℤ_{2}) is trivial, too.

Proof. a) Since l_{1}, …, l_{6} are defined over k, B is the blowing-up of P_{k}^{2} in 15 k-rational points. Therefore, the Gal(\overline{k}/k)-action on the whole of Pic(B\overline{k}) is trivial.

b) follows from a), together with Theorem 3.5. □

Corollary 3.9 (The splitting field of T(S\overline{k}, ℤ_{2})/4 T(S\overline{k}, ℤ_{2})). Let k be a field of characteristic not 2 and S a K3 surface over k as in 2.1. Suppose that l_{1}, …, l_{6} are defined over k. Denote by K ⊇ k the splitting field of T(S\overline{k}, ℤ_{2})/4 T(S\overline{k}, ℤ_{2}).

a) Then K is an abelian extension of k of exponent at most 2.

b) Suppose that k is a number field. Then K is unramified over k at all primes of good reduction and odd residue characteristic.

Proof. a) By definition, one has a natural injection

Gal(K/k) ↪ Aut(T(S\overline{k}, ℤ_{2})/4 T(S\overline{k}, ℤ_{2})) .

But {A ∈ GL_{n}(ℤ/4ℤ) | A ≡ E_{n} (mod 2)} is an elementary abelian 2-group, for any n ∈ ℕ.

b) As T(S\overline{k}, ℤ_{2}) ⊂ H_{ét}^{2}(S\overline{k}, ℤ_{2}(1)) has no cotorsion, the natural homomorphism T(S\overline{k}, ℤ_{2})/4 T(S\overline{k}, ℤ_{2}) ↪ H_{ét}^{2}(S\overline{k}, μ_{4}) is injective. Moreover, by virtue of the smooth specialisation theorem [SGA4, Exposé XVI, Corollaire 2.3], the splitting field of H_{ét}^{2}(S\overline{k}, μ_{4}) is known to be unramified at any prime of k of odd residue characteristic, at which S has good reduction. □

Corollary 3.10. Let S be a K3 surface as in 2.1, over k = ℚ. Suppose that l_{1}, …, l_{6} are defined over ℚ. Then, for an odd prime p of good reduction, the action of the Frobenius Frob_{p} on T(S\overline{ℚ} , ℤ_{2})/4 T(S\overline{ℚ} , ℤ_{2}) is completely determined by the class of Frob_{p} in the Galois group of the number field

K = ℚ(\sqrt{−1}, \sqrt{2}, \sqrt{d} | d a bad prime for S) .

Proof. This is the particular case of Corollary 3.9, for k = ℚ. □

The action of Sym(6) on T(S\overline{k}, ℤ_{2})/2 T(S\overline{k}, ℤ_{2}) in the case that rk Pic(S\overline{k}) = 16.

Notation. In the remainder of this section, a double index is meant to be an unordered pair. E.g., a_{ij} = a_{ji}. In particular, we write e_{ij}, but also e_{ji}, for the exceptional curve on B\overline{k} that lies over the point of intersection V(l_{i})∩V(l_{j}), for i ≠ j, 1 ≤ i, j ≤ 6.

Lemma 3.11. Let k be a field of characteristic not 2 and S a K3 surface over k as in 2.1. Suppose that rk Pic(S\overline{k}) = 16. a.i) Then Pic(S\overline{k}) ⊃ ℤπ^{∗}[l] ⊕ ℤπ^{∗}[e_{12}] ⊕ ⋯ ⊕ ℤπ^{∗}[e_{56}] is a sublattice of full rank. ii) There are further divisor classes [D_{1}], …, [D_{6}] ∈ Pic(S\overline{k}) such that

2[D_{i}] = π^{∗}[l] + ∑_{{j=1,...,6, \atop j≠i}}π^{∗}[e_{ij}] .  (11)

The classes [D_{1}], …, [D_{6}] generate Pic(S\overline{k}), together with π^{∗}[l], π^{∗}[e_{12}], …, π^{∗}[e_{56}].

b) Put

M := {aπ^{∗}[l] + a_{12}π^{∗}[e_{12}] + ⋯ + a_{56}π^{∗}[e_{56}] ∈ 𝔽_{2}π^{∗}[l] ⊕ 𝔽_{2}π^{∗}[e_{12}] ⊕ ⋯ ⊕ 𝔽_{2}π^{∗}[e_{56}]

| a + ∑_{{j=1,...,6, \atop j≠i}}a_{ij} = 0, for i = 1, …, 6\} .

Then there is a natural isomorphism

Br(S\overline{k})_{2} ≅ M/⟨π^{∗}[l] + ∑_{{j=1,...,6, \atop j≠i}}π^{∗}[e_{ij}] | i = 1, …, 6⟩ .  (12)

Proof. One has Pic(B\overline{k}) = ℤ[l] ⊕ ℤ[e_{12}] ⊕ ⋯ ⊕ ℤ[e_{56}], the direct sum being orthogonal. Moreover, [l]·[l] = 1 and [e_{ij}]·[e_{ij}] = −1, for 1 ≤ i < j ≤ 6. As π\overline{k}: S\overline{k} → B\overline{k} is finite of degree 2, this yields that π^{∗}[l], π^{∗}[e_{12}], …, π^{∗}[e_{56}] ∈ Pic(S\overline{k}) are mutually perpendicular, with π^{∗}[l]·π^{∗}[l] = 2 and π^{∗}[e_{ij}]·π^{∗}[e_{ij}] = −2. From this, a.i) immediately follows. Consequently, one has ℚπ^{∗}[l] ⊕ ℚπ^{∗}[e_{12}] ⊕ ⋯ ⊕ ℚπ^{∗}[e_{56}] ⊃ Pic(S\overline{k}). As the intersection numbers with the base elements have to be integers, the coefficients are in fact half integral, at most.

Furthermore, over the strict transform of the quintic V(l_{2} ⋯ l_{6} − l_{1}^{5}) ⊂ P2 ; \overline{k}, the double cover π\overline{k}: S\overline{k} → B\overline{k} splits, since the equation of the surface goes over into w^{2} = l_{1}^{6} [EJ18, Remark 4.6]. This yields a divisor D ∈ Div(S\overline{k}) such that π_{∗}[D] = 5[l] + [e_{12}] + [e_{13}] + [e_{14}] + [e_{15}] + [e_{16}]. One may put [D_{1}] := [D] − 2π^{∗}[l] in order to fulfil (11). The divisor classes [D_{2}], …, [D_{6}] are constructed analogously. Thus, there is an inclusion

Pic(B\overline{k}) ⊇ (ℤ[l] ⊕ ℤ[e_{12}] ⊕ ⋯ ⊕ ℤ[e_{56}]) + [D_{1}] + ⋯ + [D_{6}] ,  (13)

and in order to complete the proof of a), it needs to be shown that equality holds.

On the other hand, one has M = Pic(B\overline{k})^{even}/π_{∗}(ℤπ^{∗}[l]⊕ℤπ^{∗}[e_{12}]⊕⋯⊕ℤπ^{∗}[e_{56}]) . Hence, by Theorem 3.7, there is actually a natural surjection

Br(S\overline{k})_{2} ↠ M/⟨π^{∗}[l] + ∑_{{j=1,...,6, \atop j≠i}}π^{∗}[e_{ij}] | i = 1, …, 6⟩  (14)

that is a bijection if and only if equality holds in (13). But an explicit calculation reveals that the right hand side of (14) is of order 64, M being of order 2048. As, by Theorem 3.5, Br(S\overline{k})_{2} is of order 64, too, this proves both, a) and b). □

Theorem 3.12. Let k be a field of characteristic not 2 and S a K3 surface over k as in 2.1. Suppose that rk Pic(S\overline{k}) = 16. a.i) Then the group Sym(6) permuting the six branch lines naturally acts on the sublattice of Pic(S\overline{k}) described in Lemma 3.11.a.i) by

σ(π^{∗}[l]) = π^{∗}[l]  and  σ(π^{∗}[e_{ij}]) = π^{∗}[e_{σ(i)σ(j)}] .

ii) The action on Br(S\overline{k})_{2} is as follows. There is an 𝔽_{2}-basis (b_{1}, …, b_{6}) of Br(S\overline{k})_{2} such that

σ(b_{i}) = \{ \begin{matrix}b_{σ̃(i)} , & if σ ∈ Alt(6) , \\ b_{σ̃(i)} + c , & if σ ∉ Alt(6) , \end{matrix}

for c := b_{1} + ⋯ + b_{6}. Here, Sym(6) → Sym(6), σ ↦ σ̃, is an outer automorphism.

b) The natural Gal(\overline{k}/k)-actions on Pic(S\overline{k}) and Br(S\overline{k})_{2} are the compositions of the natural Gal(\overline{k}/k)-action on the six branch lines with the actions described in a).

Proof. a.i) and b) are clear. a.ii) One puts b_{6} := \overline{π^{∗}[e_{12}] + π^{∗}[e_{23}] + π^{∗}[e_{34}] + π^{∗}[e_{45}] + π^{∗}[e_{15}]} ∈ Br(S\overline{k})_{2}. Note that indeed π^{∗}[e_{12}] + π^{∗}[e_{23}] + π^{∗}[e_{34}] + π^{∗}[e_{45}] + π^{∗}[e_{15}] ∈ M, so that this is a correct definition.

It is clear that b_{6} is stabilised by a dihedral group of order ten, permuting only {1, …, 5}. Moreover, applying the relations in (12), for i = 1 and 4, one finds that b_{6} = \overline{π^{∗}[e_{13}] + π^{∗}[e_{23}] + π^{∗}[e_{24}] + π^{∗}[e_{46}] + π^{∗}[e_{16}]}, too. Hence, the stabiliser of b_{6} is a 2-transitive subgroup of Sym(6), of order a multiple of 60.

A machine calculation shows that the orbit of b_{6} under Sym(6) is indeed of size twelve, so that the stabiliser of b_{6} is Alt(5), transitively embedded into Sym(6) [DM, Table 2.1]. Furthermore, the orbit {b_{1}, …, b_{6}} of b_{6} under Alt(6) ⊂ Sym(6) turns out to be 𝔽_{2}-linearly independent.

The orbit under Sym(6) is, in fact, {b_{1}, …, b_{6}, b_{1} + c, …, b_{6} + c}. Moreover, c ∈ Br(S\overline{k})_{2}\\{0\} is the unique Alt(6)-invariant element, and hence Sym(6)-invariant. Consequently, the stabiliser of the class \overline{b}_{6} ∈ Br(S\overline{k})_{2}/⟨c⟩ is 2-transitive of order 120, and thus Sym(5), transitively embedded into Sym(6). This shows that indeed the classes \overline{b}_{1}, …, \overline{b}_{6} ∈ Br(S\overline{k})_{2}/⟨c⟩ are permuted according to an outer automorphism of the group Sym(6) [Wi, Subsection 2.4.2], which completes the proof. □

4. A theorem on the 2-adic orthogonal group

The main theorem. 2-adic overdetermination of the trace.

Theorem 4.1. Let n ∈ ℕ. With respect to a non-degenerate, symmetric bilinear form on ℚ_{2}^{n}, let U_{1}, U_{2} ∈ M_{n×n}(ℤ_{2}) be orthogonal matrices such that

U_{1} ≡ U_{2} (mod 4) .

a) If U_{1} ≡ E_{n} (mod 2) then Tr(U_{1}) ≡ Tr(U_{2}) (mod 16).

b) If U_{1}^{2} ≡ E_{n} (mod 2) then Tr(U_{1}) ≡ Tr(U_{2}) (mod 8).

Proof. One has det(U_{1}) = ±1, since U_{1} is orthogonal. Hence, U_{1}^{−1} ∈ M_{n×n}(ℤ_{2}). The congruence U_{1} ≡ U_{2} (mod 4) therefore implies that U_{1}^{−1}U_{2} ≡ E_{n} (mod 4). I.e., there exists a matrix B ∈ M_{n×n}(ℤ_{2}) such that

U_{2} = U_{1}(E_{n} + 4B) .

Moreover, det(E_{n} + 4B) = det(U_{1}^{−1}U_{2}) = 1, hence the linear approximation of det near the unit matrix yields 1 = det(E_{n} + 4B) ≡ det(E_{n}) + 4 Tr(B) (mod 16). I.e.,

Tr(B) ≡ 0 (mod 4) .  (15)

a) Writing U_{1} = E_{n} + 2A, one finds

Tr(U_{2}) = Tr((E_{n} + 2A)·(E_{n} + 4B)) = Tr(E_{n} + 2A) + 4 Tr(B) + 8 Tr(AB)
≡ Tr(U_{1}) + 8 Tr(AB) (mod 16) .

Finally, one has Tr(AB) ≡ 0 (mod 2), due to Theorem 4.2.a), below.

b) Analogously, writing U_{1} = E_{n} + A, one sees

Tr(U_{2}) = Tr((E_{n} + A)·(E_{n} + 4B)) = Tr(U_{1}) + 4 Tr(B) + 4 Tr(AB) ,

so that the assertion follows from (15) and Theorem 4.2.b). □

2-adic divisibility of traces.

Theorem 4.2. For n ∈ ℕ, let b be a non-degenerate, symmetric bilinear form on ℚ_{2}^{n}.

a) Let A, B ∈ M_{n×n}(ℤ_{2}) be such that E_{n} + 2A and E_{n} + 4B are orthogonal with respect to b. Then Tr(AB) ≡ 0 (mod 2).

b) Let A, B ∈ M_{n×n}(ℤ_{2}) be such that E_{n} + A and E_{n} + 4B are orthogonal with respect to b and (E_{n} + A)^{2} ≡ E_{n} (mod 2). Then Tr(AB) ≡ 0 (mod 2).

A more natural formulation, not explicitly considering matrices, goes as follows.

Theorem 4.3. Let Γ be a ℤ_{2}-lattice and φ, ψ: Γ → Γ orthogonal endomorphisms. a) If (φ mod 2) acts trivially on Γ/2Γ and (ψ mod 4) acts trivially on Γ/4Γ then Tr((φ − id)∘(ψ − id)) ≡ 0 (mod 16).

b) If (φ ∘ φ mod 2) acts trivially on Γ/2Γ and (ψ mod 4) acts trivially on Γ/4Γ then Tr((φ − id)∘(ψ − id)) ≡ 0 (mod 8).

4.4 (Structure of the proof). The proof of Theorem 4.3 is organised as follows.

i) We directly check the analogue of Theorem 4.3 for regular ℤ_{2}[\sqrt{2}]-lattices. ii) We show Theorem 4.3 in a particular case, in which the discriminant of b has a small 2-adic valuation. The idea is to construct a ℤ_{2}[\sqrt{2}]-lattice Γ̃ ⊇ Γ⊗_{ℤ_{2}} ℤ_{2}[\sqrt{2}] such that b is regular on Γ̃. We check that all relevant properties of the endomorphisms φ and ψ are preserved under this change of lattices. iii) For the general case, the idea is as follows. By inspection of the dual lattice Γ^{∨}, we show that the endomorphisms φ and ψ respect various other lattices, as well. We choose one rather particular such lattice Γ′ ⊂ Γ⊗_{ℤ_{2}} ℚ_{2} , thereby making sure that the discriminant of b on Γ′ has a 2-adic valuation sufficiently small, so that ii) applies.

Remarks 4.5. a) For the concept of an 𝒪-lattice, in general, recall the terminology and notation fixed in the introduction.

b) The ring 𝒪 = ℤ_{2}[\sqrt{2}] is a principal ideal domain, in fact a discrete valuation ring. In particular, every finitely generated 𝒪 = ℤ_{2}[\sqrt{2}] -module that is projective or only torsion-free is automatically free.

c) There is a more elementary proof for Theorem 4.3 that avoids ℤ_{2}[\sqrt{2}]-lattices at the cost of a more complicated case distinction.

First step of the proof – A variant for regular lattices over discrete valuation rings.

Proposition 4.6. Let 𝒪 be a discrete valuation ring, in which 2 ≠ 0 is not a unit, Γ a regular 𝒪 -lattice, and φ, ψ: Γ → Γ orthogonal endomorphisms.

a) If (φ mod 2) acts trivially on Γ/2Γ and (ψ mod 4) acts trivially on Γ/4Γ then Tr((φ − id)∘(ψ − id)) ≡ 0 (mod 16).

b) If (φ ∘ φ mod 2) acts trivially on Γ/2Γ and (ψ mod 4) acts trivially on Γ/4Γ then Tr((φ − id)∘(ψ − id)) ≡ 0 (mod 8).

Proof. Choose a basis for Γ and denote the rank of Γ by n. The bilinear form on Γ is then given by a symmetric n × n matrix M. Thanks to the regularity assumption, one has M ∈ GL_{n}(𝒪) . Moreover, the matrix representing ψ can be written as E_{n} + 4B, for some B ∈ M_{n×n}(𝒪) . By Lemma 4.7.b), MB is symmetric modulo 2 all diagonal coefficients being divisible by 2.

a) Here, the matrix representing φ is E_{n}+2A, for a certain A ∈ M_{n×n}(𝒪) . Thus, the assertion follows from Lemmas 4.7.a) and 4.8, below.

b) Let A ∈ M_{n×n}(𝒪) be the matrix representing φ−id. The fact that φ is orthogonal is then equivalent to

A^{⊤}M + MA + A^{⊤}MA = 0 ,  (16)

which implies

A^{⊤}MA + MA^{2} + A^{⊤}MA^{2} = 0 .

On the other hand, the assumption (E_{n}+A)^{2} ≡ E_{n} (mod 2) yields A^{2} ≡ 0 (mod 2), so that one has A^{⊤}MA ≡ 0 (mod 2). Therefore, formula (16), together with the fact that M is symmetric, yields that MA is symmetric modulo 2. To summarise, it is proved that Lemma 4.8 is applicable, which shows that Tr(AB) is divisible by 2.

□

Lemma 4.7. Let 𝒪 be a discrete valuation ring, in which 2 ≠ 0 is not a unit, and M ∈ GL_{n}(𝒪) a symmetric matrix.

a) Let C ∈ M_{n×n}(𝒪) be such that E_{n}+2C is orthogonal with respect to M. Then the reduction modulo 2 of MC is symmetric.

b) Let C ∈ M_{n×n}(𝒪) be such that E_{n}+4C is orthogonal with respect to M. Then the reduction modulo 2 of MC is symmetric. Furthermore, every diagonal coefficient of MC is divisible by 2.

Proof. a) The orthogonality condition explicitly reads

C^{⊤}M + MC + 2C^{⊤}MC = 0 .  (17)

Moreover, as M is symmetric, we have C^{⊤}M = (MC)^{⊤}. Thus, (17) implies that MC ≡ (MC)^{⊤} (mod 2), which shows a).

b) Here, orthogonality means C^{⊤}M + MC + 4C^{⊤}MC = 0. Moreover, once again, we have C^{⊤}M = (MC)^{⊤}, so that MC ≡ −(MC)^{⊤} (mod 4) follows. This proves both conclusions of b). □

Lemma 4.8. Let 𝒪 be a discrete valuation ring, in which 2 ≠ 0 is not a unit, M ∈ GL_{n}(𝒪) symmetric, and A, B ∈ M_{n×n}(𝒪) such that MA ≡ (MA)^{⊤} (mod 2), MB ≡ (MB)^{⊤} (mod 2), and all diagonal coefficients of MB are divisible by 2. Then Tr(AB) is divisible by 2. Proof. Writing U := AM^{−1} and V := MB, one has

Tr(AB) = Tr(AM^{−1}MB) = Tr(UV) = ∑_{i,j} u_{ij}v_{ji} .  (18)

Here, U = M^{−1}MAM^{−1} is symmetric modulo 2, since both, MA and M^{−1}, are. Furthermore, V = MB is symmetric modulo 2, by assumption.

Therefore, in (18), the summands for the indices (i, j) and (j, i) coincide modulo 2, so that the sum of each pair is divisible by 2. Finally, the summands for i = j are divisible by 2, as the diagonal coefficients v_{ii} of V are. □

Second step of the proof – Generalities on ℤ_{2}-lattices.

Proposition 4.9 (Decomposition of ℤ_{2}-lattices). Let (Γ, b) be a ℤ_{2}-lattice. Then there is a decomposition Γ = ⨁_{i=0}^{N} Γ_{i} into an orthogonal direct sum of the kind that

b = ⨁_{i=0}^{N} 2^{i}b_{i} ,  (19)

for regular symmetric bilinear forms b_{0}, …, b_{N} on Γ_{0}, …, Γ_{N}, respectively. Proof. See [CS, Chapter 15, Theorem 2] or [Kn, Satz 15.1]. It is, in fact, shown that, for each i, the lattice Γ_{i} may be decomposed further into an orthogonal direct sum of only 1- and 2-dimensional lattices. □

Definition 4.10. Let (Γ, b) be a ℤ_{2}-lattice. Then, by the dual lattice, we mean

Γ^{∨} := {x ∈ Γ⊗_{ℤ_{2}} ℚ_{2} | b(x, Γ) ⊆ ℤ_{2}} .

Here, the ℚ_{2}-bilinear extension of b: Γ × Γ → ℤ_{2} to Γ⊗_{ℤ_{2}} ℚ_{2} is again denoted by b.

Example 4.11. A decomposition Γ = ⨁_{i=0}^{N} Γ_{i} as above, with b = ⨁_{i=0}^{N} 2^{i}b_{i}, yields

Γ^{∨} = ⨁_{i=0}^{N} 2^{−i}Γ_{i} .

Indeed, for each i, the lattice (Γ_{i}, b_{i}) is regular.

Lemma 4.12. Let Γ be a ℤ_{2}-lattice and φ: Γ → Γ an orthogonal map. Denote the ℚ_{2}-linear extension of φ to Γ⊗_{ℤ_{2}} ℚ_{2} again by φ. Then φ(Γ^{∨}) = Γ^{∨}. Proof. We have

x ∈ Γ^{∨} ⇔ b(x, Γ) ⊆ ℤ_{2} ⇔ b(φ(x), φ(Γ)) ⊆ ℤ_{2} ⇔ b(φ(x), Γ) ⊆ ℤ_{2} ⇔ φ(x) ∈ Γ^{∨} . □

Lemma 4.13. Let Γ be a ℤ_{2}-lattice and φ: Γ → Γ an orthogonal endomorphism. Moreover, let Γ = ⨁_{i=0}^{N} Γ_{i}, with b = ⨁_{i=0}^{N} 2^{i}b_{i}, be a decomposition as above and let ℬ be a basis of Γ obtained by concatenating bases of Γ_{0}, …, Γ_{N}. Finally, put

D = (D_{ij})_{i,j=0,...,N} := M_{ℬ}^{ℬ} (φ) ,

so that, for i, j = 0, …, N, the block D_{ij} represents an element of Hom(Γ_{j}, Γ_{i}).

a) Then, for i, j = 0, …, N, one has ν_{2}(D_{ij}) ≥ j − i.

b) Let e ∈ ℕ and suppose, in addition, that φ acts trivially on the quotient Γ/2^{e}Γ. Then ν_{2}(D_{ij}) ≥ j − i + e, for i ≠ j, i, j = 0, …, N.

Proof. a) As φ maps Γ onto itself, by Lemma 4.12, it does the same to the dual lattice Γ^{∨} = ⨁_{i=0}^{N} 2^{−i}Γ_{i}. This shows that ν_{2}(D_{ij}) ≥ j − i, for j > i. Note that the assertion is trivial in the case that j ≤ i.

b) By assumption, φ maps the lattices Γ and 2^{e}Γ onto themselves. Furthermore, the action induced on the quotient Γ/2^{e}Γ is assumed to be trivial. Consequently, φ maps every lattice Δ of the kind that 2^{e}Γ ⊆ Δ ⊆ Γ onto itself.

We apply this observation to the lattices, given by

Δ_{j} := ( ⨁_{{i=0,...,N \atop i≠j}}Γ_{i}) ⊕ 2^{e}Γ_{j} ,

for j = 0, …, N. As φ maps Δ_{j} onto itself, the same is true for Δ_{j}^{∨}. Noticing that

Δ_{j}^{∨} = ( ⨁_{{i=0,...,N \atop i≠j}}2^{−i}Γ_{i}) ⊕ 2^{−j−e}Γ_{j} ,

this yields ν_{2}(D_{ij}) ≥ j − i + e, for j ≠ i. Indeed, one has that φ(2^{−j−e}Γ_{j}) ⊆ Δ_{j}^{∨}. □

Remark 4.14. An alternative proof for b) may be given as follows. As φ acts trivially on Γ/2^{e}Γ, the adjoint map acts trivially on Γ^{∨}/2^{e}Γ^{∨}. As the adjoint coincides with the inverse of φ, the map being orthogonal, one may conclude that φ acts trivially on Γ^{∨}/2^{e}Γ^{∨}, as well. This implies the divisibility ν_{2}(D_{ij}) ≥ j − i + e, for i ≠ j.

Third step of the proof – A particular case.

Proposition 4.15. Let (Γ_{0}, b_{0}) and (Γ_{1}, b_{1}) be regular ℤ_{2}-lattices. Equip the direct sum Γ := Γ_{0} ⊕Γ_{1} with the symmetric bilinear form b := b_{0} ⊕2b_{1}. Then Theorem 4.3 holds for Γ. Proof. Let us first note that the ℤ_{2}[\sqrt{2}]-lattice

Γ̃ := (Γ_{0}⊗_{ℤ_{2}} ℤ_{2}[\sqrt{2}]) ⊕ \frac{1}{2} \sqrt{2} (Γ_{1}⊗_{ℤ_{2}} ℤ_{2}[\sqrt{2}])  (20)
⊂ Γ⊗_{ℤ_{2}} ℚ_{2}[\sqrt{2}] ,

equipped with the bilinear form induced by b, is regular.

a) By assumption, φ, ψ: Γ → Γ are orthogonal maps acting trivially on Γ/2Γ and Γ/4Γ, respectively. Then Lemma 4.16 shows that the induced maps φ̃, ψ: Γ̃ → Γ̃ are again orthogonal, that (φ̃ mod 2) acts trivially on Γ̃/2Γ̃, and that (ψ mod 2) acts trivially on Γ̃/4Γ̃. By Proposition 4.6.a), this implies that

Tr((φ̃ − id)∘(ψ − id)) ∈ 16ℤ_{2}[\sqrt{2}] .

Since φ̃ and ψ are obtained from φ and ψ only by base extension, one has Tr((φ − id)∘(ψ − id)) ∈ 16ℤ_{2}[\sqrt{2}], too. But the latter trace is automatically in ℤ_{2}, so that the assertion follows. The proof of b) works along the same lines. □

Lemma 4.16. Let (Γ_{0}, b_{0}) and (Γ_{1}, b_{1}) be regular ℤ_{2}-lattices. Equip Γ := Γ_{0} ⊕ Γ_{1} with the bilinear form b := b_{0} ⊕ 2b_{1} and let Γ̃ be the ℤ_{2}[\sqrt{2}]-lattice, defined by (20). Moreover, let φ: Γ → Γ be an orthogonal map, and write φ̃: Γ̃ → Γ⊗_{ℤ_{2}} ℚ_{2}[\sqrt{2}] for the map induced by φ.

a) Then φ̃ actually sends Γ̃ onto itself.

b) Moreover, φ̃: Γ̃ → Γ̃ is an orthogonal map.

c) Let e ∈ ℕ. If (φ mod 2^{e}) acts trivially on Γ/2^{e}Γ then (φ̃ mod 2^{e}) acts trivially on Γ̃/2^{e}Γ̃.

Proof. b) is clear from the construction of φ̃, once the assertion of a) is established. a) and c) Let ℬ be a basis of Γ as in Lemma 4.13 and put ({C_{00} C_{01} \atop C_{10} C_{11}} ) := M_{ℬ}^{ℬ} (φ − id). The blocks C_{ij} are then matrices with coefficients in ℤ_{2}. One even has ν_{2}(C_{ij}) ≥ e, for 0 ≤ i, j ≤ 1, under the assumption of c).

Multiplying the basis vectors of Γ_{1} by \sqrt[\frac{1}{2}]{2}, one finds a basis ℬ̃ of Γ̃, for which

Mℬ̃ ; ℬ̃(φ̃ − id) = ( \begin{matrix}C_{00} & \frac{1}{2} \sqrt{2}C_{01} \\ \sqrt{2}C_{10} & C_{11} \end{matrix} ) .

Thus, in order to prove the assertions, only ν_{2}(C_{01}) ≥ 1 and ν_{2}(C_{01}) ≥ e + 1, respectively, need to be verified. Both claims are true, due to Lemma 4.13. □

Completion of the proof.

Lemma 4.17 (Change of lattice). Let Γ be an arbitrary ℤ_{2}-lattice and Γ = ⨁_{i=0}^{N} Γ_{i} a decomposition as above. Furthermore, let φ: Γ → Γ be an orthogonal map.

a) Then φ maps the lattice Γ′ := ⨁_{i=0}^{N} Γ′_{i}, for

Γ′_{i} := 2^{−⌊\frac{i}{2}⌋}Γ_{i} ,

onto itself, as well.

b) Let e ∈ ℕ and suppose that φ acts trivially on Γ/2^{e}Γ. Then φ acts trivially on the quotient Γ′/2^{e}Γ′.

Proof. Let ℬ be a basis of Γ as in Lemma 4.13. Then there is a basis ℬ′ of Γ′ given by scaling the basis vectors of Γ_{i} by 2^{−⌊\frac{i}{2}⌋}, for i = 0, …, N. The matrix

C′ = (C′_{ij})_{i,j=0,...,N} := M_{ℬ′}^{ℬ′} (φ − id)

is then constructed out of the matrix (C_{ij})_{i,j=0,...,N} = M_{ℬ}^{ℬ} (φ − id) by putting C′_{ij} := 2^{⌊^{\frac{i}{2}}⌋−⌊\frac{j}{2}⌋}C_{ij}, for i, j = 0, …, N. This translates the claims into certain inequalities for ν_{2}(C_{ij}).

a) The assertion means that ν_{2}(C′_{ij}) ≥ 0, for i, j = 0, …, N, which is equivalent to ν_{2}(C_{ij}) ≥ ⌊\frac{j}{2}⌋ − ⌊\frac{i}{2}⌋. By assumption, one has ν_{2}(C_{ij}) ≥ 0, so that, for i ≥ j, there is nothing left to be shown. For i < j, the inequality ν_{2}(C_{ij}) ≥ ⌊\frac{j}{2}⌋ − ⌊\frac{i}{2}⌋ indeed holds, due to Lemma 4.13.a).

b) Here, the assertion means ν_{2}(C′_{ij}) ≥ e, for i, j = 0, …, N, and is equivalent to ν_{2}(C_{ij}) ≥ e + ⌊\frac{j}{2}⌋ − ⌊\frac{i}{2}⌋. As ν_{2}(C_{ij}) ≥ e holds by assumption, the case that i ≥ j does not need any further consideration. Moreover, for i < j, the assertion follows from Lemma 4.13.b). □

Proof of Theorem 4.3. Let Γ be any ℤ_{2}-lattice. In order to prove that Theorem 4.3 holds for Γ, by Lemma 4.17, it suffices to show that exactly the same statement holds for the ℤ_{2}-lattice Γ′. To actually treat Γ′, note that, by construction, the bilinear form b′ on Γ′ is of the form b′_{0} ⊕ 2b′_{1} ⊕ b′_{2} ⊕ 2b′_{2} ⊕ ⋯ ⊕ 2^{N−2⌊ \frac{N}{2} ⌋}b′_{N}, for regular ℤ_{2}-lattices (Γ′_{0}, b′_{0}), …, (Γ′_{N}, b′_{N}). Thus, Γ′ allows a decomposition Γ′ = Γ′′_{0} ⊕ Γ′′_{1} with b′ = b′′_{0} ⊕ 2b′′_{1}, for regular lattices (Γ′′_{0}, b′′_{0}) and (Γ′′_{1}, b′′_{1}). But for exactly this particular case, the assertion of Theorem 4.3 is established by Proposition 4.15. □

5. The point counting algorithm

Input. i) Let a scheme S′ be given that is presented as a double cover of P_{ℤ}^{2} branched over the union of six lines, each of which is defined over Spec ℤ. Suppose that no three of these lines have a ℚ-rational point in common, and let S be the blowing-up of S′ in the Zariski closure, equipped with the induced reduced scheme structure, of the singular locus of the generic fibre S′_{ℚ} . Suppose that Pic(S\overline{ℚ} ) is a trivial Gal(\overline{ℚ} /ℚ) -module in the case that rk Pic(S\overline{ℚ} ) ≥ 16, as well. ii) Moreover, let a bound B be given. Then the algorithm below computes #S(𝔽_{p}), for all good primes p < B of S.

Algorithm 5.1. A) Initialisation.

i) Calculate the odd primes p_{1}, …, p_{b}, at which S has bad reduction. In terms of these, declare the map

ϱ: ℙ\\{2, p_{1}, …, p_{b}\} → \{±1\}^{b+2} , p ↦ ((\frac{−1}{p}), (\frac{2}{p}), (\frac{p_{1}}{p}), …, (\frac{p_{b}}{p})) .

ii) For each σ ∈ {±1}^{b+2}, run through ℙ\{2, p_{1}, …, p_{b}} from below, until a prime l_{σ} is found of the kind that ϱ(l_{σ}) = σ. Then count #S(𝔽_{l_{σ}}) by a naive method. From the point count, derive (Tr(Frob_{l_{σ}}: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2})) mod 16) using the Lefschetz trace formula (8) and store this value in a table.

Remark 5.2. As the action of Gal(\overline{ℚ} /ℚ) on Pic(S\overline{ℚ} )⊗_{ℤ} ℚ is known to be trivial, formula (8) allows, of course, to calculate Tr(Frob_{l_{σ}}: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2})) from #S(𝔽_{l_{σ}}) exactly. But only the residue class modulo 16 is of importance. Which is exactly the information that is stored.

Indeed, let p be a possibly large prime. Then, the value σ = ϱ(p) ∈ {±1}^{b+2} completely determines the action of Frob_{p} on T(S\overline{ℚ} , ℤ_{2})/4 T(S\overline{ℚ} , ℤ_{2}) , according to Corollary 3.10. I.e., the action of Frob_{p} coincides with that of Frob_{l_{σ}}. Furthermore, by Theorem 4.1.a), this is enough to fix the trace modulo 16 on T(S\overline{ℚ} , ℤ_{2}). I.e.,

Tr(Frob_{p}: T(S\overline{ℚ} , ℤ_{2})→T(S\overline{ℚ} , ℤ_{2})) ≡ Tr(Frob_{l_{σ}}: T(S\overline{ℚ} , ℤ_{2})→T(S\overline{ℚ} , ℤ_{2})) (mod 16) ,

the residue class on the right hand side being the one that was stored. Cf. part B) of the algorithm.

Remark 5.3. The calculation of the bad primes in step A.i) involves the factorisation of a discriminant. A failure in this step would prevent the algorithm from proceeding. In our present implementation, this does not present any difficulty, as the discriminant for the family of double covers of P^{2} branched over six lines is highly reducible [Yo, Def. 7.7 and Lemma 7.8], cf. Remark 2.4.b). Step A.i) might, however, become an issue when trying to carry over the algorithm to other types of surfaces. This may concern other families of K3 surfaces, already.

5.4. The initialisation as described above ignores the group structure. It determines (Tr(σ: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2})) mod 16) individually, for every element of Gal(K/ℚ), where K := ℚ(\sqrt{−1}, \sqrt{2}, \sqrt{p_{1}}, …, \sqrt{p_{b}}) . The number of these elements is exponential in the number b of odd bad primes.

A more efficient approach is as follows. To simplify notation, put p_{−1} := −1 and p_{0} := 2. Moreover, let σ_{−1}, σ_{0}, σ_{1}, …, σ_{b} ∈ Gal(K/ℚ) be the standard generators. I.e.,

σ_{i}(\sqrt{p_{j}}) = \begin{cases}\sqrt{p_{j}} , & if j ≠ i, j ∈ \{−1, 0, 1, …, b\} , \\ −\sqrt{p_{j}} , & if j = i , \end{cases}

for i ∈ {−1, 0, 1, …, b}. Every element σ ∈ Gal(K/ℚ) may then uniquely be described by some sequence s ∈ {0, 1}^{b+2}, indexed from (−1) to b,

σ = σ_{−1}^{s_{−1}}σ_{0}^{s_{0}}σ_{1}^{s_{1}} ⋯ σ_{b}^{s_{b}} .

Or, σ = ∏_{i∈M_{s}}σ_{i}, for M_{s} := {i ∈ {−1, …, b} | s_{i} = 1}.

With respect to a basis of T(S\overline{ℚ} , ℤ_{2}), each generator σ_{i} ∈ Gal(K/ℚ) yields a matrix E_{n}+2A_{i}, with A_{i} ∈ M_{n×n}(ℤ_{2}), encoding the action on T(S\overline{ℚ} , ℤ_{2}). A product σ_{−1}^{s_{−1}} ⋯ σ_{b}^{s_{b}} then corresponds to the matrix

(E_{n} + 2A_{−1})^{s_{−1}} ⋯ (E_{n} + 2A_{b})^{s_{b}} ,

the trace of which modulo 16 is given by

Tr((E_{n} + 2A_{−1})^{s_{−1}} ⋯ (E_{n} + 2A_{b})^{s_{b}}) ≡ n + 2 ∑_{i∈M_{s}} Tr(A_{i}) + 4 ∑_{{i,j∈Ms, \atop i<i′}}Tr(A_{i}A_{i′})
+ 8 ∑_{{i,i′,i′′∈Ms, \atop i<i′<i′′}}Tr(A_{i}A_{i′}A_{i′′}) (mod 16) . (21)

Based on (21), the traces modulo 8 of all matrices A_{i}, together with the traces modulo 4 of all products A_{i}A_{i′} and the traces modulo 2 of all triple products A_{i}A_{i′}A_{i′′}, can be determined efficiently by solving a system of linear congruences. This can be described as an algorithm as follows.

Algorithm (continued). A’) Initialisation. A more efficient approach – First step. Let l run through ℙ\{2, p_{1}, …, p_{b}} from below. Each time, do the following.

i) Compute ϱ(l). I.e., determine a presentation of Frob_{l} ∈ Gal(K/ℚ) as a product σ_{−1}^{s_{−1}} ⋯ σ_{b}^{s_{b}} of some of the standard generators. ii) Count #S(𝔽_{l}) by a naive method. Derive

(Tr((E_{n} + 2A_{−1})^{s_{−1}} ⋯ (E_{n} + 2A_{b}))^{s_{b}} mod 16) =
(Tr(Frob_{l}: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2})) mod 16)

from this value using the Lefschetz trace formula (8). iii) According to formula (21) above, write down a linear congruence involving all Tr(A_{i}), Tr(A_{i}A_{i′}), and Tr(A_{i}A_{i′}A_{i′′}), for −1 ≤ i ≤ b, −1 ≤ i < i′ ≤ b, and −1 ≤ i < i′ < i′′ ≤ b, respectively. Add this congruence to the system of congruences already obtained. iv) Check whether the system of linear congruences obtained for (Tr(A_{i}) mod 8), (Tr(A_{i}A_{i′}) mod 4), and (Tr(A_{i}A_{i′}A_{i′′}) mod 2), for −1 ≤ i ≤ b, −1 ≤ i < i′ ≤ b, and −1 ≤ i < i′ < i′′ ≤ b, respectively, is uniquely solvable. If this is the case then compute the solution, store it, and terminate Step A’).

A”) Initialisation. A more efficient approach – Second step. Let s run through the elements of {0, 1}^{b+2}. Each time, determine

T(s) := (Tr((E_{n} + 2A_{−1})^{s_{−1}} ⋯ (E_{n} + 2A_{b})^{s_{b}}) mod 16)

using formula (21) and the stored values of (Tr(A_{i}) mod 8), (Tr(A_{i}A_{i′}) mod 4), and (Tr(A_{i}A_{i′}A_{i′′}) mod 2). Store the value in a table. B) Point counting. Let p run through ℙ\{2, p_{1}, …, p_{b}} from below up to B. Each time, do the following.

i) Compute s := ϱ(p), which means to the determine Frob_{p} ∈ Gal(K/ℚ). ii) Look up the corresponding value T(s) in the precomputed table. This is just (Tr(Frob_{p}: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2})) mod 16) . Applying the Lefschetz trace formula (8), calculate (#S(𝔽_{p}) mod 16) from this value. iii) Use a p-adic Harvey style algorithm [Ha] to compute (#S(𝔽_{p}) mod p) . iv) Use the Chinese remainder theorem to calculate the class (#S(𝔽_{p}) mod 16p) from (#S(𝔽_{p}) mod 16) and (#S(𝔽_{p}) mod p) .

v) Determine the unique representative of this residue class modulo 16p that is compatible with Deligne’s bound (4) for #S(𝔽_{p}) and output this number.

Remarks 5.5 (On the assumptions made on S). i) The assumptions made on the intersection points of the six lines imply that the generic fibre S_{ℚ} of S is nonsingular, i.e. a K3 surface. Moreover, as the lines are assumed to be defined over ℤ, Corollary 3.8.a) shows that the action of Gal(\overline{ℚ} /ℚ) on T(S\overline{ℚ} , ℤ_{2})/2 T(S\overline{ℚ} , ℤ_{2}) is trivial. The assumption on Pic(S\overline{ℚ} ) is automatically fulfilled if rk Pic(S\overline{ℚ} ) = 16. ii) The algorithm as described immediately carries over to other types of K3 surfaces, as soon as the actions of Gal(\overline{ℚ} /ℚ) on Pic(S\overline{ℚ} ) and T(S\overline{ℚ} , ℤ_{2})/2 T(S\overline{ℚ} , ℤ_{2}) are trivial. iii) A further generalisation is possible to K3 surfaces, for which the action of Gal(\overline{ℚ} /ℚ) on T(S\overline{ℚ} , ℤ_{2})/2 T(S\overline{ℚ} , ℤ_{2}) is trivial and that on Pic(S\overline{ℚ} ) is explicitly known. Indeed, the triviality of Pic(S\overline{ℚ} ) is only used in the references to the Lefschetz trace formula (8). iv) Finally, one might want to consider the case when both Gal(\overline{ℚ} /ℚ) -actions, that on Pic(S\overline{ℚ} ) and that on T(S\overline{ℚ} , ℤ_{2})/2 T(S\overline{ℚ} , ℤ_{2}) , are nontrivial, but explicitly known. At least when the action on T(S\overline{ℚ} , ℤ_{2})/2 T(S\overline{ℚ} , ℤ_{2}) is of exponent 2, a modification of Algorithm 5.1 is possible, which is based on Theorem 4.1.b). It may determine Tr(Frob_{p}: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2}) only modulo 8. The idea is as follows. Let the number field F be the known splitting field of T(S\overline{ℚ} , ℤ_{2})/2 T(S\overline{ℚ} , ℤ_{2}) . Then the Galois action on T(S\overline{ℚ} , ℤ_{2})/4 T(S\overline{ℚ} , ℤ_{2}) factors via Gal(K/ℚ), for K the maximal abelian extension of F of exponent 2, ramified only at the primes above 2 and the bad primes of S. This is a ray class field over F and thus, in principle, accessible to computation. Cf. Section 6 for an example.

Remark 5.6 (Initialisation). Among S_{1}, …, S_{4}, the surface S_{1} is the one having the most bad primes. There are actually six bad primes p ≠ 2. Thus, the direct initialisation requires to count the points for 256 primes. As all elements of {±1}^{8} have to be hit, the largest prime to be used would be 21 121.

The more efficient approach needs to solve a system of linear congruences in 92 variables. Thus, it requires the point count only for 92 primes. As the elements of {±1}^{8} to be hit by Frob_{p} are otherwise arbitrary, we could get by working with the primes up to 593.

Remark 5.7. Note that, in our examples, we always have 2^{b+2} ≤ 256 in comparison to B = 10^{8}. For other samples with many more bad primes, so that 2^{b} ≫ B, one might want to optimise by reversing steps A”) and B). I.e., to calculate the values T(ϱ(p)) separately for each prime.

Remark 5.8 (Practical performance). i) For each of the surfaces S_{1}, …, S_{4}, running up to B = 10^{8}, our implementation used about 20 GB of memory and between 8 and 12 hours of CPU time on one core of an Intel i7-7700 processor running at 3.6 GHz. This running time is completely dominated by the modulo p point count, for which we ran a variant of a Harvey style algorithm in p-adic precision 1 with remainder tree implemented for this particular project. Note that our implementation is in magma, not in a compiled language. And that, presumably, some of the possible optimisations are still missing. Cf. [EJ16, Sections 3 and 4] for a description of an earlier implementation. ii) The initialisation, as described in A’) and A”), took less than one minute per surface. More precisely, for the surface S_{1}, the naive point counting had to be done for 92 primes, which took around 49 seconds. For all other steps of the initialisation together, including the linear algebra calculations, the magma profiler reports a running time of 2.5 seconds. For the surfaces S_{2}, S_{3}, and S_{4}, the initialisation runs faster by a factor of at least 10, because there are fewer bad primes. The actual modulo 16 point counting mainly required Legendre symbol computations for the slightly more than 5.7 million primes up to B = 10^{8}, which took only 23 seconds per surface. Finally, the determination of the point counts modulo 16p took 5 seconds, which are essentially accounted for the computations related to the Chinese remainder theorem.

Remark 5.9 (Point counting modulo p^{2} versus modulo p). i) p-adic point counting for a surface of the shape w^{2} = xyzf_{3}(x, y, z) requires to do the following: In order to count modulo p, one has to compute the coefficient at (xyz)^{(p−1)/2} in f_{3}^{(p−1)/2} with p-adic precision 1. In all our examples, the moving simplex approach (cf. [EJ16, Remark 4.8]) never resulted in a loss of p-adic precison. Thus, we were able to work with p-adic precision 1 during all the intermediate steps. On the other hand, for point counting modulo p^{2}, one has to compute the coefficient at (xyz)^{(p−1)/2} in f_{3}^{(p−1)/2} with p-adic precision 2 and, furthermore, the coefficient at x^{i(p−1)/2}y^{j(p−1)/2}z^{k(p−1)/2} in f_{3}^{3(p−1)/2}, for every triple (i, j, k) ∈ ℕ^{3} of odd numbers such that i + j + k = 9. Thus, instead of computing one coefficient, one has to compute eleven. Assuming that this can be done without p-adic precision loss, one can work with p-adic precision 2 during all the intermediate steps. This indicates that one has to expect an increase of the run time by at least a factor of 22. As the exponent in f_{3}^{3(p−1)/2} is increased by a factor of 3 compared to f_{3}^{(p−1)/2}, a naive implementation would slow down the process even more, in the worst case by another factor of 3. However, a better implementation using multipoint evaluation techniques [vGG, Section 10.1] might reduce this factor significantly. ii) For checking correctness, we implemented a simple p-adic point counting with p-adic precision 2 that does not use advanced techniques such as the remainder tree. This implementation took about one day of CPU time per surface, running only to B = 10^{5}. It is important to note, however, that this is not a fair comparison, since too many optimisations were missing.

Remarks 5.10 (Results). a) The main outcome of our computations are the histograms presented in [EJ21, Section 5].

b) The distribution of the traces modulo 16 relative to the elements in {±1}^{b+2}, as indicated in the table below, appears to be rather erratic.

Residue mod 16 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
S_{1}  46 0 44 0 32 0 26 0 18 0 36 0 32 0 22 0
S_{2}  0 0 7 0 0 0 7 0 0 0 9 0 0 0 9 0
S_{3}  0 20 0 0 0 28 0 0 0 4 0 0 0 12 0 0
S_{4}  8 0 2 0 0 0 4 0 0 0 2 0 0 0 0 0

Table 1. Number of elements of {±1}^{b+2} for each residue mod16

Nevertheless, there are a few more observations that should perhaps be noticed.

i) For instance, for S_{3}, it happens that (Tr(Frob_{p}: T(S\overline{ℚ} , ℤ_{2})→T(S\overline{ℚ} , ℤ_{2})) mod 16) is independent of the Legendre symbol (\frac{2}{p}). For S_{4}, it suffices to consider (\frac{6}{p}), instead of (\frac{2}{p}) and (\frac{3}{p}) individually. These, however, are the only regularities that occurred above those predicted by Corollary 3.10. ii) (Explanation of the zeroes in Table 1) For p odd, a double cover of P_{𝔽_{p}}^{2} , branched over six 𝔽_{p}-rational lines in general position, has an odd number of points, since the branch locus has. This yields that Tr(Frob_{p}: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2})) is always even in the case of geometric Picard rank 16, and odd, for geometric Picard rank 17. But more is true. One has that det(E_{n}+2A) = ±1 implies 1+2 Tr(A) ≡ ±1 (mod 4) and therefore Tr(E_{n} + 2A) ≡ n − 1 ± 1 (mod 4). This explains why, for S_{1} and S_{4}, there are equally many elements of {±1}^{b+2} leading to traces (0 mod 4) and (2 mod 4). The surfaces S_{2} and S_{3}, however, have trivial jump characters [CEJ], so that det(Frob_{p}: T(S\overline{ℚ} , ℤ_{2}) → T(S\overline{ℚ} , ℤ_{2})) = +1 , for every prime p. This explains why only traces (2 mod 4) occur for S_{2} and only traces (1 mod 4) for S_{3}. Finally, for every p ≡ 3 (mod 4), Tr(Frob_{p}: T(S_{4,\overline{ℚ}} , ℤ_{2}) → T(S_{4,\overline{ℚ}} , ℤ_{2})) = 0 holds exactly. This is the spike in [EJ21, Figure 3]. On the other hand, for p ≡ 1 (mod 4), one has det(Frob_{p}: T(S_{4,\overline{ℚ}} , ℤ_{2}) → T(S_{4,\overline{ℚ}} , ℤ_{2})) = +1 , so that only traces (2 mod 4) are allowed. The non-occurrence of traces (14 mod 16) seems to be explained only by the fact that b = 2 is very small.

6. A more advanced example – A surface with real multiplication

This section is devoted to the surface S_{5} from Example 2.2.v).

6.1 (Properties of the surface). i) This surface is [EJ21, Example 5.8]. Also, S_{5} is isomorphic to the specialisation to t = 0 of the family described in [EJ20a, Example 1.5]. In particular, rk Pic(S_{5,\overline{ℚ}} ) = 16 and S_{5}(ℂ) has real multiplication by ℚ(\sqrt{5}) . ii) The surface S′_{5,ℚ} is a double cover of P_{ℚ}^{2} , branched geometrically over six lines, any three of which do not have a geometric point in common. Two of these lines are defined over ℚ, while the other four are defined over ℚ(ζ_{5}) and permuted cyclically by Gal(ℚ(ζ_{5})/ℚ) ≅ ℤ/4ℤ. By Theorem 3.12.a.i) and b), Pic(S_{5,\overline{ℚ}} ) contains a sublattice of full rank that is a linear permutation representation of Gal(ℚ(ζ_{5})/ℚ). The underlying permutation representation has one fixed point and is otherwise the action on pairs of six objects, two of which are fixed while the others form a 4-cycle. Thus, in total, there are three orbits of size four each, one orbit of size two, and two fixed points. I.e.,

Tr(σ: Pic(S_{5,\overline{ℚ}} )⊗_{ℤ} ℚ → Pic(S_{5,\overline{ℚ}} )⊗_{ℤ} ℚ) = \begin{cases}16 , & if ord(σ) = 1 , \\ 4 , & if ord(σ) = 2 , \\ 2 , & if ord(σ) = 4 . \end{cases}  (22)

iii) For every good prime p ≡ 2, 3 (mod 5), one has

#S_{5}(𝔽_{p}) = p^{2} + 2p + 1

by [EJ20a, Lemma 6.7]. This means that Tr(Frob_{p}: T(S_{5,\overline{ℚ}} , ℤ_{2}) → T(S_{5,\overline{ℚ}} , ℤ_{2})) = 0 . iv) In other words, only the good primes p ≡ 1, 4 (mod 5) need consideration in this example. For these, according to (22) and (8), one has

#S_{5}(𝔽_{p}) = p^{2} + T_{alg}p + Tr(Frob_{p}: T(S_{5,\overline{ℚ}} , ℤ_{2}) → T(S_{5,\overline{ℚ}} , ℤ_{2}))p + 1 ,  (23)

for

T_{alg} := \begin{cases}16 , & if p ≡ 1 (mod 5) , \\ 4 , & if p ≡ 4 (mod 5) . \end{cases}

6.2 (The Gal(\overline{ℚ} /ℚ)-action on T(S_{5,\overline{ℚ}} , ℤ_{2})/2 T(S_{5,\overline{ℚ}} , ℤ_{2}) ). Theorem 3.12.a.i) and b), together with Theorem 3.5, provides an explicit description of T(S\overline{ℚ} , ℤ_{2})/2 T(S\overline{ℚ} , ℤ_{2}) as a Gal(\overline{ℚ} /ℚ) -module. The results are as follows.

i) The Gal(\overline{ℚ} /ℚ) -action on Br(S\overline{ℚ} )_{2} factors via Gal(ℚ(ζ_{5})/ℚ), which is cyclic of order four. ii) With respect to a suitable basis, the action of a generator of Gal(ℚ(ζ_{5})/ℚ) on Br(S\overline{ℚ} )_{2} is given by the matrix

( \begin{matrix}1 & 1 & 1 & 0 & 1 & 1 \\ 0 & 1 & 1 & 1 & 1 & 1 \\ 1 & 0 & 1 & 1 & 1 & 1 \\ 1 & 1 & 0 & 1 & 1 & 1 \\ 1 & 1 & 1 & 1 & 0 & 1 \\ 1 & 1 & 1 & 1 & 1 & 0 \end{matrix} ) .

Thus, the action of the element of order two is given by

( \begin{matrix}0 & 1 & 0 & 0 & 0 & 0 \\ 1 & 0 & 0 & 0 & 0 & 0 \\ 0 & 0 & 0 & 1 & 0 & 0 \\ 0 & 0 & 1 & 0 & 0 & 0 \\ 0 & 0 & 0 & 0 & 1 & 0 \\ 0 & 0 & 0 & 0 & 0 & 1 \end{matrix} ) .  (24)

iii) By Theorem 3.5, one has T(S\overline{ℚ} , ℤ_{2})/2 T(S\overline{ℚ} , ℤ_{2}) ≅ (Br(S\overline{ℚ} )_{2})^{∨} . The action on T(S\overline{ℚ} , ℤ_{2})/2 T(S\overline{ℚ} , ℤ_{2}) is therefore provided by the transposed inverses of the matrices given.

6.3 (The Gal(\overline{ℚ} /ℚ)-action on T(S\overline{ℚ} , ℤ_{2})/4 T(S\overline{ℚ} , ℤ_{2}) ). As the Galois action on T(S\overline{ℚ} , ℤ_{2})/2 T(S\overline{ℚ} , ℤ_{2}) factors via Gal(ℚ(ζ_{5})/ℚ), the action on T(S\overline{ℚ} , ℤ_{2})/4 T(S\overline{ℚ} , ℤ_{2}) factors via Gal(K/ℚ), for K the maximal abelian extension of ℚ(ζ_{5}) of exponent 2, ramified only at 2 and the prime above 5. It is not hard to see that

K = ℚ(\sqrt{−1}, \sqrt{2}, ζ_{5}, \sqrt{ζ_{5} − 1}, \sqrt{ζ_{5}^{2} − 1}) .  (25)

Note here that the prime above 5 is (ζ_{5} − 1). Moreover, the unit group ℤ[ζ_{5}]^{∗} is generated by the cyclotomic unit \frac{ζ_{5}^{2}−1}{ζ_{5}−1} = ζ_{5} + 1, together with (−ζ_{5}).

6.4 (Adaptation of the point counting algorithm). Suppose a good prime p ≡ 1, 4 (mod 5) to be given. Then one determines the conjugacy class Frob_{p} in Gal(K/ℚ). As before, there is a small prime l such that Frob_{l} is the same class. By the construction of K, this means that the action of Frob_{p} on T(S_{5,\overline{ℚ}} , ℤ_{2})/4 T(S_{5,\overline{ℚ}} , ℤ_{2}) agrees with that of Frob_{l}. Moreover, one may look up the value (Tr(Frob_{l}: T(S_{5,\overline{ℚ}} , ℤ_{2}) → T(S_{5,\overline{ℚ}} , ℤ_{2})) mod 16) in a precomputed table. Let us now distinguish between the two cases. Case 1: p ≡ 4 (mod 5). Then Frob_{p} ∈ Gal(ℚ(ζ_{5})/ℚ) is the element of order two. Correspondingly, the action of Frob_{p} on T(S_{5,\overline{ℚ}} , ℤ_{2})/2 T(S_{5,\overline{ℚ}} , ℤ_{2}) is not trivial, cf. (24), but that of Frob_{p}^{2} is. Hence, Theorem 4.1.b) applies and shows that

Tr(Frob_{p}: T(S_{5,\overline{ℚ}} , ℤ_{2}) → T(S_{5,\overline{ℚ}} , ℤ_{2})) ≡
Tr(Frob_{l}: T(S_{5,\overline{ℚ}} , ℤ_{2}) → T(S_{5,\overline{ℚ}} , ℤ_{2})) (mod 8) .

Thus, the precomputation determines (Tr(Frob_{p}: T(S_{5,\overline{ℚ}} , ℤ_{2})→T(S_{5,\overline{ℚ}} , ℤ_{2}))mod 8) , and therefore (#S_{5}(𝔽_{p}) mod 8), when taking (23) into consideration. Combining this with a point count modulo p, one may easily compute (#S_{5}(𝔽_{p}) mod 8p).

Recall at this point that S_{5}(ℂ) has real multiplication by a quadratic number field. This causes the algebraic monodromy group to be significantly smaller than usual. Concretely, the Zariski closure of the image of Gal(\overline{ℚ} /ℚ) in Aut(T(S\overline{ℚ} , \overline{ℚ} _{2})) is isomorphic to [O_{3}(\overline{ℚ} _{2})]^{2}, and not to O_{6}(\overline{ℚ} _{2}). Moreover, as p ≡ 4 (mod 5), the action of Frob_{p} lies in [O_{3}^{−}(\overline{ℚ} _{2})]^{2} [EJ21, Theorem 5.9]. In particular, two of the six eigenvalues are bound to be (−1).

Denoting the other eigenvalues by λ_{1}, …, λ_{4}, formula (23) takes the form

#S_{5}(𝔽_{p}) = p^{2} + (2 + λ_{1} + λ_{2} + λ_{3} + λ_{4})p + 1 .

As |λ_{i}| = 1, for i = 1, …, 4, this shows that (#S_{5}(𝔽_{p}) mod 8p) uniquely determines #S_{5}(𝔽_{p}), except for the two edge cases λ_{1} = ⋯ = λ_{4} = 1 and λ_{1} = ⋯ = λ_{4} = −1, which seem indistinguishable. However, the second of these does not occur, due to the Lemma below.

Lemma 6.5. Let p be an odd prime number and S a K3 surface over 𝔽_{p} as in 2.1. Suppose that Frob_{p} acts on the six lines as a permutation of order at most two. Then, among the six eigenvalues of Frob_{p} on the orthogonal complement of π^{∗}[l], π^{∗}[e_{12}], …, π^{∗}[e_{56}] in H_{ét}^{2}(S_{\overline{𝔽}_{p}}, ℤ_{2}(1)), at least one is not equal to (−1). Proof. Assume the contrary. Then, for the arithmetic Picard group of S, one has Pic(S)⊗_{ℤ} ℚ ⊆ ℚπ^{∗}[l] ⊕ ℚπ^{∗}[e_{12}] ⊕ ⋯ ⊕ ℚπ^{∗}[e_{56}]. An orthogonal basis is provided by the class π^{∗}[l], the classes π^{∗}[e_{ij}] being invariant under Frob_{p}, and the classes π^{∗}[e_{ij}] + π^{∗}[e_{i′j′}] formed by an orbit of size two. The self-intersection numbers of these are equal to 2, (−2), and (−4), respectively, so that the discriminant of Pic(S) as a quadratic space is (±\overline{1}) or (±\overline{2}) ∈ ℚ^{∗}/ℚ^{∗}^{2} .

On the other hand, according to the Artin–Tate formula [Mi, Theorem 6.1], the value of this discriminant may be calculated as \overline{±p·∏_{λ≠1}(1 − λ)}, the product being taken over all eigenvalues λ ≠ 1 of Frob_{p} on H_{ét}^{2}(S_{\overline{𝔽}_{p}}, ℤ_{2}(1)), counted with multiplicities. However, according to our assumptions, every eigenvalue ≠1 of Frob_{p} is (−1), which enforces the discriminant of Pic(S) to be (±\overline{p}) or (±\overline{2p}). A contradiction. □

Case 2: p ≡ 1 (mod 5). This case is easier. One has that Frob_{p} ∈ Gal(ℚ(ζ_{5})/ℚ) is the neutral element. Consequently, the action of Frob_{p} on T(S_{5,\overline{ℚ}} , ℤ_{2})/2 T(S_{5,\overline{ℚ}} , ℤ_{2}) is trivial, so that Theorem 4.1.a) applies and shows

Tr(Frob_{p}: T(S_{5,\overline{ℚ}} , ℤ_{2}) → T(S_{5,\overline{ℚ}} , ℤ_{2})) ≡

Tr(Frob_{l}: T(S_{5,\overline{ℚ}} , ℤ_{2}) → T(5, S\overline{ℚ} , ℤ_{2})) (mod 16) .

I.e., the precomputed value fixes (Tr(Frob_{p}: T(S_{5,\overline{ℚ}} , ℤ_{2}) → T(S_{5,\overline{ℚ}} , ℤ_{2})) mod 16) and therefore (#S_{5}(𝔽_{p}) mod 16). Combining this with a modulo p point count, one may compute (#S_{5}(𝔽_{p}) mod 16p). And, similarly to (4), this is enough to completely determine #S_{5}(𝔽_{p}). Note that, in formula (23), the trace of Frob_{p} is bounded by 6 in absolute value.

Remark 6.6. The information on (#S_{5}(𝔽_{p}) mod 8p) suffices to determine #S_{5}(𝔽_{p}) in Case 2, as well. Indeed, real multiplication causes two further eigenvalues (+1), so that one has #S_{5}(𝔽_{p}) = p^{2} + (18 + λ_{1} + λ_{2} + λ_{3} + λ_{4})p + 1. This shows that, again, only the two edge cases seem indistinguishable. But 22 eigenvalues (+1) are impossible for a K3 surface over the prime field 𝔽_{p}, for p ≠ 2, [Ar, (6.8)].

Remark 6.7 (Practical performance). The total running time for S_{5} was around 58 hours, which is a lot more than for the other examples. Cf. Remark 5.8.

The difference comes mainly from the p-adic algorithm. In fact, for a surface given by W^{2} = f_{6}(T_{1}, T_{2}, T_{3}) as a double cover of P_{𝔽_{p}}^{2} , the number of 𝔽_{p}-rational points modulo p depends only on the coefficient at T_{1}^{p−1}T_{2}^{p−1}T_{3}^{p−1} of f_{6}^{(p−1)/2}. Therefore, for f_{6} = T_{1}T_{2}T_{3}f_{3}, one only needs to compute the coefficient at T_{1}^{(p−1)/2}T_{2}^{(p−1)/2}T_{3}^{(p−1)/2} of f_{3}^{(p−1)/2}. Our implementation makes systematic use of this simplification, which applies to S_{1}, S_{2}, S_{3}, and S_{4}.

However, the equation of S_{5} only has the form f_{6} = T_{1}T_{2}f_{4}, so that the coefficient at T_{1}^{(p−1)/2}T_{2}^{(p−1)/2}T_{3}^{p−1} of f_{4}^{(p−1)/2} is asked for. This computation is more elaborate, so the last example took about five times longer.

Remarks 6.8 (Results). a) The main purpose of our computations for this example was to generate the histogram in [EJ21, Figure 4] to the left.

b) Moreover, our computations show that, in this particular example, the trace Tr(Frob_{p}: T(S_{5,\overline{ℚ}} , ℤ_{2}) → T(S_{5,\overline{ℚ}} , ℤ_{2})) modulo 8 or 16, respectively, is determined by the conjugacy class Frob_{p} in a field a lot smaller than the field K deduced from the general theory, cf. formula (25). In fact, the following holds.

i) If p ≡ 4 (mod 5) then

Tr(Frob_{p}: T(S_{5,\overline{ℚ}} , ℤ_{2}) → T(S_{5,\overline{ℚ}} , ℤ_{2})) ≡
\{ \begin{matrix}6 (mod 8) , & if (−1) is a square in 𝔽_{p} , \\ 2 (mod 8) , & otherwise . \end{matrix}

ii) If p ≡ 1 (mod 5) then

Tr(Frob_{p}: T(S_{5,\overline{ℚ}} , ℤ_{2}) → T(S_{5,\overline{ℚ}} , ℤ_{2})) ≡
6 (mod 16) ,  if (−1), (ζ_{5} − 1), and (ζ_{5}^{2} − 1) are squares in 𝔽_{p} ,
2 (mod 16) , if (−1) is a square, but \frac{ζ_{5}^{2}−1}{ζ_{5}−1} = ζ_{5} + 1 is a non-square in 𝔽_{p} ,
14 (mod 16) ,  otherwise .

Note that these conditions are independent of the choice of the fifth root of unity ζ_{5} ∈ 𝔽_{p}. Indeed, replacing ζ_{5} by ζ_{5}^{2}, one finds that only \frac{ζ_{5}^{4}−1}{ζ_{5}−1} = −ζ^{4} = −(ζ^{2})^{2} needs to be identified as being a square.

7. The very general picture

Consider the class of all K3 surfaces over ℚ, or even a different kind of surfaces, but suppose that H_{ét}^{1}(S\overline{ℚ} , ℤ_{2}) = 0 and that Pic(S\overline{ℚ} ) is computable as a Gal(\overline{ℚ} /ℚ)- module. Is it then, at least in principle, possible to devise a 2-adic point counting algorithm for such a class of surfaces? This, in essence, means to make the Gal(\overline{ℚ} /ℚ)-module T(S\overline{ℚ} , ℤ_{2})/2^{m} T(S\overline{ℚ} , ℤ_{2}) explicit, for a suitable value of m.

A major portion of the information on the Gal(\overline{ℚ} /ℚ)-module structure is encoded in the splitting field F_{m} of T(S\overline{ℚ} , ℤ_{2})/2^{m} T(S\overline{ℚ} , ℤ_{2}). This is, by definition, the smallest field allowing a commutative diagram

\xymatrix{Gal(\overline{ℚ} /ℚ) \ar[r]^{ϱ} \ar@{->>}[d] & Aut(T(S\overline{ℚ} , ℤ_{2})/2^{m} T(S\overline{ℚ} , ℤ_{2})) \\ Gal(F_{m}/ℚ) \ar@{-->}[ur]^{ϱ_{Fm}}} ,

for ϱ the natural action. One has that F_{m} is an algebraic number field, for every n ∈ ℕ.

7.1. One might want to determine the splitting fields F_{m} inductively. The induction step from m to m + 1 should work as follows.

One has that {A ∈ GL_{n}(ℤ/2^{m+1}ℤ) |A ≡ E_{n} (mod 2^{m})} is an elementary abelian 2-group, hence F_{m+1}/F_{m} is always an abelian field extension of exponent 2. Moreover, the smooth specialisation theorem [SGA4, Exposé XVI, Corollaire 2.3] implies that F_{m+1}/F_{m} is unramified at any prime of odd residue characteristic, except possibly those lying above the prime numbers at which S has bad reduction. In other words, an upper bound for F_{m+1} is provided by a certain ray class field of F_{m}, which is, at least in principle, amenable to computation.

7.2. On the other hand, the splitting field F_{2} of T(S\overline{ℚ} , ℤ_{2})/2 T(S\overline{ℚ} , ℤ_{2}) is a number field of degree ≤# GL_{t}(𝔽_{2}) = 2^{t(t−1)/2}(2^{t} − 1) ⋯ (2^{1} − 1), for t := dim T, unramified at every odd prime of good reduction of S. There are only finitely many such number fields, according to Minkowski’s Theorem [Ne, Theorem III.2.13], and to determine all of them is, in theory, effective. Thus, the composite of all these fields is an upper bound for F_{2}.

Such an approach, however, appears practically unfeasable under virtually all circumstances. Thus, it seems that, generally speaking, the base case is more complex than the induction step.

Remark 7.3. In order to settle this issue with the base case for the particular family of K3 surfaces considered in this article, we decided to apply the isomorphism from Theorem 3.5. This requires to make Br(S\overline{ℚ} )_{2} explicit, for which there is no obvious general approach either. The work of A. N. Skorobogatov [Sk, Theorem 1.1] we use is limited to double covers. Furthermore, it provides, in general, only an exact sequence, which might be non-split in certain cases.

Remark 7.4. Only a subfield of F_{m}, the trace field, is relevant for the algorithm. This is a minimal field K, for which there is a commutative diagram

\xymatrix{Gal(F_{m}/ℚ) \ar[r]^{ϱ_{Fm}} \ar@{->>}[d] & Aut(T(S\overline{ℚ} , ℤ_{2})/2^{m} T(S\overline{ℚ} , ℤ_{2})) \ar[d]^{Tr} \\ Gal(K/ℚ) \ar[r] & ℤ/2^{m}ℤ} .

The 2-adic overdetermination phenomenon established in Section 4 indicates that [K : ℚ] may be significantly smaller than [F_{m} : ℚ].

References

[Ar] Artin, M.: Supersingular K3 surfaces, Ann. Sci. École Norm. Sup. 7 (1974), 543–567 [BCP] Bosma, W., Cannon, J., and Playoust, C.: The Magma algebra system I. The user lan-

guage, J. Symbolic Comput. 24 (1997), 235–265

[Ch] Charles, F.: The Tate conjecture for K3 surfaces over finite fields, Invent. Math. 194 (2013), 119–145

[CS] Conway, J. H. and Sloane, N. J. A.: Sphere packings, lattices and groups, Third edition, Grundlehren der Mathematischen Wissenschaften 290, Springer, New York 1999

[CEJ] Costa, E., Elsenhans, A.-S., and Jahnel, J.: On the distribution of the Picard ranks of the reductions of a K3 surface, Research in Number Theory 6 (2020)art.27

[De74] Deligne, P.: La conjecture de Weil I, Publ. Math. IHES 43 (1974), 273–307

[De81] Deligne, P.: Relèvement des surfaces K3 en caractéristique nulle, Prepared for publication by Luc Illusie, in: Algebraic surfaces (Orsay 1976–78), Lecture Notes in Math. 868, Springer, Berlin–New York 1981, 58–79

[DM] Dixon, J. D. and Mortimer, B.: Permutation groups, Graduate Texts in Mathematics 163, Springer, New York 1996

[EJ16] Elsenhans, A.-S. and Jahnel, J.: Point counting on K3 surfaces and an application concerning real and complex multiplication, in: Proceedings of the ANTS XII conference (Kaiserslautern 2016), LMS Journal of Computation and Mathematics 19 (2016), 12–28

[EJ18] Elsenhans, A.-S. and Jahnel, J.: Real and complex multiplication on K3 surfaces via period integration, To appear in: Experimental Mathematics, doi: 10.1080/10586458.

2022.2061649

[EJ20a] Elsenhans, A.-S. and Jahnel, J.: Explicit families of K3 surfaces having real multiplication, To appear in: Michigan Mathematical Journal, doi: 10.1307/mmj/20205878

[EJ20b] Elsenhans, A.-S. and Jahnel, J.: Computations with algebraic surfaces, in: Mathematical software–ICMS 2020, Lecture Notes in Comput. Sci. 12097, Springer, Cham 2020, 87–93

[EJ21] Elsenhans, A.-S. and Jahnel, J.: Frobenius trace distributions for K3 surfaces, arXiv:

2102.10620

[vGG] von zur Gathen, J. and Gerhard, J.: Modern computer algebra, Cambridge University Press, New York 1999

[vG] van Geemen, B.: Some remarks on Brauer groups of K3 surfaces, Adv. Math. 197 (2005), 222–247

[GH] Griffiths, P. and Harris, J.: Principles of algebraic geometry, Wiley-Interscience, New York 1978

[Ha] Harvey, D.: Computing zeta functions of arithmetic schemes, Proc. Lond. Math. Soc. 111 (2015), 1379–1401 [HS] Harvey, D. and Sutherland, A.: Computing Hasse-Witt matrices of hyperelliptic curves

in average polynomial time, II. Frobenius distributions: Lang-Trotter and Sato-Tate conjectures, in: Contemp. Math. 663, AMS, Providence 2016, 127–147

[Ke] Kedlaya, K.: Counting points on hyperelliptic curves using Monsky-Washnitzer cohomology, Journal of the Ramanujan Mathematical Society 16 (2001), 323–338

[Kn] Kneser, M.: Quadratische Formen, Springer, Berlin 2002

[Mi] Milne, J. S.: On a conjecture of Artin and Tate, Ann. of Math. 102 (1975), 517–533 [Ne] Neukirch, J.: Algebraic number theory, Grundlehren der Mathematischen Wissenschaf-

ten 322, Springer, Berlin 1999

[Og] Ogus, A.: Supersingular K3 crystals, in: Journées de Géométrie Algébrique de Rennes (Rennes 1978) II, Astérisque 64, SMF, Paris 1979, 3-86

[Pi] Pila, J.: Frobenius maps of abelian varieties and finding roots of unity in finite fields, Math. Comp. 55 (1990), 745–763

[Sch] Schoof, R.: Counting points on elliptic curves over finite fields, J. Théor. Nombres Bordeaux 7 (1995), 219–254

[SGA4] Artin, M., Grothendieck, A. et Verdier, J.-L. (avec la collaboration de Deligne, P. et Saint-Donat, B.): Théorie des topos et cohomologie étale des schémas, Séminaire de Géométrie Algébrique du Bois Marie 1963–1964 (SGA 4), Lecture Notes in Math. 269, 270, 305, Springer, Berlin, Heidelberg, New York 1972–1973

[SGA4^{1}⁄_{2}] Deligne, P. (avec la collaboration de Boutot, J. F., Grothendieck, A., Illusie, L. et Verdier, J.-L.): Cohomologie Étale, Séminaire de Géométrie Algébrique du Bois Marie (SGA4^{1}⁄_{2}), Lecture Notes in Math. 569, Springer, Berlin, Heidelberg, New York 1977

[SGA5] Grothendieck, A. (avec la collaboration de Bucur, I., Houzel, C., Illusie, L. et Serre, J.-P.): Cohomologie l-adique et Fonctions L, Séminaire de Géométrie Algébrique du Bois Marie 1965–1966 (SGA 5), Lecture Notes in Math. 589, Springer, Berlin, Heidelberg, New York 1977

[Sk] Skorobogatov, A. N.: Cohomology and the Brauer group of double covers, in: Brauer groups and obstruction problems: moduli spaces and arithmetic (A. Auel, B. Hassett, A. Várilly-Alvarado, and B. Viray eds.), Springer, Cham 2017

[Wi] Wilson, R. A.: The finite simple groups, Graduate Texts in Mathematics 251, Springer, London 2009

[Yo] Yoshikawa, K.-I.: Discriminant of certain K3 surfaces, in: Representation theory and automorphic forms, Progr. Math. 255, Birkhäuser, Boston 2008, 175–210

Institut für Mathematik, Universität Würzburg, Emil-Fischer-Straße 30, D-97074 Würzburg, Germany

Email address: stephan.elsenhans@mathematik.uni-wuerzburg.de
URL: https://www.mathematik.uni-wuerzburg.de/computeralgebra/team/elsenhans-step
han-prof-dr/

Department Mathematik, Univ. Siegen, Walter-Flex-Str. 3, D-57068 Siegen, Germany

Email address: ~jjahnel@mathematik.uni-siegen.de
URL: http://wwwuser.gwdg.de/~jjahnel