Superspecial points on Humbert surfaces and the probability of (N,N)-splitting

What it is

A preprint by Tanush Shaska (ePrint 2026/2522, not peer reviewed) that computes how often a superspecial principally polarized abelian surface over F̄_p is optimally (N,N)-split. This is the target density of the splitting-detection attack on the dimension-two superspecial isogeny problem. It requires p ≡ 3 mod 4.

What the summary leaves out

• Exact first moment. For p ∤ N, the expected number of optimal (N,N)-splittings is exactly 5·N·J₂(N)·(p−1)/(p²+1). The result is exact, not asymptotic, and it covers every p ∤ N, not only large p.
• Second factorial moment. For p > 2N², it equals c_N/(p²+1), with c_N independent of p. The paper determines c_N explicitly for 2 ≤ N ≤ 7. This is the quantity that links the expected count to the split proportion. It is why the proportion is 5N·J₂(N)/p + O_N(p⁻²) for fixed N, with the error constant depending on N.
• Extra results. The paper also gives:
• the first moment of primitive representations for every discriminant prime to p;
• mixed moments across several levels;
• an exact probability at level 2;
• a proof that the earlier geometric upper bound has the correct leading term.

Worked from the formula (J₂(N) = N²∏(1−1/q²) over primes q | N, so J₂(2) = 3 and J₂(3) = 8), the split proportion is about 30/p for N=2 and about 120/p for N=3. These figures are my arithmetic, not quoted from the page.

How it works

• Surfaces are weighted by 1/|Aut|, which is the stationary measure of the Richelot random walk.
• The key step is showing that superspecial surfaces sample the genus of their refined Humbert invariants with Siegel's weights. This makes Siegel's theorem on genus averages applicable.
• The c_N values come from enumeration. The paper says everything else is proved, and the formulas were also confirmed by exact computation at twelve primes.

Preconditions

• p ≡ 3 mod 4.
• N ≥ 2.
• p ∤ N for the first moment.
• p > 2N² for the second moment.
• The proportion result is asymptotic in p for fixed N.

Caveats

• Only the abstract was available. I have not seen the proofs, the error bound, or the c_N values.
• The result is a density estimate for the attack's target, not a new attack or a complexity claim. Any effect on the cost of the attack or on parameter choices would need to be worked out separately.