Previosly my impression on this subject was that hyperelliptic cryptography systems (as well as other possible cryptosystems based on abelian varieties of dimension $>1$) have no advantages over elliptic curve ones and are more difficult to implement. Yet Google search has demonstrated me that people are working on improving hyperelliptic cryptosystems and also implement them as computer programs. So my question is: is anybody currently using hyperelliptic cryptography "in practice", and what is the chance that anyone will prefer hyperelliptic cryptography to the elliptic one "soon enough".


Sorry if this question is not appropriate for MO.



Is hyperelliptic cryptography "practical"?
I am not aware of anybody seriously considering hyperelliptic curves for actual real-world usage, beyond toys, and I would be rather surprised to hear differently from anyone. 


As you say, hyperelliptic provide comparatively few (if any!) advantages over elliptic curves but have the huge disadvantage that virtually nobody has well-tested, battle-hardened code for them. As a matter of fact, even elliptic curves are difficult to implement right, which is one of the reasons Dan Bernstein developed [Curve25519](https://cr.yp.to/ecdh.html) -- this is an elliptic curve (and more) which is designed to make it hard to screw up, compared to previously used ones.


Given all that, why should a practical cryptographer then bother with hyperelliptic curves?


To convince people who implement crypto to use a new cryptosystem is *hard*. Heck, some standard committees and vendors still are unsure about these new-fangled elliptic curves ;-).


And if they switch to something new, they usually want it to give some serious advantage, to justify the cost and the incompatibility. Such as (a high chance for) being safe against quantum computer attacks -- and hyperelliptic curves are no better in that regard than RSA or elliptic curves (i.e. they are completely broken if we ever get "real" quantum computers).


My best guesses as to why people still research crypto based on hyperelliptic curves are:


1. habit,
2. they are genuinely curious, and do the research for its own sake, not caring about applications,
3. they suffer from the very disturbing, but also sadly widespread disconnection between crypto researchers who work purely theoretically, and people who actually implement it, and know how to do it properly. The intersection between these two sets is rather small, and a lot of crypto systems that look good on paper are completely useless in reality for that reason.


Being an algebraist myself, whose most applied results at best have application in theoretical physics (string theory for that), I am very reluctant to judge any research based on how applicable it is to real-world scenarios. But in this case, I am tempted... ;-)


