1 Elliptic Curves Over Finite Fields 1.1 Introduction Definition 1.1. Elliptic curves can be defined over any field K; the formal definition of an elliptic curve is a non- singular (no cusps, self-intersections, or isolated points) projective algebraic curve over K with genus 1 with a given point defined over K. If the characteristic of K is neither 2 or 3, then every elliptic curve over K can be written in the form y2 = x3 − px − q where p;q 2 K such that the RHS does not have any double roots. If the characteristic of K is 3, then the most general equation is of the form 2 3 2 y = 4x + b2x + 2b4x + b6 such that RHS has distinct roots. In characteristic 2, the most general equation is of the form 2 3 2 y + a1xy + a3y = x + a2x + a4x + a6 provided that the variety it defines is non-singular. Definition 1.2. A rational point is a point whose coordinates lie in K. W denote the set of rational points as E(K) and this set forms a group. 1.2 Isogenies Definition 1.3. A non-constant morphism f : E1 ! E2 between elliptic curves such that f(O) = O is called an isogeny. Let f : E1 ! E2 be an isogeny. Then there is a unique isogeny fˆ : E2 ! E1 satisfying fˆ ◦ f = [degf]. fˆ is called the dual of f. Remark. In the above statement, [n] denotes the isogeny which adds n times. q q If E is defined over Fq and pq;E : E ! E is the Frobenius morphism (x;y) 7−! (x ;y ), then E(Fq) = ker(1 − pq;E ). As we noted, an isogeny has finite kernel. Lemma 1.1. Let E1 and E2 be isogenous elliptic curves defined over Fq. Then #E1(Fq) = #E2(Fq). Proof. Any isogeny f : E1 ! E2 commutes with the Frobenius map on E1 and E2. Now, f is surjective. So we have −1 y 2 E2(Fq) , pq;E2 (f(x)) = f(x) , x 2 ker((1 − pq;E2 )f). Now, each f (y) has degsep f elements. Thus, #E2(Fq) = ker((1−pq;E2 )f)=degsep f = #ker(f(1−pq;E2 ))=degsep f = #ker(f(1−pq;E1 ))=degsep f = degsep(1− fq;E1 ) = #E1(Fq). Recall the following useful facts on degrees and dual maps (i) f\+ y = fˆ + yˆ (ii) [nˆ] = [n] (iii) deg[n] = n2 (iv) degfˆ = degf (v) fˆ = f (vi) deg(−f) = deg(f) (vii) d(f;y) := deg(f + y) − degf − degy is symmetric, bilinear on Hom(E1;E2), where Ei is an elliptic curve. (viii) degf > 0 for any isogeny f 1.3 Riemann Hypothesis for Elliptic Curves For an elliptic curve E defined over a finite field Fq, the most obvious parameter is the number of points in E(Fq). Theorem 1.1. (Riemann hypothesis for elliptic curves (Hasse, 1934)) Let E be an elliptic curve defined over Fq. Then n n=2 j#E(Fqn ) − 1 − q j 6 2q 8n > 1 pq q Proof. Choose a Weierstrass equation with coefficients in Fq. Since Gal(Fq=Fq) is topologically generated by x 7−! x , n a point P of E(Fq) lies in E(Fq) if and only if pq;E (P) = P. Thus P 2 E(Fqn ) if and only if pq;E (P) = P, i.e., n n E(Fqn ) = ker(1−pq;E ). Now 1−pq;E is a separable morphism (since its differential is the identity). Thus, #E(Fqn ) = n deg(1−pq;E ). We noted that, for any two elliptic curves over a field, the function d : Hom(E1;E2)×Hom(E1;E2) ! Z, (f;y) 7−! deg(f +y)−degf −degy is a positive definite bilinear form. By the Cauchy-Schwarz inequality, we get n n q n jdeg(1 − pq;E ) − deg1 − degpq;E j 6 2 deg1degpq;E i.e. n n=2 j#E(Fqn ) − 1 − q j 6 2q 1.4 The Weil Conjectures Let Kn = Fqn . If V is a projective variety, we want to keep account of #V(Kn). We can do this by using the zeta function of V and it is defined as the formal power series ! ¥ T n Z(V=K1 : T) = exp ∑ #V(Kn) n=1 n Note that 1 dn #V(K ) = logZ(V=K ;T)j n (n − 1)! dT n 1 T=0 T n The reason for defining the zeta function in this manner is that the series ∑n>1 #V(Kn) n often looks like the log of a rational function of T. Let V be any smooth projective variety of dimension n, defined over K1 = Fq. Then: • Rationality conjecture Z(V=K1;T) 2 Q(T) • Functional conjecture There exists an integer c such that 1 Z V=K ; = ±qnc=2T c Z(V=K ;T) 1 qnT 1 • Factorization There exists a factorization P (T)P (T)···P (T) Z = 1 3 2n−1 P0(T)P2(T)···P2n−2(T)P2n(T) n with P0(T) = 1 − T, P2n(T) = 1 − q T, each Pi(T) 2 Z[T] and 1 −1 bi Pi = P n−i(T) qnT 2 Tqn−i=2 where bi = degPi = degP2n−i • Riemann hypothesis −i=2 Each root of Pi(T) satisfies jaj = q The conjecture was proven in its entirety by the efforts of Weil, Dwork, M. Artin, Grothendieck, Lubkin, Deligne, Laumon. But the first case for elliptic curves was solved by Hasse in 1934 before the conjectures were formulated in this generality by Weil in 1949. Weil pointed out that if one had a suitable cohomology theory for abstract varieties analogous to the usual cohomology for varieties over C, the standard properties of the cohomology would imply all the conjectures. For instance, the functional equation would follow from Poincare´ duality property. Such a cohomology is the etale´ cohomology. 1.5 Tate Modules and the Weil Pairing Let E be an elliptic curve defined over Fq. Suppose l is a prime not dividing q. We know that the l−division points of n d n n n E, i.e., E[l ] = ker[l ] is Z=l × Z=l . [l] E[ln] E[ln+1] −! E[ln] T (E) = E[ln] The inverse limit of the groups with respect to the maps is the Tate module l lim− . E[ln] =ln− T (E) (= =ln)− Since each is naturally a Z module, it can be checked that l is a Zl lim−Z module. It is a free Zl−module of rank 2. Any isogeny f : E1 ! E2 induces a Zl−module homomorphism fl : Tl(E1) ! Tl(E2). In particular, we have a repre- sentation End(E) ! M2(Zl);f 7−! fl if l - q. n Note that End(E) ,! End(Tl(E)) is injective because if fl = 0 then f is 0 on E[l ] for large n, i.e., f = O. Finally, let us recall the Weil pairing. This is a non-degenerate, bilinear, alternating pairing d e T (E) × T (E) ! T ( ) = n ∼ : l l l m lim− ml = Zl It has the important property that e(fx;y) = e(x;fˆy). Remark. For any general curves C;D, and a nonconstant morphism f : C ! D, recall that f ∗ : Div(D) ! Div(C) is a homomorphism defined by (P) 7−! ∑ ef (Q)(Q) Q2f −1(P) where ef (Q) is the ramification index at Q. For C = D an elliptic curve, all the ef (Q) = deginsep f. For a general C and D, ordP( f ◦ f) = ef (Q)ordf(P)( f ) for every nonconstant rational function on D. 1.6 Weil Conjectures for Elliptic Curves Lemma 1.2. Let f 2 End(E) and l - q be a prime. Then, detfl = degf tracefl = 1 + degf − deg(1 − f) In particular, detfl;tracefl are independent of l, and are integers. Proof. Let (v1;v2) be a Zl− basis of Tl(E) and write a b f = l c d with respect to this basis. We now use the Weil pairing e which is bilinear and alternating degf e(v1;v2) = e(deg(f)v1;v2) = e((fˆ)l(f)l)v1;v2) = e(flv1;flv2) = e(av1 + cv2;bv1 + dv2) ad−bc = e(v1;v2) detfl = e(v1;v2) Since e is nondegenerate, we have that degf = degfl. Finally, tracefl = 1 + detfl − det(Id − fl) = 1 + degf − deg(1 − f) n To prove the Weil conjectures for E, we have to compute #E(Kn), where Kn = Fqn . Now #E(Kn) = deg(1−f ) where f = pq;E is the Frobenius isogeny. A consequence of the lemma is the fact that the characteristic polynomial of fl has coefficients in Z when l 6= charFq. m Write det(Id · T − fl) = (T − a)(T − b) for a;b 2 C. Moreover, for all n 2 Q, we get m 1 1 det Id − f = det(mId − nf ) = deg(m − nf) > 0 n l n2 l n2 n n n This implies a = b. Note by triangularizing, that detId · T − fl ) = (T − a )(T − b ), we get n n n 1=2 Theorem 1.2. For all n > 1, #E(Kn) = 1 − a − a + q where jaj = q . In particular, 1 − aT + qT 2 Z(E=K ;T) = 1 (1 − T)(1 − qT) 2 1 where a 2 Z and 1 − aT + qT = (1 − aT)(1 − aT). Further, Z(E=K1; qT ) = Z(E=K1;T). Proof. We have that n #E(Kn) = deg(1 − f ) n = det(1 − fl ) = 1 − an − an + qn p and jaj = q.