18.783 Elliptic Curves Spring 2013 Lecture #16 04/09/2013 Elliptic curves over C We now consider elliptic curves over the complex numbers. Our main tool will be the correspondence between elliptic curves over C and tori C/L defined by lattices L in C (see Definition 16.1). We will proceed to show the following: 1. Every lattice L can be used to define an elliptic curve E/C. 2. Every elliptic curve E/C arises from a lattice L. 3. If E/C is the elliptic curve corresponding to the lattice L, then there is an isomorphism Φ C/L −→ E/C that is both analytic (as a mapping of complex manifolds) and algebraic: addition of points in E(C) corresponds to addition in C modulo the lattice L. This correspondence between lattices and elliptic curves over C is known as the Uniformiza- tion Theorem; we will spend this lecture and part of the next proving it. To make the correspondence explicit, we need to specify the map Φ from C/L and an elliptic curve E/C. This map is parameterized by elliptic functions, specifically the Weier- strass ℘-function. We will introduce general properties of elliptic functions in Section 16.1, specialize to the ℘-function in Section 16.3, and then construct the map Φ in Section 16.4. Once we have fleshed out this correspondence, we obtain a powerful method to construct elliptic curves with desired properties. The arithmetic properties of lattices over C are usu- ally easier to understand than those of the corresponding elliptic curve. In particular, by choosing an appropriate lattice, we can construct an elliptic curve with a given endomor- phism ring. In the case of elliptic curves over C, the endomorphism ring must either be Z or an order O in an imaginary quadratic field (a fact we will prove). The order O may be viewed as a lattice, and we will see that the elliptic curve corresponding to the torus C/O has endomorphism ring O. This has important implications for elliptic curves over finite fields. If we choose a suitable prime p, we can reduce an elliptic curve E/C with complex multiplication to a curve E/¯ Fp with the same endomorphism ring O. The endomorphism ring determines, in particular, the trace of the Frobenius endomorphism π (uptoasign),whichinturn determines the group order #E(Fp)=p +1− tr(π). This allows us to construct elliptic curves over finite fields that have a prescribed group order, using what is known as the CM method. As we will see, this has many practical applications, including cryptography and primality proving. 16.1 Elliptic functions We begin with the definition of a lattice in the complex plane. Definition 16.1. A lattice L =[ω1,ω2] is an additive subgroup = ω1ZZ+ω2 of C generated by complex numbers ω1 and ω2 that are independent over R. 1 Andrew V. Sutherland Example 16.2. Let τ be the root of a monic quadratic equation x2 + bx + c with integer coefficients and negative discriminant. Then the lattice [1,τ] is the additive group of an imaginary quadratic order O = Z[τ]. Conversely, if O is an imaginary quadratic order Z[τ], then the additive group of O is the lattice [1,τ]. If we take the quotient of the complex plane C modulo a lattice L,wegetatorusC/L. Definition 16.3. A fundamental parallelogram for L =[ω1,ω2] is a set of the form Fα = {α + t1ω1 + t2 ω 2 : α ∈ C, 0 ≤ t1,t2 < 1}. We can identify the points in a fundamental parallelogram with the points of C/L. ω1 ω2 Figure 1: A lattice [ω1,ω2] with a fundamental parallelogram shaded. In order to define the correspondence between complex tori and elliptic curves over C, we need to define the notion of an elliptic function on C. As complex analysis is not a prerequisite for this course, we first define the terminology we need, which can be found in any standard textbook on the subject, including [1, 3].1 A function f(z)definedonsomeopenneighborhoodofapointz0 ∈ C is said to be holomorphic at z0 if the complex derivative f(z0 + h) − f(z0) f (z0) = lim h→0 h 2 exists. We say that f is holomorphic on an open set Ω if it is holomorphic at every z0 ∈ Ω, and we say that f is holomorphic on a closed set C if it is holomorphic on some open set Ω containing C. Functions that are holomorphic on all of C are said to be entire. 1We will occasionally appeal to some standard theorems of complex analysis which are covered in any first course on the subject. We will note when we do and provide references to proofs. 2The limit must take the same value no matter how the complex number h approaches 0; this makes differentiability a very strong condition for a complex function to satisfy. 2 Examples of holomorphic functions include polynomials and convergent power series. Functions that admit a power series expansion about a point z0 are said to be analytic at z0.Itisatheorem([1, Thm. 5.3], [3, Thm. 2.4.4]) that in fact any function that is holomorphic at z0 has a power series expansion about z0,thusthetermsanalytic and holomorphic are often used interchangeably. A complex function f(z) has a zero of order k at z0 if an equation of the form k f(z)=(z − z0) g(z) holds in some neighborhood of z0 in which g is holomorphic and g(z0) =0.Wesaythat f(z) has a pole of order k at z0 precisely when the function 1/f(z) has a zero of order k at z0. Note that f cannot be holomorphic at z0 if it has a pole at z0, but we say that f is meromorphic if it is holomorphic everywhere except for a discrete set of poles (this means that there exists a neighborhood about each pole that contains no other poles). Definition 16.4. An elliptic function for a lattice L is a complex function f(z) such that 1. f is meromorphic. 2. f is periodic with respect to L. This means that f(z + ω)=f(z) for all ω ∈ L.3 Note that if f is an elliptic function for L then it is also an elliptic function for every sub-lattice of L. For a fixed lattice L, the set of elliptic functions for L form a field C(L) that is an extension of C (every constant function is an elliptic function). Definition 16.5. The order of an elliptic function is the number of poles it has in a fundamental parallelogram, each counted with multiplicity equal to its order. Whenever we count poles or zeros, we do so with multiplicity. Theorem 16.6. For any nonzero elliptic function f(z) thenumberofzerosoff in any fundamental parallelogram is equal to the order of f. To prove this we rely on the following theorem, known as Cauchy’s argument principle. Theorem 16.7 (Argument Principle). Let f be a meromorphic function and let F be a region whose boundary ∂F is a simple closed curve4 that contains no zeros or poles of f. Then 1 f (z) dz = (number of zeros of f in F ) − (number of poles of f in F ), 2πi ∂F f(z) where each zero and each pole is counted with multiplicity equal to its order. Proof. See [1, Thm. 4.20] or [3, Thm. 3.4.1]. 3 Equivalently, when L =[ω1,ω2] the function f is also called doubly periodic,withperiods ω1 and ω2, since f(z + mω1)=f(z + nω2)=f(z) for all m, n ∈ Z. 4A curve in the complex plane is the image of a continuous function u(t) from the unit interval to C, subject to some additional conditions (at a minimum, we require curves to have finite length). All the curves we shall consider consist of a finite number of line segments and arcs (a “toy contour” in [3]). A curve is simple if u(t) is injective, except possibly u(0) = u(1), in which case the curve is closed. 3 Proof of Theorem 16.6. The zeros and poles of f are all isolated, so we can pick a funda- mental parallelogram F such that f(z) has no zeros or poles on the boundary ∂F,which we orient counterclockwise. By periodicity the integrals along opposite sides of ∂F cancel each other out, because f(z) (and f (z)) takes on the same values but we are integrating in opposite directions. Hence 1 f (z) dz =0. 2πi ∂F f(z) We then apply the argument principle (Theorem 16.7). 16.2 Eisenstein series Before giving some non-trivial examples of elliptic functions, we first define the Eisenstein series of a lattice. Definition 16.8. Let L be a lattice and let k>2 be an integer. The weight-k Eisenstein series for L is the sum 1 Gk(L)= k . ω∈L ω where the notation meansthatweexcludethelatticepointω =0. Remark 16.9. Gk(L) is a function of the lattice L, so for any fixed lattice, it is a constant. If we consider lattices L =[1,τ] parameterized by a complex number τ in the upper half plane H = {z ∈ C :imz>0}, we can view Gk(L) as a function of τ: 1 Gk(τ):=Gk([1,τ]) = k . m,n∈Z (m + nτ) Because it comes from function defined over a lattice, the function Gk(τ) has some very nice −k transformation properties.