# Automorphism group of the elliptic curve $y^2 + y = x^3$

Consider the elliptic curve $E : y^2+y = x^3$ over $\overline{\mathbb{F}_2}$. It has the biggest automorphism group $G$ among all elliptic curves, namely with order $24$. What is the structure of $G$? Which of the 15 groups of order 24 is it?

There is a subgroup consisting of those automorphisms of the form $x \mapsto ux, y \mapsto y+t$ where $u \in \mathbb{F}_4^*, t \in \mathbb{F}_2$. It is abelian and has order $6$, hence isomorphic to $\mathbb{Z}/6$.

The other automorphisms have the form $x \mapsto ux+r, y \mapsto y+r^{-1} ux + t$ for some $t \in \mathbb{F}_4 \setminus \mathbb{F}_2$ and $u,r \in \mathbb{F}_4^*$. If $\mathbb{F}_4 = \{0,1,\zeta,\zeta+1\}$, it follows that $G$ is generated by $a = (x \mapsto \zeta x, y \mapsto y)$ (order $3$), $b = (x \mapsto x, y \mapsto y+1)$ (order $2$), and $c_r = (x \mapsto x+r, y \mapsto y+r^{-1} x + \zeta)$ for $r \in \mathbb{F}_4^*$. Actually $c_r^2 = b$, so $c_r$ has order $4$ and we don't need $b$. But I don't know how to get further (without just writing down a large Cayley table).

-
The $c_r$:s generate a 2-group. As they all have squares $=b$, that 2-group must be the quaternion group. Conjugation by $a$ maps $c_1\mapsto c_\zeta\mapsto c_{\zeta+1}\mapsto c_1$, which is the usual $i\mapsto j\mapsto k\mapsto i$ outer automorphism of $Q_8$. So $b$ is in the center, and the group looks like $Q_8\rtimes C_3$. My guess would be that this is isomorphic to $SL_2(\mathbb{F}_3)$. Does this act faithfully on the 3-torsion? – Jyrki Lahtonen Jan 14 '13 at 20:43
@JyrkiLahtonen: you are right the group is $SL_2(\mathbb F_3)$. – user18119 Jan 14 '13 at 21:34
@QiL: If you know of a convenient way of showing that, go ahead and answer! I'm off to bed now :-) – Jyrki Lahtonen Jan 14 '13 at 21:50
@JyrkiLahtonen: I never think about this seriously. But the result is kind of well known. – user18119 Jan 14 '13 at 22:47

I believe QiL in that the result is well-known. The point of this answer is to show, given the data in the OP, that the automorphism group is $SL_2(\mathbb{F}_3)$ from the first principles. I enjoyed this exercise as a refresher, so...

The point doubling formula for this $j=0$ curve is the following. If $P=(x,y)$ is an affine point, then $2P=(x^4,x^3+x^6+y+1)$. Similarly the additive inverse is given by the formula $-P=(x,y+1)$. These formulas are given in all books on elliptic curves. An affine point is thus 3-torsion, iff $2P=-P$, iff $x=x^4$ and $y=x^3+x^6+y$. The first equation simply means that $x\in\mathbb{F}_4$. But then we have either $x^3=0$ or $x^3=1$, and the latter equation thus holds automatically. Therefore the $\mathbb{F}_4$-rational affine points $(0,0); (0,1)$; $(1,\zeta);(1,\zeta^2)$; $(\zeta,\zeta);(\zeta,\zeta^2)$;$(\zeta^2,\zeta);(\zeta^2,\zeta^2)$ are exactly the 3-torsion points.

The sum of the points $P=(x_1,y_1)$ and $Q=(x_2,y_2)$ is $P+Q=(x_3,y_3)$, where $\lambda=(y_1+y_2)/(x_1+x_2)$, $x_3=\lambda^2+x_1+x_2$, $y_3=\lambda(x_1+x_3)+y_1+1$. So if we write $P_1=(0,0)$, and $P_2=(1,\zeta)$, then a calculation repeatedly using the relation $\zeta^2=\zeta+1$ shows (barring my mistake) that $P_3=P_1+P_2=(\zeta,\zeta)$ and $P_4=P_1+2P_2=(\zeta^2,\zeta^2)$. Thus we see that $P_1$ and $P_2$ generate all of $E[3]$. The other 3-torsion points are the negatives of the listed ones.

Any automorphism of $E$ will act on the 3-torsion $E[3]$, so let us consider the action of the listed automorphisms on $E[3]\simeq\mathbb{F}_3^2$ (isomorphic as abelian groups). I write them as 2x2 matrices with entries in $\mathbb{F}_3$ with respect to the basis $\{P_1,P_2\}$. The automorphism $b$ maps all the points to their negatives, and thus maps to $-I_2$. The automorphism $a$ maps $P_1=(0,0)$ to itself, and $P_2=(1,\zeta)$ to $(\zeta,\zeta)=P_1+P_2$. The matrix is thus $$a\mapsto \pmatrix{1&1\cr0&1\cr}.$$ Continuing this we see that $c_1(P_1)=c_1(0,0)=(0+1,0+0+\zeta)=(1,\zeta)=P_2$ and $c_1(P_2)=c_1(1,\zeta)=(1+1,\zeta+1+\zeta)=(0,1)=-P_1$. Therefore $$c_1\mapsto \pmatrix{0&-1\cr 1&0\cr}.$$ In the same way we see that $c_\zeta(P_1)=P_1+P_2$ and $c_\zeta(P_2)=P_1+2P_2$, so $$c_\zeta\mapsto \pmatrix{1&1\cr1&2\cr}.$$ As a further check we can compute that the relation $ac_1a^{-1}=c_\zeta$ (see my comments to OP) holds on the matrix side as well.

It is then easy to check that the listed matrices generate all of $SL_2(\mathbb{F}_3)$. Because we knew that the automorphism group $G$ is of order $24=|SL_2(\mathbb{F}_3)|$, we have seen that $G\simeq SL_2(\mathbb{F}_3)$ and that elements of $G$ can be identified by their action on $E[3]$ (IOW the above homomorphism sending an automorphism of $E$ to its restriction on $E[3]$ is injective).

I think that it always happens that the restriction of the automorphism group on $E[p]$ for any prime $p$ is inside the special linear group. This is because the action has to respect the Weil pairing.

-
+1: Amazing how clearly a good night's sleep makes you think and write :-) – Georges Elencwajg Jan 15 '13 at 11:55
Thanks Jyrki to provide a nice proof ! – user18119 Jan 15 '13 at 12:01
Thanks for the supportive comments. This was trivial to you, but I enjoyed working this out. All: sorry about the multiple edits. I gave three problem sessions for my freshman abstract algebra course today, and only had a chance to edit this during brief intervals every two hours. Well, many of you have been there :-) – Jyrki Lahtonen Jan 15 '13 at 14:14
Thanks a lot for this great answer. – Martin Brandenburg Jan 15 '13 at 19:18