Let E be an elliptic curve defined over $\mathbb{Q}$ (coeffs. there), and consider its $n-$torsion points in $\mathbb{C}$, $E(\mathbb{C})_{\text{tors}}[n]$. We know this group is isomorphic to $\mathbb{Z}/n\mathbb{Z} \times \mathbb{Z}/n\mathbb{Z}$. Moreover, if we consider $K_n$ to be the field extension of $\mathbb{Q}$ obtained by adjoining the coordinates of the $n$-torsion points we obtain a natural action of $\text{Gal}(K_n / \mathbb{Q})$ on $E(\mathbb{C})_{\text{tors}}[n]$, so we obtain an injective representation \begin{equation*} \chi_n : \text{Gal}(K_n / \mathbb{Q}) \hookrightarrow \text{Aut}(E(\mathbb{C})_{\text{tors}}[n]) \cong \text{GL}_2(\mathbb{Z}/n\mathbb{Z}) \end{equation*}

If we consider a prime $p$ of good reduction for $E$, and let $\text{Frob}_p$ be the corresponding Frobeniu element in $\text{Gal}(K_n/\mathbb{Q})$ (I know the Frobenius elements constitute, in fact, a conjugacy class $\mathcal{C}_p$: pick any of them for our purposes), then there is a theorem (in Silverman, for example) which says that \begin{equation*} \begin{cases} \text{det}( \chi_n(\text{Frob}_p)) \equiv p \text{ (mod }n) \\ \text{Tr}(\chi_n(\text{Frob}_p)) \equiv a_p \text{ (mod }n) \end{cases} \end{equation*} where $a_p = 1+p-|E(\mathbb{F}_p)|$.

I want to apply this theorem for the elliptic curve $y^2 = x^3 - 1$; in particular I want to say something about $a_p$ for a given $p$. I think there is some result which states

1) If $p \equiv 2 \text{ (mod }3)$, then $a_p = 0$.

2) If $p \equiv 1 \text{ (mod }3)$, then $a_p = 2a$ where $a$ is such that $p = a^2+ab+b^2$ (or something similar).

Can someone give some reference on where to find such a result, or where I can find a similar study for elliptic curves of the form $y^2 = x^3 + D$? My effords from now on have been simply computing the trace by hand for some specific cases ($p=2$ and $3$), but it gets extremely tedious even for $p=3$.

Thank you very much!

  • 3
    $\begingroup$ See Ireland and Rosen's number theory book: Lemma 1 section 4 chapter 9 and Theorem 4 section 3 chapter 18. $\endgroup$ – KCd Jun 30 '15 at 20:27
  • 1
    $\begingroup$ I have a vague recollection that the case $p\equiv2\pmod3$ might have been covered on our site. I cannot check, but I suspect the general case can be found from e.g. Ireland and Rosen (I would begin checking out the chapter on Jacobi sums). $\endgroup$ – Jyrki Lahtonen Jun 30 '15 at 20:29
  • $\begingroup$ Is there some way to use the above representation to prove these statements? I see Ireland and Rosen use only techniques on algebraic number theory. $\endgroup$ – Klaramun Jun 30 '15 at 21:20

When $p = 2 \bmod 3$, every element $x\in \mathbb{F}_p$ has a unique cube root, which is equal to $x^{(2p-1)/3} \bmod p$. Thus, for every $y\in \mathbb{F}_p$, there is a unique $x\in\mathbb{F}_p$ such that $y^2 = x^3-1$. It follows that $E(\mathbb{F}_p)$ has exactly $p+1$ elements (one element for every value of $y$, and the neutral "point-at-infinity"). This implies $a_p = 0$.

Such curves have been suggested for cryptography because they have computable pairings that map $r$-torsion elements (for $r$ a prime that divides $p+1$) into the group of $r$-th roots of unity in $\mathbb{F}_{p^2}$. Correspondingly, this means that discrete logarithm in such a curve is not harder than discrete logarithm modulo $\mathbb{F}_{p^2}$, which implies that, for cryptographic purposes, $p$ must be large (typically 1024 bits or more), which is detrimental to performance.

When $p = 1 \bmod 3$, things are more complicated. I don't know about any rule on $a_p$ (except $|a_p| \leq 2\sqrt{p}$ by Hasse's theorem) but that does not mean that there is no such rule. Curves with equation $y^2 = x^3+b$ for some constant $b$, in $\mathbb{F}_p$ where $p = 1 \bmod 3$ is prime, are in wide use. Notably, Bitcoin uses such a curve (called "secp256k1").


The key fact you need is this: if $E/K$ is an elliptic curve which has complex multiplication over $K$, then the associated $\ell$-adic Galois representations $$\rho_{E,\ell}:G_K\to\mathrm{GL}_2(\overline{\mathbb Q}_\ell)$$ are reducible for all primes $\ell$. Indeed, $\mathrm{End}(E)\otimes\overline{\mathbb Q}_\ell$ embeds into the endomorphism ring of $\rho_{E,\ell}$, and the former is not a division ring.

In your case, your curve $E: y^2 = x^3-1$ does not have CM over $\mathbb Q$, but it picks up extra endomorphisms over $K=\mathbb Q(\zeta_3)$. It follows that $\rho_{E,\ell}$ is irreducible, but $\rho_{E,\ell}|_{G_K}$ becomes reducible, and representation theory kicks in to show that $$\rho_{E,\ell}\cong \mathrm{Ind}_{G_K}^{G_\mathbb Q}\chi_\ell\qquad(*)$$ where $\chi_\ell$ is a character -- actually it is the Galois character corresponding to the Hecke grossencharacter which is attached to $E$ by the theory of CM.

Finally, one can show using pure representation theory that $(*)$ is equivalent to the statement $$\rho_{E,\ell}\cong\rho_{E,\ell}\otimes\theta\qquad(**)$$ where $\theta:G_\mathbb Q\to\overline{\mathbb Q}_\ell^\times$ is the one dimensional representation which has as its kernel $G_K$. Explicitly, $\theta$ is a lift of the unique non-trivial Dirichlet character of conductor $3$.

In particular:

  • If $p\equiv 2\pmod 3$, then $\theta(\mathrm{Frob}_p) = -1$ and it follows from $(**)$ that $a_p = -a_p$, so $a_p = 0$.
  • If $p\equiv 1\pmod 3$, then it follows from $(*)$ and the usual formula for the trace of an induced representation that $a_p = 2\chi_\ell(\mathrm{Frob}_p)$, which turns out to be the value you'd expect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.