# The Frobenius Trace for an elliptic curve

Let E be an elliptic curve defined over $\mathbb{Q}$ (coeffs. there), and consider its $n-$torsion points in $\mathbb{C}$, $E(\mathbb{C})_{\text{tors}}[n]$. We know this group is isomorphic to $\mathbb{Z}/n\mathbb{Z} \times \mathbb{Z}/n\mathbb{Z}$. Moreover, if we consider $K_n$ to be the field extension of $\mathbb{Q}$ obtained by adjoining the coordinates of the $n$-torsion points we obtain a natural action of $\text{Gal}(K_n / \mathbb{Q})$ on $E(\mathbb{C})_{\text{tors}}[n]$, so we obtain an injective representation \begin{equation*} \chi_n : \text{Gal}(K_n / \mathbb{Q}) \hookrightarrow \text{Aut}(E(\mathbb{C})_{\text{tors}}[n]) \cong \text{GL}_2(\mathbb{Z}/n\mathbb{Z}) \end{equation*}

If we consider a prime $p$ of good reduction for $E$, and let $\text{Frob}_p$ be the corresponding Frobeniu element in $\text{Gal}(K_n/\mathbb{Q})$ (I know the Frobenius elements constitute, in fact, a conjugacy class $\mathcal{C}_p$: pick any of them for our purposes), then there is a theorem (in Silverman, for example) which says that \begin{equation*} \begin{cases} \text{det}( \chi_n(\text{Frob}_p)) \equiv p \text{ (mod }n) \\ \text{Tr}(\chi_n(\text{Frob}_p)) \equiv a_p \text{ (mod }n) \end{cases} \end{equation*} where $a_p = 1+p-|E(\mathbb{F}_p)|$.

I want to apply this theorem for the elliptic curve $y^2 = x^3 - 1$; in particular I want to say something about $a_p$ for a given $p$. I think there is some result which states

1) If $p \equiv 2 \text{ (mod }3)$, then $a_p = 0$.

2) If $p \equiv 1 \text{ (mod }3)$, then $a_p = 2a$ where $a$ is such that $p = a^2+ab+b^2$ (or something similar).

Can someone give some reference on where to find such a result, or where I can find a similar study for elliptic curves of the form $y^2 = x^3 + D$? My effords from now on have been simply computing the trace by hand for some specific cases ($p=2$ and $3$), but it gets extremely tedious even for $p=3$.

Thank you very much!

• See Ireland and Rosen's number theory book: Lemma 1 section 4 chapter 9 and Theorem 4 section 3 chapter 18. – KCd Jun 30 '15 at 20:27
• I have a vague recollection that the case $p\equiv2\pmod3$ might have been covered on our site. I cannot check, but I suspect the general case can be found from e.g. Ireland and Rosen (I would begin checking out the chapter on Jacobi sums). – Jyrki Lahtonen Jun 30 '15 at 20:29
• Is there some way to use the above representation to prove these statements? I see Ireland and Rosen use only techniques on algebraic number theory. – Klaramun Jun 30 '15 at 21:20

When $p = 2 \bmod 3$, every element $x\in \mathbb{F}_p$ has a unique cube root, which is equal to $x^{(2p-1)/3} \bmod p$. Thus, for every $y\in \mathbb{F}_p$, there is a unique $x\in\mathbb{F}_p$ such that $y^2 = x^3-1$. It follows that $E(\mathbb{F}_p)$ has exactly $p+1$ elements (one element for every value of $y$, and the neutral "point-at-infinity"). This implies $a_p = 0$.

Such curves have been suggested for cryptography because they have computable pairings that map $r$-torsion elements (for $r$ a prime that divides $p+1$) into the group of $r$-th roots of unity in $\mathbb{F}_{p^2}$. Correspondingly, this means that discrete logarithm in such a curve is not harder than discrete logarithm modulo $\mathbb{F}_{p^2}$, which implies that, for cryptographic purposes, $p$ must be large (typically 1024 bits or more), which is detrimental to performance.

When $p = 1 \bmod 3$, things are more complicated. I don't know about any rule on $a_p$ (except $|a_p| \leq 2\sqrt{p}$ by Hasse's theorem) but that does not mean that there is no such rule. Curves with equation $y^2 = x^3+b$ for some constant $b$, in $\mathbb{F}_p$ where $p = 1 \bmod 3$ is prime, are in wide use. Notably, Bitcoin uses such a curve (called "secp256k1").

The key fact you need is this: if $E/K$ is an elliptic curve which has complex multiplication over $K$, then the associated $\ell$-adic Galois representations $$\rho_{E,\ell}:G_K\to\mathrm{GL}_2(\overline{\mathbb Q}_\ell)$$ are reducible for all primes $\ell$. Indeed, $\mathrm{End}(E)\otimes\overline{\mathbb Q}_\ell$ embeds into the endomorphism ring of $\rho_{E,\ell}$, and the former is not a division ring.

In your case, your curve $E: y^2 = x^3-1$ does not have CM over $\mathbb Q$, but it picks up extra endomorphisms over $K=\mathbb Q(\zeta_3)$. It follows that $\rho_{E,\ell}$ is irreducible, but $\rho_{E,\ell}|_{G_K}$ becomes reducible, and representation theory kicks in to show that $$\rho_{E,\ell}\cong \mathrm{Ind}_{G_K}^{G_\mathbb Q}\chi_\ell\qquad(*)$$ where $\chi_\ell$ is a character -- actually it is the Galois character corresponding to the Hecke grossencharacter which is attached to $E$ by the theory of CM.

Finally, one can show using pure representation theory that $(*)$ is equivalent to the statement $$\rho_{E,\ell}\cong\rho_{E,\ell}\otimes\theta\qquad(**)$$ where $\theta:G_\mathbb Q\to\overline{\mathbb Q}_\ell^\times$ is the one dimensional representation which has as its kernel $G_K$. Explicitly, $\theta$ is a lift of the unique non-trivial Dirichlet character of conductor $3$.

In particular:

• If $p\equiv 2\pmod 3$, then $\theta(\mathrm{Frob}_p) = -1$ and it follows from $(**)$ that $a_p = -a_p$, so $a_p = 0$.
• If $p\equiv 1\pmod 3$, then it follows from $(*)$ and the usual formula for the trace of an induced representation that $a_p = 2\chi_\ell(\mathrm{Frob}_p)$, which turns out to be the value you'd expect.