# Fields of definition for torsion points on elliptic curves over finite fields

This is about the following proposition from R. Schoof's article Nonsingular Plane Cubic Curves over Finite Fields:

Proposition 3.7: Let $E$ be an elliptic curve over the finite field ${\mathbb F}_q$ of characteristic $p$ and $n\in {\mathbb N}$ such that $p\nmid n$. Further, let $t$ be the trace of the Frobenius $\phi$, that is, $t := q + 1 - |E({\mathbb F}_q)|$. Then the following are equivalent:

1. $E(\overline{{\mathbb F}_q})[n]\subset E({\mathbb F}_q)$, i.e. every $n$-torsion point is defined over ${\mathbb F}_q$.
2. $n | q-1$, $n^2 | q + 1 - t$, and either $\phi\in{\mathbb Z}$ or ${\mathcal O}\left(\frac{t^2-4q}{n^2}\right)\subset\text{End}_{{\mathbb F}_q}(E)$.

Here ${\mathcal O}(\Delta)$ is introduced earlier as the complex quadratic order with discriminant $\Delta$.

I'm having trouble understanding the precise meaning of the second statement if $E$ is not ordinary. First, under the assumption that $n | q - 1$ and $n^2 | q + 1 - t$, one has $n^2 | t^2 - 4q$, so ${\mathcal O}\left(\frac{t^2-4q}{n^2}\right)$ is defined. But:

Q: Is ${\mathcal O}\left(\frac{t^2-4q}{n^2}\right)\subset\text{End}_{{\mathbb F}_q}(E)$ really only supposed to mean that there's some embedding, even if $\text{End}_{{\mathbb F}_q}(E)$ is not assumed to be commutative?

As far as I understand, for a commutative domain $R$ the image of an embedding ${\mathcal O}\left(\Delta\right)\to R$ is unique if it exists, namely the subring of $R$ spanned by all solutions of quadratic equations with discriminant $\Delta$ - and in fact, a single such would suffice. However, over the non-commutative domain $\text{End}_{{\mathbb F}_q}(E)$ this canonicity seems to fail - e.g. in the ring of integral quaternions ${\mathbb Z}[i,j,k]$ we have $X^2 + 1 = (X-i)(X+i) = (X-j)(X+j) = (X-k)(X+k)$ corresponding to different embeddings ${\mathcal O}(-4)={\mathbb Z}[i]\hookrightarrow {\mathbb Z}[i,j,k]$. Given that such quaternion algebras actually arise as endomorphism algebras of supersingular elliptic curves, this example doesn't seem to be too far-fetched. In fact, this is the case I am most interested in.

Q: Considering that the proposition is specifically about describing $\frac{\phi-1}{n}$ as opposed to any quadratic element of $\text{End}_{{\mathbb F}_q}(E)$ of discriminant $\frac{t^2-4q}{n^2}$, perhaps one should restrict the discussion to the intersection of $\text{End}_{{\mathbb F}_q}(E)$ with the ${\mathbb Q}$-subalgebra of $\text{End}_{\overline{{\mathbb F}_q}}(E)\otimes_{\mathbb Z}{\mathbb Q}$ generated by $\phi$?

Looking at the proof doesn't help me, unfortunately, because it also uses notation I'm lacking a precise definition for.

I'd be happy if somebody could clarify. Thanks alot!

• Most curves aren't supersingular. For those ordinary curves, those two rings are subrings of imaginary quadratic fields and so inclusion just means inclusion (of subrings of $\Bbb C$ if you want to be really concrete). – Lord Shark the Unknown Oct 23 '17 at 19:08
• @LordSharktheUnknown I'm especially interested in supersingular curves, though. As detailed in the question, the commutative case appears unproblematic. – Hanno Oct 23 '17 at 19:24
• Sorry forget it. Do you have Silverman the arithmetic of elliptic curves ? It is about $End_{\overline{\mathbb{F}_q}}(E) \supset \mathbb{Z}[\phi] \cong \mathbb{Z}[\sqrt{t^2-4q}]$ ie. the minimal polynomial of $\phi$ is $x^2-tx+q$. If the curve is not supersingular then that's nearly its whole endomorphism ring. For example $y^2 = x^3-x \bmod p$ for every $p \ne 2,3$ has CM by $\mathbb{Z}[i]$, its Frobenius $\phi = a+ib$ and $\mathbb{Z}[\phi] = \mathbb{Z}[ib]$. – reuns Oct 24 '17 at 6:06
• @reuns Thanks! That last example also assumes $E$ non-supersingular, i.e. $p\equiv 1\pmod 4$, right? (For $p\equiv 3\pmod 4$ the Frobenius and the CM by $i$ anticommute) If $p\equiv 1\pmod 4$, how would you argue that $\phi\in{\mathbb Z}[i]$? – Hanno Oct 24 '17 at 6:36