I am reading Pairings for Beginners from Craig Costello (pdf available for free, just google it)

on page 53-55,

We consider an elliptic curve E defined on a finite field $F_q$ with q prime q. We are interested in the r-torsion group E[r] and we consider the smallest finite extension of $F_q$ in which the whole E[r] fits in. let k be the degree of this extension, k is actually the smallest integer such that r is a divisor of $q^k -1$

We can then define the TraceMap : E→E with $Tr(P)=P+π(P)+π^2(P)+⋯+π^{k−1}(P)$, where π is the Frobenius (x,y)↦$(x^q,y^q)$ and the AntiTraceMap P→P′=[k]P−Tr(P).

Then we can define $G1=E[r] \cap ker(π−[1])$ et $G2=E[r] \cap ker(π−[q])$

  1. G1 is called the "base-field subgroup", and every trace of a point in E[r] lands in G1 (i can prove that)

  2. G2 is the subgroup of trace 0. Indeed, every element of G2 image by TraceMap is O (the point at infinity) [I can prove that as well].

However i don't see how to prove the reverse statement: that any point of E[r] such that its Trace is O belongs to G2.


proof of 1) if Q = Tr(P) , and P $\in$ E[r]then Q $\in$ G1 :


it suffices to prove that $π^k(P)=P$ to prove that $π(Q)=Q$. If we come back to the definition of Frobenius, $π^k(P)=(x^{q^k},y^{q^k})=(x(x^{q^{k−1}},y(y^{q^{k−1}}))=(x,y)=P$ because order(P) = r ,and r is a divisor of $q^k−1$

to prove that the order of Q is r, we just notice that $\pi(P)$ and its powers are of order r, and their sum as well.

proof of 2) G2 = E[r] ∩ Ker(Pi - [q]) is the group of trace zero

$(\rightarrow)$ if $P \in G2$, $Tr(P)=P+π(P)+…+π^{k−1}(P)=[1+q+q2+…+q^{k−1}]P=[(q^k−1)/(k−1)]P$ (geometric sum) now, r is a divisor of $q^k−1$ but is prime with k-1 thus the number in brackets is a multiple of r, and the order of P is r, thus Tr(P)=0

$(\leftarrow)$ no proof yet

as a bonus question, in the same book Costello explains the construction and properties of the Tate and Weil pairing. It shows how to compute those pairings and through examples we can verify their bilinearity. It is briefly said that it has to do with the Weil reciprocity which is stated without any proof. Can anyone give at least some intuition or insight (or just a good link is enough) why this is true ?



In the book, $r$ is prime and $r^2=|E[r]|$ doesn't divide $E(\mathbb{F}_q)$, so $E[r]$ isn't contained in $E(\mathbb{F}_q)$. But $E[r]$ is isomorphic to the square of $\mathbb{Z}/(r)$, so that $G_1$ is cyclic with order $r$.

Since $k > 1$, $r$ and $q-1$ are coprime (I honestly can't see why the embedding condition of $E[r]$ in $E(\mathbb{F}_{q^k})$ implies $r|q^k-1$ and $r$ not dividing $q-1$ but never mind), which forces $G_1$ and $G_2$ to be subgroups of $E[r]$ with trivial intersection. So $G_2$ is trivial or cyclic with order $r$. (*)

As you showed (wrong geometric sum though, it's $(q^k-1)/(q-1)$ and as $r$ doesn't divide $q-1$ but divides $q^k-1$, you're still done), $G_2$ is contained in the kernel of the trace, so as the trace $E[r] \rightarrow G_1$ can't be injective, it is either trivial, or surjective with cyclic kernel of order $r$.

Note that, on $G_1$, the trace is $k$ times the identity, and $k,r$ are coprime, because else $r|k$ and $0=q^k-1=q^{k/r}-1$ mod $r$ (which contradicts the minimality of $k$), so is injective. So the trace is nonzero and its kernel $K$ has cardinality $r$.

As $G_2 \subset K$, if $G_2$ has cardinality $r$, we are done. Because of (*), it is enough to show that $G_2$ is nontrivial.

But the characteristic equation of the Frobenius $\pi$ is $\pi^2-t\pi+q=0$, so, applied to a fixed point in $E[r]$, it follows $t=q+1$ mod $r$, so that on $E[r]=\mathbb{F}_r^2$, $\pi^2-(q+1)\pi+q=0$. So, if $x \in E[r] \backslash G_1$, you can check that $(\pi - [q])(y)=0$ where $y=\pi(x)-x \neq 0$, so that $G_2$ is nontrivial. So $G_2$ is nontrivial, which concludes.

I'm afraid I can't help you for the link with Weil reciprocity though.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.