The multiplication-by-n endomorphism [n] on the group of points of a Weierstrass
curve, packaged as an additive group homomorphism W.Point →+ W.Point.
Instances For
Evaluating the multiplication-by-n map at a point P is the same as the integer
scalar multiple n • P.
The n-torsion subgroup E[n] of a Weierstrass curve, defined as the kernel of the
multiplication-by-n homomorphism.
Instances For
A point P lies in E[n] if and only if n • P = 0.
Any additive group homomorphism between point groups of Weierstrass curves preserves
the n-torsion subgroup.
A Weierstrass curve W over a field of characteristic p is ordinary if its
p-torsion E[p] is isomorphic to ℤ/pℤ (cf. Definition 6.2 of Sutherland).
Instances For
A Weierstrass curve W over a field of characteristic p is supersingular if its
p-torsion E[p] is trivial (cf. Definition 6.2 of Sutherland).
Instances For
For a supersingular curve, any point killed by multiplication by p is the zero
point.
A curve is supersingular if and only if multiplication by p is injective on its
group of points.
Multiplication-by-n is natural with respect to additive group homomorphisms between
point groups: [n] ∘ α = α ∘ [n] (cf. Proposition 6.5 of Sutherland).
The pointwise version of multiplicationByN_comp_hom: n • (α P) = α (n • P).
A nonzero integer multiple of a (nonzero) isogeny remains a nonzero homomorphism;
expresses the torsion-freeness of Hom(E₁, E₂) as a ℤ-module.
The ℤ-rank of Hom(E₁, E₂) is at most 4, a classical structural fact for the
homomorphism group between two elliptic curves.
Right-cancellation for isogenies (one half of Lemma 6.6): if α ∘ γ = β ∘ γ with
γ an isogeny (hence surjective), then α = β as homomorphisms.
An isogeny composed with a nonzero homomorphism is itself nonzero: pre-composition by
an isogeny δ reflects nonzeroness of homomorphisms.
Left-cancellation for isogenies (the other half of Lemma 6.6): if δ ∘ α = δ ∘ β
with δ an isogeny, then α = β as homomorphisms.
The n-torsion subgroup E(K)[n] of an elliptic curve E/k after base change to a
field extension K, defined as the torsion subgroup of the projective point group.
Instances For
Membership characterisation: a point P ∈ E(K) lies in E(K)[n] iff n • P = 0.
Over an algebraically closed field K, when n is coprime to the characteristic,
the n-torsion E(K)[n] is finite — a Fintype instance underlying Theorem 6.1.
Instances For
Theorem 6.1 (cardinality part): over an algebraically closed field K, if n is
coprime to char k, then #E(K)[n] = n².
A finite abelian group of order n² whose every element is killed by n is
isomorphic to (ℤ/nℤ)². Used as a structural step toward Theorem 6.1.
Theorem 6.1 (structure part): over an algebraically closed K, when n is coprime
to char k, the n-torsion is E(K)[n] ≃ ℤ/nℤ ⊕ ℤ/nℤ.
Theorem 6.1 (characteristic-p part): over an alg. closed K, the p-torsion is
either ℤ/pℤ (ordinary case) or trivial (supersingular case).
Over an algebraically closed field, multiplication-by-n (for n ≠ 0) is surjective
on the group of points of an elliptic curve.
Supersingularity is preserved under powers of p: if E[p] = 0 then E[pᵉ] = 0
for all e ≥ 1.
Ordinarity propagates to powers of p: if E[p] ≃ ℤ/pℤ then E[pᵉ] ≃ ℤ/pᵉℤ.
Corollary 6.4 (subgroup form): any finite subgroup of E(K̄) is a direct sum of (at
most) two cyclic groups, only one of which can have order divisible by char k.
Corollary 6.4 (finite field form): for E/𝔽_q of characteristic p,
E(𝔽_q) ≃ ℤ/n₁ℤ ⊕ ℤ/n₂ℤ with n₂ ∣ n₁ and p ∤ n₂.
The degree of a composition of isogenies is the product of the degrees:
deg(ψ ∘ φ) = deg ψ · deg φ.
Two isogenies with the same underlying additive map must have the same degree (since the degree is determined by the kernel/map data).
The kernel of an isogeny α is contained in the kernel of multiplication-by-deg α;
this is a key step toward the construction of the dual isogeny (Theorem 6.7).
A degree-1 isogeny has trivial kernel.
A degree-1 isogeny is injective on points.
Existence of the dual for a degree-1 isogeny: a degree-1 isogeny is an isomorphism
and its inverse plays the role of the dual (cf. Theorem 6.7).
If p is a prime dividing the degree of an isogeny α : E₁ → E₂ of degree > 1,
then there exists an intermediate curve and a degree-p quotient isogeny β : E₁ → E_mid
whose kernel is contained in that of α.
For any prime divisor p of deg α (with deg α > 1), one can factor α = γ ∘ β
with deg β = p and the degrees multiplying to deg α.
A composite-degree isogeny can be properly factored: if deg α > 1 is not prime, then
α = γ ∘ β with both β and γ of degree strictly less than deg α.
Existence of the dual via composition: if α factors as γ ∘ β with duals existing
for both β and γ, then a dual exists for α (used in the inductive proof of 6.7).
Multiplication-by-n is surjective on the points of a Weierstrass curve when
n ≠ 0.
Package multiplication-by-n as an Isogeny E E of degree n².
Instances For
The underlying additive homomorphism of the packaged multiplication-by-n isogeny is
exactly multiplicationByN E n.
Any self-isogeny whose underlying map is multiplicationByN E n has degree n².
Factoring through the kernel: if ker φ ⊆ ker ψ, then ψ factors as λ ∘ φ for
some isogeny λ (existence statement).
Existence of the dual for a prime-degree isogeny: when deg α is prime, the dual
exists, by factoring [deg α] through α.
Theorem 6.7 (existence): for every isogeny α : E₁ → E₂ there exists an isogeny
α̂ : E₂ → E₁ satisfying α̂ ∘ α = [deg α]. Proven by strong induction on degree.
Uniqueness of the dual at the homomorphism level (cf. Theorem 6.7): any two isogenies
αd₁, αd₂ satisfying the defining equation of the dual agree as homomorphisms.
Theorem 6.7 in existence-and-uniqueness form: there is a unique-up-to-toAddMonoidHom
isogeny α̂ satisfying α̂ ∘ α = [deg α].
Extensionality for Isogeny: two isogenies are equal if their underlying homs and
degrees agree.
Any isogeny β satisfying the dual equation β ∘ α = [deg α] automatically has
deg β = deg α — using deg(β ∘ α) = (deg α)².
Definition 6.8: the dual isogeny α̂ of α, obtained by choosing a witness from
α.dual_exists.
Instances For
Defining property of the dual isogeny (Definition 6.8): α̂ ∘ α = [deg α].
Pointwise form of Isogeny.dualIsogeny_comp: α̂(α(P)) = (deg α) • P.
Uniqueness of the dual at the homomorphism level: any β : E₂ → E₁ with
β ∘ α = [deg α] agrees as a hom with α.dualIsogeny.
The dual isogeny has the same degree as the original (part of Lemma 6.10).
Strengthened existence-and-uniqueness of the dual as an Isogeny (not just at the
toAddMonoidHom level), using Isogeny.ext and degree_dualIsogeny.
The other half of Lemma 6.10: α ∘ α̂ = [deg α] on E₂, obtained by right-cancelling
through α.
Pointwise form of α ∘ α̂ = [deg α]: α(α̂(Q)) = (deg α) • Q.
The dual of the dual recovers the original (α̂̂ = α, part of Lemma 6.10).
Lemma 6.10 (self-duality of [n]): for any n ≠ 0, [n]̂ = [n] as endomorphisms.
Lemma 6.11: the dual is additive — (α + β)̂ = α̂ + β̂ for α, β ∈ Hom(E₁, E₂).
Pointwise form of Lemma 6.11 (dualIsogeny_add).
Lemma 6.12: the dual of a composition is the reversed composition of duals,
(α ∘ β)̂ = β̂ ∘ α̂.
Definition 6.13: the endomorphism ring End(E) = Hom(E, E) as the additive monoid of
endomorphisms of E.Point, with multiplication given by composition.
Instances For
Ring structure on EndRing E, inherited from AddMonoid.End.
The canonical ring homomorphism ℤ → End(E) sending n to [n].
Instances For
Evaluating intToEndRingHom n at a point P yields n • P.
The image of n under intToEndRingHom is the multiplicationByN endomorphism.
Integers (viewed as endomorphisms via [n]) commute with every endomorphism of E,
i.e. [n] lies in the center of End(E).
The product in EndRing E is composition pointwise: (α * β) P = α (β P).
The sum in EndRing E is pointwise addition.
The unit 1 : EndRing E is the identity endomorphism.
The zero 0 : EndRing E sends every point to the zero point.
Auxiliary form of Lemma 6.16: if oneMinusAlpha = [1] - α as homs, then its dual
equals [1] - α̂. Used to relate the duals of α and 1 - α.
Lemma 6.16: α + α̂ = [1 + deg α - deg(1 - α)] as endomorphisms of E.
Existence of an isogeny representing [1] - α, used to package the trace
construction underlying Definition 6.17.
Auxiliary trace formula tr α = 1 + deg α - deg(1 - α) parameterised by a specific
witness of 1 - α (cf. Definition 6.17).
Instances For
Rephrasing of Lemma 6.16 in terms of traceAux: α + α̂ = [traceAux α (1-α)].
Definition 6.17: the trace of an endomorphism α, defined via the integer such that
α + α̂ = [tr α]. Implemented by choosing a witness for 1 - α.
Instances For
Defining identity for the trace (Definition 6.17): α + α̂ = [tr α].
Pointwise form of the trace identity: α(P) + α̂(P) = (tr α) • P.
Convenience abbreviation trace' for Isogeny.trace, used to state Theorem 6.18.
Instances For
Trace identity restated using trace': α + α̂ = [trace' α].
Combined existence statement: a witness oma of 1 - α exists together with the
trace identity expressed via 1 + deg α - deg(oma).
Auxiliary form of Theorem 6.18 (characteristic polynomial via traceAux):
α² - [tr α] α + [deg α] = 0 in End(E).
Theorem 6.18 (for α): α satisfies its characteristic equation
α² - [tr α] α + [deg α] = 0.
Auxiliary form of Theorem 6.18 for the dual: α̂ also satisfies the same
characteristic equation, expressed via traceAux.
Theorem 6.18 (for α̂): the dual α̂ also satisfies the characteristic equation
λ² - (tr α) λ + deg α = 0.
Two endomorphisms α, β of E agree on n-torsion iff their underlying maps match
on E[n]. This is the predicate denoted αₙ = βₙ in Lemma 6.19.
Instances For
Cauchy-style interpolation for endomorphisms: if α and β agree on E[n] for a
sufficiently large n coprime to the characteristic and to both degrees, then globally
either α = β or α = -β.
If n is coprime to deg α, then α restricted to E[n] is injective: the only
n-torsion point in the kernel of α is 0.
Existence of an n-torsion point whose image under α is not 2-torsion, used in
the sign resolution step of Lemma 6.19.
Pointwise version of the global ± dichotomy: under the hypotheses of Lemma 6.19,
for every P, either α(P) = β(P) or α(P) = -β(P).
Sign-resolution step in Lemma 6.19: combining the pointwise ± dichotomy with
agreement on E[n] and the non-2-torsion image, deduce α = β.
Auxiliary form of Lemma 6.19 stated with an unfolded agreement hypothesis: if α and
β agree on E[n] for n satisfying the size/coprimality conditions, then α = β.
Lemma 6.19: for n ≥ 2√m + 1 coprime to the characteristic and to deg α, deg β,
if αₙ = βₙ (i.e. α and β agree on E[n]) then α = β.
Pointwise form of Lemma 6.19: under the same hypotheses, α(P) = β(P) for every
point P.