2

I am starting out trying to understand ordinary and supersingular elliptic curves, I have read that for an elliptic curve to be supersingular over a field F, then its p-torsion subgroup must be trivial.

Firstly is this the only criteria that needs to be met in order to have a supersingular curve?

And secondly, how would you go about generating the p-torsion subgroup in order to see whether it is trivial or not?

Thanks

Junsworth
  • 55

1 Answers1

5

To answer your second question first, there is a polynomial $\psi_{E,p}(x)$ whose roots are the $x$-coordinates of the $p$-torsion points. It can be computed recursively by a "double-and-add" procedure in roughly $O(\log p)$ time. And there are no $p$-torsion points on $E$ if and only if $\psi_{E,p}(x)$ is constant. However, one can also compute a polynomial $F_p$ with the property $F_p(j(E))=0$ if and only if $E$ is supersingular. To get to your first question, there are other criteria that are equivalent to there being no $p$-torsion. For example, $E$ is supersingular if and only if the multiplication-by-$p$ map is purely inseparable. (One place to read about this is Chapter V Section 4 of my book The Arithmetic of Elliptic Curves, but of course there are plenty of other sources.)

Joe Silverman
  • 2,174
  • Thank you for your reply, how would one go about computing the polynomial $F_p$ you speak of? – Junsworth Feb 24 '17 at 15:59
  • 2
    For $E_\lambda:y^2=x(x-1)(x-\lambda)$, you'll find the equation for $H_p(\lambda)=0$ giving the supersingular curves in any standard textbook. For example, my Arithmetic of Elliptic Curves, Theorem V.4.1. There's an easy formula for $j(E_\lambda)$, so that's more-or-less what you want. Explicitly $$H_p(\lambda)=\sum_{i=0}^{(p-1)/2} \binom{m}{i}^2\lambda^i$$ and $$j(E_\lambda)=2^8\frac{(\lambda^2-\lambda+1)^3}{\lambda^2(\lambda-1)^2}.$$ – Joe Silverman Feb 24 '17 at 20:58