3

Please help or hints me to solve this question:

Suppose that $E: y^2+y= x^3+x$ be an elliptic curve over $\Bbb F_2$, We know that $E$ is supersingular. Show that $E[5] ‎‎\subseteq‎‎ E(\Bbb F_{16})$.

Masoud
  • 425
  • More generally, the smallest integer $k \geq 1$ such that $E[m] \subset E(\Bbb F_{q^k})$ (where $(m,q)=1$) is equal to the smallest integer $r \geq 1$ such that $m$ divides $q^r-1$. – Watson Feb 09 '17 at 13:11
  • 1
    @Watson: Is that really so? Over the algebraic closure $k=\overline{\Bbb{F}2}$ the curve $E$ has $15^2=225$ torsion points of order a factor of $15$. We cannot have all of them included in $E(\Bbb{F}{16})$ because by Hasse-Weil $|E(\Bbb{F}{16})|\le 16+2\cdot4+1=25$. What is true (follows from rationality of Weil pairing) that if $E[m]\subset E(\Bbb{F}{Q})$ then $m\mid Q-1$. – Jyrki Lahtonen Feb 09 '17 at 13:20
  • @JyrkiLahtonen : you seem to be right. Maybe we should make the extra assumption that there is a point of order $m$ in $E(\Bbb F_q)$ (not only over the algebraic closure). I haven't checked if this curve has. But I think that in that case $m \mid Q-1 \implies E[m] \subset E(\Bbb F_Q)$. – Watson Feb 09 '17 at 13:35
  • @JyrkiLahtonen : I think that this is Lemma 6.2. p. 387-388 in 2nd edition of Silverman's The Arithmetic of Elliptic Curves. – Watson Feb 09 '17 at 13:44
  • Thanks, @Watson. My copy of Silverman is at home. Will check later today. [Added later:] Couldn't find it in there. Apparently mine is an older edition given that p. 387-388 are well into the index. Well, Lubin's answers + comments settled it anyway. – Jyrki Lahtonen Feb 09 '17 at 13:46
  • 1
    After doing my answer(s) up, I realize that these comments have the whole thing in a nutshell. Since the $e_5$-pairing is defined over $\Bbb Z$, once you have a point of order $5$ and the fifth roots of unity, you have the other points of order $5$ as well. – Lubin Feb 09 '17 at 14:49

2 Answers2

5

My (never totally reliable) computation says that for this curve, $[2](\xi,\eta)=(\xi^4+1,\eta^4+\xi^4+1)$, and that therefore $[4](\xi,\eta)=(\xi^{16},\eta^{16}+1)$. Since $[-1](\xi,\eta)=(\xi,\eta+1)$, you see that for any $P\in E(\Bbb F_{16})$, you have $[4](P)=[-1](P)$. I did the computation by hand in about 10 minutes. From the fact that the curve has five points over the prime field, you use the Zeta function to see that it has $25$ points over $\Bbb F_{16}$, and that does it.

EDIT - addendum:
But the right way to do it is this: Since the curve has five points over $\Bbb F_2$, the characteristic polynomial for Frobenius $\mathbf f$ is $X^2+2X+2$, eigenvalues $-1\pm i$. Thus the characteristic polynomial of $\mathbf f^4$ has both eigenvalues equal to $-4$. That shows immediately that for $P\in E(\Bbb F_{16})$, $P=[-4](P)$.

Lubin
  • 62,818
2

Extended hints:

A point $P$ is of order $5$ iff $[4]P=-P$. For this to happen it is necessary that the points $[4]P$ and $[P]$ share the $x$-coordinate, but don't share the $y$-coordinate (if $[4]P=P$, then $P$ will be 3-torsion). This suggests the following approach:

  • Figure out the point doubling formula for this curve.
  • Iterate the above to figure out the point quadrupling formula.

Then show that this leads to a system of equations with all the solutions in $\Bbb{F}_{16}$.

Jyrki Lahtonen
  • 133,153
  • I didn't redo this now, but some fifteen years ago I worked this out for our seminar. That's how it went. IIRC trace also showed up. – Jyrki Lahtonen Feb 09 '17 at 13:12