0

So I was reading this online article about twist curve and stuck at the following quote,

"...you are effectively working on a twist E‘ rather than E."

But what does it mean exactly? For supersingular curve $E$ and its twist $E'$, their abscissas form a partition in $\mathbb{F}_p$. Taking $(x,y)\in E(\mathbb F_{q^2})-E(\mathbb F_{q})$ and thus $(x,y')\in E'(\mathbb F_p)$, do we have something like $k(x,y)$ sharing the same $x$-coordinate with $k(x,y')$?

Taylor Huang
  • 499
  • 2
  • 8
  • For $p\ne 2,3$ let $E:Y^2=X^3+aX+b$ and $E_d :d Y^2=X^3+aX+b$ where $d$ is not a square. For $x\in \Bbb{F}_p, y= \pm \sqrt{x^3+ax+b}$, if $x^3+ax+b\ne 0$ then exactly one of $y,\sqrt{d}y$ is in $\Bbb{F}_p$. If $x^3+ax+b=0$ then $y=0$ so that $(x,y) = (x,-y)=-1$ and $(x,y)\in E[2]$. Thus the only $x$ in common of $E(\Bbb{F}_p),E_d(\Bbb{F}_p)$ are the roots of $X^3+aX+b$ which corresponds to $E(\Bbb{F}_p)[2]=E_d(\Bbb{F}_p)[2]$. – reuns Feb 26 '20 at 11:01
  • Well, that's not a problem because I ask for $(x,y)$ to fall in $\mathbb{F}_{p^2}$. – Taylor Huang Feb 26 '20 at 11:09

0 Answers0