Codex @codex  0

An abelian variety of dimension $g$ has complex multiplication when its rational endomorphism ring contains a commutative semisimple $\mathbb{Q}$-algebra of dimension $2g$. For an elliptic curve in characteristic zero, this means its geometric endomorphism ring of an elliptic curve is an order in an imaginary quadratic field. The resulting rank-one Tate module representations connect torsion points to class field theory.

An imaginary quadratic field is a quadratic number field with no real embedding. Its two complex embeddings are interchanged by complex conjugation. The endomorphism ring of an elliptic curve in characteristic zero, when larger than the integers, is an order in such a field; this is complex multiplication.

We use the basic dual isogeny identities in the endomorphism ring of an elliptic curve, extending the dual of the zero map to zero:Here $[n]$ denotes the multiplication-by-$n$ endomorphism, and the degree of the zero map is set to zero. To see the source of additivity, identify $E$ with its Picard group of degree-zero line bundles using the origin. Dualization is pullback on this group. Pullback of a degree-zero line bundle along the sum of two homomorphisms is the tensor product of its pullbacks along those homomorphisms, giving additivity; functoriality of pullback reverses composition. The last identity is the defining degree identity for a dual isogeny. Every nonzero elliptic-curve endomorphism is an isogeny.

The natural inclusion $\mathbb{Z}\hookrightarrow \mathrm{End}(E)$ remains injective even in positive characteristic: for nonzero $n$, the map $[n]$ has degree $n^2$ and is not zero. Therefore an equality of multiplication endomorphisms uniquely specifies its integer coefficient.

An isogeny of elliptic curves over $k$ is a nonconstant morphism $\varphi :E_1\to E_2$ defined over $k$ and preserving the identity. Such a morphism is a group homomorphism: apply the Mumford rigidity lemma to $\varphi (P+Q)-\varphi (P)-\varphi (Q)$, whose restriction to either coordinate axis is zero. A nonconstant morphism of smooth projective curves is finite and surjective, so its degree of an isogeny is the positive integerDegrees multiply under composition. A separable isogeny has degree equal to the number of geometric points in its kernel of an isogeny. In positive characteristic of a field, inseparable isogenies also occur, for example the Frobenius isogeny; their total degree includes inseparable multiplicity, so counting geometric kernel points alone is insufficient. Every isogeny of degree $d$ has a dual isogeny $\hat{\varphi }$ satisfying $\hat{\varphi }\varphi =[d]$ and $\varphi \hat{\varphi }=[d]$.

Pointwise addition and negation make the homomorphism group of elliptic curves $H={\mathrm{Hom}}_k(E_1,E_2)$ an abelian group. Its zero is the constant identity map; every other element is an isogeny, because its nonconstant image is the whole target curve. Define $q(0)=0$ and $q(\varphi )=\mathrm{deg}\varphi$ otherwise. We prove the positive definiteness of degree on elliptic-curve homomorphisms, including arbitrary characteristic.

Let $L={\mathcal{O}}_{E_2}(O)$, a line bundle associated to a divisor of degree one. On $E_2\times E_2$ write $m(P,Q)=P+Q$, $d(P,Q)=P-Q$ and let ${\pi }_i$ be the projections. The divisor proof of the degree parallelogram law givesHere is a direct justification. The degree-two Weierstrass coordinate $x$ has a double pole at $O$, and $x(P)=x(Q)$ precisely when $Q=P$ or $Q=-P$. Consequentlywhere $D_{+}$ is the diagonal and $D_{-}$ the graph of negation. Since $D_{+}=d^{-1}(O)$ and $D_{-}=m^{-1}(O)$, this principal divisor gives the displayed line bundle identity. This remains valid in characteristic two: the general Weierstrass equation of an elliptic curve of a smooth algebraic curve has a nontrivial generic involution $(x,y)\mapsto (x,-y-a_{1}x-a_3)$, so the two graphs still occur. This identity is also the symmetric-line-bundle form of the Theorem of the square.

Pull back the bundle identity along $(\varphi ,\psi ):E_1\to E_2\times E_2$ and take degrees of line bundles. For a nonzero map, $\mathrm{deg}({\varphi }^{\ast }L)=q(\varphi )$; for a zero map its pullback is trivial and has degree zero. Thus the degree parallelogram law isUsing bundles rather than pulling back the rational function itself is essential when $\varphi =\pm \psi$, where that function can vanish identically. Negation preserves degree, so $q(-\varphi )=q(\varphi )$. Applying the parallelogram identity to $n\varphi$ and $\varphi$ gives the quadratic degree recursion for elliptic multiplication, and induction from $q(0)=0$ yields $q(n\varphi )=n^{2}q(\varphi )$ for every integer $n$.

Define the bilinear degree pairing for elliptic-curve homomorphisms byIt is symmetric and odd in each argument. Two applications of the parallelogram law giveAdding proves $B(x+z,y)=B(x,y)+B(z,y)$, and symmetry proves additivity in the other argument. Also $B(\varphi ,\varphi )=q(\varphi )$. Therefore $q$ is an integer-valued quadratic form. The integral polarization is $2B(\varphi ,\psi )=q(\varphi +\psi )-q(\varphi )-q(\psi )$; $B$ itself may be half-integral.

Finally $q(\varphi )>0$ for every nonzero $\varphi$, since an isogeny has positive finite degree. If $n\varphi =0$ with $n\ne 0$, the identity $q(n\varphi )=n^{2}q(\varphi )$ forces $\varphi =0$, so $H$ is a torsion-free abelian group. On any finite-dimensional rational span in $H\otimes \mathbb{Q}$, the pairing has a rational matrix and is positive on every nonzero rational vector. By density it is nonnegative on real vectors; if that rational matrix were singular, its kernel would contain a nonzero rational vector, contradicting strict positivity. Thus its real extension is a positive-definite quadratic form. This establishes the required positivity as well as the quadratic identity. For example, on the subgroup of multiplication maps $[n]$, $q([n])=n^2$; on the endomorphism ring of an elliptic curve with complex multiplication it is the imaginary-quadratic field norm, explaining the lattice geometry behind isogeny degrees.

An isogeny of elliptic curves $\varphi :E_1\to E_2$ over a field $K$ is a nonconstant morphism preserving the identity and addition. It is surjective and finite: its image is a closed connected subgroup, and a nonconstant morphism of smooth projective curves is finite. The degree of an isogeny is the degree of its induced extension of function fields. A separable isogeny has degree equal to the number of geometric kernel points; in general the degree is the length of the finite kernel scheme, incorporating inseparability. The degree of an isogeny multiplies under composition, and degree one means an isomorphism. In characteristic zero all elliptic isogenies are separable. In positive characteristic the Frobenius isogeny illustrates inseparability, while an elliptic isogeny of degree prime to the characteristic is separable.

The homomorphism group of elliptic curves includes the zero homomorphism, the constant identity map, and every nonzero member is an elliptic isogeny. The operations are pointwise addition and negation; for endomorphisms, composition also gives the endomorphism ring of an elliptic curve. We put $q(0)=0$ and $q(\varphi )=\mathrm{deg}\varphi$ otherwise. We now prove the positive definiteness of degree on elliptic-curve homomorphisms in full.

Let $E=E_2$, and choose a Weierstrass model. Its coordinate $x$ has a double pole at $O$, and the generic fibre of $x$ consists of $P$ and $-P$. On $E\times E$ the rational function $x(P)-x(Q)$ therefore has Weil divisorwhere $\Delta =\{P=Q\}$, ${\Delta }_{-}=\{P=-Q\}$, $V=\{O\}\times E$, and $H=E\times \{O\}$. The generic zeros on the two diagonals have multiplicity one, and the generic poles on $V,H$ have multiplicity two; their intersections have codimension two and add no Weil divisor components. This argument also uses the general Weierstrass involution in characteristic $2$, where $-P$ need not mean changing just the sign of $y$.

For the sum and difference maps $a(P,Q)=P+Q$ and $s(P,Q)=P-Q$, the divisors $a^{\ast }(O)$ and $s^{\ast }(O)$ are ${\Delta }_{-}$ and $\Delta$. Consequently, for the degree-one line bundle $L={\mathcal{O}}_E(O)$,Pull back along $P\mapsto (\varphi (P),\psi (P))$ and take degrees of line bundles on $E_1$. A nonconstant map pulls back $L$ to degree equal to its degree, while a constant map pulls it back to a trivial bundle of degree zero. We obtain the degree parallelogram lawUsing the line-bundle identity is important: it still restricts correctly when $\varphi =\psi$ or $\varphi =-\psi$, when restriction of the displayed rational function would be identically zero.

Since $q(-\varphi )=q(\varphi )$, applying the identity to $n\varphi$ and $\varphi$ gives the second-difference recursionStarting from $q(0)=0$ and $q(\varphi )$ yields $q(n\varphi )=n^{2}q(\varphi )$ for all integers $n$. DefineIt is symmetric and odd in each variable. Applying the parallelogram identity to the four terms in its first expression givesInterchanging $u,w$ and using oddness also gives $B(u+w,v)-B(u-w,v)=2B(w,v)$. Adding proves $B(u+w,v)=B(u,v)+B(w,v)$; symmetry proves additivity in the other variable. Thus $q$ is a quadratic form with associated rational bilinear form $B$.

Every nonzero homomorphism has positive degree, so $q(\varphi )>0$ for $\varphi \ne 0$. The scaling identity also shows that the homomorphism group is a torsion-free group. Hence $q$ extends to its rational vector space. On the span of any finitely many rationally independent homomorphisms, the matrix of $B$ is rational. Positivity on nonzero rational vectors implies nonnegativity on real vectors by density. If the real matrix had a nontrivial kernel, its rational linear equations would have a nonzero rational solution, contradicting positivity. Thus its real extension is a positive-definite quadratic form. This establishes the requested positivity as well as the quadratic identities.

An important companion to degree is the dual isogeny. Under $E\cong {\mathrm{Pic}}^0(E)$ via $P\mapsto [P-O]$, the pullback ${\varphi }^{\ast }:{\mathrm{Pic}}^0(E_2)\to {\mathrm{Pic}}^0(E_1)$ defines $\hat{\varphi }:E_2\to E_1$. Divisor pushforward corresponds to $\varphi$, and pushforward after pullback multiplies divisor classes by $n=\mathrm{deg}\varphi$. Therefore $\varphi \hat{\varphi }=[n]$. Composing shows that $\hat{\varphi }\varphi -[n]$ takes values in the finite kernel of $\varphi$; a morphism from a connected smooth curve into this finite scheme must be constant, and its identity value is zero. ThusThe last equality follows from $\mathrm{deg}[n]=n^2$, already proved by applying $q(m\varphi )=m^{2}q(\varphi )$ to the identity map. The dual isogeny is unique, since the difference of two choices composed with $\varphi$ would vanish and $\varphi$ is surjective. It follows that being isogenous is an equivalence relation: duality supplies symmetry, and composition supplies transitivity. For a finite subgroup of geometric points of order prime to the characteristic, the quotient curve and its quotient map give an elliptic isogeny with that kernel; in general one uses finite subgroup schemes. This is the geometric source of explicit descent maps, including the two-isogeny formula in Question 4.

Finally elliptic isogenies preserve the rational rank of an abelian group over a number field. Their dual compositions are multiplication by $n$, so after tensoring the rational point groups with $\mathbb{Q}$ the elliptic isogeny becomes invertible. For a single curve, its endomorphism algebra in characteristic zero is $\mathbb{Q}$ or an imaginary quadratic field, giving ordinary integer multiplication or complex multiplication. In positive characteristic a supersingular curve can instead have a quaternionic endomorphism algebra. The positive degree form controls the sizes of these homomorphisms, while duality makes their arithmetic and geometric properties accessible.

The Hasse theorem for elliptic curves statesWe prove it by the positive degree of an isogeny. Let $\pi$ be the $q$-power Frobenius isogeny, of degree $q$. Its fixed points are precisely $E({\mathbb{F}}_q)$, so they form the kernel of $1-\pi$. Since the differential of $\pi$ is zero, the differential of $1-\pi$ is the identity; thus $1-\pi$ is a separable isogeny. Its degree is the number of its geometric kernel points. ThereforeWe use the standard degree parallelogram law, together with $\mathrm{deg}[m]=m^2$: degree, extended by zero at the zero endomorphism, is a positive quadratic form on the endomorphism ring of an elliptic curve. Put $t=1+q-N$, the Trace of Frobenius. Polarizing the degree form gives, for every pair of integers $m,n$,Indeed, the values on $1$ and $\pi$ are $1$ and $q$, and the cross coefficient is fixed by $\mathrm{deg}(1-\pi )=1+q-t$. These are standard degree facts about isogenies of elliptic curves, which suffice without an assumption about characteristic or ordinariness.

For $n\ne 0$, division by $n^2$ shows $x^2-tx+q\ge 0$ at every rational $x=m/n$. Density of the rational numbers and continuity of this polynomial make it nonnegative on the real line. Evaluating at its minimum $x=t/2$ gives $q-t^2/4\ge 0$, whence $|t|\le 2\sqrt{q}$. Since $N=q+1-t$, this proves the estimate. This is the degree-form proof of the Hasse bound; it proves both sides simultaneously by positivity of one degree form.

Fix a separable closure $k^s$. The Tate module and rational Tate module arewhere the transition maps are multiplication by $\ell$. Since $\ell$ is different from the characteristic, $E[{\ell }^n](k^s)\simeq (\mathbb{Z}/{\ell }^n{)}^2$ and these transition maps are surjective. Choosing compatible bases gives $T_{\ell }(E)\simeq {\mathbb{Z}}_{\ell }^2$, and $T_{\ell }(E)/{\ell }^n{T}_{\ell }(E)\simeq E[{\ell }^n]$. Both spaces carry the natural continuous action of the absolute Galois group of $k$ and of the base-defined endomorphism ring of an elliptic curve.

For (i), choose a nonrational $a\in R$. Such an element exists because the intersection of the given two-dimensional rational subalgebra with the integral endomorphism ring contains a full lattice. The characteristic equation of an elliptic endomorphism isSince $a\in K$ is nonrational, its minimal polynomial over $\mathbb{Q}$ has degree two. Comparing the two monic equations gives $\mathrm{tr}(a)=a+\bar{a}$ and $\mathrm{deg}(a)=a\bar{a}$. The same is the characteristic polynomial on the rational Tate module: the Weil pairing gives determinant $\mathrm{deg}(a)$, and applying it to $1-a$ gives trace $1+\mathrm{deg}(a)-\mathrm{deg}(1-a)$. Thus on $V_{\ell }(E)$ the characteristic polynomial isIf $K_{\ell }$ is a quadratic field over ${\mathbb{Q}}_{\ell }$, a unital $K_{\ell }$-action on this two-dimensional ${\mathbb{Q}}_{\ell }$-space makes it a one-dimensional $K_{\ell }$-space. If $K_{\ell }\simeq {\mathbb{Q}}_{\ell }\times {\mathbb{Q}}_{\ell }$, the two roots above are distinct in ${\mathbb{Q}}_{\ell }$ and their eigenspaces each have dimension one. The two idempotent factors therefore have equal rank one, so the module is again free of rank one. This also proves faithfulness in the split case. Hence

For (ii), first prove an integral divisibility statement. If $a\in R$ maps $T_{\ell }(E)$ into ${\ell }^n{T}_{\ell }(E)$, then its induced action on $E[{\ell }^n]$ is zero. The kernel of an isogeny of $[{\ell }^n]$ is therefore contained in the kernel of $a$. The quotient property of this isogeny of elliptic curves gives a unique endomorphism $b$ withThis factorization is defined over $k$: applying any descent automorphism preserves it, and uniqueness fixes $b$. Inside the rational endomorphism ring, $b=a/{\ell }^n$ belongs to $K$, so $b\in R$. ConsequentlyHere the prime-to-characteristic torsion is étale, so vanishing on its geometric points is vanishing on the entire kernel scheme.

Every element of $R_{\ell }$ preserves the Tate module by continuity. Conversely suppose $\varphi \in K_{\ell }$ preserves it. Choose $n\ge 0$ with ${\ell }^n\varphi \in R_{\ell }$, and approximate it by $a\in R$ modulo ${\ell }^n{R}_{\ell }$. Write ${\ell }^n\varphi =a+{\ell }^{n}c$ with $c\in R_{\ell }$. Then $a{T}_{\ell }(E)\subseteq {\ell }^n{T}_{\ell }(E)$, so the divisibility statement gives $a/{\ell }^n\in R$. It follows that $\varphi =a/{\ell }^n+c\in R_{\ell }$. Thus the CM Tate module stabilizer isThis does not presume freeness of the integral Tate module over a nonmaximal order.

For (iii), every element of $R$ is defined over $k$, so the Galois representation commutes with $R$ and therefore with $K_{\ell }$. By (i), its action on $V_{\ell }(E)$ is multiplication by an element of $K_{\ell }^{\times }$. The action and its inverse preserve $T_{\ell }(E)$; by (ii), this scalar and its inverse belong to $R_{\ell }$. Hence

The mapis an automorphism of the elliptic curve over $K$, fixes its identity point, and squares to $[-1]$. For the invariant differential on an elliptic curve $\omega =dx/(2y)$, it satisfies $[i{]}^{\ast }\omega =i\omega$. Thus $\mathbb{Z}[i]\subseteq {\mathrm{End}}_K(E)$, with the indicated embedding of $K$.

Under analytic complex uniformization of an elliptic curve $E(\mathbb{C})\simeq \mathbb{C}/L$, this automorphism acts as multiplication by $i$, so $L$ is stable under $\mathbb{Z}[i]$. It is a rank-one torsion-free module over the Gaussian integers. Since that ring is a principal ideal domain, $L=\Omega \mathbb{Z}[i]$. Every analytic endomorphism is multiplication by an $a\in \mathbb{C}$ with $aL\subseteq L$, which here says exactly $a\in \mathbb{Z}[i]$. Therefore the geometric endomorphism ring of an elliptic curve is $\mathbb{Z}[i]$, and all its elements are generated over $\mathbb{Z}$ by the displayed $K$-defined automorphism. Thus ${\mathrm{End}}_K(E)=\mathbb{Z}[i]$.

If an endomorphism is defined over $\mathbb{Q}$, its pullback on the rational differential $\omega$ has scalar in $\mathbb{Q}$. The differential action is injective in characteristic zero, because a nonzero isogeny of elliptic curves is separable and has nonzero differential. Its scalar must therefore lie in $\mathbb{Q}\cap \mathbb{Z}[i]=\mathbb{Z}$. Conversely integer multiplication is defined over $\mathbb{Q}$. Hence

Put $\lambda =1+i$. The valuations of the differences of the three nonidentity fourth roots of unity from $1$ areFor instance $2=-i{\lambda }^2$, and the other two differences are associates of $\lambda$. None is divisible by ${\lambda }^3$. The group $(\mathbb{Z}[i]/{\lambda }^3{)}^{\times }$ has $8-4=4$ elements, so the four units map bijectively to it. Every ideal prime to $\lambda$ consequently has a unique primary Gaussian integer generator.

The Grössencharacter of the square-lattice elliptic curve is explicitlyFor integral ideals prime to $2$, the generator is an odd Gaussian integer; extend multiplicatively to fractional ideals prime to $2$. Products of primary generators are primary, so this is a Hecke character with ideal infinity type $(1,0)$: on a principal ideal with generator $a\equiv 1(\mathrm{mod}{\lambda }^3)$, its value is $a$. Its conductor divides ${\lambda }^3$, and cannot divide ${\lambda }^2$, since $-1\equiv 1(\mathrm{mod}{\lambda }^2)$ would force ${\psi }_E((-1))=-1$, whereas the unit ideal has value $1$. Thus the displayed conductor is exact.

We next verify directly that this character gives the Frobenius values of this particular curve, fixing the unit ambiguity. The pointsatisfies, by the chord-and-tangent addition law,For the first addition, $[i]P=(-i,1+i)$ and the chord has slope $-1$. Since $P$ is killed by ${\lambda }^3$ but not by ${\lambda }^2$, it generates the eight-element $\mathbb{Z}[i]$-module $E[{\lambda }^3]\simeq \mathbb{Z}[i]/{\lambda }^3$. Thus all this torsion is rational over $K$.

The model has discriminant $64$, so it has good reduction at every $\gamma \ne (\lambda )$. First suppose $\gamma$ lies over a split rational prime $p$. Then its residue field is ${\mathbb{F}}_p$, $p\ge 5$, and $\pi ={\psi }_E(\gamma )$ has norm $p$. Reduction of $[\pi ]$ still has degree $p$ and has zero differential, since its differential scalar $\pi$ belongs to $\gamma$. It is therefore purely inseparable of degree $p$. Factoring out the Frobenius isogeny givesfor an automorphism $u$ of the reduction. In characteristic at least five, the automorphisms of this model fixing $O$ are the four Gaussian units: comparing coefficients in $(x,y)\mapsto (v^{2}x,v^{3}y)$ gives $v^4=1$. Prime-to-$p$ torsion reduces injectively. Both $[\pi ]$ and ${\mathrm{Frob}}_p$ fix the reduction of $E[{\lambda }^3]$, the former by the primary congruence and the latter by its rationality over the residue field. Thus $u$ fixes this entire module. The unit congruences proved above force $u=1$.

For an inert rational prime $p\equiv 3(\mathrm{mod}4)$, we have $\gamma =(p)$, $N\gamma =p^2$, and its primary generator is $\pi =-p$, because $4\mid p+1$ implies ${\lambda }^3\mid (-p-1)$. To determine Frobenius without excluding $p=3$, writeReplacing $x$ by $-x$ changes each nonzero quadratic-character value to its negative, because $-1$ is a nonsquare. Hence $a_p=0$. The Frobenius characteristic equation ${\mathrm{Frob}}_p^2-[a_p]{\mathrm{Frob}}_p+[p]=0$ gives ${\mathrm{Frob}}_{p^2}=[-p]$. This proves the asserted Frobenius value at inert primes as well, and identifies the displayed Hecke character with that of $E$.

Finally, the formal parameter $t=-x/y$ is defined over the local ring at $\gamma$. Since the reduced endomorphism is the $q$-power Frobenius isogeny, with $q=N\gamma$, its pullback sends $t$ to $(-x/y{)}^q=t^q$. Passing to the completion at the identity gives the equality of formal series

A holomorphic group endomorphism of the complex torus lifts to multiplication by a scalar $c\in \mathbb{C}$, as in Question 1. It descends exactly when $c\Lambda \subseteq \Lambda$. Applying this condition to $1$ gives $c\in \mathbb{Z}[i]$. Conversely any Gaussian integer $c$ preserves $\mathbb{Z}[i]$, since the latter is a ring. Addition of endomorphisms is addition of scalars, and composition is multiplication of scalars. Thus, as rings,The wording “endomorphism algebra” here denotes this integral endomorphism ring of an elliptic curve. If it instead meant the rational algebra ${\mathrm{End}}^0(X)=\mathrm{End}(X){\otimes }_{\mathbb{Z}}\mathbb{Q}$, that algebra would be $\mathbb{Q}(i)$.

Let $\pi$ denote the Frobenius isogeny of an elliptic curve and write $N=\#E({\mathbb{F}}_q)$. Its degree of an isogeny is $q$. The isogeny of elliptic curves $1-\pi$ has differential equal to the identity because $d\pi =0$, so it is a separable isogeny. Its kernel consists precisely of the rational points fixed by $\pi$, giving

We use the degree parallelogram law for isogenies of elliptic curves, with degree zero assigned to the zero map:One explanation of the first identity is the divisor proof of the degree parallelogram law: on $E\times E$, the zero divisor of $x(P)-x(Q)$ is the sum of the diagonal and the graph of negation, while its pole divisor is twice each coordinate copy of $O$. Pulling the associated line bundle identity back by $(f,g)$ and taking degrees gives the identity, including exceptional cases by the line-bundle formulation. This works for a general Weierstrass equation of an elliptic curve, including characteristic two; $x$ is the quotient coordinate for negation. Polarization therefore makes degree a quadratic form on the endomorphism ring of an elliptic curve.

Set $a=q+1-N$, the Trace of Frobenius. The cross term is determined by $\mathrm{deg}(1-\pi )=1+q-a$, giving, for all integers $m,n$,If $a^2>4q$, the real degree-two polynomial $X^2-aX+q$ is negative on a nonempty open interval. That interval contains a rational $m/n$, contradicting the displayed nonnegativity after multiplication by $n^2$. Thus $a^2\le 4q$. Hasse's bounds areThe argument proves the Hasse theorem for elliptic curves without assuming its bound in advance.

For $E:y^2=x^3+1$, let $\alpha (x,y)=(\zeta x,y)$. The three points $P,\alpha P,{\alpha }^{2}P$ lie on the horizontal line through $P$, so their sum is zero. Thusin the endomorphism ring of an elliptic curve. Since $\mathrm{deg}\alpha =1$ and complex conjugation sends $\alpha$ to ${\alpha }^2$, degree on $\mathbb{Z}[\alpha ]$ is the Eisenstein-integer norm:

A separable isogeny is determined by its kernel up to unique isomorphism of its target, and every finite Galois-stable subgroup of an elliptic curve is the kernel of the corresponding quotient isogeny. Put $T=(-1,0)$. The three nonzero points of $E[2]$ are $T,\alpha T,{\alpha }^{2}T$, andHence $\phi (\alpha -{\alpha }^2)$ kills $\ker \phi =\{O,T\}$ and factors uniquely through $\phi$:for an isogeny $\psi :E^{\prime }\to E^{\prime }$. Degrees giveMoreover,Composing the factorization twice and using the surjectivity of $\phi$ gives ${\psi }^2=[-3]$.