Isogeny of elliptic curves

An isogeny between elliptic curves is a nonconstant morphism preserving their group identities; it is finite and surjective with finite kernel.

An isogeny is a nonconstant morphism of elliptic curves preserving their identity points. It is a finite surjective group homomorphism.

A division point above $P$ is a point $Q$ over an algebraic closure satisfying $[N]Q=P$, for a specified nonzero integer $N$. Two such points differ by an $N$-torsion point of an elliptic curve. If the characteristic of a field does not divide $N$, there are $N^2$ distinct division points; in other characteristics the scheme fibre still has length $N^2$, but its geometric points can be fewer. The unramified division torsors at good primes control their coordinate fields over local fields.

The group ${\mathrm{Hom}}_K(E_1,E_2)$ consists of morphisms of elliptic curves defined over $K$ that preserve the group operation, with pointwise addition. Its zero element is the constant map to the identity. Every nonzero element is an isogeny of elliptic curves: its image is a closed connected subgroup of the target, so nonconstancy makes it the whole curve, and a nonconstant morphism of smooth projective curves is finite. The degree of an isogeny extends to this group by assigning degree zero to the zero homomorphism.

Elliptic curves isogenous over a finite field have the same number of rational points: the isogeny intertwines Frobenius, and multiplicativity of degree gives equal degrees for $1-\pi$. Their groups need not be isomorphic. Over ${\mathbb{F}}_7$, $y^2=x^3-x$ and $y^2=x^3+4x$ are two-isogenous and have groups $\mathbb{Z}/2\mathbb{Z}\times \mathbb{Z}/4\mathbb{Z}$ and $\mathbb{Z}/8\mathbb{Z}$, respectively.

The elliptic curves $E_1:y^2=x^3-x$ and $E_2:y^2=x^3-x+1$ over ${\mathbb{F}}_5$ both have eight rational points. The first has four rational 2-torsion points and the second has two, so their point groups are not isomorphic. They are nevertheless degree-two isogenous via $X=x+2/(x-1)$, $Y=y(1-2/(x-1{)}^2)$. The map sends $O$ and $(1,0)$ to $O$; its pole divisor for $X$ is $2O+2(1,0)$, giving degree two. Their j-invariant of an elliptic curve values are respectively three and one, so the curves are not geometrically isomorphic either.

The endomorphism ring of an elliptic curve consists of its self-isogenies together with the zero map, with pointwise addition and composition as multiplication.

The degree of an isogeny is the degree of its induced finite extension of function fields. On $\mathrm{End}(E)$ it is a quadratic form: $\mathrm{deg}(n\varphi )=n^2\mathrm{deg}\varphi$, and

Let $q(\varphi )=\mathrm{deg}\varphi$ for nonzero elements of the homomorphism group of elliptic curves, and $q(0)=0$. For an elliptic curve $E$, the degree-two coordinate $x$ on a Weierstrass model has a double pole at its identity and identifies a generic point only with its inverse. Thus on $E\times E$,where the two diagonals are $P=Q$ and $P=-Q$. The resulting line bundle isomorphism is $a^{\ast }{\mathcal{O}}_E(O)\otimes s^{\ast }{\mathcal{O}}_E(O)\cong {\mathrm{pr}}_1^{\ast }{\mathcal{O}}_E(O{)}^{\otimes 2}\otimes {\mathrm{pr}}_2^{\ast }{\mathcal{O}}_E(O{)}^{\otimes 2}$, for the sum and difference maps $a,s$. Pull it back along $(\varphi ,\psi )$ and take degrees. This gives the degree parallelogram law, even when one homomorphism equals plus or minus the other: bundle restriction remains valid in these cases.

It implies $q(n\varphi )=n^{2}q(\varphi )$ by the second-difference recursion, and polarization gives the symmetric bilinear form $B(\varphi ,\psi )=(q(\varphi +\psi )-q(\varphi -\psi ))/4$. To check additivity, the parallelogram law gives $B(x+z,y)+B(x-z,y)=2B(x,y)$; interchange $x,z$ and use oddness to get $B(x+z,y)-B(x-z,y)=2B(z,y)$. Adding proves bilinearity. Since a nonzero isogeny has positive degree, $q$ is positive on every nonzero element. On every finite-dimensional rational span the matrix of $B$ is rational. Positivity on rational vectors implies nonnegativity on real vectors by density; a nontrivial kernel of a rational matrix would contain a nonzero rational vector. Hence the real extension is positive definite. This proves the positive-definite quadratic form property, rather than only a parallelogram identity.

With zero degree assigned to the zero element of the homomorphism group of elliptic curves, the degree parallelogram law makes this symmetric pairing additive in both arguments. Its diagonal is the degree of an isogeny; it is positive definite on every finite-dimensional rational span after extension to the real numbers. The integral polarization $2B(\varphi ,\psi )$ is integer-valued, while $B$ can be half-integral. For instance, if an elliptic curve has an automorphism $\omega$ with ${\omega }^2+\omega +1=0$, then $1+\omega =-{\omega }^2$ has degree one, so $B(1,\omega )=-1/2$.

The degree parallelogram identity for endomorphisms of an elliptic curve gives $d_{n+1}+d_{n-1}=2d_n+2$ for $d_n=\mathrm{deg}[n]$, with $d_0=0$ and $d_1=1$. Induction gives $d_n=n^2$ in every characteristic. A zero pullback on differentials therefore does not mean that multiplication is the zero morphism.

On the product of an elliptic curve with itself, let $D_{+}$ and $D_{-}$ be the diagonal and the graph of negation. The principal divisor of $x(P)-x(Q)$ is $D_{+}+D_{-}-2(\{O\}\times E)-2(E\times \{O\})$: equality of the coordinates means $Q=\pm P$, while $x$ has a double pole at $O$. Pulling back along $(\varphi ,\psi )$ and taking degrees proves the parallelogram law for the degree of an isogeny when $\varphi ,\psi$ are nonzero and $\varphi \ne \pm \psi$. The exceptional cases follow from $\mathrm{deg}[2]=4$. The same argument uses the quotient by negation in characteristic two. Thus degree, with degree zero assigned to the zero map, is a positive quadratic form on $\mathrm{Hom}(E_1,E_2)$.

For an isogeny of elliptic curves $\varphi :E_1\to E_2$, write $x_2\circ \varphi =A(x_1)/B(x_1)$ with coprime polynomials $A,B$. Each $x_i:E_i\to {\mathbb{P}}^1$ is a two-to-one finite morphism, and function field degrees multiply in a tower. Consequently $2\mathrm{deg}\varphi =2\max (\mathrm{deg}A,\mathrm{deg}B)$. This computes the total degree, including an inseparable factor. The zero homomorphism is assigned degree zero separately.

A separable isogeny is an isogeny whose induced extension of function fields is separable. Its degree equals the number of geometric points in its kernel.

A nonzero isogeny of elliptic curves is separable exactly when its pullback of an invariant differential on an elliptic curve is nonzero. For a map of smooth curves in characteristic $p$, a zero differential means the function-field extension has a nontrivial inseparable part. The criterion turns sums of elliptic endomorphisms into computations of their tangent scalars.

Vélu's formulas construct the quotient of a Weierstrass elliptic curve by a specified finite subgroup and give rational functions for the resulting separable isogeny.

For an isogeny $\varphi :E\to E^{\prime }$, its kernel is denoted $E[\varphi ]$. In characteristic zero its cardinality equals $\mathrm{deg}\varphi$.

The dual of an isogeny $\varphi :E\to E^{\prime }$ of degree $n$ is the unique isogeny $\hat{\varphi }:E^{\prime }\to E$ satisfying

For $\varphi \in \mathrm{End}(E)$, its trace is the integer characterized byEquivalently, $\mathrm{tr}(\varphi )=1+\mathrm{deg}\varphi -\mathrm{deg}(1-\varphi )$.

The characteristic equation ${\varphi }^2-[\mathrm{tr}\varphi ]\varphi +[\mathrm{deg}\varphi ]=0$ gives

For an elliptic curve over ${\mathbb{F}}_q$, the Frobenius isogeny sends $(x,y)$ to $(x^q,y^q)$. If $a=q+1-\#E({\mathbb{F}}_q)$, then

If an isogeny of elliptic curves $\pi :E_1\to E_2$ satisfies $\pi {\varphi }_1=-{\varphi }_2\pi$ for their Frobenius isogenies, then $\pi (1-{\varphi }_1)=(1+{\varphi }_2)\pi$. Multiplicativity of the degree of an isogeny gives $\mathrm{deg}(1-{\varphi }_1)=\mathrm{deg}(1+{\varphi }_2)$. The degree parallelogram law then gives the displayed point-count identity, since $\mathrm{deg}(1-{\varphi }_i)=\#E_i({\mathbb{F}}_q)$ and $\mathrm{deg}{\varphi }_i=q$.

For an elliptic curve over ${\mathbb{F}}_q$, the trace of Frobenius isIt is the trace of the Frobenius isogeny of an elliptic curve on every prime-to-$q$ Tate module.

For odd $p$, let $y^2=f(x)$ be a nonsingular cubic Weierstrass equation of an elliptic curve over ${\mathbb{F}}_p$. Its Trace of Frobenius is $a_p=-{\sum }_x\chi (f(x))$, where $\chi$ is the Legendre symbol extended by $\chi (0)=0$. By the Euler criterion, reduce this sum to $f(x{)}^{(p-1)/2}$. The sum of a positive power $x^j$ over ${\mathbb{F}}_p$ is zero unless $p-1$ divides $j$, when it is $-1$. Since the polynomial has degree $3(p-1)/2<2(p-1)$, only its $x^{p-1}$ coefficient contributes.

If $\alpha ,\beta$ are the roots of $T^2-aT+q$, where $a=q+1-\#E({\mathbb{F}}_q)$, then

For an elliptic curve over ${\mathbb{F}}_q$, the Frobenius isogeny has characteristic polynomial $T^2-tT+q$. Taking traces of its powers gives this recurrence. If $\alpha ,\beta$ are the roots, then $t_n={\alpha }^n+{\beta }^n$ and $\#E({\mathbb{F}}_{q^n})=q^n+1-t_n$. The Hasse bound implies $|\alpha |=|\beta |=\sqrt{q}$, including the repeated-root case.

At an odd good prime, use a model $y^2=x^3-d^{2}x$ with $d$ a unit. If $p\equiv 3(\mathrm{mod}4)$, pairing $x$ with $-x$ cancels their Legendre symbols, so the trace is zero. If $p\equiv 1(\mathrm{mod}4)$, the four distinct rational 2-torsion points force the group order to be divisible by four, whereas $p+1$ is two modulo four. The trace cannot vanish. This proves the converse without an explicit complex-multiplication character-sum evaluation.

For an elliptic curve over a finite field of characteristic $p$, its rational-point group is finite and abelian. Prime-to-characteristic geometric torsion bounds every other prime-torsion dimension by two. Multiplication by $p$ has degree $p^2$ and inseparable degree at least $p$, so the $p$-torsion dimension is at most one. The structure theorem for finite abelian groups therefore gives two cyclic factors with $m\mid n$ and $p\nmid m$.

For odd $p$ and $k\not\equiv 0(\mathrm{mod}p)$, take $E:y^2=x^3+kx$. If $p\equiv 3(\mathrm{mod}4)$, pairing $x$ with $-x$ cancels the Legendre symbols. If $p\equiv 1(\mathrm{mod}4)$, the coefficient formula for trace of Frobenius modulo p givesThe binomial coefficient is nonzero because every factorial involved is shorter than $p$. Thus the Trace of Frobenius is not zero in the second case.

For an elliptic curve over ${\mathbb{F}}_p$, put $N=\#E({\mathbb{F}}_p)$ and $a=p+1-N$. The trace of the square of an elliptic-curve endomorphism gives $\mathrm{tr}({\pi }^2)=a^2-2p$ for the Frobenius isogeny. Therefore $\#E({\mathbb{F}}_{p^2})=p^2+1-a^2+2p=N(2p+2-N)$.

For $E:y^2=x^3-x-1$ over ${\mathbb{F}}_3$, the Trace of Frobenius is three andIn particular, $\#E({\mathbb{F}}_{3^r})=3^r+1$ exactly when $r\equiv 3(\mathrm{mod}6)$.

For an elliptic curve over ${\mathbb{F}}_q$,

For Frobenius $\pi$, put $a=\mathrm{tr}(\pi )$ and note that $\mathrm{deg}\pi =q$. Nonnegativity of the quadratic formfor all integers $m,n$ forces its discriminant to be nonpositive, so $a^2\le 4q$. Since $\#E({\mathbb{F}}_q)=\mathrm{deg}(1-\pi )=q+1-a$, this is the Hasse bound.

This finite-field function supplies a local factor of a Hasse–Weil zeta function when the curve is a reduction of a curve over a number field.

If $a=q+1-\#E({\mathbb{F}}_q)$, then

If $1-aT+q{T}^2=(1-\alpha T)(1-\beta T)$ is the numerator of the zeta function, the Riemann hypothesis in this case is $|\alpha |=|\beta |=\sqrt{q}$. It is equivalent to the Hasse theorem for elliptic curves.