7

Let $p$ be a prime number such that $p \equiv 3 \bmod 4$. Now consider the elliptic curves $$ E/\mathbb{F}_{p^2}: \quad y^2 = x^3 - ax \quad \text{and} \quad E'/\mathbb{F}_{p^2}: \quad y^2 = x^3 - a^{-1}x $$ where $a$ is an element generating $\mathbb{F}_{p^2}^*$.

The curve itself depends on the choice of $a$: the curves $E$ and $E'$ are not isomorphic in general, see MAGMA code below (for my computed cases, they are all not isomorphic to each other). But what I noticed is that in every case I computed, it is $|E(\mathbb{F}_{p^2})| = |E'(\mathbb{F}_{p^2})|$.

Question: Is this a general observation or is it just mere coincidence?

Below is the MAGMA code I used:

for p in [ x : x in [3 .. 100] | IsPrime(x) and x mod 4 eq 3 ] do
    print "";
    K := GF(p^2);
    a := PrimitiveElement(K);
    R<x> := PolynomialRing(K);
    f := x^3 - a*x;
    g := x^3 - 1/a*x;
    E := EllipticCurve(f);
    Eprime := EllipticCurve(g);
    print "Are both curves isomorphic?";
    IsIsomorphic(E,Eprime);
    print "Do both curves have the same cardinality?";
    #E eq #Eprime;
end for;
Michael Hardy
  • 1
Ribbity
  • 989
  • 1
  • 7
  • 17
  • 1
    An interesting observation: If you look at the class of curves $E/\mathbb{F}_p: y^2=x^3-ax$ for any primitive root $a$, they all have the same number of points. I think that this stems from the fact that if you have an automorphism $\phi: F\to F$ of a finite field and two elliptic curves $E$ and $E'$ such that applying $\phi$ to the coefficients of $E$ you get $E'$, then they have the same number of points. The automorphism in our cases is the unique one defined by sending corresponding primitive roots to one another. – Milo Moses Apr 21 '21 at 04:15
  • 3
    Two elliptic curves, $E_1$ and $E_2$, over a finite field $K=\Bbb{F}_q$ have the same number of $K$-rational points if and only if there is a (non-trivial) isogeny $\phi:E_1\to E_2$. IIRC this is a theorem on Cassels. One direction follows immediately from Hasse-Weil in some cases. Say, if you have an isogeny with a small kernel. Then $E_2(K)$ has $Im(\phi)$ as a large subgroup, and Hasse-Weil together with Lagrange only leave a single possible value for $#E_2(K)$. – Jyrki Lahtonen Apr 21 '21 at 05:21
  • (cont'd) I'm not an expert on this, but I once had a reason to dig this up when two fellow coding theorists unearthed a strange identity on Kloosterman sums over $\Bbb{F}_{2^m}$ (the values of such character sums have an obvious relation with $#E/K)$). I had a student produce the required isogeny (basically by embedding the function field of one to that of the other). Another junior colleague then realized that the type of Kloosterman sum identities must come from modular curves. Tragically, he died before he managed to polish off the manuscript for publication. – Jyrki Lahtonen Apr 21 '21 at 05:27
  • See also here. – Jyrki Lahtonen Apr 21 '21 at 11:53
  • 1
    You say the cardinalities are equal in your data, but the code you display in your question does not let you see what the common cardinalities are each time. Did you look at that, e.g., common cardinality $p^2+1$? – KCd Apr 21 '21 at 16:27
  • @KCd: I did not notice that before. Yes, my code gives $p^2+1$ as the cardinality for both elliptic curves. Is that helpful in any way? – Ribbity Apr 21 '21 at 21:03
  • @MiloMoses: This is interesting if true. Is there any reference for this observation? – Ribbity Apr 21 '21 at 21:06
  • Sadly I do not. I will try to come up with a proof of why it should be true. – Milo Moses Apr 21 '21 at 22:58
  • 1
    @Ribbity a related page: https://math.stackexchange.com/questions/3482443/finding-an-elliptic-curve-with-frobenius-trace-zero – KCd Apr 22 '21 at 00:57
  • @MiloMoses It is impossible that there would be an automorphism of the constant field mapping a given primitive root to another. The field $\Bbb{F}_q$, $q=p^n$, has exactly $n$ automorphisms but $\phi(q-1)$ primitive elements. This is strikingly obvious in the case of the prime field with no non-trivial field automorphisms. – Jyrki Lahtonen Apr 24 '21 at 05:24
  • @JyrkiLahtonen I am not sure I understand. $\mathrm{Gal}\left(\mathbb{F}_q/\mathbb{F}_p\right)$ certainly has $n$ elements, but $\mathbb{F}_p$ has many automorphisms, namely all the ones that sends one primitive root ($a$) to another ($b$), i.e $\phi(a^n)=b^n$. If you are saying that there are no non trivial automorphisms of $\mathbb{F}_p$ that fix $\mathbb{F}_p$, I am aware. – Milo Moses Apr 24 '21 at 16:15
  • 1
    @MiloMoses An automorphism of a field maps $\phi(1)=1$. Hence $\phi(2)=\phi(1+1)=\phi(1)+\phi(1)=1+1=2$ et cetera. Or, viewed differently, any automorphism always fixes the elements of the prime field. The mapping you described does not preserve sums. – Jyrki Lahtonen Apr 24 '21 at 20:11

1 Answers1

2

Taking $c=a^{-(p+1)/4}\in \Bbb{F}_{p^2}$ $$E':y^2=x^3-a^{-1}x$$ is $\Bbb{F}_{p^2}$-isomorphic to $$(c^3y)^2= (c^2x)^3-a^{-1}(c^2 x)=c^6(x-a^{-1}c^{-4} x)$$ ie. to $$E^p:y^2 = x^3-a^p x$$ Whence $$|E'(\Bbb{F}_{p^2})|=|E^p(\Bbb{F}_{p^2})|=|E(\Bbb{F}_{p^2})^p|=|E(\Bbb{F}_{p^2})|$$ This also proves that the two curves are non-isomorphic.

reuns
  • 79,880
  • So simple! I was trying to find the isogeny and failed. Or rather, I have only checked moding out the 2-torsion of $y^2=x^3-ax$. Unless I made a mistake $$(x,y)+(0,0)=(-a/x,ay/x^2).$$ The subfield of $\Bbb{F}_{p^2}(x,y)$ fixed by $\phi:(x,y)\mapsto (-a/x,ay/x^2)$ is isomorphic to $u^2=v^3-4av$. No cigar :-( – Jyrki Lahtonen Apr 24 '21 at 21:02
  • It is midnight here, so it is, of course, possible that I commited some silly errors. Anyway, your idea seems to work, and I have no reason to think that an isogeny with a kernel of order two would do the trick. – Jyrki Lahtonen Apr 24 '21 at 21:18
  • @JyrkiLahtonen The last line of my answer is a bit sloppy, $E'$ is also (isomorphic to) the quadratic twist $ay^2=x^3-ax$, but I'm unsure how it relates to isogenies, if there is a separable one, and what is its kernel. – reuns Apr 24 '21 at 22:06
  • @reuns: Thank you! Could you please explain the notation $E(\mathbb{F}_{p^2})^p$? It would also nice if you could explain why your observation above shows that the two curves are non-isomorphic. – Ribbity Apr 28 '21 at 22:37
  • @Ribbity $E(F_q)^p$ is the image of $E(F_q)$ under the $p$-th frobenius $(x,y)\to (x^p,y^p)$. Saying that $E'\cong E^p$ is isomorphic to the quadratic twist $E_a:ay^2=x^3-ax$ is probably easier. The non-isomorphicity of twists is proven in Silverman AEC. – reuns Apr 28 '21 at 23:19
  • @reuns: Could you also explain why $E' \simeq E^p$ is isomorphic to $E_a$? – Ribbity Apr 29 '21 at 00:54