For Divisors, do we use order of the point or multiplicity of the point?

Question

This is from the Book Mathematical Cryptography by Silverman, Pipher etc.

From the book where they describe Rational Functions & their Divisors on Elliptic Curves

5.8.2 Rational functions and divisors on elliptic curves We keep track of the zeros and poles of $f(X)$ and their multiplicities by defining the divisor of $f(X)$ to be the formal sum

$div(f(X)) = b_1[{\alpha}_1] + b_2[{\alpha}_2] + ... + b_r[{\alpha}_r] - d_1[{\beta}_1] - d_2[{\beta}_2] - ... - d_r[{\beta}_r]$ --- (A)

Here the book describes ${\alpha}_1$, ${\alpha}_2$ etc as the zeroes, $b_1$, $b_2$ etc as their multiplicities & similarly for the poles ${\beta}_1$ etc.

Few pages ahead in the book, where it describes a Weil Pairing with an example, we see this

$e_m(P, Q)$ is described as the Weil Pairing map for all $P, Q \in E(m)$ for $m$-torsion points on Elliptic Curve $E$. So $e_2$ will be the map for the 2-torsion points.

Now the example

Example 5.40. We are going to compute $e_2$ directly from the definition. Let $E$ be given by the equation $Y^2 = X^3 + Ax + B = (X − {\alpha}_1)(X − {\alpha}_2)(X − {\alpha}_3)$. Note that ${\alpha}_1 + {\alpha}_2 + {\alpha}_3 = 0$, since the left-hand side has no $X^2$ term. The points $P1 = ({\alpha}_1, 0), P2 = ({\alpha}_2, 0), P3 = ({\alpha}_3, 0)$, are points of order 2, and as noted earlier,

$div(X − {\alpha}_i) = 2[P_i] − 2[\mathcal O]$ --- (B)

---

In (A), the book says that in the term $b_r[{\alpha}_r]$, $b_r$ is the multiplicity of the Point ${\alpha}_r$.

However, in (B) while writing down the divisor, he uses the order $2$ of the point $P$ instead of it's multiplicity. How can this be explained?

UPDATE:

The question has been partly answered but there are areas of confusion for me.

1. As per this - https://crypto.stackexchange.com/a/55427/3941 they calculate that there are just 2 zeros & hence by Bazout's, hence the divisor is $2[P] - 2[\mathcal O]$. Whereas in the answer below, the same result is arrived at in a very different way - $(2[P_i]+[\mathcal{O}])-(3[\mathcal{O}])=2[P_i]-2[\mathcal{O}]$

2. Is $[0:1:0]$ a zero? $f$ evaluates to $\frac {0 -{a_i}0}{0}$ at $[0:1:0]$ - it's a divide by zero. So is it really a zero? It works only if we calculate zeros of numerator separately without including the denominator.

Answer 1

In (B), the term "order" is referring to the order of the point in the group law on the elliptic curve. It is not so simple as "point of order $n$" implies "that point appears in some divisor with multiplicity $n$" - there is actual math happening there.

To calculate the divisor of $f=X-a_i$, we first write the rational function $f$ on the affine open subset $D(Z)\cap E$ of $E$ as a ratio of homogeneous polynomials of the same degree, which will let us more easily determine the behavior of our function away from $D(Z)\cap E$. To do this, we homogenize with respect to $Z$ and then divide by $Z$ to the degree of the resulting polynomial. Here, homogenizing $f$ with respect to $Z$ gives $X-a_iZ$, and then we divide by $Z$ to obtain $f=\frac{X-a_iZ}{Z}$. Now we determine the divisor of $f$ by counting with multiplicity the intersections of $V(X-a_iZ)$ and $V(Z)$ with $E$ and taking their difference.

$V(X-a_iZ)$ meets $E$ at $[a_i:0:1]$ and $[0:1:0]$. From the construction of the group law on elliptic curves using lines, a point $P$ of order two has a vertical tangent which meets the curve with multiplicity two at $P$. Therefore $V(X-a_iZ)$ meets $E$ at $[a_i:0:1]$ with multiplicity two and therefore the divisor $V(X-a_iZ)\cap E$ is $2[P_i]+[\mathcal{O}]$. $V(Z)$ meets $E$ at $[0:1:0]$, so the divisor of $V(Z)\cap E$ is $3[\mathcal{O}]$. Subtracting the two gives $div(f) = 2[P_i]-2[\mathcal{O}]$.

---

Addressing the update:

1. Yes, there are two zeroes of $f$: $P_i$ twice. This is exactly what the above calculation shows. (I would push back a little on the phrasing that "the same result is arrived at in a very different way" - the linked answer from the cryptography site does not explain their method. In fact, by writing $X-a_i$ as $\frac{X-a_iZ}{Z}$, there is a suggestion that they might be doing it the same way I am.)

2. This is like asking "to what order does the function $\frac{x^n}{x^m}$ on $\Bbb R$ vanish at zero?" Well, $x^n$ vanishes to order $n$, and $x^m$ vanishes to order $m$, so the total order of vanishing is $x^{n-m}$. To be specific, the local ring of every point on the curve $E$ is a valuation ring, so we can ask what the valuation is of $f$ in the local ring at $\mathcal{O}$. Valuations add over multiplication, so it really does work exactly the same as the example. The calculation here is that first we dehomogenize the numerator and denominator with respect to $Y$, so $f$ can be written as $\frac{(X-a_iZ)/Y}{Z/Y}$. Now both the numerator and denominator are functions defined on the affine open neighborhood $D(Y)\cap E$ of $\mathcal{O}$, so we can compute their valuations, which are exactly equal to the intersection multiplicities of numerator and denominator with $E$ at $\mathcal{O}$. So the numerator has valuation $1$ and the denominator has valuation $3$, leading to a total valuation of $-2$. So $f$ has a pole of order $2$ at $\mathcal{O}$.