Group Structure of Rational Points a Supersingular Elliptic Curve over $\mathbb{F}_{p^2}$ with $p=2^a3^b-1$?

277 Views Asked by At

I'm looking at this Jao-De Feo-Plut paper and this expository paper by Craig Costello. Both claim that for a prime $p$ of the form $p=2^a3^b-1$, the entire $(p+1)$-torsion of a supersingular elliptic curve over $\mathbb{F}_{p^2}$ is defined over $\mathbb{F}_{p^2}$. Costello seems to imply that this follows from the number of points on such a curve necessarily being equal to $(p+1)^2$ (and in general, for any prime $p$, the $(p-1)$ or $(p+1)$ torsion is defined over $\mathbb{F}_{p^2}$), but I don't understand why even this claim is true. Can someone give me a couple pointers to understand what's behind either/both of these claims?

Edit: there's also a stipulation that $p\equiv 3\mod 4,$ so $p$ is actually of the form $p=2^{2a}3^b-1$.

1

There are 1 best solutions below

1
On

In SIDH, we work only with $j$-invariants. (The shared secret obtained by both parties at the end is a $j$-invariant.) Since we work only with $j$-invariants, all twists of an elliptic curve defined over $\mathbb{F}_{p^2}$ are conflated for this purpose. We always use the twist that has $(p+1)^2$ points.

Tate's isogeny theorem states that two elliptic curves $E$ and $E'$ are isogenous via an isogeny defined over a finite field $\mathbb{F}$ if and only if the cardinality of $E(\mathbb{F})$ equals the cardinality of $E'(\mathbb{F})$. Since we start with a curve $E_0$ defined over $\mathbb{F}_p$, and consider only curves isogenous to $E_0$ via an isogeny defined over $\mathbb{F}_{p^2}$, we always remain with curves of the same cardinality over $\mathbb{F}_{p^2}$, namely curves with $(p+1)^2$ points.