Structure of the group of points of order $m$ on an elliptic curve

188 Views Asked by At

I am reading the book An Introduction to Mathematical Cryptography and in the chapter about Elliptic Curves and Cryptography there is the proposition below.

It is about the structure of the group $E(\mathbb{C})[m]$ of points of order $m$ and its counterpart for finite fields:

Proposition

That proposition seems quite unexpected and is not proven in the book. I can't figure out how we might have such a result.

Would it be possible to give the idea / intuition of a proof in the simplest terms?

If not, what would be a roadmap to be able to fully understand the reasons for this result?

1

There are 1 best solutions below

0
On

I will try to answer (a). I think the easiest way to see this is analytically, i.e. seeing $E$ as a complex tori, say $\mathbb{C}/\Lambda$, where $\Lambda = \mathbb{Z} + \tau \mathbb{Z}$ with $\tau$ a purely imaginary complex number of positive imaginary part (any complex lattice is isomorphic to one of those, by scaling essentially). Now, it is enough to look at the $m$-torsions of $\mathbb{C}/\Lambda$. These $m$-torsions are the points $c\in \mathbb{C}$ such that $mc \in \Lambda$, modulo $\Lambda$. That is the points in $\frac{1}{m} \mathbb{Z} + \frac{\tau}{m} \mathbb{Z}$ modulo $\Lambda$. Now it shouldn't be too difficult to see this is $\mathbb{Z}/m\mathbb{Z} \times \mathbb{Z}/m\mathbb{Z}$.

I see you also have trouble to understand why the map $\phi: \mathbb{C}/\Lambda \rightarrow E(\mathbb{C})$ that allows us to see $E$ as a complex tori is an isomorphism (of complex Lie groups). For the details, you can look at Silverman's standard book "The arithmetic of Elliptic Curves", Proposition 3.6 on page 170 of the second edition. Perhaps, I can briefly explain why this is an homomorphism. Take $c, c' \in \mathbb{C}$ then there exists an elliptic function (doubly periodic meromorphic function) with period $\Lambda$, say $f$, such that the principal divisor associated to $f$ is $$div(f) = (c+c') - (c) - (c') + (0).$$ Now, one can show that any such elliptic function $f$ is a rational function of $\mathcal{P}(z)$ and $\mathcal{P}'(z)$ where $\mathcal{P} $ is the Weierstrass function associated to $\Lambda$. That is, we can write $f(z) = g(\mathcal{P}(z), \mathcal{P}'(z))$ where $g(X,Y)\in \mathbb{C}(X,Y)$. Let us denote $x, y$ the image of $X$ and $Y$ respectively in the coordinate ring of $E$ (that is under the projection $\mathbb{C}[X,Y] \rightarrow \mathbb{C}[X,Y]/(h(X,Y))$ where $h$ is the polynomial defining $E$). Now, we can treat $g$ as an element of the function field of $E$, i.e., $g(x,y) \in \mathbb{C}(x,y) = \mathbb{C}(E)$. We get a principal divisor on $E$ $$div(g) = (\phi(c+c'))-(\phi(c)) - (\phi(c')) +(\phi(0)).$$ This can only happen if $div(g) = \mathcal{O}$ where $\mathcal{O}$ is the neutral element of $E$ as a group (note that the last summation is a summation of elements of $E$). That is, $\phi(c+c') = \phi(c) + \phi(c').$

As a remark on (b), the only possible obstruction to not get (a) is issues of inseparability, that is if the multiplication-by-$m$ map, denoted $[m]$, is inseparable, which is not the case as long as $p$ does not divide $m$. Again, you can consult Silverman, Corollary 6.4, he also gives the case when $p$ divides $m$.

Hope this helps a bit.