2
$\begingroup$

Please help or hints me to solve this question:

Suppose that $E: y^2+y= x^3+x$ be an elliptic curve over $\Bbb F_2$, We know that $E$ is supersingular. Show that $E[5] ‎‎\subseteq‎‎ E(\Bbb F_{16})$.

  • 0
    More generally, the smallest integer $k \geq 1$ such that $E[m] \subset E(\Bbb F_{q^k})$ (where $(m,q)=1$) is equal to the smallest integer $r \geq 1$ such that $m$ divides $q^r-1$. – 2017-02-09
  • 0
    @Watson: Is that really so? Over the algebraic closure $k=\overline{\Bbb{F}_2}$ the curve $E$ has $15^2=225$ torsion points of order a factor of $15$. We cannot have all of them included in $E(\Bbb{F}_{16})$ because by Hasse-Weil $|E(\Bbb{F}_{16})|\le 16+2\cdot4+1=25$. What is true (follows from rationality of Weil pairing) that if $E[m]\subset E(\Bbb{F}_{Q})$ then $m\mid Q-1$. – 2017-02-09
  • 0
    @JyrkiLahtonen : you seem to be right. Maybe we should make the extra assumption that _there is_ a point of order $m$ in $E(\Bbb F_q)$ (not only over the algebraic closure). I haven't checked if this curve has. But I think that in that case $m \mid Q-1 \implies E[m] \subset E(\Bbb F_Q)$. – 2017-02-09
  • 0
    @JyrkiLahtonen : I think that this is Lemma 6.2. [p. 387-388 in 2nd edition of Silverman's _The Arithmetic of Elliptic Curves_](https://books.google.com/books?id=Z90CA_EUCCkC&pg=PA388#v=onepage&q&f=false). – 2017-02-09
  • 0
    Thanks, @Watson. My copy of Silverman is at home. Will check later today. [Added later:] Couldn't find it in there. Apparently mine is an older edition given that p. 387-388 are well into the index. Well, Lubin's answers + comments settled it anyway. – 2017-02-09
  • 0
    After doing my answer(s) up, I realize that these comments have the whole thing in a nutshell. Since the $e_5$-pairing is defined over $\Bbb Z$, once you have a point of order $5$ and the fifth roots of unity, you have the other points of order $5$ as well. – 2017-02-09

2 Answers 2

1

Extended hints:

A point $P$ is of order $5$ iff $[4]P=-P$. For this to happen it is necessary that the points $[4]P$ and $[P]$ share the $x$-coordinate, but don't share the $y$-coordinate (if $[4]P=P$, then $P$ will be 3-torsion). This suggests the following approach:

  • Figure out the point doubling formula for this curve.
  • Iterate the above to figure out the point quadrupling formula.

Then show that this leads to a system of equations with all the solutions in $\Bbb{F}_{16}$.

  • 0
    I didn't redo this now, but some fifteen years ago I worked this out for our seminar. That's how it went. IIRC trace also showed up. – 2017-02-09
4

My (never totally reliable) computation says that for this curve, $[2](\xi,\eta)=(\xi^4+1,\eta^4+\xi^4+1)$, and that therefore $[4](\xi,\eta)=(\xi^{16},\eta^{16}+1)$. Since $[-1](\xi,\eta)=(\xi,\eta+1)$, you see that for any $P\in E(\Bbb F_{16})$, you have $[4](P)=[-1](P)$. I did the computation by hand in about 10 minutes. From the fact that the curve has five points over the prime field, you use the Zeta function to see that it has $25$ points over $\Bbb F_{16}$, and that does it.

EDIT - addendum:
But the right way to do it is this: Since the curve has five points over $\Bbb F_2$, the characteristic polynomial for Frobenius $\mathbf f$ is $X^2+2X+2$, eigenvalues $-1\pm i$. Thus the characteristic polynomial of $\mathbf f^4$ has both eigenvalues equal to $-4$. That shows immediately that for $P\in E(\Bbb F_{16})$, $P=[-4](P)$.