Supersingular elliptic curve

In algebraic geometry, supersingular elliptic curves form a certain class of elliptic curves over a field of characteristic p > 0 with unusually large endomorphism rings. Elliptic curves over such fields which are not supersingular are called ordinary and these two classes of elliptic curves behave fundamentally differently in many aspects. Hasse (1936) discovered supersingular elliptic curves during his work on the Riemann hypothesis for elliptic curves by observing that in positive characteristic elliptic curves could have endomorphism rings of unusually large rank 4, and Deuring (1941) developed their basic theory.

The term "supersingular" has nothing to do with singular points of curves, and all supersingular elliptic curves are non-singular. It comes from the phrase "singular values of the j-invariant" used for values of the j-invariant for which a complex elliptic curve has complex multiplication. The complex elliptic curves with complex multiplication are those for which the endomorphism ring has the maximal possible rank 2. In positive characteristic it is possible for the endomorphism ring to be even larger: it can be an order in a quaternion algebra of dimension 4, in which case the elliptic curve is supersingular.

Definition

There are many different but equivalent ways of defining supersingular elliptic curves that have been used. Some of the ways of defining them are given below. Let K be a field with algebraic closure $\overline{K}$ and E an elliptic curve over K.

• The $\overline{K}$-valued points $E(\overline{K})$ have the structure of an abelian group. For every n, we have a multiplication map $[n]: E\to E$. Its kernel is denoted by $E[n]$. Now assume that the characteristic of K is p > 0. Then one can show that either

$E[p^r](\overline{K}) \cong \begin{cases} 0 & \mbox{or}\\ \mathbb{Z}/p^r\mathbb{Z} \end{cases}$

for r = 1, 2, 3, ... In the first case, E is called supersingular. Otherwise it is called ordinary. In other words, an elliptic curve is supersingular if and only if the group of geometric points of order p is trivial.

• Supersingular elliptic curves have many endomorphisms over the algebraic closure $\overline{K}$ in the sense that an elliptic curve is supersingular if and only if its endomorphism algebra (over $\overline{K}$) is an order in a quaternion algebra. Thus, their endomorphism algebra (over $\overline{K}$) has rank 4, while the endomorphism group of every other elliptic curve has only rank 1 or 2. The endomorphism ring of a supersingular elliptic curve can have rank less than 4, and it may be necessary to take a finite extension of the base field K to make the rank of the endomorphism ring 4. In particular the endomorphism ring of an elliptic curve over a field of prime order is never of rank 4, even if the elliptic curve is supersingular.

• Let G be the formal group associated to E. Since K is of positive characteristic, we can define its height ht(G), which is 2 if and only if E is supersingular and else is 1.

• We have a Frobenius morphism $F: E\to E$, which induces a map in cohomology

$F^*: H^1(E, \mathcal{O}_E) \to H^1(E,\mathcal{O}_E)$.

The elliptic curve E is supersingular if and only if $F^*$ equals 0.

• We have a Frobenius morphism $F: E\to E$, which induces a map on the global 1-forms

$F^*: H^0(E, \Omega^1_E) \to H^0(E,\Omega^1_E)$.

The elliptic curve E is supersingular if and only if $F^*$ equals 0.

• An elliptic curve is supersingular if and only if its Hasse invariant is 0.

• An elliptic curve is supersingular if and only if the group scheme of points of order p is connected.

• An elliptic curve is supersingular if and only if the dual of the Frobenius map is purely inseparable.

• An elliptic curve is supersingular if and only if the "multiplication by p" map is purely inseparable and the j-invariant of the curve lies in a quadratic extension of the prime field of K, a finite field of order p².

• Suppose E is in Legendre form, defined by the equation $y^2 = x(x-1)(x-\lambda)$, and p is odd. Then E is supersingular if and only if the sum

$\sum_{i=0}^n {n\choose{i}}^2\lambda^i$

vanishes, where $n = (p-1)/2$. Using this formula, one can show that there are only finitely many supersingular elliptic curves over K (up to isomorphism).

• Suppose E is given as a cubic curve in the projective plane given by a homogeneous cubic polynomial f(x,y,z). Then E is supersingular if and only if the coefficient of (xyz)^p–1 in f^p–1 is zero.

• If the field K is a finite field of order q, then an elliptic curve over K is supersingular if and only if the trace of the q-power Frobenius endomorphism is congruent to zero modulo p.

When q=p is a prime greater than 3 this is equivalent to having the trace of Frobenius equal to zero (by the Hasse bound); this does not hold for p=2 or 3.

Examples

• If K is a field of characteristic 2, every curve defined by an equation of the form

$y^2+a_3y = x^3+a_4x+a_6$

with a₃ nonzero is a supersingular elliptic curve, and conversely every supersingular curve is isomorphic to one of this form (see Washington2003, p. 122).

• Over the field with 2 elements any supersingular elliptic curve is isomorphic to exactly one of the supersingular elliptic curves

$y^2+y = x^3+x+1$

$y^2+y = x^3+1$

$y^2+y = x^3+x$

with 1, 3, and 5 points. This gives examples of supersingular elliptic curves over a prime field with different numbers of points.

• Over an algebraically closed field of characteristic 2 there is (up to isomorphism) exactly one supersingular elliptic curve, given by

$y^2+y=x^3$,

with j-invariant 0. Its ring of endomorphisms is the ring of Hurwitz quaternions, generated by the two automorphisms $x\rightarrow x+\omega$ and $y\rightarrow y+x+\omega,x\rightarrow x+1$ where $\omega^2+\omega+1=0$ is a primitive cube root of unity. Its group of automorphisms is the group of units of the Hurwitz quaternions, which has order 24 and contains a normal subgroup of order 8 isomorphic to the quaternion group.

• If K is a field of characteristic 3, every curve defined by an equation of the form

$y^2 = x^3+a_4x+a_6$

with a₄ nonzero is a supersingular elliptic curve, and conversely every supersingular curve is isomorphic to one of this form (see Washington2003, p. 122).

• Over the field with 3 elements any supersingular elliptic curve is isomorphic to exactly one of the supersingular elliptic curves

$y^2 = x^3-x$

$y^2 = x^3-x+1$

$y^2 = x^3-x+2$

$y^2 = x^3+x$

• Over an algebraically closed field of characteristic 3 there is (up to isomorphism) exactly one supersingular elliptic curve, given by

$y^2=x^3-x$,

with j-invariant 0. Its ring of endomorphisms is the ring of quaternions of the form a+bj with a and b Eisenstein integers. , generated by the two automorphisms $x\rightarrow x+1$ and $y\rightarrow iy,x\rightarrow -x$ where i is a primitive fourth root of unity. Its group of automorphisms is the group of units of the these quaternions, which has order 12 and contains a normal subgroup of order 3 with quotient a cyclic group of order 4.

• For $\mathbb{F}_p$ with p>3 the elliptic curve defined by $y^2 = x^3+1$ with j-invariant 0 is supersingular if and only if $p\equiv 2 \text{(mod 3)}$ and the elliptic curve defined by $y^2 = x^3+x$ with j-invariant 1728 is supersingular if and only if $p\equiv 3 \text{(mod 4)}$ (see Washington2003, 4.35).

• The elliptic curve given by $y^2 = x(x-1)(x+2)$ is nonsingular over $\mathbb{F}_p$ for $p\neq 2,3$. It is supersingular for p = 23 and ordinary for every other $p\leq 73$ (see Hartshorne1977, 4.23.6).
• The modular curve X₀(11) has j-invariant −2¹²11⁻⁵31³, and is isomorphic to the curve y² + y = x³ − x² − 10x − 20. The primes p for which it is supersingular are those for which the coefficient of q^p in η(τ)²η(11τ)² vanishes mod p, and are given by the list

2, 19, 29, 199, 569, 809, 1289, 1439, 2539, 3319, 3559, 3919, 5519, 9419, 9539, 9929,...  A006962

• If an elliptic curve over the rationals has complex multiplication then the set of primes for which it is supersingular has density 1/2. If it does not have complex multiplication then Serre showed that the set of primes for which it is supersingular has density zero. Elkies (1987) showed that any elliptic curve defined over the rationals is supersingular for an infinite number of primes.

Classification

For each positive characteristic there are only a finite number of possible j-invariants of supersingular elliptic curves. Over an algebraically closed field K an elliptic curve is determined by its j-invariant, so there are only a finite number of supersingular elliptic curves. If each such curve is weighted by 1/|Aut(E)| then the total weight of the supersingular curves is (p–1)/24. Elliptic curves have automorphism groups of order 2 unless their j-invariant is 0 or 1728, so the supersingular elliptic curves are classified as follows. There are exactly ⌊p/12⌋ supersingular elliptic curves with automorphism groups of order 2. In addition if p≡3 mod 4 there is a supersingular elliptic curve (with j-invariant 1728) whose automorphism group is cyclic or order 4 unless p=3 in which case it has order 12, and if p≡2 mod 3 there is a supersingular elliptic curve (with j-invariant 0) whose automorphism group is cyclic of order 6 unless p=2 in which case it has order 24.

Birch & Kuyk (1975) give a table of all j-invariants of supersingular curves for primes up to 307. For the first few primes the supersingular elliptic curves are given as follows. The number of supersingular values of j other than 0 or 1728 is the integer part of (p−1)/12.

prime	supersingular j invariants
2	0
3	1728
5	0
7	1728
11	0, 1728
13	5
17	0,8
19	7, 1728
23	0,19, 1728
29	0,2, 25
31	2, 4, 1728
37	8, 3±√15

See also

• Supersingular prime

References

• Robin Hartshorne (1977), Algebraic Geometry, Springer. ISBN 1-4419-2807-3
• Joseph H. Silverman (2009), The Arithmetic of Elliptic Curves, Springer. ISBN 0-387-09493-8
• Lawrence C. Washington (2003), Elliptic Curves, Chapman&Hall. ISBN 1-58488-365-0