In this section we describe how to make use of the existence of large prime divisors of the conductor of Z[π]. The techniques described here will be the only methods by which we may construct endomorphisms of E not lying in Z[π]. This will not be the motivating goal however, and we will incidentally produce such endomorphims only when the endomorphism ring is unexpectedly large. If one takes a constructive approach to the problem the methods outlined here can be applied to build generators for O, but the computational complexity is significantly worse than that obtainable for the determination of the endomorphism type of E.
By decomposition into prime degree isogenies, and application of proposition 21, we see that an isogeny between elliptic curves of endomorphism types O1 and O2 must have degree divisible by the integer
[O1O2 :O1]·[O1O2 :O2] = [O1 :O1∩ O2]·[O2 :O1∩ O2].
Moreover, every elliptic curve in the isogeny class of E over k has endomorphism ring containing Z[π]. Thus for any isogeny ϕ : E → E′ of degree relatively prime to the conductor of Z[π], the image curve E′ also has endomorphism type O. By proposition 22 the kernel ideal for ϕ is projective, andϕ is principal if and only if E′ is isomorphic to E. This gives us the bijection of the endomorphism class of E, up to isomorphism, with the class group of O as described in section 3.4 of Chapter 3.
This suggests two approaches which we might exploit for the determination of the endomorphism type of E. The first is to enumerate all of the h(O) elliptic curves in the endomorphism class of E. This involves choosing a set of small prime generators for the class group and using these to construct the corresponding endomorphisms of elliptic curves. The second involves computation of principal ideals of smooth norm
CHAPTER 4. THE ORDINARY CASE 49 in a possible endomorphism ring O, and then determining the corresponding isogeny to determine whether the image curve is isomorphic toE.
First we explore the possibilities of the enumeration approach. The class number of Z[π] and the orders containing it can be exceedingly large. The discriminant of O divides D = t2 −4q, and the class number has bound O(p
|D|log(|D|)). By the Brauer-Siegel Theorem [4, Theorem 4.9.15], the growth of log(OK) is asymptotically log(|DK|1/2), but the result is noneffective, and few absolute bounds on h(OK) from below are known.
However, if the conductor of Z[π] is divisible by a large prime l, then the orders containing
O1 =Z
π−a l
have discriminants dividing (t2−4q)/l2 and class numbers of these orders divide the class numberh(O1). Thus if we can enumerate the elliptic curves, up to isomorphism, in the endomorphism class of E until we exceed h(O1), we can conclude that E lies at the floor of rationality with respect tol.
Such a calculation presupposes that we have determinedh(O1) and that we have small splitting primes in O1 from which we can feasibly construct sequences of isogenies of small degree to all members of the endomorphism class. In the last section we will deal with the existence questions and the bounds necessary to derive complexity bounds on this method.
In order to enumerate the curves in the endomophism class ofE, up to isomorphism, we blindly explore the bounds of the class until we have determined the size of the world to which E is confined. This fails to exploit the considerable knowledge we have of the ideal group acting on the endomorphism class ofE. Instead we can build on the algorithms for ideal class groups to find class group relations among small splitting primes r1, . . . ,rc in the order O1. In doing so we obtain a principal ideal (β) =rs11· · ·rscc ⊆ O1, with exponent sum u=s1+· · ·+sc and let b =βO ∩ O. By constructing the sequence of isogenies:
E0 =E →E1 =E/E[r1]→E2 =E/E[r21]→ · · · →Eu =E/E[b],
each of small degree, we obtain a curve Eu =E/E[b] which is isomorphic toE if and only if b is principal. Typically we find β in a ring O1 containing Z[π] with large index, and we expect b to be nonprincipal in O = End(E). In the incidental case that O ⊇ O1 we have constructed a new endomorphism E −→E′ ∼=E.
We now recap the procedure for constructing the isogeny with kernel idealr. We note that any prime ideal r of O which does not divide the discriminant of Z[π] can be written in the form (r, π−b) for r=N(r) andb∈Z. Let FE(X, Y) be a Weierstrass equation forE and letψr(X, Y),ψb(X, Y), and φb(X) be the division polynomials on E in the notation of §2.2. The kernel of the isogenyE →E′ =E/E[r] is determined
CHAPTER 4. THE ORDINARY CASE 50 by the ideal
I = (ψr(X, Y), Xqψb(X, Y)2−φb(X))⊆ k[X, Y] (FE(X, Y)).
We let ψ(X) be a generator forI∩k[X], and construct E/E[r] using the formulas of
§ 2.4.
We can now complete the determination of the endomorphism type of the curve E of Example 2. We return to the complexity issues in the following section, in which we synthesize an algorithm.
Example 6. Now we can complete the calculation of the index ofZ[π] inO = End(E) for the curve of Example 2. In order to have class group of the smallest possible size, it will be useful to have an isogenous curve near the surface for each of the primes 2, 3 and 7. It is easy to find a curve one level above the floor of rationality forl since the unique isogeny of degreel overFp from a curve at the floor of rationality is to a curve with larger endomorphism ring. Finding a curve at the surface, however, involves a random search for one lying at the surface. Of the l+ 1 elliptic curves isogenous to E via an isogeny of degree l, only one lies at a depth less than E. At each depth above the floor of rationality one must calculate up to l+ 1 isogenies and determine the depth of each by the methods of the previous section. By means of such a search we identify an elliptic curve E0 with j-invariant
j0 = 580821385975059568086463192 modp
at the surface with respect to 2, 3, and 7. We know then that the endomorphism ring has either discriminant−3·5472·105953 or is maximal with discriminant −3·105953.
In the maximal order there exists a principal ideal p13p319 of norm 13·193. Since 13 and 19 do not divide the conductor of Z[π], in any order O1 containing Z[π], the primes p13 and p19 restrict to primes q13 = (13, π−3)O1 and q19 = (19, π+ 3)O1 in O1.
The curve E0/E0[q13] isogenous to E0 via the isogeny of degree 13 induced by the ideal q13 has the following j-value:
j1 = 4912256076205411462701139763 modp.
Further, constructing isogenies induced by the ideal q19, we get a sequence of elliptic curves having j-invariants as follows.
j2 = 6695768474115274781661782366 modp, j3 = 10013983805943763612560658488 modp, j4 = 7630889439855778258800203176 modp.
Since the final curve hasj-value j4 6=j0, we can conclude that q13q319 is not principal in the endomorphism ring ofE0, so it has discriminant −3·5472·105953. Combining the index calculations done in Example 5, we conclude that the endomorphism ring O of E has discriminant −218·32·710·5472·105953.
CHAPTER 4. THE ORDINARY CASE 51