11

In the proof of Hasse's Theorem over finite fields, one considers the Frobenous endomorphism $\phi(x,y) \rightarrow (x^q,y^q) \in E(\bar{F_q})$ and then notes that this endomorphism fixes the elements of $F_q\times F_q$ but permutes the rest of the element of ($\bar{F_q}\times \bar{F_q})\setminus (F_q\times F_q)$. Therefore, $$\#E(F_q) = \#ker(\phi - 1) = deg(\phi - 1)$$

In both Silverman's book as well as Washington's book, they go to extreme lengths (requiring Weil's pairing) in calculating the degree of this endomorphism. My question is, why can't we directly calculate the degree of this endomorphism? In other words, what's wrong with the following argument?

Let's pick a point $(\bar{x},\bar{y}) \in E(\bar{F_q})\setminus E(F_q)$ which will not be fixed by Frobenous. Then $(\bar{x}^q,\bar{y}^q)$ and $(\bar{x},\bar{y})$ cannot be equal. Therefore the explicit formula for the X-coordinate of $(\phi - 1)(\bar{x},\bar{y}) = (\bar{x}^q,\bar{y}^q) \oplus (\bar{x},-\bar{y})$ can be calculated using explicit point addition formula as $$\left(\frac{\bar{y}^q + \bar{y}}{\bar{x}^q - \bar{x}}\right)^2-\bar{x}^q - \bar{x} = \beta$$ for some $\beta \in \bar{F_q}\setminus F_q$ which is the the x-coordiate of some point. The degree of this equation can be easily calculated using high-school algebra, and that should tell us the number of points on the curve.

There is something wrong with my argument or Hasse's theorem won't be a bound. Can someone please point me what's wrong?

Kaj Hansen
  • 33,011
MachPortMassenger
  • 301
  • I didn't understand how you propose to calculate the degree of $\phi-1$ from a study of that displayed equation? Can you give a small example? For example, how would the method work for the curve $y^2+y=x^3$ in the case $q=4$? To aid the calculation I reveal that $E(\Bbb{F}_4)$ has $9$ points. As an example of a point not fixed by Frobenius I proffer $x=\alpha^3$, $y=\alpha^4$, where $\alpha$ is a zero of $T^3+T+1$, i.e. an element of $\Bbb{F}_8$. For field arithmetic see this post. Even the case $q=2$ may do as an exposition. – Jyrki Lahtonen Dec 08 '16 at 11:51
  • I suspect that you are trying to calculate the size of the inverse image of a generic point under $\phi-1$ or something. Could you please shed a bit of extra light on that. – Jyrki Lahtonen Dec 08 '16 at 11:56
  • @JyrkiLahtonen, these equations won't work in characteristics 2 or 3. But what I'm arguing is that since endomorphisms are surjective, there are plenty of $\beta \in \bar{F_q} \setminus F_q$ to choose from such that $\bar{x}^q - \bar{x} \neq 0$ and the above polynomial (after simplification) completely splits. (Every polynomial in $\bar{F_q}$ splits by definition, and since $\phi - 1$ is separable, we only have to care about the degree of that equation, after replacing $\bar{y}^2$ with $\bar{x}^3+A\bar{x}+C$). In the proof of $#ker(\alpha) = deg(\alpha)$ one uses similar argument. – MachPortMassenger Dec 08 '16 at 19:07
  • I see, that sounds reasonable (separability is the key). May be I misunderstood, but I also get the impression that you think this is in violation of Hasse's bound. Why would that be the case? – Jyrki Lahtonen Dec 08 '16 at 19:53
  • There is definitely something wrong with my argument, because the degree of that polynomial after simplification is always $3q$. I could be making a mistake in simplifying the equation, but even then the degree doesn't seem to depend on $A$ or $B$ but the number of points is heavily dependent on $A$ and $B$ values. – MachPortMassenger Dec 08 '16 at 20:02
  • There will always be largish amounts of cancellation. For example, applying $$\overline{y}^{2q}=\overline{x}^{3q}+A\overline{x}^q+C$$ will cancel some high degree terms automatically. Working on an example with $p=7$. It looks like there is something else going on as well. – Jyrki Lahtonen Dec 08 '16 at 20:04
  • 1
    With $p=7$ and the curve $Y^2=X^3-X$ that is known to have $8$ points over $\Bbb{F}_7$ I got the polynomial $$6 B X^{14}+2 B X^9+6 B X^4+X^{15}+2 X^{12}+6 X^{10}+X^9+5 X^8+6 X^7+6 X^6+2 X^4+6 X.$$ This has degree $15$, which is too high. I plugged in $B=2$ (my notation for your $\beta$). Because there are no $\Bbb{F}_7$ rational points with $X=2$ I think that should work the same way. Then Mathematica gave me the factorization: $$X (X+6) \left(X^2+3 X+6\right) \left(X^3+X^2+6 X+5\right) \left(X^8+2 X^7+4 X^6+3 X^5+2 X^4+2 X^2+4\right).$$ – Jyrki Lahtonen Dec 08 '16 at 20:24
  • So we see the extraneous factors $X$ and $X-1$ in there. The points $(0,0)$ and $(1,0)$ are both on the curve. When you clear the denominator from that equation any point $(x,0)\in E(\Bbb{F}_p)$ will also give a factor, right? I wonder why I am not seeing $X+1$ also, because $(-1,0)$ is also on that curve?? That degree 8 factor may be what you should arrive at, but I cannot explain the other factors. I need to recheck the calculation, but unfortunately that will have to wait. I need to take a look at tomorrow's lecture. – Jyrki Lahtonen Dec 08 '16 at 20:29

2 Answers2

2

I actually found the answer. Basically in the expression $$\frac{(y^q + y)^2}{(x^q -x)^2} - (x^q + x) = \beta $$ one needs to discard all the roots of $x \in F_q$ since for those values of $x$, $(x^q -x)^2$ in the denominator will end up being zero. (Note that we are not guaranteed that simplifying the above equation will only have roots in $\bar{F}_q \setminus F_q $. This was the main flaw in my original argument.) Therefore, we have to manually discard roots that are in $F_q$.

After discarding those roots, the degree of numerator (or equivalently, the degree of the denominator + 1; +1 for point at infinity) is equal to size of the kernel.

Doing this exercise has helped me understand the motivation for SEA algorithm so much better. Thanks everyone for taking the time to reply to my question.

MachPortMassenger
  • 301
0

Here is a partial answer. The fraction$$(y^q + y)^2/(x^q - x)^2 - x^q - x$$is a rational function in $x$, but of much lower degree than $3q$.

When I tried it for the elliptic curve $y^2 = x^3 - x$ mod $7$, as in the example above, it reduced to an degree $8$ polynomial divided by a degree $7$ polynomial. That exactly agrees with the degree of $\phi - 1$ being $8$.

In general, the degree should tell us how many rational points are on the curve, but I do not see how to obtain this from the rational function. Any $x_0$ in the finite field with $q$ elements for which the corresponding $y$ satisfies $y = 0$ or $y^{q - 1} = -1$ cancels $x - x_0$ from the numerator and denominator and thereby lowers the degree.

But I have not yet been able to turn this into a count of rational points on the curve. I am sure it is possible with the correct insight.

KeD
  • 2,137
  • 9
  • 31