A SUMMARY OF THE CM THEORY OF ELLIPTIC CURVES

JAYCE GETZ

1. Introduction: a few modular forms

We first fix some terminology from the classical theory of modular forms over Γ := SL_{2}(ℤ). For k ≥ 4, let

E_{k}(z) := 1 − \frac{B_{k}}{2k} ∑_{n=1}^{∞} σ_{k−1}(n)q^{n}

be the Eisenstein series of weight k. Here B_{k} is the kth Bernoulli number,

σ_{k−1}(n) := ∑_{d|n} d^{k−1}

and q := e^{2πiz}. We further define the Δ-, or discriminant function, to be the unique normalized weight 12 cusp form:

Δ(z) := \frac{E_{4}(z)^{3} − E_{6}(z)^{2}}{1728} = q ∏_{n=1}^{∞}(1 − q^{n})^{24}.

Finally we define the most important modular form for our purposes, namely the weight zero modular function

j(z) := \frac{E_{4}(z)^{3}}{Δ(z)} = q^{−1} + 744 + 196884q + 21493760q^{2} + · · · . (1.1)

The purpose of this expository paper is to describe some part of the intimate connection between this analytic function, the theory of elliptic curves with complex multiplication, and the algebraic number theory of imaginary quadratic fields. In terms of prerequisites, we will assume some familiarity with the j-function and its connection with the analytic geometry of elliptic curves, some basic constructs from the algebraic geometry of elliptic curves, and a knowledge of the tools of class field theory. We follow the relevant sections of [11] and [12, §II] closely.

2. The endomorphism ring over ℂ

Recall that for an elliptic curve E/ℂ, there exists a lattice L ⊂ ℂ such that

(2.1)  ℂ/L ˜⟶ E
z ∉ L ↦ (℘(z, L), ℘′(z, L), 1)
z ∈ L ↦ (0 : 1 : 0)

is an analytic isomorphism. Here ℘ is the classical Weierstrass ℘-function. Conversely, given any lattice L ⊂ ℂ, one can show that there exists an elliptic curve E for which an analytic isomorphism of the form (2.1) holds. Under this correspondence between lattices and elliptic curves, isomorphism classes of elliptic curves over ℂ correspond to equivalence classes of lattices, where the equivalence is given by L ∼ L′ if L = cL′ for some c ∈ ℂ^{∗}. By way of terminology, the map L′ → L given by multiplication by c ∈ ℂ^{∗} is called a homothety, and two lattices related in such a way are called homothetic. Note that we may choose a lattice L_{τ} with basis {τ, 1} with τ ∈ ℍ in each homothety class. Different bases of L_{τ} are given by applying elements of Γ to the basis {τ, 1}; it follows that we may take τ ∈ 𝔉. With this stipulation, the basis {τ, 1} is uniquely determined. We will denote by E_{τ} the corresponding elliptic curve under the map

Date: May 27, 2004.

ℂ/L_{τ} → E_{τ}.

We call this map (which is induced by (2.1)) an analytic representation of E_{τ}.

We now wish to make this analytic representation more explicit; additionally, because it will be useful later, we work in a slightly more general context. Let E/K be an elliptic curve over a field K of characteristic not equal to 2 or 3. Up to isomorphism, we can assume that E is given in affine coordinates by

(2.2)  E : y^{2} = 4x^{3} − g_{4}x − g_{6}

(see, for example, [7, §III.2]). If we restrict to the case K = ℂ, with the normalizations given above, the map (2.1) just formalizes the parametrization

E : (℘′(z, L))^{2} = 4(℘(z, L))^{3} − g_{4}℘(z, L) − g_{6}.

that exists for some lattice L ⊂ ℂ.

We now wish define the j-invariant of E_{τ}, and show how it relates to j(τ). First, the discriminant Δ(E) of the elliptic curve E/k is defined as

(2.3)  Δ(E) = (2π)^{−12}(g_{4}^{3} − 27g_{6}^{2}).

Remark. It is important to observe that the discriminant function Δ(E) is not equal to the discriminant of the cubic polynomial defining the curve. Since the discriminant of the polynomial defining an elliptic curve E is not an isomorphism invariant of E, there are a variety of essentially equivalent ways to define the discriminant; the reason for our particular definition will soon be apparent.

We define the j-invariant of E to be the quantity

(2.4)  j(E) := \frac{1728g_{4}^{3}}{(2π)^{12}Δ(E)}.

One can show by elementary means that over any field K of characteristic not equal to 2 or 3 that j(E) is indeed an invariant of the isomorphism class of E, and, further, given any j(E) ∈ K, there exists a curve of j-invariant j(E) (see [7, §III.2]).

Note the similarity of (2.4) and (1.1). This is no accident. Let ℂ/L_{τ} → E_{τ} be an analytic representation. It turns out that, with the normalizations given above, we have g_{2} = \frac{4}{3}π^{4}E_{4}(τ), g_{3} = \frac{8}{27}π^{6}E_{6}(τ). Hence, we have

Δ(E) = \frac{(E_{4}(τ)^{3} − E_{6}(τ)^{2})}{1728} = Δ(τ)

and

j(E_{τ}) = j(τ). (2.5)

Thus the coincidence of the “j” in j-function and j-invariant is really no coincidence. Indeed, noting the fact that as the j-invariant varies over K it parameterizes isomorphism classes of elliptic curves over K (at least if we continue to assume that the characteristic of K is not 2 or 3), and recalling that the j-function is a bijection between 𝔉 and ℂ, we have a bijective map

𝔉 ⟷ {isomorphism classes of E/ℂ} .

For proofs of the statements we just made on the equality of the various definitions of j and Δ, see [8, §I and p. 112]. For a basic introduction to the theory of elliptic curves, see [7].

Now that we have (2.1) and the isomorphism invariant j(E) in hand, we completely understand isomorphism classes of elliptic curves over ℂ considered as analytic objects; they are explicitly parameterized by ℘(z, L_{τ}) (considered as a function of τ ∈ 𝔉). For example, define E[N], the N-division points of E, to be the points of E of order dividing N. Viewing E/ℂ as ℂ/L_{τ}, it is evident that E[N] is simply the group \frac{1}{N} L_{τ}/L_{τ}, that is,

E[N] ≈ ℤ/Nℤ × ℤ/Nℤ.

The ring of endomorphisms of E, or End(E), can also be understood in a relatively straightforward manner using analytic representations. To begin, we have the following:

Lemma 1. Let L, M be two lattices in ℂ, and let

λ : ℂ/L → ℂ/M

be a complex analytic homomorphism. Then there exists a complex number α so that the following diagram commutes:

α : ℂ → ℂ
↓  ↓
λ : ℂ/L → ℂ/M.

Here the top map is multiplication by α and the bottom is the homomorphism λ.

Proof. In a neighborhood of zero, λ can be expressed by a power series

λ(z) = a_{0} + a_{1}z + a_{2}z^{2} + ⋯,

On the other hand, λ is a homomorphism, so a_{0} = 0 and additionally we have

λ(z + z′) ≡ λ(z) + λ(z′) (mod M).

If we choose a small enough neighborhood U of zero, we must have that this congruence is an equality in U; thus

λ(z) = a_{1}z

for z ∈ U. But for any z ∈ ℂ, z/n is in U for sufficiently large integers n, and from this we conclude that, identifying z with its reduction modulo L,

λ(z) = λ (n (\frac{z}{n})) = nλ (\frac{z}{n}) = na_{1} (\frac{z}{n}) = a_{1}z.

□

Remark. Abusing notation, we will often denote the complex number α and the homomorphism λ by the same symbol λ. We will also usually only be considering the special case L = M of Lemma 1.

So far we have been identifying an elliptic curve with an analytic parametrization, and hence its endomorphism ring with the endomorphism ring of a lattice. The following proposition, in conjunction with Lemma 1, shows that this endomorphism ring is unchanged if we instead think of elliptic curves as objects in a category with isogenies as morphisms:

Proposition 2. Let E_{1}, E_{2} be elliptic curves analytically parametrized by the lattices L_{1}, L_{2}, respectively. Then the natural inclusion

{isogenies ϕ : E_{1} ⟶ E_{2}} ⟶ {holomorphic maps ϕ : ℂ/L_{1} → ℂ/L_{2} with ϕ(0) = 0}

is a bijection.

Proof. First note that an isogeny is given locally by everywhere defined rational functions (i.e. it is a morphism). Hence the map induced on the corresponding complex tori will be holomorphic. Thus the association

Hom(E_{1}, E_{2}) ⟶ Holom. Map(ℂ/L_{1}, ℂ/L_{2})

is well defined, and it is clearly injective.

We now prove injectivity. It suffices to provide an isogeny corresponding to a map λ induced by multiplication by α as in Lemma 1. The induced map on Weierstrauss equations (c.f. (2.2)) is given by

E_{1} ⟶ E_{2}
[℘(z, L_{1}), ℘′(z, L_{1}), 1] ⟼ [℘(αz, L_{2}), ℘(αz, L_{2}), 1]

so we must show that ℘(αz, L_{2}) and ℘′(αz, L_{2}) can be expressed as rational functions of ℘(z, L_{1}) and ℘′(z, L_{2}). But αL_{1} ⊂ L_{2}, so for any ω ∈ L_{1},

℘(α(z + ω), L_{2}) = ℘(αz + αω, L_{2}) = ℘(αz, L_{2}),

and similarly for ℘′(αz, L_{2}). Thus both ℘(αz, L_{2}) and ℘′(αz, L_{2}) are complex analytic elliptic functions with respect to the lattice L_{1}. By elementary complex analysis, this implies that they can be expressed as rational functions of ℘(z, L_{1}) and ℘′(z, L_{2}) (see, for example, [11, §VI.3.2]]). □

Returning to the characterization of the endomorphism ring in Lemma 1, is clear that any λ ∈ ℤ will induce an endomorphism of ℂ/L_{τ}, which we can then identify with an element of End(E_{τ}). We will call these endomorphisms the trivial endomorphisms of E_{τ}. We have the following:

Definition. If E/ℂ is an elliptic curve with nontrivial elements in its endomorphism ring End(E/ℂ), then we say E is a curve with complex multiplication, or, briefly, E has CM.

The complex numbers λ inducing a nontrivial endomorphism of a lattice L turn out to be algebraic numbers; more specifically, they are quadratic over ℚ. Before we formalize and prove this as a proposition, we offer another definition:

Definition. Suppose τ ∈ ℍ is the root of a quadratic equation with integer coefficients; that is, τ = \frac{−b+\sqrt{b^{2}−4ac}}{2a} with a, b, c ∈ ℤ and gcd(a, b, c) = 1. We say that τ is a Heegner point and that d_{τ} = b^{2} − 4ac is the discriminant of τ.

Proposition 3. Suppose E/ℂ is an elliptic curve. Then (1) Every nontrivial endomorphism of E/ℂ is induced (in the sense of Theorem 1) either

by a Heegner point λ ∈ ℍ or by −λ for a Heegner point λ ∈ ℍ.

(2) The curve E/ℂ has CM if and only if j(E) = j(τ) for some Heegner point τ ∈ 𝔉.

(3) The curve E/ℂ has CM if and only if End(E) ≅ O, where O is an order in an imaginary quadratic number field K.

Proof. The endomorphism ring of E is unchanged if we replace it with another elliptic curve isomorphic to it, so we assume without loss of generality that E = E_{τ}, τ ∈ 𝔉. Thus we have an analytic representation

ℂ/L_{τ} → E_{τ}.

As we proved in Lemma 1, a nontrivial automorphism of E_{τ} can now be realized as a λ ∈ ℂ^{∗} − ℤ such that

λL_{τ} ⊂ L_{τ}

or, equivalently, for some ( \begin{matrix}a & b \\ c & d \end{matrix}) ∈ GL_{2}(ℚ) ∩ M_{2×2}(ℤ),

λτ = aτ + b
λ = cτ + d.

This implies that λ is a root of the quadratic equation

|\begin{matrix}x − a & −b \\ −c & x − d \end{matrix}| = 0.

Thus λ is a quadratic irrational algebraic integer. Now note that τ cannot be real; otherwise L_{τ} would not be a lattice, and c ≠ 0, for then λ would be an integer. Thus ℚ(τ) = ℚ(λ), and, further, both λ and τ are imaginary quadratic numbers. This proves (1).

We’ve also proven the “only if” implication of (2), just by recalling that j is an isomorphism invariant. The other direction follows similarly: note that if j(E) = j(τ) with τ a Heegner point, then E_{τ} ≈ E, and E_{τ} is evidently CM.

Finally, for (3), note that if E is CM, as proven above, there is an isomorphic curve E_{τ} where τ is a Heegner point. Thus End(E) ≈ End(L_{τ}), and, again as proven above, any complex number inducing a nontrivial endomorphism of L_{τ} is an element of O_{ℚ(τ)}, the ring of integers of ℚ(τ), but not an element of ℤ. With this observation in mind it is easy to see that the evident map End(L_{τ}) → O_{ℚ(τ)} is a homomorphism of rings with identity, and, further, the image of this homomorphism is not contained in ℤ ⊂ O_{ℚ(τ)}. Thus End(L_{τ}) ≈ End(E_{τ}) is isomorphic to an order in O_{ℚ(τ)}. Conversely, note that if End(E) ≈ O, with O an order in a quadratic imaginary field, then End(E) is not isomorphic to ℤ, so E must be CM. □

By way of terminology, if τ ∈ ℍ is a Heegner point, then j(τ) ∈ ℂ is called a singular modulus. In view of parts (3) and (4) of the last proposition, one might guess that these singular moduli would be of interest in the study of the arithmetic of imaginary quadratic number fields. This is indeed the case, but before we can explain anything in any more detail we must explore the connection between the CM elliptic curves and quadratic imaginary fields. We begin this program in the next section. First, however, we describe a normalization on the space of differentials Ω_{E} of an elliptic curve E that will be of use to us later . We recall for the reader’s convenience that for a curve written in Weierstrauss form as in (4.1), a translation-invariant differential is given by

ω := \frac{dx}{2y + a_{1}x + a_{3}} ∈ Ω_{E}

(for background on Ω_{E}, see [11, §III.5]). We have the following:

Proposition 4. Let E/ℂ be a CM elliptic curve with endomorphism ring R. Then there is an isomorphism

[·] : R˜⟶ End(E)

such that for any invariant differential ω ∈ Ω_{E} we have

[α]^{∗}ω = αω.

Proof. Note that an isomorphism of elliptic curves has the effect of multiplying the invariant differential by a constant (see, for example, [11, §II.1, Table 1.2]). Therefore, it suffices to choose a lattice L analytically parametrizing some elliptic curve E_{L} in the isomorphism class of E, and then prove the proposition for E_{L}.

Note that the endomorphism ring of E_{L} is (or is isomorphic to)

{α ∈ ℂ : αL ⊂ L} = R ⊂ ℂ

by Proposition 12. More precisely, each α ∈ ℝ gives an endomorphism [α] : E_{L} → E_{L} determined by the commutativity of the following diagram:

\begin{aligned}& ϕ_{α} \\ ℂ/L & ⟶ & ℂ/L \\ ↓ f & & ↓ f \\ E_{L} & ⟶ & E_{L} \\ & [α] \end{aligned}.

Here ϕ_{α} is the map induced by z ⟼ αz (c.f. Proposition 1) and f is an analytic parametrization. We claim that this map [·] : R˜→ End(E) satisfies [α]^{∗}ω = αω.

First note that any two nonzero invariant differentials on E_{L} are scalar multiples of eachother. This follows trivially from the fact that their quotient would be a translation invariant function, and hence would be constant. So if we take any invariant differential ω ∈ Ω_{E} and pull back via the isomorphism f : ℂ/L → E_{L}, we obtain a multiple of the invariant differential dz on ℂ/L, say

f^{∗}ω = cdz.

Now using the commutative diagram yields

[α]^{∗}ω = (f^{−1})^{∗} ∘ ϕ_{α}^{∗} ∘ f^{∗}(ω) = (f^{−1})^{∗} ∘ ϕ_{α}^{∗}(cdz) = (f^{−1})^{∗}(cαdz) = αω.
□

Corollary 5. Let (E_{1}, [·]_{E_{1}}) and (E_{2}, [·]_{E_{2}}) be normalized elliptic curves with CM, and that both endomorphism rings are isomorphic to an order R in a quadratic imaginary field. Morever let ϕ : E_{1} → E_{2} be an isogeny. Then, for all α ∈ R,

ϕ ∘ [α]_{E_{1}} = [α]_{E_{2}} ∘ ϕ.

Proof. Let 0 ≠ ω ∈ Ω_{E_{2}} be an invariant differential. Then

(ϕ ∘ [α]_{E_{1}})^{∗}ω = [α]_{E_{1}}^{∗}(ϕ^{∗}ω)
= αϕ^{∗}ω since ϕ^{∗}ω is an invariant differential on E_{1}
= ϕ^{∗}αω
= ϕ^{∗}([α]_{E_{2}}^{∗}ω
= ([α]_{E_{2}} ∘ ϕ)^{∗}ω.

Since we are working over ℂ, the map

Hom(E_{1}, E_{2}) ⟶ Hom(Ω_{E_{1}}, Ω_{E_{2}})
ϕ ⟼ ϕ^{∗}

is injective. This follows, for instance, from the fact that every element of Hom(E_{1}, E_{2}) is induced by multiplication by a complex number by Lemma 1 and Proposition 2 when we view E_{1}, E_{2} as ℂ/L_{1} and ℂ/L_{2} for two lattices L_{1}, L_{2} ⊂ ℂ. Then the Ω_{E_{i}} can be thought of as the dual of the tangent space of ℂ/L_{i} at the origin, which can be identified with ℂ. It is then straightforward to see that multiplication by λ ∈ ℂ as an isogeny from ℂ/L_{1} to ℂ/L_{2} induces multiplication by λ as an element of Hom(Ω_{E_{1}}, Ω_{E_{2}}). For an alternate proof, see [11, §II.4.2c].

In any case, injectivity implies that ϕ ∘ [α]_{E_{1}} = [α]_{E_{2}} ∘ ϕ. □

3. Class and Galois groups associated to imaginary quadratic fields

We’ve seen in Proposition 3 that every CM elliptic curve has endomorphism ring isomorphic to an order in a quadratic number field. We now work in an opposite direction. Fix an imaginary quadratic number field K, and let O_{K} be its ring of integers. We wish to study the following sets:

(3.1)  ELL(O_{K}) : = \frac{\{elliptic curves E/ℂ with End(E) ≅ O_{K}\}}{isomorphism over ℂ}
≅ \frac{\{lattices L with End(L) ≅ O_{K}\}}{homothety}.

We now show that these sets are nonempty for any imaginary quadratic number field K. Fix an embedding K ↪ ℂ. Given any nonzero fractional ideal 𝔞 ⊂ K, we know from elementary algebraic number theory that the image of 𝔞 under our chosen embedding (which we will also denote by 𝔞) is a lattice in ℂ. Denote by E_{𝔞} the elliptic curve associated to this lattice. We have

End(E_{𝔞}) ≅ {α ∈ ℂ : α𝔞 ⊂ 𝔞}
= {α ∈ K : α𝔞 ⊂ 𝔞} since 𝔞 ⊂ K,
= O_{K} since 𝔞 is a fractional ideal.

Thus given O_{K}, we can find an elliptic curve E with End(E) ≈ O_{K}. Further, since homothetic lattices give rise to isomorphic elliptic curves, if c ∈ K, then E_{(c)𝔞} ≈ E_{𝔞}. In other words, multiplying a fractional ideal by a principal ideal in O_{K} does not change the elliptic curve that arises from that ideal. In particular, if we denote by CL(K) the ideal class group of K, that is,

CL(K) := \frac{\{nonzero fractional ideals of K\}}{\{nonzero principal ideals of K\}}.

then we have a map

CL(K) ⟶ ELL(O_{K})
\overline{𝔞} ⟼ E_{𝔞}

where \overline{𝔞} is the ideal class of 𝔞 ∈ CL(k). More generally, if L is any lattice and 𝔞 any nonzero fractional ideal of K, then define the product

𝔞L := {α_{1}λ_{1} + ⋯ + α_{r}λ_{r} : α_{i} ∈ 𝔞, λ_{i} ∈ L}.

Now let L be a lattice with E_{L} ∈ ELL(O_{K}) its associated elliptic curve. We define

\overline{𝔞} ∗ E_{L} := E_{𝔞^{−1}L} (3.2)

The content of the following proposition is that (3.2) induces an action:

Proposition 6. Let L be a lattice with E_{L} ∈ ELL(O_{k}), and let 𝔞 and 𝔟 be non-zero fractional ideals of K. We have

(1) 𝔞L is a lattice in ℂ,

(2) The elliptic curve E_{𝔞L} satisfies End(E_{𝔞L}) ≅ R_{K}, and

(3) E_{𝔞L} ≅ E_{𝔟L} if and only if \overline{a} = \overline{b} in CL(O_{K}). Hence we have a well defined action

(3.3)  CL(k) ⟶ ELL(O_{K})
\overline{𝔞} ⟼ \overline{𝔞} ∗ E_{L} := E_{𝔞^{−1}L}.

Further, this action is simply transitive.

Proof. (1) By assumption, End(E_{L}) = O_{K}, so O_{K}L = L. Choose a nonzero integer d ∈ ℤ so that d𝔞 ⊂ O_{K}. Then 𝔞L ⊂ \frac{1}{d}L, so 𝔞L is a discrete subgroup of ℂ. Similarly, choosing a nonzero integer d so that dO_{k} ⊂ 𝔞, we find that dL ⊂ 𝔞L, so 𝔞L also spans ℂ.

(2) For any α ∈ ℂ and any fractional ideal 𝔞 ≠ 0, we have that

α𝔞L ⊂ 𝔞L ⟺ 𝔞^{−1}α𝔞L ⊂ 𝔞^{−1}𝔞L ⟺ αL ⊂ L.

Hence

End(E_{𝔞L}) = {α ∈ ℂ : α𝔞L ⊂ 𝔞L} = {α ∈ ℂ : αL ⊂ L} = End(E_{L}) = O_{K}.

(3) Recall that, as we discussed in §2, the isomorphism class of E_{L} is determined by the homothety class of L and the homothety class of L is determined by the ismorphism class of E_{L}. Thus

E_{𝔞L} ≅ E_{𝔟L} ⟺ 𝔞L = c𝔟L,

or, rewriting,

E_{𝔞L} ≅ E_{𝔟L} ⟺ L = c𝔞^{−1}𝔟L ⟺ L = c^{−1}𝔞𝔟^{−1}L.

Hence if E_{𝔞L} ≅ E_{𝔟L}, then both c𝔞^{−1}𝔟 and c^{−1}𝔞𝔟^{−1} take L to itself. This implies, in particular, that they are both equal to O_{K}. Thus

𝔞 = c𝔟

which implies c ∈ K and \overline{a} = \overline{b}. This provides the “only if” direction; the other direction is obvious.

To prove that (3.3) induces an action given what we have just proven, observe

\overline{a} ∗ (\overline{b} ∗ E_{L}) = 𝔞 ∗ E_{𝔟^{−1}L} = E_{𝔞^{−1}(𝔟^{−1}L)} = E_{(𝔞𝔟)^{−1}L} = (\overline{𝔞}\overline{𝔟}) ∗ E_{L}.

That this action is simple (i.e. faithful) follows immediately from (2). To finish the proof of the proposition, we must show that it is transitive. Let E_{L_{1}}, E_{L_{2}} ∈ ELL(O_{K}). We must find a nonzero fractional ideal 𝔞 with the property that 𝔞_{1} = \frac{1}{λ_{1}} L_{1}. Choose any nonzero element λ_{1} ∈ L_{1}, and consider the lattice 𝔞_{1} = \frac{1}{λ_{1}} L_{1}. As we noted in the proof of Proposition 3, L_{1} is equivalent under the action of Γ to a lattice with basis {1, τ}, τ ∈ K. It follows that 𝔞_{1} ⊂ K, and, by assumption, it is a finitely generated O_{K} module. Thus it is a fractional ideal of K.

Similarly, choosing a non-zero λ_{2} ∈ L_{2}, we obtain a second fractional ideal 𝔞_{2} = \frac{1}{λ_{2}} L_{2} of K. We have

\frac{λ_{2}}{λ_{1}} 𝔞_{2}𝔞_{1}^{−1}L_{1} = L_{2}.

Thus, letting 𝔞 = 𝔞_{2}^{−1}𝔞_{1}, then we have

\overline{𝔞} ∗ E_{L_{1}} = E_{𝔞^{−1}L_{1}} = E_{\frac{λ_{1}}{λ_{2}} L_{2}} ≅ E_{L_{2}},

for homothetic lattices analytically parametrize isomorphic elliptic curves. □

Now that we have an action defined, we look briefly at a particular algebraic object generalizing the groups E[m]. Let 𝔞 ∈ O_{K} be an (integral) ideal, and E be an elliptic curve with endomorphism ring isomorphic to O_{K}. Recalling our normalization in Proposition 4, we define

E[𝔞] := {P ∈ E : [α]P = 0 for all α ∈ 𝔞}.

We call E𝔞 the group of 𝔞-torsion points of E. The following proposition will be of use to us in the proof of Proposition 26 below:

Proposition 7. Let E ∈ ELL(O_{K}), and let 𝔞 be an integral ideal of O_{K}. The following are true:

(1) The group E[𝔞] is the kernel of the natural map E ⟶ \overline{𝔞} ∗ E.

(2) The group E[𝔞] is a free O_{K}/𝔞-module of rank 1.

(3) Thus the map E ⟶ \overline{a} ∗ E has degree N_{ℚ}^{K}𝔞.

Proof. Let L be a lattice analytically parametrizing E. We have

E[𝔞] ≅ {z ∈ ℂ/L : αz = 0 for all α ∈ 𝔞}
= {z ∈ ℂ : αz ∈ L for all α ∈ 𝔞}/L
= {z ∈ ℂ : z𝔞 ⊂ L}/L
= 𝔞^{−1}L/L
= ker (ℂ/L ⟶ ℂ/𝔞^{−1}L) here the map is just z ↦ z
= ker (E ⟶ \overline{𝔞} ∗ E) .

This proves (1).

For (2), keep the same notation as above. Arguing as in the proof of Proposition 3, we may assume that L is spanned by 1 and τ, where τ ∈ K. In other words, L ⊂ K is a finitely generated O_{K} module, and hence is a factional ideal of K.

From (1), we know that E[𝔞] ≅ 𝔞^{−1}L/L as O_{K}/𝔞-modules. Note that if 𝔮 is any integral ideal dividing 𝔞, then the fact that O_{K}L = L implies

(𝔞^{−1}L/L) ⊗_{O_{K}} (O_{K}/𝔮) ≅ 𝔞^{−1}L/(L + 𝔮𝔞^{−1}L) = 𝔞^{−1}L/𝔮𝔞^{−1}L.

Hence if we use the Chinese Remainder Theorem to write

O_{K}/A ≅ ∏_{𝔭 prime}O_{K}/𝔭^{e(𝔭)}

then we have

E[𝔞] ≅ ∏_{𝔭 prime}𝔞^{−1}L/𝔭^{e(𝔭)}𝔞^{−1}L.

Thus, it suffices to prove that if 𝔟 is a fractional ideal of O_{K} (in particular if 𝔟 = 𝔞^{−1}L) and if 𝔭^{e} is a power of a prime ideal, then 𝔟/𝔭^{e} is a free O_{k}/𝔭^{e} module of rank one.

We momentarily write

R′ := O_{K}/𝔭^{e}, 𝔭′ := 𝔭/𝔭^{e} and 𝔟′ := 𝔟/𝔭^{e}𝔟.

Note that R′ is a local ring with maximal ideal 𝔭′ (indeed, the only ideals in R′ are (0), 𝔭^{′e−1}, ⋯ 𝔭′, (1)). Consider the quotient

𝔟′/𝔭′𝔟′ ≅ 𝔟/𝔭𝔟

as a vector space over the field R′/𝔭′ ≅ O_{K}/𝔭. We claim that it is a one-dimensional vector space.

First we observe that any two elements of 𝔟 are O_{K}-linearly dependent, so the dimension of 𝔟/𝔭𝔟 over O_{K}/𝔭 is at most one. On the other hand, if the dimension were zero, we would have 𝔟 = 𝔭𝔟, which is absurd. Hence the dimension is 1. By Nakayama’s lemma (see [1, Proposition 2.8], for example), applied to the local ring R′ and the R′-module 𝔟′, it follows that 𝔟′ is a free R′-module of rank one. This completes the proof of (2).

Finally, (3) follows immediately from (1) and (2):

deg(E → 𝔞 ∗ E) = #E[𝔞] from (1)
= N_{ℚ}^{K}𝔞 from (2).
□

We now return to the action discussed in Proposition 6. Fix the notation

h_{K} = |CL(K)|.

Then Proposition 6 tells us, in particular, that |ELL| = h_{K}. We can extract a good deal of additional information from Proposition 6; indeed, it is the basis for the remainder of the results in this paper. We first use it to prove that the singular moduli introduced above are algebraic numbers. In order to do this, we must understand how to translate the action of CL(O_{K}) on ELL(O_{K}) into an action of Gal(\overline{K}/K) on \{j(E) : E ∈ ELL(O_{K})\}. We now begin this process.

For σ ∈ Aut(ℂ), let c^{σ} denote σ(c) for all c ∈ ℂ, and let E^{σ} denote the elliptic curve formed by letting σ act on the coefficients of the defining affine equation of E. Further, if ϕ : E → E is an endomorphism of E, then denote by ϕ^{σ} : E^{σ} → E^{σ} the induced endomorphism (i.e. isogeny from E^{σ} to itself) of E^{σ}. With this notation fixed, we have the following:

Lemma 8. Let E/ℂ be an representative of a class of elliptic curves in ELL(O_{K}) for O_{K} the ring of integers of an imaginary quadratic field K. Then j(E) ∈ \overline{ℚ}.

Proof. Let σ : ℂ → ℂ be a field automorphism of ℂ. First note that End(E^{σ}) ≃ End(E), simply because if ϕ : E → E is any endomorphism of E, then ϕ^{σ} : E^{σ} → E^{σ} is an endomorphism of E^{σ}. Thus End(E^{σ}) ≈ End(E). In particular, as σ varies, E^{σ} varies over only finitely many ℂ-automorphism classes of elliptic curves with endomorphism ring isomorphic to O_{K} because the action (3.3) is simply transitive and the class group is finite.

Note that E^{σ} is obtained from E by letting σ act on the coefficients of the affine equation defining E. The invariant j(E) is just a rational combination of those coefficients, so we have

j(E^{σ}) = j(E)^{σ}. (3.4)

Since the isomorphism class of an elliptic curve is determined by its j-invariant and there are only finitely many ℂ-isomorphism classes in {E^{σ}}_{σ∈Aut(ℂ)}, it follows that j(E)^{σ} takes on only finitely many values as σ ranges over Aut(ℂ). Therefore [ℚ(j(E)) : ℚ] is finite, so j(E) is an algebraic number. This completes the proof. □

The first application of Lemma 8 is the following proposition, which tells us that we may choose a curve defined over \overline{ℚ} as a model for a given isomorphism class of CM curves.

Proposition 9. Let K be a quadratic imaginary field. Then

ELL(O_{K}) ≅ \frac{\{elliptic curves E/\overline{ℚ} with End(E) ≅ O_{K}\}}{isomorphism over \overline{ℚ}}.

Proof. For any subfield 𝔽 ⊂ ℂ denote by

ELL_{F} (O_{K}) := \frac{\{elliptic curves E/F with End(E) ≅ O_{K}\}}{isomorphism over 𝔽}

for the purposes of this proof. Fixing an embedding \overline{ℚ} ↪ ℂ, we have a natural map

ϵ : ELL\overline{ℚ}(O_{K}) ⟶ ELL_{ℂ}(O_{K}).

We need to check that this map is a bijection. Let E/CC represent an element of ELL_{ℂ}(O_{K}). Then j(E) ∈ \overline{ℚ} by Lemma 8, and hence by the discussion in §2 there exists an elliptic curve E′/ℚ(j(E)) with j(E) = j(E′), that is, E ≅ E′ over ℂ. Thus ϵ is surjective.

Now let E_{1}/\overline{ℚ} and E_{2}/\overline{ℚ} be elements of ELL\overline{ℚ}(O_{K}). If they are isomorphic over ℂ (i.e. ϵ(E_{1}) = ϵ(E_{2})), then their j-invariants are the same and are additionally defined over \overline{ℚ}. Hence they are isomorphic over \overline{ℚ} as well. This proves injectivity. □

We can say a good deal more about the algebraic nature of j(E), but in order to prove anything, we must first understand more precisely how to relate the action of CL(K) on ELL(O_{K}) to the action of Gal(\overline{K}/K) on the K. The first step in towards this understanding is the first part of the following Theorem, the second part will be useful in §5

Theorem 10. The following are true.

(1) Let E/ℂ be a CM elliptic curve with endomorphism ring R ⊂ ℂ. Then

[α]_{E}^{σ} = [α^{σ}]_{E^{σ}} for all α ∈ R and all σ ∈ Aut(ℂ)

where the isomorphism [·]_{E} : R˜→ End(E) and [·]_{E^{σ}} : R˜→ End(E^{σ}) are normalized as in Proposition 4.

(2) Let E_{1}/L and E_{2}/L be elliptic curves defined over a field L ⊂ ℂ. Then there is a finite extension L′/L such that every isogeny from E_{1} to E_{2} is defined over L′.

Proof. For (1), let ω ∈ Ω_{E} be a non-zero invariant differential on E. Then the normalizations described in Proposition 4 imply that

[α]_{E}^{∗}ω = αω for all α ∈ R.

Further, ω^{σ} is an invariant differential on E^{σ} (here ω^{σ} is the differential formed by letting σ act on the complex coefficients defining ω). Thus, again from Proposition 4,

[β]_{E^{σ}}^{∗}ω^{σ} = βω^{σ} for all β ∈ R.

Now for any α ∈ R and any σ ∈ Aut(ℂ) we compute

([α]_{E}^{σ})^{∗}(ω^{σ}) = ([α]_{E}^{∗}ω)^{σ} = (αω)^{σ} = α^{σ}ω^{σ} = [α^{σ}]_{E^{σ}}^{∗}(ω^{σ}).

In particular, [α]_{E^{σ}} and [α^{σ}]_{E^{σ}} have the same effect on the invariant differential ω^{σ}. Note that

(3.5)  End(E^{σ}) ⟶ End(Ω_{E^{σ}})
(3.6)  ψ ⟼ ψ^{∗}

is injective by Proposition 4. Thus we have [α]_{E}^{σ} = [α^{σ}]_{E^{σ}}.

Now we prove (2). Take affine equations for E_{1} and E_{2} with coefficients in L. Let ϕ ∈ Hom(E_{1}, E_{2}) be an isogeny. Then for any σ ∈ Aut(ℂ) such that σ fixes L, we have ϕ^{σ} ∈ Hom(E_{1}, E_{2}). Note that deg ϕ^{σ} = deg ϕ. From [11, Proposition 11, §III.4], any isogeny ϕ ∈ Hom(E_{1}, E_{2}) is determined by its kernel, at least up to automorphisms of E_{1}, E_{2}. The curves E_{1} and E_{2} only have finitely many subgroups of any given order, and their automorphism groups are finite (this is immediate from the analytic parametrization). Therefore the set

{ϕ^{σ} : σ ∈ Aut(ℂ), σ fixes L}

is finite, which implies that ϕ is defined over a finite extension of L. Finally, we observe that Hom(E_{1}, E_{2}) is a finitely generated group (see Corollary 7.5, [11, §III.8]), so it suffices to take a field of definition for some finite set of generators. □

Leaving explicit considerations of the endomorphism ring for a moment, we define an action of Gal(\overline{K}/K) on ELL(O_{K}) in the following manner. Suppose we are given σ ∈ Gal(\overline{K}/K). Because the action of CL(K) defined in (3.3) is transitive, there is a representative \overline{𝔞} of the unique class in CL(K), depending on σ, such that \overline{𝔞} ∗ E = E^{σ}. Thus we have a well defined map

F : Gal(\overline{K}/K) ⟶ CL(K)

characterized by the property

(3.7) E^{σ} = F (σ) ∗ E for all σ ∈ Gal(\overline{K}/K).

We can also characterize F in terms of j-invariants. Using the fact that the j-invariant is, well, an invariant of the isomorphism class of a curve (or, equivalently, a lattice), we have

j(L)^{σ} = j(F (σ)^{−1}L) (3.8)

where L is a lattice with End(L) ≈ O_{K}, as usual. We will show in Proposition 11 that F defines a homomorphism, which isn’t that surprising. What is more striking is that the definition of F is independent of the choice of the isomorphism class of E; this will be proven in Proposition 11 as well.

Proposition 11. Let K/ℚ be a quadratic imaginary field. Then there exists a homomorphism

F : Gal(\overline{K}/K) ⟶ CL(K)

characterized by the condition

E^{σ} = F (σ) ∗ E for all σ ∈ Gal(\overline{K}/K) and E ∈ ELL(O_{K}).

Proof. We noted in the proof of Lemma 8 that End(E^{σ}) ≅ End(E) for any σ ∈ Aut(ℂ). This, combined with the fact that the action of CL(K) on ELL(O_{K}) is simply transitive, imply that for any σ ∈ Gal(\overline{K}/K) and any E ∈ ELL(O_{K}), there is a unique \overline{a} ∈ CL(K) with E^{σ} = \overline{𝔞} ∗ E. Thus for a fixed E as above, we obtain a well defined map F as in the statement of the theorem. To prove that F is a homomorphism, just note that

F (στ) ∗ E = E^{στ} = (E^{τ})^{σ} = (F (τ) ∗ E)^{σ} = F (σ) ∗ (F (τ) ∗ E) = (F (σ)F (τ)) ∗ E.

for σ, τ ∈ Gal(\overline{K}/K) (note Gal(\overline{K}/K) acts on the left).

This part was easy; the more involved part is to show that F is independent of the choice of E. Let E_{1}, E_{2} ∈ ELL(O_{K}), σ ∈ Gal(\overline{K}/K), and write E_{1}^{σ} = \overline{𝔞}_{1} ∗ E_{1} and E_{2}^{σ} = \overline{𝔞}_{2} ∗ E_{2}. We must show that \overline{𝔞}_{1} = \overline{𝔞}_{2}. Since CL(K) acts transitively on ELL(O_{K}), we can find a \overline{𝔟} with E_{2} = \overline{𝔟} ∗ E_{1}. Then

(\overline{𝔟} ∗ E_{1})^{σ} = E_{2}^{σ} = \overline{𝔞}_{2} ∗ E_{2} = \overline{𝔞}_{2} ∗ (\overline{𝔟} ∗ E_{1}) = (\overline{𝔞}_{2}\overline{𝔟}\overline{𝔞}_{1}^{−1}) ∗ E_{1}^{σ}. (3.9)

We will prove independently in Proposition 12 below that (\overline{𝔟}∗E_{1})^{σ} is equal to \overline{𝔟}^{σ}∗E_{1}^{σ}. Noting that \overline{𝔟}^{σ} = \overline{𝔟} because 𝔟 ⊂ K, we can then cancel 𝔟 from both sides of (3.9) to conclude that E_{1}^{σ} = (\overline{𝔞}_{2}\overline{𝔞}_{1}^{−1})∗E_{1}^{σ}, which implies by Proposition 6(3) that \overline{𝔞}_{1} = \overline{𝔞}_{2}. This completes the proof of the Proposition, modulo proving Proposition 12, which will be done below. □

We now need to prove

Proposition 12. Suppose K is a quadratic imaginary field. Let E/\overline{ℚ} be an elliptic curve representing an element of ELL(O_{K}), let \overline{𝔞} ∈ CL(O_{K}), and let σ ∈ Gal(\overline{ℚ}/ℚ). Then

(\overline{𝔞} ∗ E)^{σ} = \overline{𝔞}^{σ} ∗ E^{σ}.

This will suffice to prove Proposition 11, since every isomorphism class in ELL(O_{K}) has a representative defined over \overline{ℚ} by Proposition 9. Notice that Proposition 12 describes the algebraic action of Gal(\overline{ℚ}/ℚ) on the analytic object 𝔞 ∗ E (recall 𝔞 ∗ E := ℂ/𝔞^{−1}L for some lattice L analytically parametrizing E). Indeed, the main objective of the proof of Proposition 12 will be to find a suitable algebraic description of 𝔞 ∗ E.

Before we begin this proof, however, we must first prove the following lemma from commutative algebra:

Lemma 13. Let R be a Dedekind domain, 𝔞 a fractional ideal of R, and M a torsion-free R-module. Then the natural map

ϕ : 𝔞^{−1}M ⟶ Hom_{R}(𝔞, M)
x ⟼ ϕ_{x} := (α ↦ αx)

is an isomorphism.

Proof of Lemma 13. It is easy to see that the given map is well defined and a monomorphism (because R is a domain). Using the fact that M is a free R-module, we can reduce the proof to the special case of demonstating

ϕ : 𝔞^{−1} ⟶ Hom_{R}(𝔞, R)
x ⟼ ϕ_{x} := (α ↦ αx)

is surjective. Now given an element f ∈ Hom_{R}(𝔞, R) and a, b ∈ 𝔞 ⊂ R, we clearly have af(b) = bf(a). Thus f(b) = \frac{b}{a}f(a), so f = ϕ_{f(a)/a}. Further, \frac{f(a)}{a} ∈ 𝔞^{−1}, because it has the property that for every b ∈ 𝔞, b\frac{f(a)}{a} ∈ R. □

Proof of Proposition 12. Choose a lattice L so that E ≅ E_{L}, and fix a resolution (i.e. an exact sequence)

O_{K}^{m} ⟶ O_{K}^{n} ⟶ 𝔞 ⟶ 0.

Here the first map is represented by a matrix A ∈ M_{m×N}(O_{K}). The main idea behind this proof is that we ought to have

ℂ/𝔞L ≅ \overline{𝔞} ∗ E ≅ Hom(𝔞, E).

Here and throughout this proof, Hom means O_{K}-module homomorphisms. However, in order to provide this sequence of isomorphisms, we are going to interpret Hom(𝔞, E) not just as an O_{K}-module, but also as an algebraic variety.

Using our free resolution in conjunction with the short exact sequence

O ⟶ L ⟶ ℂ ⟶ E ⟶ 0 (3.10)

we obtain the following commutative diagram:

0  0  0 ↓  ↓  ↓ 0 ⟶ Hom(𝔞, L) ⟶ Hom(𝔞, ℂ) ⟶ Hom(𝔞, E) ↓  ↓  ↓ 0 ⟶ Hom(O_{K}^{n}, L) ⟶ Hom(O_{K}^{n}, ℂ) ⟶ Hom(O_{K}^{n}, E) ↓ A  ↓ A  ↓ A 0 ⟶ Hom(O_{K}^{m}, L) ⟶ Hom(O_{K}^{m}, ℂ) ⟶ Hom(O_{K}^{m}, E).

For any O_{K} module M, we have Hom(O_{K}, M) ≅ M^{n}, and applying Lemma 13 with M = L and then M = ℂ, we obtain

Hom(𝔞, L) = 𝔞^{−1}L Hom(𝔞, ℂ) = 𝔞^{−1}ℂ = ℂ

Hence we can rewrite the diagram above as

\begin{aligned}& & 0 & & 0 & & 0 \\ & & ↓ & & ↓ & & ↓ \\ 0 & ⟶ & 𝔞^{−1}L & ⟶ & ℂ & ⟶ & Hom(𝔞, E) \\ & & ↓ & & ↓ & & ↓ \\ 0 & ⟶ & L^{n} & ⟶ & ℂ^{n} & ⟶ & E^{n} & ⟶ & 0 \\ & & ↓ A^{t} & & ↓ A^{t} & & ↓ A^{t} \\ 0 & ⟶ & L^{m} & ⟶ & ℂ^{m} & ⟶ & E^{m} & ⟶ & 0 \end{aligned}. (3.11)

Here A^{t} is the transpose of the matrix A, and exactness of the bottom two rows follows immediately from (3.10).

An application of the snake lemma to the bottom two rows of (3.11) then yields the exact sequence

0 ⟶ 𝔞^{−1}L ⟶ ℂ ⟶ ker(A^{t} : E^{n} → E^{m}) ⟶ L^{n}/A^{t}L^{m}. (3.12)

Now, A^{t} : E^{n} → E^{m} is an algebraic map of algebraic group varieties, since A^{t} ∈ M_{m×n}(O_{K}) and End(E) = O_{K}. Hence the inverse image of the point (0, 0, ⋯, 0) ∈ E^{m} is an algebraic group subvariety of E^{n}. By Theorem 10, for any σ ∈ Aut(ℂ), the corresponding map (E^{σ})^{n} → (E^{σ})^{m} is obtained by applying σ to the entries of A^{t}, treated as elements of O_{K} ⊂ ℂ.

If we give every object in (3.12) the topology induced by thinking of the object as a complex Riemann surface, note that it is topologically exact as well. With respect to these topologies, L^{n}/A^{t}L^{m} is discrete and ℂ/𝔞^{−1}L is connected. Hence (3.12) yields

(𝔞 ∗ E)(ℂ) = ℂ/A^{−1}L ≅ identity component of ker(A^{t} : E^{n} → E^{m}).

The whole point of this business was to give an algebraic characterization of 𝔞 ∗ E, which we now have. We can now use this description to finish the proof of the Proposition. For any σ ∈ Gal(\overline{ℚ}/ℚ), we apply this characterization first to E and then to E^{σ} to deduce that

(𝔞 ∗ E)^{σ} = (identity component of ker(A^{t} : E^{n} → E^{m}))^{σ}
= identity component of ker((A^{σ})^{t}(E^{σ})^{n} → (E^{σ})^{m})
= 𝔞^{σ} ∗ E^{σ}.

This concludes the proof of Proposition 12. □

Proposition 11 hints at an intimate connection between the arithmetic of elliptic curves in ELL(O_{K}) and the class field theory of K. One of the most important consequences of this relationship is the following statement:

Theorem 14. Let E be an elliptic curve representing a class in ELL(O_{K}). Then K(j(E)) is the Hilbert class field of K, that is, the maximal unramified abelian extension of K.

We will prove Theorem 14 in §6; it will require class field theory, which we will assume, and more information from the general algebraic theory of elliptic curves, which we will develop to some extent in the next two sections.

4. Elliptic curves in arbitrary characteristic

In this section we collect some well-known general results on elliptic curves, all of which are proven in various sections of [11]. We begin writing down an explicit, general form for the affine equation defining an elliptic curve. We say that an elliptic curve (E/K, O) (O the origin) is in Weierstrass form if its affine equation is given by

E : y^{2} + a_{1}xy + a_{3}y = x^{3} + a_{2}x^{2} + a_{4}x + a_{0} (4.1)

with a_{i} ∈ K and 0 = [0, 1, 0] (see [11, §III.3]). One can show, either by explicit manipulations as in [7, §III.2] or the Riemann-Roch theorem as in [11, Proposition 3.1, §III.3], that every elliptic curve defined over a field K of arbitrary characteristic can be put in Weierstrass form via linear changes of variable. In order to write down the discriminant and j-invariant of an elliptic curve given in Weierstrass form in a palatable form, we define the standard quantities

b_{2} = a_{1}^{2} + 4a_{2},
b_{4} = 2a_{4} + a_{1}a_{3},
b_{6} = a_{3}^{2} + 4a_{6},
b_{8} = a_{1}^{2}a_{6} + 4a_{2}a_{6} − a_{1}a_{3}a_{4} + a_{2}a_{3}^{2} − a_{4}^{2},
c_{4} = b_{2}^{2} − 24b_{4},
c_{6} = −b_{2}^{3} + 36b_{2}b_{4} − 216b_{6}.

Then we have

disc(E) = −b^{2}b_{8} − 8b_{4}^{3} − 27b_{6}^{2} + 9b_{2}b_{4}b_{6},
j = c_{4}^{3}/disc(E).

With these quantities defined, we note that a curve E has disc(E) ≠ 0 if and only if E is nonsingular.

We note that with respect to (4.1), an invariant differential on E/K is given by

ω := \frac{dx}{2y + a_{1}x + a_{3}} ∈ Ω_{E}. (4.2)

The primary uses (at least in our setting) of differentials are to provide a criterion for separability, and to linearize isogenies. In particular, we have the following two results:

Proposition 15. Let ϕ : E_{1} → E_{2} be an isogeny. Then ϕ is separable if and only if the map

ϕ^{∗} : Ω_{E_{2}} ⟶ Ω_{E_{1}}

is injective, or equivalently, nonzero (since both spaces have dimension 1, nonzero).

Proof. See [11, S II.4] for a statement in this language and [3, §16.5] for a proof. □

Theorem 16. Let E, E′ be elliptic curves, ω an invariant differential on E, and let

ϕ, ψ : E′ → E

be two isogenies. Then

(ϕ + ψ)^{∗}ω = ϕ^{∗}ω + ψ^{∗}ω.

Proof. See [11, Theorem 5.2, §III.5]. □

Denote by [m] : E → E the typical “multiplication-by-m” map. Using Theorem 16 and inducting, we have [m]^{∗}ω = mω for any invariant differential ω ∈ Ω_{E} and m ∈ ℤ. This observation yields the following useful corollary:

Corollary 17. Let E/K be an elliptic curve, 0 ≠ m ∈ ℤ. Assume that char(K) = 0 or that m is prime to char(K). Then the multiplication-by-m map on E is a finite, separable endomorphism.

Proof. Let ω be an invariant differential on E. Then from our observation above,

[m]^{∗}ω = mω ≠ 0

so [m] ≠ 0. That the map is finite now follows from the fact that an isogeny is a non-constant map of curves (defined over K). Proposition 15 ensures that it is separable. □

We now leave differentials behind for a moment, and consider divisors. As usual, we denote by Div(E) the group of divisors of E, Pic(E) the Picard group of E, and Div^{0}(E), Pic^{0}(E) the subgroups consisting of degree 0 divisors and classes of degree 0 divisors, respectively. If K(E) denotes the function field of E over K, then we denote by

div : K(E) ⟶ Div(E)

the typical homomorphism. One can use the Riemann-Roch theorem to prove that the following sequence is well defined and exact:

div

(4.3)  1 ⟶ \overline{K}^{∗} ⟶ \overline{K}(E) ⟶ Div^{0}(E) ⟶ Pic^{0}(E) ⟶ 0.

For a proof, see [11, §II.3]. Notice, in particular, that this sequence implies that every effective divisor (i.e. divisor of the form div(f) for f ∈ \overline{K}(E)) is of degree zero.

Now let E_{1}, E_{2} be two elliptic curves. From (4.3), we have isomorphisms

(4.4)  κ_{i} : E_{i} ˜⟶ Pic^{0}(E_{i})
P ⟼ class of (P) − (O)

(compare [11, Proposition 3.4, §III.3]). Thus, given any isogeny ϕ : E_{1} → E_{2}, we can define a group homomorphism

\begin{aligned}& κ_{2} & & ϕ^{∗} & & κ_{1}^{−1} \\ E_{2} & ⟶ & Pic^{0}(E_{2}) & ⟶ & Pic^{0}(E_{1}) & ⟶ & E_{1}. \end{aligned}

One of the consequences of the following theorem is that this homomorphism is also an isogeny:

Theorem 18. Let ϕ : E_{1} → E_{2} be a nonconstant isogeny of degree m. Then the following are true.

(1) There exists a unique isogeny

ϕ̂: E_{2} ⟶ E_{1}

satisfying

ϕ̂ ∘ ϕ = [m].

(2) As a group isomorphism, ϕ̂ equals the compositition

ϕ^{∗}
E_{2} ⟶ Div^{0}(E_{2}) ⟶ Div^{0}(E_{1}) ⟶  E_{1}
Q ⟼ (Q) − (O)  ∑ n_{P} (P) ⟼ ∑[n_{P}]P.

Proof. See [11, Theorem 7.1, §III.6]. □

Definition. Given a nonconstant isogeny ϕ : E_{1} → E_{2} of degree m, the isogeny ϕ̂: E_{2} → E_{1} associated to it by Theorem 18 is called the dual isogeny of ϕ. If ϕ = [0], we take the convention ϕ̂ = [0].

The following theorem lists some elementary properties of dual isogenies:

Theorem 19. Let

ϕ : E_{1} ⟶ E_{2}

be an isogeny. Then the follwowing are true.

(1) Let m = deg ϕ. Then

ϕ̂ ∘ ϕ = [m] on E_{1},
ϕ ∘ ϕ̂ = [m] on E_{2}.

(2) Let λ : E_{2} → E_{3} be another isogeny. Then

{ \atop λ ∘ ϕ} = λ̂ ∘ ϕ̂.

(3) Let ψ : E_{1} → E_{2} be another isogeny. Then

{ \atop ϕ + ψ} = ϕ̂ + ψ̂.

(4) For all m ∈ ℤ,

ˆ[m] = [m] and deg[m] = m^{2}.

(5)

deg ϕ̂ = deg ϕ.

(6)

ˆϕ̂ = ϕ.

When one hears the word “dual,” the first natural question one asks is “with respect to what pairing?” One answer in our particular case is the Weil pairing. In order to define this pairing, we will make use of the following fact (which follows from the proof of (4.3)): a divisor ∑ n_{i}(P_{i}) ∈ Div(E) on an elliptic curve E is effective (i.e. the divisor of a function) if and only if ∑ n_{i} = 0 and ∑[n_{i}]P_{i} = 0.

Let E/K be an elliptic curve over a field of characteristic 0 or prime characteristic p, and T ∈ E[m] for some m ≥ 2 prime to p. Then there exists a function f ∈ \overline{K}(E) (the function field of E over \overline{K}) such that

div(f) = m(T) − m(O).

Letting T′ ∈ E with [m]T′ = T (which is possible given the assumption p ÷̸m, there is similarly a function g ∈ \overline{K}(E) satisfying

div(g) = [m]^{∗}(T) − m^{∗}(O) = ∑_{R∈E[m]}(T′ + R) − (R).

(note that #E[m] = m^{2} by Theorem 34 below, and [m^{2}]T′ = 0). One verifies easily that f ∘ [m] and g^{m} have the same divisor. Thus, by multiplying f by an element of \overline{K}^{∗} if necessary, we may assume

f ∘ [m] = g^{m}.

Now suppose S ∈ E[M] (S = T is allowed). Then, for any point X ∈ E,

g(X + S)^{m} = f([m]X + [m]S) = f([m]X) = g(X)^{m}.

Thus we can define a pairing

e_{m} : E[m] × E[m] ⟶ μ_{m}

where μ_{m} is the set of mth roots of unity, by setting

e_{m}(S, T) = g(X + S)/g(X) (4.5)

for any point X ∈ E such that g(X + S) and g(X) are both defined and nonzero. Notice that this is a well-defined pairing; though g is only defined up to an element of \overline{K}^{∗}, e_{m}(S, T) does not depend on this choice. The pairing in (4.5) is called the Weil e_{m}-pairing, and it enjoys the following properties:

Proposition 20. The Weil e_{m}-pairing is:

(1) Bilinear:

e_{m}(S_{1} + S_{2}, T) = e_{m}(S_{1}, T)e_{m}(S_{2}, T)
e_{m}(S, T_{1} + T_{2}) = e_{m}(S, T_{1})e_{m}(S, T_{2});

(2) Alternating:

e_{m}(T, T) = 1; in particular, e_{m}(S, T) = e_{m}(T, S)^{−1};

(3) Non-degenerate:

If e_{m}(S, T) = 1 for all S ∈ E[m], then T = O;

(4) Galois invariant: For all σ ∈ Gal(\overline{K}/K),

e_{m}(S, T)^{σ} = e_{m}(S^{σ}, T^{σ});

(5) Compatible: If S ∈ E[mm′] and T ∈ E[m], then

e_{mm′}(S, T) = e_{m}([m′]S, T).

Proof. See [11, Proposition 8.1, §III.8]. □

Further, if ϕ is an isogeny, ϕ and ϕ̂ are adjoints with respect to the e_{m}-pairing:

Proposition 21. Let S ∈ E_{1}[m], T ∈ E_{2}[m], and ϕ : E_{1} → E_{2} be an isogeny. Then

e_{m}(S, ϕ̂(T)) = e_{m}(ϕ(S), T).

Proof. See [11, Proposition 8.2, §III.8]. □

Now, the compatibility property of the e_{m}-pairing suggests that it might behave well ℓadically. This is indeed the case, but in order to take advantage of this fact, we require a few definition. From this point onward, we take the convention that ℓ ∈ ℤ is a prime not equal to the characteristic of the relevant field K, if char(K) > 0.

Definition. Let E be an elliptic curve and ℓ ∈ ℤ a prime. The (ℓ-adic) Tate module of E is the group

T_{ℓ}(E) := \underleftarrow{lim}_{n} E[ℓ^{n}]

the inverse limit being taken with respect to the natural maps

[ℓ] : E[ℓ^{n+1}] ⟶ E[ℓ^{n}].

Definition. Let K be a number field, and, as before,

μ_{ℓ^{n}} ⊂ \overline{K}^{∗}

the group of ℓ^{n}th roots of unity. The Tate module of K is the group

T_{ℓ}(μ) := \underleftarrow{lim}_{n} μ_{ℓ^{n}}

taken with respect to the “raising to the ℓth power” maps

(·)^{ℓ} : μ_{ℓ^{n+1}} ⟶ μ_{ℓ^{n}}.

With this notation in place, we can string the e_{ℓ^{n}} pairings together into a pairing e_{E} : T_{ℓ}(E) × T_{ℓ}(E) → T_{ℓ}(μ):

Proposition 22. There exists a bilinear, alternating, non-degenerate, Galois invariant pairing

e_{E} : T_{ℓ}(E) × T_{ℓ}(E) ⟶ T_{ℓ}(μ).

Further, if ϕ : E_{1} → E_{2} is an isogeny, then ϕ and its dual isogeny ϕ̂ are adjoints with respect to this pairing.

Proof. The only thing that needs to be checked, given the inverse limits defining T_{ℓ}(E) and T_{ℓ}(μ), is that for all S, T ∈ E[ℓ^{n+1}],

e_{ℓ^{n+1}}(S, T)^{ℓ} = e_{ℓ^{n}}([ℓ]S, [ℓ]T).

By bilinearity,

e_{ℓ^{n+1}}(S, T)^{ℓ} = e_{ℓ^{n+1}}(S, [ℓ]T),

and then the desired result follows by compatibility. □

We will again call e_{E} : T_{ℓ}(E) × T_{ℓ}(E) → T_{ℓ}(μ) the Weil pairing.

The reason we recalled all of this material will be evident in the next section; it will be extremely useful in the proof of Proposition 25.

5. Reduction of elliptic curves

The primary purpose of this section is to prove propositions 25 and 26. Proposition 25 is crucial both in the proof of Proposition 26 and in our discussion of supersingularity in §7. We fix the notations K for a global field (not necessarily complete), ν a finite place of K, O_{ν} its ring of integers, and π a uniformizer for O_{ν} (i.e. the maximal ideal of O_{ν} is πO_{ν}.

We begin with the following definition:

Definition. Let E/K be an elliptic curve. A Weierstrass equation for E as in (4.1) is called a minimal (Weierstrass) equation for E at ν if nu(disc(E)) is minimized subject to the constraint that a_{i} ∈ O_{ν}. The value of ν(disc(E)) for the minimal Weierstrass equation is the valuation of the minimal discriminant of E at ν.

We introduced minimal equations mostly for the purpose of studying the reduciton of E under the canonical map O_{ν} → O_{ν}/πO_{ν}. We make the following

Definition. Let E/K be an elliptic curve, and let Ẽ be the curve defined by reducing the coefficients of a minimal Weierstrass equation for E under the map O_{ν} → O_{ν}/πO_{ν}. We say that E has good (or stable) reduction if Ẽ is nonsingular.

One can check that a curve has good reduction at ν if and only if ν(disc(E)) = 0. For a proof of this fact, see [11, §VII.5]. For a discussion of minimal Weierstrass equations, see [11, §VII.1].

Now, given an arbitrary prime ideal 𝔓 ⊂ K, we can form a valuation ν_{𝔓} associated to it in the usual way. We say that an elliptic curve E has good reduction at 𝔓 if it has good reduction at ν_{𝔓}. We recall one propositition and deduce a corollary before we start actually proving things again.

Proposition 23. Let E/K be an elliptic curve and m ≥ 1 an integer relatively prime to char(O_{ν}/πOO_{ν}). Assume K is complete with respect to ν. Then if E has good reduction at ν, the reduction map

E(K)[m] → Ẽ

is injective.

Proof. See [11, Proposition 3.1, §VII.3]. □

Corollary 24. Let E/K be an elliptic curve and m ≥ 1 an integer relatively prime to a prime ideal 𝔓 ⊂ K. Then if E has good reduction at ν, the reduction map

E(K)[m] → Ẽ

is injective.

Proof. Apply the Lefschetz principle to Proposition 23. See [11, §VI.6] for details. □

We now actually prove something:

Proposition 25. Let L be a number field, 𝔓 a maximal ideal of L, E_{1}/L, E_{2}/L elliptic curves with good reduction at 𝔓, and Ẽ_{1}, Ẽ_{2} their reductions modulo 𝔓. Then the natural reduction map

Hom(E_{1}, E_{2}) ⟶ Hom(Ẽ_{1}, Ẽ_{2})
ϕ ⟼ ϕ̃

is injective. Further, it is degree-preserving:

deg(ϕ) = deg(ϕ̃).

Proof of Proposition 25. First notice that since the degree of a nonzero isogeny is nonzero, the second assertion immediately implies the first. Therefore, we only have to prove that deg(ϕ) = deg(ϕ̃). Choose a rational prime ℓ relatively prime to 𝔓. We will use the Weil pairing e with respect to ℓ to calculate everything on the Tate modules. For any x, y ∈ T_{ℓ}(E_{1}), we have

e_{E_{1}}(x, y)^{deg(ϕ)} = e_{E_{1}}((deg(ϕ))x, y) = e_{E_{1}}(ϕ̃ϕx, y) = e_{E_{2}}(ϕx, ϕy), (5.1)

and a similar calculation on Ẽ_{1} yields

eẼ_{1}(x̃, ỹ)^{deg ϕ̃} = eẼ_{2}(ϕ̃x̃, ϕ̃x̃) (5.2)

Here we use our assumption that ℓ is relatively prime to 𝔓 and E_{1}, E_{2} have good reduction a 𝔓.

Now, notice that if E/L is any elliptic curve with good reduction at 𝔓, then by (24), the canonical reduction map provides an isomorphism E[ℓ^{n}] ≅ Ẽ[ℓ^{n}] for all n ∈ ℤ_{>0}. It follows that in this scenario T_{ℓ}(E) ≅ T_{ℓ}(Ẽ), and further

{ \atop e_{E}(x, y)} = eẼ(x̃, ỹ) for all x, y ∈ T_{ℓ}(E). (5.3)

We now take x, y ∈ T_{ℓ}(E_{1}) and compute

eẼ_{1}(x̃, ỹ)^{deg(ϕ)} = { \atop e_{E_{1}}(x, y)}^{deg(ϕ)} from (5.3)
= { \atop e_{E_{2}}(ϕx, ϕy)} from (5.1)
= eẼ_{2}(ϕ̃x, ϕ̃y) from (5.3)
= eẼ_{2}(ϕ̃x̃, ϕ̃ỹ)
= eẼ_{2}(x̃, ỹ)^{deg ϕ̃} from (5.2).

This equality holds for all x, y ∈ T_{ℓ}(E_{1}), and hence for all x̃, ỹ ∈ T_{ℓ}(Ẽ_{1}). Noting that the Weil pairing on T_{ℓ}(Ẽ_{1}) is non-degenerate, this implies deg(ϕ) = deg(ϕ̃). □

We now prove the following proposition, which will turn out to be the backbone of the proof of Theorem 14 in §6.

Proposition 26. There is a finite set of rational primes S ⊂ ℤ such that if p ∉ S is a prime which splits in K, say as pO_{K} = 𝔭𝔭′, then

F (σ_{𝔭}) = \overline{𝔭} ∈ CL(K).

Proof of Proposition 26. We know that ELL(O_{K}) is finite from Proposition 6 and that every isomorphism class in ELL(O_{K}) is represented by a curve that can be defined over \overline{ℚ} by Proposition 9. Thus we can choose a finite extension field N/K and representatives E_{1}, ⋯, E_{n} defined over N for the distinct \overline{K} isomorphism classes in ELL(O_{K}). Futher, by Theorem 10(2), we may replace N with a finite extension so that every isogeny between any two of the E_{i}’s is defined over N. We define our finite set S to be the set of rational primes satisfying any one of the following three conditions:

(1) p ramifies in N,

(2) some E_{i} has bad reduction at some prime of N lying over p, or

(3) p divides either the numerator or the denominator of one of the numbers N_{ℚ}^{L}(j(E_{i}) − j(E_{k})) for some i ≠ k.

Notice that condition (3) says that the set of representatives “remains distinct” upon reduction modulo 𝔓. That is, if p ∉ S and if 𝔓 is a prime of L dividing p, then Ẽ_{i} ≅ ˜E̸_{k} (mod 𝔓), since their j-invariants are not the same modulo 𝔓. Now let p ∉ S be a prime which splits as pO_{K} = 𝔭𝔭′ in K, and 𝔓 be a prime of N lying over 𝔓. Moreover, let E/L a representative of an isomorphism class in ELL(O_{K}) and L be a lattice analytically parametrizing E. Choose an integral ideal 𝔞 ⊂ O_{K} relatively prime to p such that 𝔞𝔓 is principal, say

𝔞𝔭 = (α).

As we proved in Proposition 12, the following diagram of analytic maps can also be viewed as a diagram of isogenies:

z ↦ z  z ↦ z  z ↦ αz
ℂ/L ⟶ ℂ/𝔭^{−1}L ⟶ ℂ/𝔞^{−1}𝔭^{−1}L = ℂ/(α^{−1})L ˜⟶ ℂ/L
↓ ≀  ↓ ≀  ↓ ≀  ↓ ≀
E ⟶ \overline{𝔭} ∗ E ⟶ \overline{a} ∗ \overline{p} ∗ E = (α) ∗ E  ˜⟶  E.
ϕ  ψ  λ

Now choose a Weierstrass equation for E/L which is minimal at 𝔓, and let

ω = \frac{dx}{2y + a_{1} + a_{2}}

be the associated invariant differential on E. The pull-back of ω to ℂ/L is some multiple of dz (since dz spans the one-dimensional space of differentials on ℂ/L). Since the map along the top row of the diagram is just z ↦ αz, we see that dz in turn pulls back to d(αz) = αdz. Tracing around the diagram, we have

(λ ∘ ψ ∘ ϕ)^{∗}ω = αω.

As usual, we will use a tilde to denote reduction modulo 𝔓. Since the equation for E/L is minimal at 𝔓 and E/L has good reduction at 𝔓, we obtain an equation for Ẽ by simply reducing the coefficients of the minimal Weierstrass equation modulo 𝔓. Thus the reduced differential

ω̃ = \frac{dx}{˜2y + ã_{1}x + ã_{3}}

is a nonzero invariant differential on Ẽ. Further, since (α) = 𝔞𝔭 and since 𝔓 divides 𝔭, we have

(λ̃ ∘ ψ̃ ∘ ϕ̃)^{∗}ω̃ = { \atop (λ ∘ ψ ∘ ϕ)^{∗}ω} = α̃ω̃ = ˜0.

Thus, by Proposition 15,

λ̃ ∘ ψ̃ ∘ ϕ̃

is inseparable. On the other hand, by Proposition 25, and Proposition 7(3), we have

deg ϕ̃ = deg ϕ = N_{ℚ}^{K}𝔭 = p
deg ψ̃ = deg ψ = N_{ℚ}^{K}𝔞
deg λ̃ = deg λ = 1.

Since N_{ℚ}^{K}𝔞 is prime to p by assumption, both ψ̃ and λ̃ are separable, so we conclude that

ϕ̃: Ẽ ⟶ { \atop \overline{𝔭} ∗ E}

must be inseparable. Now, by general facts on morphisms of curves (see [11, II.2.12]), any such map factors as a qth-power Frobenius map followed by a separable map, so the fact that ϕ̃ has degree p and is inseparable implies that ϕ̃ must essentially be the pth-power Frobenius map. More precisely, there is an isomorphism from Ẽ^{(}p) (the curve formed by raising the coefficients of Ẽ to the pth power) to { \atop \overline{𝔭} ∗ E} so that the composition

Ẽ ⟶ Ẽ^{(p)}˜⟶{ \atop \overline{p} ∗ E}

equals ϕ̃. Here the first map is the pth power Frobenius map.

In particular, we have

j({ \atop p̃∗ E}) = j(Ẽ^{(p)}) = j(Ẽ)^{p},

so

j(𝔭̃ ∗ E) ≡ j(E)^{p} = j(E)^{N_{ℚ}^{K}𝔭} ≡ j(E)^{σ_{𝔭}} = j(E^{σ_{𝔭}}) = j(F (σ_{𝔭}) ∗ E) (mod 𝔓).

By our choice of the set S, we know that

j(E_{i}) ≡ j(E_{k}) (mod 𝔓) if and only if E_{i} ≅ E_{k}.

Hence 𝔭̃ ∗ E ≅ F (σ_{𝔭}) ∗ E, and the simplicity of the action of CL(K) on ELL(O_{K}) then gives the conclusion

F (σ_{𝔭}) = \overline{𝔭}.
□

We record for use in §7 the following result which we proved in the course of the proof of Proposition 26:

Lemma 27. Let K be a quadratic imaginary field and E be an elliptic curve with CM, End(E) ≅ O_{K}. Moreover suppose E is defined over a number field N. If 𝔭 is a prime of K that does not ramify in L, and such that E has good reduction at all primes 𝔓 ⊂ L lying above 𝔭, the natural map

E ⟶ \overline{𝔭} ∗ E

has degree p, and its reduction

Ẽ ⟶ { \atop \overline{𝔭} ∗ E}

is purely inseparable (here we reduce modulo one of the primes 𝔓 of N lying above 𝔭).

6. The Hilbert class field

We first fix some notation from class field theory. Let K is a totally imaginary number field (which is the only case we will consider), N/K is a normal extension, and 𝔓 ⊂ N is a prime ideal lying over a prime ideal 𝔭 ⊂ K that does not ramify in L. We have a restriction homomorphism

{σ ∈ Gal(N/K) : 𝔓^{σ} = 𝔓} ⟶ Gal ((O_{N}/𝔓)/(O_{K}/𝔭)) .

This map is surjective, and the group on the right hand side is generated by the Frobenius automorphism

x ⟼ x^{N_{ℚ}^{K}𝔭}.

Here N_{ℚ}^{K} is the typical norm from K to ℚ. If we further assume that N/K is an abelain extension (and recall our previous assumption that 𝔭 does not ramify), then there is a unique element σ_{𝔭} ∈ Gal(N/K) with the property that

σ_{𝔭}(x) ≡ x^{N_{ℚ}^{p}} (mod 𝔓) for all x ∈ O_{N}.

Everything thus far in this section has been a collection of basic results from algebraic number theory; for proofs see [13, §I.13, §I.14], for example.

Let 𝔠 be an integral ideal of K that is divisible by all primes that ramify in L/K (N.B. it is well known that there are only finitely many such primes) and let I(𝔠) be the group of all fractional ideals of K which are relatively prime to 𝔠. We fix the notation

(·, L/K) : I(𝔠) ⟶ Gal(L/K)
∏_{𝔭}𝔭^{n_{𝔭}} ⟼ ∏_{𝔭}σ_{𝔭}^{n_{𝔭}}.

for the Artin map. Notice that all but finitely many of the n_{𝔭} are zero; we are just factoring elements of I(𝔠) in order to define the map.

To motivate the next few definitions, we recall the following weak form of Artin reciprocity, which we will not prove:

Proposition 28 (Artin Reciprocity). Let L/K be a finite abelian extension of number fields. Then there exists an integral ideal 𝔠 ⊂ O_{K}, divisible by precisely the primes of K that ramify in L, such that

((α), L/K) = 1 for all α ∈ K^{∗} satisfying α ≡ 1 (mod 𝔠)

We define the conductor of L/K, denoted by 𝔠_{L/K}, to be the largest ideal for which Proposition 28 is true. We further define

P (𝔠) = {(α) : α ∈ K^{∗}, α ≡ 1 (mod 𝔠)}

We require one final definition before we can state the classical formulation of “Class Field Theory.”

Definition. Let 𝔠 be an integral ideal of K. A ray class field of K (modulo 𝔠) is a finite abelian extension K_{𝔠}/K with the property that for any finite abelian extension N/K,

𝔠_{L/K}|𝔠 ⟹ L ⊂ K_{𝔠}.

Theorem 29 (Class Field Theory). Let L/K be a finite abelian extension of number fields, and 𝔠 an integral ideal of K. Then the following are true.

(1) The Artin map

(·, L/K) : I(𝔠_{L/K}) ⟶ Gal(L/K)

is a surjective homomorphism.

(2) The kernel of the Artin map is (N_{K}^{L}I_{L})P (𝔠_{L/K}), where I_{L} is the group of non-zero fractional ideals of L.

(3) There exists a unique ray class field K_{𝔠} of K (modulo 𝔠). The conductor of K_{𝔠}/K divides 𝔠.

(4) The ray class field K_{𝔠} is characterized by the property that it is an abelian extension of K and satisfies

{primes of K that split completely in K} = {prime ideals in P (𝔠)}.

The primary ray class field we will be considering is the ray class field modulo the unit ideal 𝔠 = (1). This is the maximal abelian extension of K which is unramified at all primes. We call K_{(1)} the Hilbert class field of K and denote it by H. Notice that

I(𝔠_{H/K}) = I((1)) = {all non-zero fractional ideals of K} P (𝔠_{H/K} = P ((1)) = {all non-zero principal ideals of K},

so the Artin map induces an isomorphism between the ideal class group of K and the Galois group of the Hilbert class field of K:

(·, H/K) : CL(K)˜⟶ Gal(H/K).

The final fact from class field theory that we will require is the following version of the Cebotarev density theorem (a generalization of Dirichet’s theorem on primes in arithmetic progressions):

Theorem 30. Let K be a number field and 𝔠 an integral ideal of K. Then every ideal class in I(𝔠)/P (𝔠) contains infinitely many degree 1 primes of K.

We are finally ready to start proving some results. Using Proposition 26 from the last section, we prove the following theorem, which contains Theorem 14 as part (1).

Theorem 31. Let E be a curve representing an isomorphism class in ELL(O_{K}). Then the following are true.

(1) The Hilbert class field of K is H := K(j(E)).

(2) If we denote by h_{K} := #CL(K) = # Gal(H/K) as before, then [ℚ(j(E)) : ℚ] = [K(j(E)) : K] = h_{K}.

(3) If E_{1}, ..., E_{h_{K}} be a complete set of representatives for ELL(O_{K}), then {j(E_{1}), ..., j(E_{h_{K}})} is the set of Gal(\overline{K}/K) conjugates for j(E).

(4) For any nonzero fractional ideal 𝔞 of K,

j(E)^{(𝔞,H/K)} = j(\overline{𝔞} ∗ E),

in particular, if 𝔭 is a prime ideal of K, then

j(E)^{σ_{𝔭}} = j(\overline{𝔭} ∗ E).

Proof. Let L/K be the finite extension corresponding to the homomorphism F : Gal(\overline{K}/K) → CL(K), that is, L is the fixed field of ker F. Then

Gal(\overline{K}/L) = ker F
= \{σ ∈ Gal(\overline{K}/K) : F (σ) = 1\}
= \{σ ∈ Gal(\overline{K}/K) : F (σ) ∗ E = E\}.

This last equality follows from Proposition 6, which states that the action of CL(K) on ELL(O_{K}) is simply transitive (here we’re thinking of E as an isomorphism class of curves). Continuing, the last set above is equal to

(Gal(\overline{K}/L)) = \{σ ∈ Gal(\overline{K}/K) : E^{σ} = E^{σ}\}
= \{σ ∈ Gal(\overline{K}/K) : j(E^{σ}) = j(E)\}
= \{σ ∈ Gal(\overline{K}/K) : j(E)^{σ} = j(E)\}
= Gal(\overline{K}/K(j(E))).

Thus K(j(E)) = L. Because F maps Gal(L/K) injectively into CL(K) (by definition of L), we see that L/K = K(j(E))/K is an abelian extension.

Let ⌋_{L/K} be the conductor of L/K, and consider the composition of the Artin map with F:

\begin{aligned}& (·, L/K) & & F \\ I(𝔠_{L/K}) & ⟶ & Gal(L/K) & ⟶ & CL(O_{K}). \end{aligned}

We claim that this map is just the projection 𝔞 ↦ \overline{𝔞}, that is,

F ((𝔞, L/K)) = \overline{𝔞} for all 𝔞 ∈ I(𝔠_{L/K}).

To see this, let 𝔞 ∈ I(𝔠_{L/K}), and let S be the finite set of primes described in Proposition 26. From Theorem 30, there exists a degree 1 prime 𝔭 ∈ I(𝔠_{L/K}) in the same P (𝔠_{L/K})-ideal class as 𝔞 and not lying over a prime in S. In other words, we have an α ∈ K^{∗} such that

α ≡ 1 (mod 𝔠_{L/K}) and 𝔞 = (α)𝔭.

We compute

F ((𝔞, L/K)) = F ((α)𝔭, L/K))
= F ((𝔭, L/K)) since α = 1 (mod 𝔠_{L/K})
= \overline{𝔭} from Proposition 26
= \overline{𝔞},

which establishes the claim.

Notice that this implies, in particular, that if (α) ∈ I(𝔠_{L/K}) is a principal ideal (not necessarily congruent to 1 (mod 𝔠_{L/K})), then

F (((α), L/K)) = 1. (6.1)

The map F : Gal(L/K) → CL(O_{K}) is injective (by definition of L), so (6.1) implies that

((α), L/K) = 1

for all (α) ∈ I(𝔠_{L/K}). But the conductor of L/K, by definition, is the largest integral ideal 𝔠 with the property that

α ≡ 1 (mod 𝔠) ⟹ ((α), L/K) = 1.

Thus 𝔠_{L/K} = (1), which implies L/K is everywhere unramified. Therefore L ⊂ H, the Hilbert class field of K.

Now, clearly the natural canonical quotient map I(𝔠_{L/K}) = I(1) → CL(K) is surjective, so the claim we proved above implies that the monomorphism F : Gal(L/K) → CL(K) is also surjective, and hence an isomorphism. Therefore,

[L : K] = # Gal(L/K) = #CL(K) = # Gal(H/K) = [H : K],

which, along with the inclusion L ⊂ H, implies H = L. From above, L = K(j(E)), so this completes the proof of (1) and the second equality in (2).

To prove the first equality in (2), note that the proof of Proposition 8 implies that

[ℚ(j(E)) : ℚ] ≤ h_{K}.

This inequality, combined with [K(j(E)) : K] = h_{K} and [K : ℚ] = 2, implies that [ℚ(j(E)) : ℚ] = h_{K}. This completes the proof of (2).

We now prove (3). From Proposition 6, we know that CL(K) acts transitively on the set of j-invariants

J := {j(E_{1}), ⋯, j(E_{h_{k}})}

simply by identifying an ismorphism class in ELL(O_{K}) with the j-invariant of that class. From (3.8), we see that the homomorphism F : Gal(\overline{K}/K) → CL(K) is obtained by identifying the natural action of Gal(\overline{K}/K) on J with the action of CL(K) on J described above, so Gal(\overline{K}/K) acts transitively on J. This proves (3).

Finally, the claim proven above gives (4) for all ideals in I(𝔠_{L/K}) = I((1)), which is the set of all nonzero fractional ideals of K. □

We now wish to restate part (3) of Theorem 31 using the language of Heegner points. Recall that an integer d ≠ 1 is a fundamental discriminant if it is not divisible by the square of any odd prime and satisfies either d ≡ 1 (mod 4) or d ≡ 8, 12 (mod 16). We prove the following lemma:

Lemma 32. Let d < 0 be a fundamental discriminant, and K = ℚ(\sqrt{d}). Then there are precisely h_{K} Heegner points of discriminant d in 𝔉.

Proof. Notice that if τ = \frac{−b+\sqrt{b^{2}−4ac}}{2a} ∈ 𝔉 with a, b, c ∈ ℤ, gcd(a, b, c) = 1, and b^{2} − 4ac = d, then ax^{2} + bxy + cy^{2} is a primitive positive definite quadratic form of discriminant d. Since d is fundamental, the number of such forms is precisely |CL(K)| = h_{K}. □

We now have the following corollary of Theorem 31(3):

Corollary 33. Let d < 0 be a fundamental discriminant and τ_{1}, ..., τ_{h_{K}} be the Heegner points of discriminant d in 𝔉. Then j(τ_{i}) ∈ \overline{ℤ} for all i, and j(τ_{1}), ..., j(τ_{h_{K}}) is a complete set of Galois conjugates under the action of Gal(\overline{K}/K).

Proof. First note that the map

𝔉 ⟷ \frac{\{lattices L ⊂ ℂ\}}{homothety}
(6.2)  z ⟼ [L_{z}]

is a bijection. Suppose τ ∈ 𝔉 is a Heegner point of discriminant d. Using (2.5), we have that j(E_{τ}) = j(τ), which implies by part (2) of Proposition 3 that E_{τ} has endomorphism ring isomorphic to an order in an imaginary quadratic number field. This implies that the same is true of L_{τ}. By the proof of Proposition 3, we may take this imaginary quadratic number field to be K. In fact, End(L_{τ}) ≅ O_{K}, the full ring of integers. To see this, we observe that O_{K} = ℤ[\frac{1+\sqrt{d}}{2}] if d is odd (resp., O_{K} = ℤ[\frac{\sqrt{d}}{2}] if d is even), hence one need only check that \frac{1+\sqrt{d}}{2} · τ ∈ L_{τ} (resp., \frac{\sqrt{d}}{2} · τ ∈ L_{τ}). We omit this calculation.

With this claim in hand, (6.2) yields an injection

\{Heegner points in 𝔉 of discriminant d\} ↪ \frac{\{lattices L ⊂ ℂ with End(L) ≅ O_{K}\}}{homothety}
(6.3)  τ ⟼ [L_{τ}].

The set on the left hand side of (6.3) has cardinality h_{K} by Lemma 32 as does the set on the right hand side by (3.1) and the fact that the action (3.3) is simply transitive. Thus (6.3) is a bijection.

We now identify the set on the right of (6.3) with (3.1). Applying Theorem 31(3) then yields the corollary. □

7. Supersingularity

After we discussed analytic parametrization in §2, the first algebraic object we discussed for an elliptic curve E/ℂ was its group of N-torsion points

E[N] ≈ ℤ/Nℤ × ℤ/Nℤ.

This isomorphism was immediate after we realized that E/ℂ is essentially just a lattice in the complex plane.

If we ask for the description of the E[N] for E an elliptic curve over a field of finite characteristic, providing the answer is a little more subtle. Our goal for this final section is to provide a very brief glimpse of what phenomenon can occur. In particular, we have the following:

Theorem 34. Let E be an elliptic curve and m ∈ ℤ, m ≠ 0. Then the following are true. (1) If char(K) = 0 or m is prime to char(K), then

E[m] ≅ ℤ/mℤ × ℤ/mℤ.

(2) If char(K) = p, then either

E[p^{e}] = {O} for all e ∈ ℤ_{>0}

or

E[p^{e}] ≅ ℤ/p^{e}ℤ for all e ∈ ℤ_{>0}.

Proof. For (1), we apply Proposition 17 to conclude that [m] is a finite, separable map. Hence, using Theorem 19, we conclude

#E[m] = deg[m] = m^{2}.

By the same argument, for every integer d dividing m we have

#E[d] = d^{2}.

From the classification theorem for finite abelian groups, we see that we must have

E[m] ≈ ℤ/mℤ × ℤ/mℤ.

We now prove (2) (compare [11, Corollary 6.4, §III.6]). In this case, [p^{e}] is no longer a separable morphism. However, any morphism ψ between smooth curves over a field of prime characteristic p be written as a composition λ ∘ ρ, where λ is separable and ρ is purely inseparable (indeed, ρ is the qth power Frobenius map for some pth power q). We thus define deg_{s} ψ = deg λ. For a general morphism between curves, we have

#ψ^{−1}(P) = deg_{s} ψ

for all but finitely many points P, but if ψ is an isogeny, this equality is true for all points P. Thus, in particular, if we denote by ϕ the p-th power Frobenius endomorphism, we have

#E[p^{e}] = deg_{s}[p^{e}]
= (deg_{s}(ϕ̂ ∘ ϕ))^{e}
= (deg_{s} ϕ̂)^{e}.

Now, the p-th Frobenius endomorphism has degree p; this combined with Theorem 19 yields

deg ϕ̂ = deg ϕ = p.

Thus there are two possibilities. If ϕ̂ is inseparable, then deg_{s} ϕ̂ = 1, so

#E[p^{e}] = 1

for all e. Otherwise ϕ̂ is separable, so deg_{s} ϕ̂ = p and

#E[p^{e}] = p^{e}

for all e > 0. This implies (since it is an equality for all positive integers e) that

E[p^{e}] = ℤ/p^{e}ℤ.
□

Thus, if we have a curve E/\overline{𝔽}_{p}, there are two possibilities for E[p], either it is trivial, or isomorphic to ℤ/pℤ. In the first case we say that E is supersingular at p. Although, given E/ℚ, it is in general not easy to find primes p at which E is supersingular, a famous theorem of Elkies asserts that there are infinitly many such primes.

Recalling that j(E) is an isomorphism invariant of E, and given the central role that the study of j-invariants plays in CM theory, it should come as no surprise that it enters the discussion here as well. We note first that if E/\overline{ℚ} has good reduction at a prime ideal 𝔓 ⊂ O_{K} above p ≥ 5, then j(E) is p-integral. This follows trivially from the computation of the j-invariant in terms of the discriminant below (4.1), for example. Thus we can make the following:

Definition. Let K be a number field, and suppose E/\overline{ℚ} is supersingular at a prime ideal 𝔓 ⊂ O_{K} above a prime p ≥ 5. Then the reduction of j(E) in \overline{𝔽}_{p} is said to be a supersingular j-invariant over \overline{𝔽}_{p}.

Using the dictionary between Heegner points and CM elliptic curves we have developed, we can state the following theorem, which yields a nice method of deciding whether a CM curve is supersingular at a particular prime:

Theorem 35. Let τ be a Heegner point of discriminant d_{τ} < −4, (d_{τ} a fundamental discriminant), and E_{τ} be an elliptic curve with j-invariant j(τ). Fix a prime p ≥ 5, and suppose that p is inert or ramified in ℚ(\sqrt{d_{τ}}). If E_{τ} has good reduction at 𝔭 for all primes 𝔭 above p in ℚ(j(τ)), then j(τ) reduces to a supersingular j-invariant in \overline{𝔽}_{p}.

Remark. There is a converse statement, namely that if p splits completely in ℚ(\sqrt{d_{τ}}) and E_{τ} has good reduction at 𝔭 for all primes 𝔭 above p in ℚ(j(τ)), then E_{τ} is not supersingular at p. For a proof of this, see [9, §13.4.12].

We now prove Theorem 35:

Proof of Theorem 35. Let K := ℚ(\sqrt{d_{τ}}) and assume, without loss of generality, that E is defined over the finite extension N/K (by Theorem 31 we could take N = H, the Hilbert class field of K, for example). Further, let ω be the standard invariant differential for E (written down explicitly after (4.1) and [·] the corresponding normalized isomorphism O_{K} ≅ E (we know that End(E) ≅ O_{K} by the assumption that d_{τ} is a fundamental discriminant).

Suppose first that p splits completely in K as pO_{K} = 𝔭𝔭′, pp ≠ 𝔭′, and 𝔓 ⊂ N is a prime above 𝔭. Moreover, choose a positive integer M so that 𝔭^{m} and 𝔭^{′n} are both principal, say

𝔭^{m} = μO_{K} and 𝔭^{′m} = μ′O_{K}.

Then we have μμ′ = p^{m}. Note μ ∉ 𝔭, so we have that [mu]_{E}^{∗}ω = μω ≢ 0 (mod 𝔓) by our assumption that E has good reduction at 𝔓. Applying Proposition 15 then implies that ˜[μ] ∈ End(Ẽ) is separable, so, using Proposition 25 and Proposition 7, we have

deg ˜[μ] = deg[μ] = N_{ℚ}^{K}(μ) = p^{m}.

On the other hand, because ˜[μ] is an isogeny we have

# ker(˜[μ] : Ẽ → Ẽ) = deg_{s}[μ] = deg[μ] = p^{m}.

Since p^{m} = μμ′, this implies the kernel of the map

˜[p^{m}] : Ẽ ⟶ Ẽ

is nonzero; in other words, Ẽ has a point of order p. □

We end this paper with an explicit example to illustrate Theorem 35:

Example. Consider the elliptic curve E : y^{2} = x^{3} + x. Using the formula given after (4.1), we calculate that the discriminant of this curve is −4 and conclude that it has good reduction at any prime p ≥ 3. We then calculate that the j-invariant is 1728. It is a standard fact from the theory of modular functions that j maps the arc from e^{2πi/3} = −\frac{1}{2} + \frac{\sqrt{−3}}{2} to i along the unit disc {z : |z| = 1} bijectively onto the interval [0, 1728]; in particular, j(i) = 1728. It follows that from Proposition 3 that E has CM with endomorphism ring an order in K = ℚ(i).

It is a fact from elementary number theory that a prime p ≥ 5 splits in K if and only if p ≡ 1 (mod 4). Therefore, by Theorem 35, we should expect that E : y^{2} = x^{3} + x is supersingular when considered as a curve in 𝔽_{p} for primes p ≥ 5 with p ≡ 3 (mod 4). We prove this in an elementary manner by demonstrating that |E/𝔽_{p}| = p + 1. This implies E/𝔽_{p} has no p-torsion, which is one of our definitions of supersingularity.

Let (\frac{·}{·}) denote the typical Legendre symbol. We have

(\frac{x^{3} + x}{p}) = (\frac{x}{p}) (\frac{x^{2} + 1}{p}) .

Because p ≡ 3 (mod 4), (\frac{−1}{p}) = −1, so

(\frac{(−x)^{3} + (−x)}{p}) = (\frac{−x}{p}) (\frac{(−x)^{2} + 1}{p}) = (\frac{−1}{p}) (\frac{x}{p}) (\frac{x^{2} + 1}{p}) = − (\frac{x}{p}) (\frac{x^{2} + 1}{p}) .

By pairing x and −x for x ∈ 𝔽_{p}^{∗}, we can conclude that exactly half the p − 1 elements x ∈ 𝔽_{p}^{∗} have the property that x^{3} + x is a quadratic residue. Each such x yields two solutions to the equation y^{2} = x^{3} + x over 𝔽_{p}^{∗}, corresponding to ±y. Adding in the point (x, y) = (0, 0) and the point at infinity, we have |E/𝔽_{p}| = p + 1.

References

[1] M. F. Atiyah and I. G. MacDonald, Introduction to Commutative Algebra, Addison-Wesley, Reading, MA, (1969).

[2] M. Deuring, Teilbarkeitseigenschaften der singulären modulen der elliptischen funktionen und die diskriminante der klassengleichung, Comm. Math. Helv. 19 (1945), 74-82.

[3] D. Eisenbud, Commutative Algebra with a View Toward Algebraic Geometry, Springer Verlag, New York, (1995).

[4] F.Q. Gouvêa, Arithmetic of p-adic modular forms, Springer Lect. Notes in Math., 1304, (1985).

[5] K. Ireland and M. Rosen, A Classical Introduction to Modern Number Theory, Springer Verlag, New York, 1991.

[6] M. Kaneko and D. Zagier, Supersingular j-invariants, hypergeometric series, and Atkin’s orthogonal polynomials, Computational Perspectives on Number Theory (Chicago, IL, 1995), AMS/IP 7 (1998), 97–126.

[7] A. Knapp, Elliptic Curves, Mathematical Notes, Princeton University Press, 40 Princeton, New Jersey, 1992.

[8] N. Koblitz, Introduction to Elliptic Curves and Modular Forms, Springer-Verlag, New York, 1993.

[9] S. Lang, Elliptic Functions, 2nd edition, Springer-Verlag, New York, 1987.

[10] K. Ono, The Web of Modularity: Arithmetic of the Coefficients of Modular Forms and q-series, AMS-CBMS Regional Conference Series in Mathematics, 102 (2004) Providence, RI.

[11] J. Silverman, The Arithmetic of Elliptic Curves, Springer-Verlag, New York, 1986.

[12] J. Silverman, Advanced Topics in the Arithmetic of Elliptic Curves, Springer-Verlag, New York, 1994.

[13] W. Stein, A Brief Introduction to Classical and Adelic Algebraic Number Theory, http://modular.fas.harvard.edu/edu/Spring2004/129/ant/.

4404 South Ave. W, Missoula, MT 59804

 E-mail address: getz@fas.harvard.edu