Isomorphisms, twists, automorphism group

Isomorphic elliptic curves

The mysterious $j$-invariant seems to appear everywhere when reading about elliptic curves. But should it really be that mysterious?

Let’s consider an elliptic curve $E$ defined by:

$y^2 = x^3 + ax + b$

This is referred to as the short Weierstrass equation. The generalized Weierstrass equation is given by:

$y^2 + a_1xy + a_3y = x^3 + a_2x^2 + a_4x + a_6$

When we are working in a field with characteristic not equal to 2 or 3, there exists a variable substitution that can reduce the equation to the short Weierstrass form.

So, let’s focus on the short Weierstrass form. The $j$-invariant is defined as:

$j(E) = 1728\frac{4a^3}{4a^3 + 27b^2}$

There is a powerful theorem:

Theorem: Two elliptic curves are isomorphic over the algebraically closed field if and only if they have the same $j$-invariant.

Let’s say we have two isomorphic elliptic curves. Let us prove they have the same j-invariant. But how does the isomorphism between two elliptic curves look like?

We can assume that the isomorphism preserves the short Weierstrass form. It turns out that the isomorphism is then of the form:

$(x, y) \rightarrow (u^2 x, u^3 y)$

That’s kind of surprising. The above transformation is linear in $x$ and $y$. Why does the isomorphism need to be linear?

Well, due to the way elliptic curve addition is defined, the isomorphism must map a line to a line. Therefore, the only transformations that can serve as isomorphisms are linear.

A quick calculation shows that the transformations of the form $(x, y) \mapsto (x + u, y)$ or $(x, y) \mapsto (x, y + v)$ do not preserve the short Weierstrass form. Therefore, the isomorphism needs to be of the form $(x, y) \mapsto (ux, vy).$

But let’s observe:

$v^2y^2 = u^3x^3 + aux + b$

To preserve the short form, it would need to be:

$v^2 = u^3$

$v = u^{\frac{3}{2}}$

Thus:

$(x, y) \rightarrow (u x, u^{\frac{3}{2}} y)$

So, if we want to have an isomorphism $(x, y) \mapsto (u x, u^{\frac{3}{2}} y)$ between the elliptic curves, $u$ needs to be a square.

Let’s define $d = \sqrt{u}.$

We now have $(x, y) \mapsto (d^2x, d^3 y).$

So we have the elliptic curve $E$:

$E: y^2 = x^3 + ax + b$

and the elliptic curve $E'$, which is isomorphic to $E$:

$E': d^6y^2 = d^6x^3 + ad^2x + b$

$E': y^2 = x^3 + ad^{-4}x + b d^{-6}$

$E': y^2 = x^3 + a_1 x + b_1$

We can see:

$a = a_1 d^4$

$b = b_1 d^6$

This is related to twists (see below).

Twists

The twist of the elliptic curve $E$ is the elliptic curve $E'$, which is not isomorphic to $E$ over $K$, but is isomorphic over some extension of $K.$

Let’s consider the elliptic curve $E: y^2 = x^3 + ax + b.$ There exists an isomorphism $(x, y) \mapsto (ux, u^{\frac{3}{2}}y)$ to the elliptic curve $E': y^2 = x^3 + au^{-2}x + bu^{-3}$, but what if $u$ does not have a square root in $K$?

In that case, $E$ and $E'$ are not isomorphic over $K$, but they are isomorphic over $K[\sqrt{u}]$. In this situation, $E'$ is said to be a quadratic twist of $E$ (and vice versa).

Note that $E'$ is isomorphic to $u y^2 = x^3 + ax + b$, as we can use $(x,y) \mapsto (x, \sqrt{u} y)$. The map $(x, y) \mapsto (ux, u^{\frac{3}{2}}y)$ simply scales this one.

Number of points

So, let’s have the elliptic curve over $\mathbb{F}_p$, where $p$ is a prime greater than $3$

$E: y^2 = x^3 + ax + b$

and its twist

$E': u y^2 = x^3 + ax + b$

where $u$ is not a square in $\mathbb{F}_p.$

It holds:

$\#E + \#E' = 2p + 2$

How can we see this? Note that if $x^3 + ax + b$ is a square in $\mathbb{F}_p$ (meaning $(x, y)$ is on $E$), then $(x, y)$ cannot be on $E'$ because $u$ is not a square (and vice versa). That means that for each $x \in \mathbb{F}_p$, we have $2$ points on either $E$ or $E'$. Additionally, there are two points at infinity, which gives us $2p + 2.$

Note that some care is needed in cases when $x^3 + ax + b = 0.$ In these cases, $(x, y) = (x, 0)$ lies on both curves. However, this simply means we still have exactly two points for each such $x$ as well.

We know:

$\#E = p + 1 - t$

where $t$ is called the trace of Frobenius. From the above, it follows that:

$\#E' = p + 1 + t$

Automorphism group

The automorphism group of an elliptic curve $E$depends on the $j$-invariant.

General case ($j \neq 0, 1728$)

The automorphism of elliptic curve $E$where $j(E) \in \{0, 1728 \}$is

$Aut(E) \cong \mathbb{Z}/2\mathbb{Z}$

generated by the following map:

$(x, y) \mapsto (x, -y)$

Special cases ($j = 0, 1728$)

When $j(E) = 0$, the curve can be written as $E: y^2 = x^3 + b.$ The automorphism group is:

$Aut(E) \cong \mathbb{Z}/6\mathbb{Z}$

generated by

$(x, y) \mapsto (x, -y)$

and

$(x, y) \mapsto (\omega x, y)$

where $\omega$is a primitive cube root of unity.

When $j(E) = 1728$, the curve can be written as $E: y^2 = x^3 + ax.$ The automorphism group is:

$Aut(E) \cong \mathbb{Z}/4\mathbb{Z}$

generated by

$(x, y) \mapsto (x, -y)$

and

$(x, y) \mapsto (-x, iy)$

where $i^2 = -1.$