1
$\begingroup$

let $F$ be a finite field, $E(F)$ an elliptic curve of order $n$, $r$ a factor of $n$, $k(r)$ for the embedding degree of $E(F)$ with respect to $r$.

Then why the full $r$-torsion group contains $r^2$ many elements and consists of $r+1$ subgroups?

$\endgroup$

1 Answer 1

1
$\begingroup$

Only if $r$ is prime.

Let $E[r] = \langle P,Q \rangle$ be the $r$-torsion subgroup. Its cyclic subgroup is defined by a generator of the form $[a]P + [b]Q$, but up to a (non-zero) scalar multiple: because $G$ and $[k]G$ generate the same subgroups.

How to count the subgroups? In the expression $$G = [a]P + [b]Q$$ we can always take $$[a^{-1}]G = [1]P + [ba^{-1}]Q$$ if $a$ is nonzero, or $$[b^{-1}]G = [ab^{-1}]P + [1]Q$$ if $b$ is nonzero (and one of them has to be non-zero).

Therefore, we can count $2r$ generators of the form $[1]P + [a]Q$ and $[a]P + [1]Q$ for any $a$ (incl. 0). But we counted the subgroups where both coefficients are invertible twice, which is when $a$ is invertible (non-zero): $$\langle[1]P+[a][Q]\rangle=\langle[a^{-1}]P+[1][Q]\rangle.$$ So we have to correct it and get $$2r-(r-1)=r+1.$$

$\endgroup$
1
  • $\begingroup$ This answer missing the title part. $\endgroup$
    – kelalaka
    Commented Dec 4, 2023 at 16:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.