MathOverflow will be down for maintenance for approximately 3 hours, starting Monday evening (06/24/2013) at approximately 9:00 PM Eastern time (UTC-4).

## How do you explicitly compute the p-torsion points on a general elliptic curve in Weierstrass form?

Consider the Weierstrass cubic $$y^2z = x^3 + A\, xz^2+B\,z^3.$$ This defines a curve $E$ in $\mathbb{P}^2$, which if smooth is an elliptic curve with basepoint at $[0,1,0]$.

I'm interested in having an explicit description of the locus of $p$-torsion points of this curve, where $p$ is prime.

In fact, suppose $p\neq 3$. Then ideally I'd like to be able to find a curve $C$ in $\mathbb{P}^2$, given by an equation $f=0$ of degree $d=(p^2-1)/3$, so that the scheme $X=E\times_{\mathbb{P}^2} C$ is precisely the locus of points of exact order $p$.

Example: For $p=2$, it's well known that $f=y$ gives such a curve.

I'd like $f$ to be an expression which depends on $A$ and $B$; i.e., I want to do this over a generic part of the moduli stack. I would also like this expression to work in characteristic p; in this case, $X$ should turn out to be the "scheme representing Drinfeld level structures $\mathbb{Z}/p\to E$". (Edit: I'm particularly interested in families of curves which include supersingular curves.)

(My example curve $E$ is never smooth in characteristic $2$, but if you consider a more general Weierstrass form which is smooth in char. $2$, then you can find a degree $1$ curve $C$ which does what I ask. For instance, if $E: y^2z+A\,xyz+yz^2=x^3$, take $f=A\,x+2\,y+z$.)

So my questions are:

1. Is it usually possible to find an equation $f=0$ such that $E\cap C$ is exactly the $p$-torsion? (Is this the same as asking that $X$ is a complete intersection?) Can you ever show it's not possible?
2. Are there known methods for computing the locus of $p$-torsion points explicitly? Are there software packages which do this? (I'm aware there are ways to find explicit torsion points on elliptic curves defined over some field or number ring; I'm asking for something a little different, I think.)
3. Have people carried out these sorts of computations for various small values of $p$ (even $p=5$), and are these computations described in print? (I'm probably most interested in this question.)

Warning: I am not an algebraic geometer or number theorist.

-

Here is an attempt to answer my own question, using the "division polynomials" of Kevin's and Jared's answers. It is probably the maximally naive idea, and I do not claim it works, though it's not clear to me that it can't. I've community wiki-ed this answer, as it's probably junk anyway ...

Fix $A,B\in \mathbb{Z}$, obtaining an elliptic curve $E$ over $S=Spec \mathbb{Z}[\Delta^{-1}]$, and a prime $p\geq 5$ not dividing the discriminant $\Delta=\Delta(A,B)$. The division polynomial $\psi_p(t)$ is supposed to be a polynomial of degree $d=(p^2-1)/2$ over $\mathbb{Z}$, whose roots are the values $t(P)=x(P)/z(P)$ as $P$ ranges over the points of exact order $p$ in $E$.

Turn $\psi_p$ into a homogeneous polynomial $g$ of degree $d$ in $\mathbb{Z}[x,y,z]$, so that $g(x,y,1)=\psi_p(x)$. The polynomial deterimes a curve $C=(g)$ in $P^2/S$, and thus a closed subscheme $D=E\cap C$ of $E$. Over $\mathbb{Z}[\Delta^{-1},p^{-1}]$, $D$ should consist of the points of exact order $p$ on $E$ (with multiplicity $1$), together with the basepoint of $E$ with multiplicity $d$.

Claim. $D$ is an effective Cartier divisor on $E/S$, of degree $3d$.

Proof. I don't know. I need to prove that $D\to S$ is flat, the main concern being the behavior over $\mathbb{Z}_{(p)}$. I don't even know if this is really plausible in general.

Let's pretend we somehow know $D$ is an effective Cartier divisor on $E$ relative to the base $S$. There is another relative Cartier divisor, namely $$D' = E[p] \quad + \quad (d-1)[0]$$ where $E[p]$ is the $p$-torsion subgroup scheme of $E$, and $[0]$ is the degree one divisor of the basepoint of $E$. It seems clear that away from characteristic $p$, the divisors $D$ and $D'$ are equal. Equality of effective divisors on a smooth curve is a closed condition, so they should be equal over all of $S$.

The divisor I want is thus $D''=D-d[0]=D'-d[0]$ (which is still effective). Then it's really easy to find a homogeneous polynomial $h$ of degree $2d/3$ which defines $D''$; because of the form of the Weierstrass equation, you can produce it from $g$ by hand, and if my claim is true you can produce it globally, i.e., with coefficients in $\mathbb{Z}[A,B]$.

I've carried out this out in the case $p=5$, and it appears to "work". That is, I get an answer which appears sane for general $A$ and $B$, and which for some explicit cases I've tried of $A,B\in \mathbb{Z}$ appears to give me a flat $D\to S$. For instance, if $E/\mathbb{Z}[6^{-1}]$ is the curve with $(A,B)=(0,1)$ (which reduces to a supersingular curve at $p=5$), I find $$h= 729z^{8}-1350x^4z^4+360x^6z^2+5x^8.$$

-
 What you seem to be doing is writing down the divisor $E[p]$ minus the identity section. I thought you wanted the scheme parametrising points of order $p$ in the sense of Drinfeld. The problem is that in characteristic $p$ the relationship between these two things is delicate. For example $E[p]$ minus the identity, over an ordinary elliptic curve over an alg closed field of char $p$, will typically have all its components non-reduced. But the moduli space for the Drinfeld level structure will have reduced components IIRC. I am unclear about what you want though. – Kevin Buzzard Mar 6 2010 at 19:34 If you're happy with $E[p]$ minus the identity then great. That sort of notion was understood in the 1960s. Drinfeld level structures are more subtle and weren't around until the 1980s. – Kevin Buzzard Mar 6 2010 at 19:35 Perhaps I am confused, or am using incorrect terminology. The gadget I want should not have reduced components in char p; I want a Gamma_1(p) structure in the sense of Katz-Mazur, 3.2. – Charles Rezk Mar 6 2010 at 22:22 Well perhaps I am confused as well; I'll try and remember to look at my copy of K-M on Monday (you seem to indicate that I've forgotten what the special fibre of X_1(p) looks like, which might be true; I had thought it had two components, one a (reduced) Igusa curve and one non-reduced). But my point is this. Why should E[p] minus the origin represent points of order p in the sense of Drinfeld? If that's true (which it might be) then it's news to me. I'll try to remember to get back to you. If this trick works then you're in business! – Kevin Buzzard Mar 7 2010 at 15:42 Well, K-M define a $\Gamma_1(m)$ structure as a group homomorphism $f:Z/m\to E$ (equivalently, a choice of $f(1)\in E[m]$) which satisfies a certain condition (an inequality $\sum [f(i)]\leq E[m]$ of effective divisors). This is a closed condition, so $\Gamma_1(m)$ is a closed subscheme of $E[m]/S$; I believe they show it is flat and finite over the base $S$ (KM 5.1.1), of rank $\#\text{injections}(Z/m,Z/m^2)$. For $m=p$, this should do it, no? – Charles Rezk Mar 7 2010 at 19:25

Since you asked about software, I'd just like to point out (if you don't know already) that SAGE (available at sagemath.org) can compute division polynomials easily. The commands

R.<A,B> = PolynomialRing(GF(5))

E = EllipticCurve([A,B])

f = E.division_polynomial(5)

f

return the result

2*A*x^10 - A^2*B*x^5 + A^6 - 2*A^3*B^2 - B^4.

The warnings of the commenters apply; you must be cautious about interpreting the division polynomials. It is true that the roots of this polynomial give you the "physical" 5-torsion points of the elliptic curve in characteristic 5, but that's about all it says. The polynomial does not tell you, eg, the structure of the group scheme E[5] over the supersingular locus.

A little more helpful might be the formal group associated to this family:

G = E.formal_group()

G.mult_by_n(5,30)

which returns

2*A*t^5 + (2*A^6 - A^3*B^2 - B^4)*t^25 + O(t^30)

There's also a command G.group_law() whose output I'm not going to give here. Together these data give you the structure of E[5] over an infinitesimal neighborhood of the zero section of your elliptic curve over $\text{Spec}\mathbf{F}_5[A,B,\Delta^{-1}]$.

I'm a firm believer in explicit calculations as a means of developing intuition about algebro-geometric concepts. But by all means read Katz-Mazur :-).

-

http://en.wikipedia.org/wiki/Division_polynomials

That's not the best wikipedia page. "The division polynomials form an elliptic divisibility sequence." is mentioned well before the far more important "the roots of the n'th division polynomial tell you the n-torsion in the curve".

-
PS finite flat group schemes are always complete intersections ;-) – Kevin Buzzard Mar 4 2010 at 16:56
Okay, I will look into that! I'm worried it's not what I want, though. The roots of the division polynomial $\psi_p$ are the $x$-coordinates of the $p$-torsion points, which means it degenerates in characteristic $p$ to something of smaller degree; it will never give the thing I want if the curve is supersingular, for instance. But since the algorithm seems to give a formula for $[n]:E\to E$, maybe I can get what I want out of it ... – Charles Rezk Mar 4 2010 at 17:13
I'll tell you a formula for [n]:E-->E; it's [n-1]+[1]. This works even in characteristic $p$. I am wondering whether if you think hard enough about this trivial observation that it will solve your problems without actually having to do any computations... – Kevin Buzzard Mar 4 2010 at 17:27
To be honest, perhaps the main contribution of the answer is telling you what to google for, rather than anything else... – Kevin Buzzard Mar 4 2010 at 17:29
PS @Charles: I've just realised that I don't understand your comment earlier about degenerations. You absolutely want the p'th division polynomial to degenerate mod p, because in characteristic p the identity of the group (the point at infinity) is a root of the equation [p]P=0 with multiplicity at least p, and hence you want some of the roots of the polynomial to go off to infinity, which is exactly what is happening. – Kevin Buzzard Mar 4 2010 at 17:39