# $j$-invariants of elliptic curves over finite fields

Let $K$ be a finite field, and $\overline{K}$ its algebraic closure. It is well known that two curves are isomorphic over $\overline{K}$ if and only if they have the same $j$-invariant. If two such curves are also $K$-isogenous, I believe we can conclude that they are $K$-isomorphic, but I cannot find any reference or elementary proof of this fact; is it easy to see, or does anyone have a reference? (it seems that this result is implicitly used in the algorithms for isogeny graphs of elliptic curves, like Kohel's, where the isogenous curves are encoded by there $j$-invariant).

As a side question, given a $j \in K$, how many curves over $K$ have this $j$-invariant, up to $K$-isomorphisms? For example, a (non-supersingular) curve and its quadratic twist both have the same $j$-invariant, but are not $K$-isogenous, so not $K$-isomorphic, so we have at least two $K$-isomorphism classes; is this it?

• For the second, look up "twists" in chapter X of Silverman's book. Together with the knowledge of what the endomorphism ring is yo ushould get the answer. Commented Oct 24, 2014 at 11:14
• So if $K$ has characteristic $p$ then since $E$ and its Frobenius twist $E^{(p)}$ are $K$-isogenous yet have the same $j$-invariant, you are claiming that $E$ and $E^{(p)}$ are always $K$-isomorphic in such cases? Commented Oct 24, 2014 at 13:30

As Chris and Rene said, your second question is all about twists. See specifically The Arithmetic of Elliptic Curves (Springer), Proposition X.5.4, which says that if the characteristic of $K$ is not 2 or 3, then the twists of $E/K$ are in one-to-one correspondence with $K^*/(K^*)^n$, where $$n=\begin{cases} 2&\text{if j(E)\ne0,1728},\\4&\text{if j(E)=1728},\\6&\text{if j(E)=0}.\\\end{cases}$$

So for a finite field $K=\mathbb{F}_q$ of characteristic $p\ge5$, in the first case there are always exactly two distinct twists, but for the latter two cases, the number of twists depends on whether $K$ has a fourth root, respectively cube root, of one, or equivalently, on the value of $q\bmod4$, respectively $q\bmod3$.

The first question seems to have been neglected. If two curves have the same $j$-invariant and are isogenous over $K$ (a finite field with $q$ elements), are they isomorphic over $K$? If they aren't, then they are twists of one another. If $j \ne 0, 1728$, the twist is a quadratic twist and if one curve has $q+1-a$ points, the other has $q+1+a$ points. They are $K$-isogenous if and only if they have the same number of points, so if and only if $a=0$. This case certainly happens. So answer to the first question is no, but only in very few cases. I am not sure what happens when $j=0, 1728$.

It is in general $\textit{not}$ true that $\textit{if}$ $A$ and $B$ are elliptic curves over the finite field $K$, lying in the same $K$-isogeny class, and with the same $j$-invariant, $\textit{then}$ $A$ and $B$ are $K$-isomorphic (see below). However, this is true if $A$ and $B$ are ordinary. You can find a related observation in Waterhouse's thesis (Abelian varieties over finite fields, Éc. Nor. Sup. 1969, remark page 542). Let me describe a different approach, similar to that suggested by Silverman.

Let me slightly reformulate the question. Let $K$ be a finite field of size $q$ and characteristic $p\geq 5$. Let $E$ an elliptic curve over $K$, denote by $\pi_E:E\to E$ the Frobenius isogeny of $E$ relative to $K$. By Honda-Tate theory, $\pi_E$ defines a Weil $q$-number whose minimal polynomial over $\mathbf{Q}$ dentifies uniquely the $K$-isogeny class of $E$. Let $E'$ be a $K$-form of $E$, with associated Weil number $\pi_{E'}$. Your first question can then can be formulated as:

Can we have that $\pi_{E'}$ is conjugate to $\pi_E$ without $E'$ being $K$-isomorphic to $E$?

(Here by "conjugate" I mean that the $\pi_E$ and $\pi_{E'}$ have the same minimal polynomial over $\mathbf{Q}$.)

To answer the question let's start by describing the $K$-forms of $E$ in a slightly different (but equivalent!) way than that used by Silverman above. Set $W_K=\textrm{Aut}_K(E)$ and $W_{\bar K}=\textrm{Aut}_{\bar K}(E\times_K\bar K)$. Since $p\geq 5$, $W_{\bar K}$ is isomorphic, as a $G_K$-module, to $\mu_n$, where $n=2,4$ or $6$. Moreover, we can think of $W_{\bar K}$ as the roots of unity inside some imaginary quadratic field $F$ embedded in $\textrm{End}_{\bar K}(E\times_K\bar K)$, where $F$ is unique if $E$ is ordinary or if $n>2$.

The set of $K$-forms of $E$ is in bijection with the (group) $H:=H^1(G_K,W_{\bar K})$. Consider the two cases

i) $W_K=W_{\bar K}$;

ii) $W_K\subsetneq W_{\bar K}$.

In the first case the evaluation map $c\mapsto c(\varphi)$ of $1$-cocycles on the arithmetic Frobenius $\varphi\in G_K$ induces an isomorphism $H\simeq W_{\bar K}$.

In the second case the action of $G_K$ on $W_{\bar K}$ is by inversion, and the evaluation map $c\mapsto c(\varphi)$ as above induces an isomorphism $H\simeq W_{\bar K}/(W_{\bar K})^2$.

You can check that this description of $H$ matches the Kummer-theoretic one given above by Silverman (at least as abstract groups).

Now, if $c$ is a $1$-cocyle (for $G_K$ acting on $W_{\bar K}$), then Silverman in his book explains how to construct an elliptic curve $E^c$ over $K$ $\textit{and}$ an isomorphism $E^c\times_K\bar K\simeq E\times_K \bar K$. One can then show (I owe the omitted proof to Jakob Stix) that in the ring $\textrm{End}_{\bar K}(E\times_K\bar K)$ the following relation holds

$\pi_{E^c}=c(\varphi)\pi_E$,

where we make an implicit use of the identification $\textrm{End}_{\bar K}(E\times_K\bar K)\simeq \textrm{End}_{\bar K}(E^c\times_K\bar K)$ induced by the isomorphism $E^c\times_K\bar K\simeq E\times_K \bar K$ encoded by $c$.

In other words, the Weil numbers $\pi_{E^c}$ and $\pi_E$ differ by multiplication by a root of unity. If the cohomology class defined by $c$ is non-trivial, the above formula implies that the non-trivial twist $E^c$ and $E$ are $K$-isogenous if and only if

$\bar\pi_E=-\pi_E$,

where $\bar\pi_E=q/\pi_E$ is the complex conjugate of $\pi_E$. Notice that from what we saw above $c$ is non-trivial in $H$ iff [$c(\varphi)\neq 1$ in case i), and $c(\varphi)\not\in W_{\bar K}^2$ in case ii)].

This last condition on $\pi_E$ then amounts to require it being purely imaginary, hence conjugate to $\sqrt {-q}$. If $q=p^e$, then $\sqrt{-q}$ arises as $\pi_E$ for some elliptic curve $E$ iff [either $e$ is odd, or else $e$ is even and $p\not\equiv 1$ mod $4$]. (In the remaining cases where $e$ is even you get $K$-simple non-geometrically simple surfaces attached to $\sqrt{-q}$).

The end of the story is that if $e$ is odd or $e$ is even and $p\not\equiv 1$ mod $4$, then every elliptic curve $E$ in the $K$-isogeny class defined by $\sqrt{-q}$ admits $|H|$-many $K$-isogenous, pairwise non-isomorphic $K$-forms. All these are examples of supersingular elliptic curves ($p$ divides the trace of $\sqrt{-q}$) with not all geometric endomorphisms defined over $K$. They exhaust the instances of the phenomenon we were after.

• For ordinary elliptic curves, this is Lemma 9.11.13 in "Mathematics of Public Key Cryptography. Version 2.0 Galbraith" Commented Nov 4, 2022 at 7:14