I've read that an elliptic curve is supersingular if and only if its endomorphism ring is an order in a quaternion algebra. Does anyone have a simple explanation of this (or a good reference)?

3$\begingroup$ I'm not sure what other people think, but I'd like to encourage people to either linkify their questions a little more, to help provide background, or explicitly provide background. I know I can't answer this sort of question, but I feel like I could easily be learning more just by reading it! $\endgroup$ – Scott Morrison♦ Oct 2 '09 at 3:37

$\begingroup$ @Scott: I agree that including references (links) and background should be encouraged, but I wouldn't sweat it too much. It's not a huge MO sin to ask a terse question without references (especially once we have some 2000+ rep users who can edit it into shape), but askers should keep in mind that the more clear an informative you make your question, the more likely you are to get a good answer. $\endgroup$ – Anton Geraschenko Oct 2 '09 at 14:53

1$\begingroup$ As Scott mentioned in his response, this (and more) was proven by Deuring: Max Deuring, Die Typen der Multiplicatorenringe elliptischer Funktionenko ̈rper, Abh. Math. Sem. Hamburg 14, 197–272 (1941). In this paper he further proves that the quaternion orders are maximal. I'm very interested in seeing a proof of this, but don't know any German. So my question is, does anybody know if this paper has been translated into english? If not, does anybody know of a place where the latter fact (about the orders being maximal) is proven? This does not seem to be covered in Silverman's book. $\endgroup$ – user1073 Jan 5 '10 at 22:55

1$\begingroup$ So certainly Ben knows this by now, but future generations: I like the Harvard senior thesis of Tony VarillyAlvarado as a reference myself. $\endgroup$ – stankewicz Jun 27 '13 at 20:39
Let $k$ be an algebraically closed field, and let $E/k$ be an elliptic curve. In general, how do we know the structure of $\mathrm{End}(E)$?
We know the following two facts in all cases: (1) considered as an additive group, $\mathrm{End}(E)$ is free abelian on 1, 2 or 4 generators; and (2) $\mathrm{End}(E) \otimes_Z Q$ is a division algebra. The first fact comes from considering homology (more on this momentarily), and the second comes from the theory of the dual isogeny.
In the case of rank=1, we must have $\mathrm{End}(E)$ an order in $Q$, i.e. $\mathrm{End}(E)=Z$.
In the case of rank=2, we must have $\mathrm{End}(E)$ an order in a quadratic field $F/Q$. This field must be imaginary, because its norm map is identified with $\lambda \mapsto \lambda \lambda^\vee$, and the latter is positive definite.
In the case of rank=4, we must have End(E) an order in a quaternion algebra R/Q.
The last case gets ruled out when $\operatorname{char}(k)=0$. We don't see it in the familiar characteristic zero setting, so we think of it as strange, but there really is nothing unnatural about it. The "simple explanation" that you seek is, most bluntly, that it does not get ruled out, since there is no replacement for $H_1(E,Z)$ in positive characteristic.
By the way, here is the reason it gets ruled out in characteristic zero: Without loss of generality by the Lefschetz principle, we may declare that k=C. Assume that $\mathrm{End}(E)$ is an order in $R$. The hard step in proving (1) above is showing that $\mathrm{End}(E)$ acts faithfully on the first homology group $H_1(E,Z)$. Granted this, $\mathrm{End}(E)$ embeds as a free rank four $Z$submodule of $\mathrm{End}(H_1(E,Z)) = M_2(Z)$. Tensoring with $Q$ we get that $R = M_1(Q)$, and hence $M_1(Q)$ would be a division algebra, which is false.
The reason I mention this argument is that, even though when $\operatorname{char}(k)=p>0$ the argument fails as stated (since one can't make $k=C$ and access $H_1(E,Z)$), one can still modify it to get information about $R$. As a substitute for $H_1(E,Z)$, one instead takes a prime $\ell$ not equal to $p$, and considers the $\ell$adic Tate module $T_\ell(E) = \varprojlim_n E[\ell^n]$, with transition maps given by multiplication by \ell. (This gadget is a free $Z_\ell$module of rank 2 whether $\operatorname{char}(k)=0$ or not, and when $k=C$ it is canonically identified with $H_1(E,Z_\ell) = H_1(E,Z) \otimes_Z Z_\ell$, which motivates its use as a substitute.) Considering again the faithfulness of the action of $\mathrm{End}(E)$, we have that $\operatorname{End}(E) \otimes_Z Z_\ell$ embeds into $\mathrm{End}(T_\ell(E)) = M_2(Z_\ell)$, and therefore $R \otimes_Q Q_\ell = M_2(Q_\ell)$. By definition, this means that the quaternion algebra $R$ is "split at $\ell$". Now we invoke a byproduct of global class field theory, which is the determination of all quaternion algebras over $Q$. They are parameterized by nonempty finite sets of even cardinality, consisting of prime numbers and possibly the symbol $\infty$. There is a unique quaternion algebra that is split at exactly those primes not occurring in the parameterizing set. Since for all $\ell$ not equal to $p$ we know that $R$ is split at $p$, the only possibility for the set associated to $R$ is $\{p,\infty\}$. Thus we know, on the nose, which quaternion algebra $R = \mathrm{End}(E) \otimes_Z Q$ is.
This is a theorem of Deuring, 1941. David alluded to this, but Section 5.3 of Silverman's The Arithmetic of Elliptic Curves has a proof that 5 conditions concerning elliptic curves over a characteristic p perfect field are equivalent, and any one of them can be taken as the definition. There are additional definitions of supersingularity, concerning the vanishing of the Hasse invariant (a modular form mod p defined by the eigenvalue of Frobenius acting on the Serre dual to the invariant differential), or line bundles with trivial pth tensor power being automatically trivial. My favorite definition is that the kernel of multiplication by p is a connected group scheme (necessarily of order p^2).
The ladic Tate module of a curve is a free Z_lmodule of rank 2, so the endomorphism ring of any elliptic curve is a free Zmodule of rank 1, 2, or 4, and for rank 2 (resp. 4), analysis of dual isogenies shows that the ring has to be an order in an imaginary quadratic field (resp. a quaternion algebra). If you assume a supersingular curve has endomorphism rank 1 or 2, you can derive a contradiction by combining two facts:
 There are only finitely many isomorphism classes of supersingular curves for a given prime p (in fact, the total number weighted by automorphisms is (p1)/24). This uses the fact that the jinvariant of a supersingular curve lies in a finite field.
 Given a curve whose endomorphism ring has rank 1 or 2, any isogenous curve has an endomorphism ring with the same fraction field.
The contradiction arises as follows: Take a sequence of elliptic curves as successive images of cyclic lpower isogenies, where l is chosen to be prime in the ring of integers of the fraction field. Two of them will be isomorphic, so you get an endomorphism by a cyclic isogeny. Analysis of degree shows that this endomorphism is equal to an automorphism composed with multiplication by a power of l. However, the two endomorphisms (presumably equal) have nonisomorphic kernels.
I'd like to add a question to this discussion: the endomorphism ring of a supersingular elliptic curve is not just an order in a quaternion algebra, it is a maximal order in such an algebra. Is there a simple explanation for this?

3$\begingroup$ Tate's isogeny theorem over finite $k$ is valid for all primes: $\mathbb{Z}_{\ell} \otimes {\rm{End}}_k(A)={\rm{End}}_k(A[\ell^{\infty}])$. Increase $k$ so ${\rm{End}}_k(A)={\rm{End}}_ {\overline{k}}(A)$. For $A$ a supersingular elliptic curve, ${\rm{End}}_k(A[\ell^{\infty}])$ then has rank 4 but is the Galoisinvariants in the $\overline{k}$endomorphism algebra of $A[\ell^{\infty}]$. The latter is ${\rm{M}}_2(\mathbb{Z}_{\ell})$ for all $\ell$ (verify using Dieudonne theory for $\ell=p$), so the quotient by its Galoisinvariants is finite yet torsionfree! QED Conceptual, yes. Simple...? $\endgroup$ – Boyarsky Jun 24 '10 at 10:53
There are a many funny things that can happen to elliptic curves over finite fields. For instance the endomorphism ring can be bigger than in char 0, and there can be no ptorsion (even after extending the field).
It turns out that many of these are equivalent, and we call an elliptic curve satisfying these equivalent properties supersingular. Silverman's AOC has a nice section discussing this.