Conceptualizing Weil Pairing for elliptic curves ( and number fields)

Question

There are two explanations in Silverman ( Arithmetic of Elliptic Curves), one in exercises developing the Weil reciprocity law ( for algebraic curves) and then generalizing, and then there is a different, somewhat computational (in my opinion) proof in one of the chapters.

[I should also point out that in case of elliptic curves over complex numbers there is a rather simple description of this pairing in terms of determinant of a matrix!, see Ribet Stein : Hecke Operators ... for example]

While I do understand the proofs, I have heard that there is a conceptual explanation of this pairing?

Is there a uniform construction for the Hilbert Symbols in number field case, which is again a "form" of Weil pairing?

Answer 1

Not sure if it will be helpful, but I wrote a survey article whose title could have been "Where do pairings really come from, anyway?" It was for a cryptography conference on pairings. I tried to explain, from a functorial point of view, the origins and relationships of the various pairings on abelian varieties associated with the names of Weil, Tate, Lichtenbaum, Neron, Cassels, ... It's just a survey, so lacks many details, but may be useful in providing an overview. Here's the reference.

J.H. Silverman, A survey of local and global pairings on elliptic curves and abelian varieties, Pairing-Based Cryptography (PAIRING 2010), M. Joye, A. Miyaji, A. Otsuka, eds., Lecture Notes in Computer Science 6487, Springer-Verlag, Berlin, 2010, 377-396.

Answer 2

My preferred take on the Weil pairing is via Mumford's theta group, which is a group scheme $\mathcal{G}$ fitting into a short exact sequence

$1 \rightarrow \mathbb{G}_m \rightarrow \mathcal{G} \rightarrow E[n] \rightarrow 0$.

Note that the theta group itself is a noncommutative central extension of one commutative group (scheme) by another. In particular, if you take $P_1, P_2 \in E[n]$ (I really mean $T$-valued points for some $K$-scheme $T$...) then (i) lift to $\tilde{P}_1, \tilde{P}_2$ in $\mathcal{G}$, and (ii) form the commutator $e(P_1,P_2) = [\tilde{P}_1,\tilde{P_2}]$, then since this maps to the commutator $[P_1,P_2]$ in the commutative group $E[n]$, i.e., it maps trivially and therefore lives in $\mathbb{G}_m$. Moreover, since $\mathbb{G}_m$ is central, this element $e(P_1,P_2)$ is independent of the choice of lifts. It is also not too hard to check that it lands in $\mu_n$ (the nth roots of unity) inside $\mathbb{G}_m$ and in fact that the map $e: E[n] \times E[n] \rightarrow \mu_n$ is nondegenerate: i.e., it puts $E[n]$ into self Cartier duality. For all this, see Mumford's book Abelian Varieties.

Indeed one of the advantages of this approach is that it generalizes very gracefully to the setting of a polarized abelian variety $(A,L)$.

This take on the Weil pairing has been vitally useful to me in my research in the Galois cohomology of abelian varieties: see for instance $\S 6$ of this paper where theta groups are studied in a more general Galois cohomological context. (I am not the only one or even the first to have studied such things: see especially the 2002 paper of Polishchuk that appears in the bibliography.)

Added: Hilbert symbols show up in my paper too, to say the least. From the cohomological perspective this is hardly a surprise, since the Hilbert symbol is really the cup product $H^1(K,\mu_n) \times H^1(K,\mu_n) \rightarrow H^1(K,\mu_n^{\otimes 2})$ in the case where $\mu_n \cong \mathbb{Z}/n\mathbb{Z}$, whereas $E[n] \cong \mu_n \times \mu_n \cong \mathbb{Z}/n\mathbb{Z} \times \mathbb{Z}/n \mathbb{Z}$ when there is full $n$-torsion over $K$. The Weil pairing is defined without any rationality assumptions on the $n$-torsion but becomes a lot harder to work with explicitly when the Galois module structure on $E[n]$ is nontrivial.

Answer 3

The unifying picture you're looking for is probably most transparent the other way around -- by re-writing the Weil pairing on elliptic curves (in fact, this works more generally for Jacobians) to make it look like Hilbert symbols. Indeed, once you view the Weil pairing as a class-field-theoretic construction and pass it through the standard function-field-to-number-field analogy, you get exactly the Hilbert symbols. This is made very explicit in, for example, Everett Howe's "The Weil Pairing and the Hilbert Symbol." With notation in the paper, compare the Weil pairing formula

\begin{equation*} e_m([X],[Y])=\prod_{p}(-1)^{m(\text{ord}_P(D))(\text{ord}_P(E))}\frac{g^{\text{ord}_P(D)}}{f^{\text{ord}_P(E)}}(P) \end{equation*}

(here, $X$ and $Y$ are $m$-torsion divisors on the Jacobian of a curve with $mX=div(f)$ and $mY=div(g)$, with $P$ running over geometric points of the curve) with Schmidt's formula for the Hilbert symbol, reveals a striking similarity.

I'm not sure if I have anything coherent to say about an improved conceptual explanation other than that the class-field-theoretic approach makes the Weil pairing appear as a natural and canonical construction, whereas the standard divisor construction feels rather ad hoc at first.

Answer 4

Here is how I like to understand the Weil pairing.

The dual of an abelian variety $A$ is the scheme $\hat{A} = \mathrm{Hom}(A, B\mathbf{G}_m)$. Here $B\mathbf{G}_m$ is the stack of line bundles and $\mathrm{Hom}$ refers to homomorphisms of group stacks. One therefore has a perfect pairing

$A \times \hat{A} \rightarrow B\mathbf{G}_m$.

This actually means something relatively concrete: For each pair of points $(a, a') \in A \times \hat{A}$ one has a one dimensional vector space $L(a,a')$, together with isomorphisms

$L(a_1 + a_2, a') \simeq L(a_1, a') \otimes L(a_2, a')$,

$L(a, a'_1 + a'_2) \simeq L(a, a'_1) \otimes L(a, a'_2)$

satisfying some compatibility conditions (you can find the details of this definition under the heading of biextensions; there is a nice explanation in SGA7). One of these compatibilities is that the two isomorphisms

$L(a_1 + a_2, a'_1 + a'_2) \simeq L(a_1, a'_1) \otimes L(a_1, a'_2) \otimes L(a_2, a'_1) \otimes L(a_2, a'_2)$

should coincide.

One consequence of the definition is that $L(0, a') = L(0 + 0, a') \simeq L(0, a') \otimes L(0, a')$ which means that $L(0, a')$ is canonically trivialized, as is $L(a, 0)$ by symmetry. Moreover, the two trivializations of $L(0,0)$ must be the same.

If we choose an $n$-torsion point $a$ of $A$ then $L(a, a')$ will be a line bundle with a trivialization of its $n$-th tensor power. Similarly, if $a'$ is also an $n$-torsion point then $L(a,a')^{\otimes n}$ will come with two trivializations coming from its identification with the canonically trivialized line bundles $L(na, a') = L(0,a')$ and $L(a, na') = L(a,0)$. Comparing these two trivializations, we get an element of $\mathbf{G}_m$ and therefore a pairing

$A[n] \times \hat{A}[n] \rightarrow \mathbf{G}_m$.

However, we notice that the induced trivializations of $L^{\otimes n^2} \simeq L(na, na')$ must coincide. Therefore the image of this map actually lands in $\mathbf{G}_m[n] = \mu_n$. This gives the Weil pairing

$A[n] \times \hat{A}[n] \rightarrow \mu_n$.

I don't know of a way to interpret the Hilbert symbol in quite this way, but I'd be very interested if someone could suggest one!