PSE Lectures Ep 26 - (n-)Torsion points: the rational map [n] of multiplication by n
PSE Lectures: Elliptic Curve Cryptography · 29 Oct 2024 · 1:42:56
This lesson covers (n-)Torsion points: the rational map [n] of multiplication in PSE’s foundational course on elliptic-curve cryptography. It develops the algebraic concepts needed to understand curves, torsion points, pairings, and modern proof systems.
Speakers
Topics
From PSE Lectures: Elliptic Curve Cryptography, hosted by Privacy Stewards of Ethereum.
Transcript
okay so uh last time we talked about the rational functions um and we proved um a fundamental property um of rational functions that is um the following theorem um for E over K with K algebraically
closed and in two rational functions if and G from E to e sorry I um I should have said rational Maps um f plus G evaluated at P IS F of p plus G of P for any p and ER I mentioned that really the
the ER the goal of um the current few sessions is to to understand the torsion points so I I think I I gave this definition before but let me let me repeat it um suppose e over K is an elliptic curve uh where K is not necessarily
algebraically closed H the end torsion points of e are e bracket n this is the set of all points in E over the algebraic closure of K such that NP is equal to the zero element in e
now I I want you to notice that osion is not exactly the same as points of order n i mean if you remember ER for any group the order of an element is the minimal integer the minimal positive integer um such that if you you add the element to itself this number of times you get the zero element ER and here in torsion points I mean points of order n are necessarily n torsion points but not not
conversely I mean not necessarily conversely uh because you could have a a a some so Mark if say k divides n and p is a point of order k then then obviously P belongs to n okay because uh I mean k * p is already zero and so when
you and and K divides n so when you do it ER I don't know l number of times H you still get you still get zero okay so so end torsion points is is a bit more General than points of order n but for for n equals 2 it's the same right because two is prime so points of order two are are precisely in torsion points I mean if you add of course um this the zero element this depends on
your convention on whether you say the zero element has order infinity or something like that but in any case the zero element is is an end torsion Point by this definition um moreover n is a subgroup of EK EK bar because you take I mean if if p and p Prime are in
n and I I add them together and then I multiply by n by the um this distributivity law it's NP plus NP Prime which is 0 + 0 which is zero and similarly um if I do n * minus p I also get um I mean I get minus
NP which is O and and so so so I mean the endent end torent points are um a subgroup of of U of EK bar and let's remark that I I won't I won't write but um I would say say here I mean the reason that we we want to take K Bar I mean that we want n torsion points to be all the points in K Bar that satisfy um NP equal o and not over
K is um the good behavior that we saw for a I mean for for example for points of order two I mean we saw that points of order two which again it's the same as end torsion points in I mean the case of two it's it's the same as n torsion points or two to torsion points um they they have a a uniform um a uniform shape when when I work over the algebraic closure um but I mean so so e
E2 is is also a point of order two plus the point at infinity and they always always have the shape of um Z 2 time Z 2 but if if K is not algebraically closed then it could be many things I mean it could be just o or it could be some other some other kind of thing so it's convenient for us to work over the algebraic closure where where we expect
that we have a uniform shape of the of the group um any questions so far now what we want is to understand um understand the group The subgroup e and um can you say do you have like a
guess what what should we expect to be it's not a difficult question I mean just extrapolate from the the case of a case that you know all points of order n and pointed Infinity no that would not because as I said if n is not prime I mean if n has some divisor k then points of order K would also be
in EN then all points of order n and all and of order of all divisors of N and point at Infinity yes that that is true um but this is a this is not a very useful H description I mean this this we don't need to prove this is immediate well or almost immediate but it's very hard for us to to to work with such a effect I mean
and we have the the case of n equals 2 in n equals 2 it was Z mod 2 * Z 2 so um we we can expect that n will be isomorphic to ZN time ZN and this this will be the case now if you think about it we have the structure theorem for a billion groups so if we know that if we know the simply the the number of elements in e e
bracket n then there are not so many options I mean the the structure theorem for a billion groups would first of all so if we show that um en n has a n Square elements we are almost done and the reason is that since
n cannot have cannot be um isomorphic to ZN squ because I mean ZN square has a an element many elements but at least one of order n square and N does not so
you see I mean if I know that n is is of size n Square then I'm I'm almost like I'm almost proving that that en n is is ZN time ZN by by the structure theorem of a billion groups because I I start ruling out um other options by considering the order of elements okay so so this is the the the general aim of um the next few sessions and before I forget I should say that
um on the 14 of July um er I'm going to another conference ER in Japan um and that would be and then I'll stay Japan until the 4th of August so the sessions between 28th and 4th of August um will be cancelled um and I think that we we could we could probably um almost
get almost get this result um in the next next couple of sessions um what what do you mean Nisa uh like to the fourth of of like from next week no from the week after the next week 14th from 14 of July until 4th of August every Friday that falls into this see period
okay so um let um NP be be given I mean let's denote the the functions um that Define multiplication by n i mean of course if we want to understand a a torsion points then we want to understand multiplication by n multiplication by n is I mean I give you
a point let's say a p is some XY and then you want to do NP that is nxy in the I mean in the elliptic curve e right ER then NP is some expression um in the first coordinate it's some expression polom expression in X and Y Pol rational function expression so I call it G nxy and and and in the second coordinate it's also some function of X and Y right
so it's h n XY so this this is my notation and we want to understand GN and hn so I claim for K algebraically closed um GN and hn are rational functions yeah rational
functions um with pulse precisely at em and and furthermore n has finitely many points okay
so maybe just a a a quick question to you I mean we we consider a finite fields or or at least fields of positive characteristic um er I mean then typically we have the points in the elliptic curve are are just a a finite set so why can't can't I say that is I mean it's a subset of a finite set so it must be finite why do I need this the last statement of the theorem
Lisa what do you think C can can you can you repeat uh like what why do need why do we need the last statement about planet many many poles in inward context no not poles points I mean I mean we we work many times um we work with elliptic curves over um over FP right right and an the number of points of an elliptic curve over FP or
over fq is is finite so why couldn't I say okay I mean the number of of points of of the elliptic curve over FP or fq is anyway finite and N is simply a subset so it must be finite why do I need this orange part of the theorem why do I need to prove it maybe because we want to be sure that we have fin many polls let's let's even disregard that that part I
mean work on the algebraic closure exactly the number of points in E over the algebraic closure is not finite it's in fact it's never finite this is something we H we talked about I I proved that it's it's also in the notes um but the I mean the algebraic closure in itself is is not a finite field and when we talk about n we talk about n torsion points over the algebraic closure so um if I mean if I don't know I mean if
the the number of points of the algeb closure is infinite then it could be that also the number of osion points which is a subset of the number of points I mean of of the the collection of points of e over the algebraic closure it it could be that itself is infinite so this this this last part of the the statement tells us that at least we can be sure that it's finite okay now um the theorem is in fact very
easy I mean by induction on N um G1 XY is is simply X and G and H1 XY is simply y so right because I mean G1 AG one is is multiply a point by one it's the say it's like the identity
function so this is fine a um so these are are clearly rational um and okay so this is the the induction ER step now suppose that um GN and hn ah and and of
course E1 I mean E1 is finite E1 is simply the ER the point at Infinity there is only one point that if you multiply it by one you get oh um so suppose that um GN hn are rational for M or n smaller than q and that n
is finite and I guess this also for all any so how can I say I mean how do I know H that um that GQ and HQ are going to be rational um so for the inductive for the inductive
step sorry I I missed the step I was uh doing something else sorry I was well can you repeat why again E1 equal Z for the base in case well what is the what is E1 it's all the point in the algebraic closure that if all the points p in the algebraic closure such that if you do one times P you get o yeah okay and there is only one one such point so for the sorry I don't see it like 1 * P for me it's like 1 time G1 H1 so it's 1 time
XY 1 * p is equal to P sure but so it's not equal to zero then oh only p is equal to zero okay but we don't say this we don't say anywhere but p is equal to zero so I don't see why you say n so n is the collection of all points in the algebraic closure such that if I multiply them by N I get zero yes so you have one time P but you don't know if one time P equals zero I I know that there is only one case in
which one time p is equal to zero okay so it's when P equals zero okay sounds good okay sorry got it thank you no it's okay um so from the IND the inductive step um I write um QP is a q minus one p I'm sorry what is Q um I do induction and I say um that my my induction hypothesis is that the statement is true for all n
smaller than q and then I will I will H I will prove it for n equals Q okay so it's just something larger than n yeah because the I mean the statement itself involves n so it's maybe nicer to pick a pick a new integer okay for I mean for the kind of the the the the induction process um so okay so I write QP as Q minus one p plus
p and um I mean obviously Q minus one p is H sorry G Q minus1 P comma h q minus1 p and by the inductive assumption GQ minus one and HQ minus one are rational right and obviously 1 * P this is 1 * p 1 * p is simply G1 of
P H1 of P which is also rational so what we have here [Music] up um so by by the theorum of less time um I can write a q -1
p + 1 * p is H let me put it like this Q minus one bracket plus one bracket and all this evaluated at P this is like the the sum of rational functions or rational Maps right and this is of course QP
um but I mean but this is a rational map because it is given by GQ minus one HQ minus one which we assume to be rational functions and this is a rational map so um um by the result of less time we get that Q from E to E and is a rational
IE um Q evaluated at P which is just a fancy fancy way to write a QP and this is given by GQ of P HQ of P um is rational which implies in particular the G GQ and HQ are rational functions
okay so this is the um er the first part of the statement I mean the first part of the theorem is proved it's I mean I just wrote it in a lengthy way it's it's it's an immediate immediate induction using the result from the the time and we we are left to show that EQ is finite um
this will follow um if we knew that P into QP or rather um a bracket Q from E to e is not the zero rational map the the zero rational map I remind
you we Den note as om okay this is like a in the the the elliptic curve over the the field of rational functions this is the zero element um yeah I am not sure I understand this statement I mean I understand why if it is zero map then it then the number of points won't be fined I understand it but I don't understand how we know that this is the only case when uh it's true yeah okay
so um if um yeah so as you said if it is the zero map then clearly EQ is um so let me just expand here um if a a q is the zero map then e q is equal to E I mean to e of of K Bar and and so and then it's not H it's never
finite right the E of Q Bar is is never finite and and if um Q is different than the zero map then there is um let's say r e such that m
q let's let's put it like this there is there is q in E such that QQ is not the zero element um yeah uh
you have you have a point some something indeed is missing well I mean but remember that we have the the inductive assumption um I mean we know that a q minus one brackets it cannot be the zero map so if a a a q is is not equal to the zero M
um and um EQ is nevertheless infinite then we should have a problem H then um I mean q is a q -1 + 1 um e
I mean maybe maybe the the thing we want to use here is that a rational map that is not constant has to be subjective so once I know that it is not IR rational map zero I know I actually know it's not constant um because at the very least zero I mean this this map maps zero to to zero um so it cannot be constant hence it's subjective if it's subjective
um then I want to say that this this will imply that e of um yeah yeah something is missing
here it how about we take a break I think about it a bit ER if I can fix it I will and if not we move on to another another part so um let's take a break of 10 minutes and I I'll try to fix this e
e e e
e e e
e e e
e e e
e e e
e e e
e e e
e e e
e e e
e e okay so uh unfortunately I I was not able to fix
this um but let me let me prove the the statement ER modu this H mod this effect so e okay so let us show
that um a q from E to e uh is not the zero map um if it was then um for all p in E QP would be equal to zero um which means that
EQ is is the the entire H group e um and now you have two cases if um Q is not prime H then then I have a some integer K that divides Q then clearly EK is a subgroup of
EQ and EK by the the inductive assumption is H is finite so let's say um K is equal to sorry Q is equal to K * L um and and if Q is in e e EQ then I multiply Q by
l i get something in EK right because if I I mean because um If I multiply l q by K then I get q q which is zero yes sorry there another uh basic understanding I missed I don't understand the the conclusion if QP equal zero then e q equal E Q Bar e k bar I mean if for all
p i mean if the map a bracket Q is um is the zero map then for all P QP is is zero right okay so all the points would be okay okay so when you multiply QP give zero so it's the the quantification here the quantification yeah for all P okay so all P's are part of e of Q Bar so okay yeah all P all p in e e e k bar yeah thank you because the the when I when I say
q h from E to E I really mean and I think I I I already I mean this e is e of K Bar okay so um so if a um if it was the zero map then I would get the EQ is the whole the whole group E and therefore I could take any element Q in
EQ and multiply It by L and get an element in EK and We Know by the inductive assumption that EK is finite um and since both EK and E are a finite by assumption um
yes yeah me again so uh here you see Q is part of EQ and then you think so if we multiply Q by L then it's part of e k but you're doing L * Q not L * k then so I'm a bit confused yeah but but but Q is equal to K * L sure but you're doing Q * L not K * L yeah but the elements of e k are the ones that if you multiply them by K you get zero sure so I I took an element of EQ it means the If I multiply it by Q I get
zero yeah and now I took this element this element is not zero in itself only we only know that if you multiply it by Q you get zero so I multiply It by L I get some other element I don't know that it is zero yes but I know that if I multiply this other element lq I multiply it by K ah if you were to multip it again okay and then you would get Q okay good thank you okay logic okay okay so um we
claim that um uh if e is finite which is the case by by our assumption um there are only finitely many points um a q with
um lq equals um equals R for a fixed R why is this the case um I denote by FR R the map from E to e given by a f r of of
Q is equal to um lq minus r um FR cannot be the zero map since otherwise [Music] um um
for all Q in E lq would be equal to the same thing to R um and then if if R is zero it means that lq is the zero map which means um sorry L is the zero map which means that e l is equal to e k bar and that's a contradiction because e is assumed to be
finite and if R is different than zero then um um f of R FR R of O is by definition it's m i mean it's minus r and r is different than zero so minus r is also different than zero so v r either I mean depending I mean independently of the the value of
R FR R cannot be the zero map okay and hence FR has finitely many poles because we said it about rational functions but this this um this propagates into rational maps I mean rational function can only have
finitely many points in which it gets infinity and therefore rational map because rational map is is is a two coordinates of rational functions and the condition is that one is infinity one gets Infinity if and only if the other gets infinity and there are only finitely many points for which each of them can get infinity so all together the rational map can can have finitely many poles okay this is but um and this of course the exception is the the zero rational map the zero
rational map has infinitely many PS um but we know that FR is not the zero map so FR R has finitely many poles and what are the poles of V this is the set of elements Q in e k bar such that lq minus r is equal to O right it or let me just write it like this this the set of Point Q such that lq is equal to
R and this is finite this number of poles is is just the number of elements in the set and this is finite for any R in particular um e Q I could write as the union of um so EQ is Con is contained EQ
is contained in the union of all the poles of um FR for r a belonging to EQ or sorry for R belonging to EK right because we said that a if um a q is in in EQ then
um lq belongs to EK um i e l Q is equal to R for some R in EK which means that that Q is in the set of poles of PR R okay this is a
maybe a bit h a bit tricky to follow but it's not it's not hard so so in in in our case since it's uh I mean EK since EK is finite and um yeah since EK is finite um EQ will be finite as well right it's it's contained in a
union of a of a I mean a finite Union of finite sets this this blue Union is this point clear so what I'm saying that if if Q this this whole this whole thing is if Q is not um if Q is not Prime and and I pick some I I pick
some some divisor of Q then I get that EQ is contained is contained in I mean in a union of finite sets a finite Union of finite sets so it has to be finite is this point clear Nicholas what do you think yep I there's some details that mini mini details L but understand the
the general yeah makes sense I will now what do you uh where are you H all good yeah um I'm going through it uh I mean when you say it it makes s of sense but uh is is always like when I try to explain it to myself is when like I need to redo all the steps uh with more time but let me let me try to repeat the argument and uh you know if you don't get it now we move on and you can uh you can read
more I'm saying we are in the I mean we are assuming that a a q is not the zero map this is the the orange assumption sorry we don't assume we want to show that a q is not the zero M so we assume that it was um if it w I claim that if it was well EQ would be equal to E I mean to to e k bar
okay now there there are basically two cases either Q is prime or Q is not prime if Q is prime sorry if Q is not prime then I find some divisor of q k and um I I observe that if I take a point in in EQ and I multiply It by L then I get immediately a point in EK this this you got yes this part yes okay
so a now I claim that since since e is finite there could be only finitely men points Q such that if l q is equal to r that is I mean and the reason is that I mean if I fix R the points Q such that l q is equal to R are the the the poles of this function
right I mean it's the points Q such that l q minus r is equal to zero yeah okay so um but um this is a rational function rational function can only have finitely many poles so so the um the points Q such that if I multiply Q by L I get any r that you want the for a fixed R they are finite but if I take r i mean as noted in in this
part if I take R to be lq I mean if I take Q in in Q then lq which is R is is equal to I mean is an element of EK so if I if if I now say um I look at the the the poles of FR imagine that um R is is a point in EK it's I mean this statement is true
without without the assumption but um we know that the number of points of of f r sorry the number of poles of of FR is finite because it's a the number of poles of rational functions but the number I mean the poles of v r if I run over all R in e these are exactly the points Q in EK bar such that um lq is equal to R and in particular this
contains EQ I mean what I really say is that EQ is contained in the union of all poles of f because if if I take if I take a point Q if I take a point Q here a then I take lq I denote it as R then a a a q would be a pole of V right because lq is equal to R so lq
minus r will be zero but FR R FR R is exactly FR R of Q is exactly l q minus r by definition yep okay so so you see every point in EQ can be viewed as a pole of of V for some R in EK but by assumption there are only finitely many points in EK and for each of these points the number of poles of of FR is
finite so EQ is contained in in a union of fin in a fin Union of finite sets so it has to be finite which of course gives us a contradiction because we assumed we assumed that um er that that bracket bracket Q was the zero map meaning that EQ is equal to the whole of e ek bar okay I should say here I should write round
brackets okay so yeah go on one short question so you said that the number of polls of p is final because it's a rational function right yeah it's a rational map yes map and and you okay so we we didn't exactly prove it I mean we proved something else we proved that the number of poles of a rational function is finite right yes H but what is a rational map a rational map is just a pair of rational functions I see I see
okay each of these rational function and and there is a condition a rational map has a condition that implies that RP is infinity if and only if s of p is infinity okay so I mean each of these functions RNs can only have finitely many poles anyway so f f can have a f at most finitely many points poles okay so I'm one thing that I'm not sure
is so you want to show to show that [Music] um that EQ is finite finite but then you show a lot of things but it looks like just by showing that since EQ um can be viewed as a as the union of poles of Pi R yes s this is finite then EQ is finite yes so then EQ is finite without needing to go into the I mean I'm not sure what I'm missing
but no I I'm saying like a a um what is happening here is if we assume that um if we assume that the map Q is the zero map then we get some contradictory issue because if it's the zero map then I have the the orange equality right then EQ is equal to EK bar which means EQ is not finite but on the other hand I get that EQ is contained in a union of
finite set so it's it's finite okay so this a contradiction okay so Al this procedure was to show that the the Assumption was was a contradiction yeah okay yeah at the end of this I should say a contradiction now the other case if Q is um is prime then um then e
E2 is obviously contained it's in fact it's a subgroup well it's contained it's not it's contained in EQ right because a um if Q is Prime and EQ is the whole thing is e of K Bar then obviously e e E2 is contained in EQ because EQ is equal to e e k bar
and and and we know that um E2 is has has four points and it's a subgroup right I mean E2 E2 is a subgroup of EK so so it must be a subgroup of EQ um it means that four
divides I mean it means that that um two divides Q because the only way that e um e of K would would divide e of would be a subgroup of e of L is if a k divides l right um so this means that a q is even um but Q is Prime and there is only one even prime so Q is equal to two and that's a
contradiction because E2 cannot be the whole thing E2 can only have Four Points okay so um it hence actually now I think I I can see how to fix the proof so we proved that EQ is not the whole of e
okay um but EQ is the set of polls of a rational function I mean GQ HQ and finite and and and GQ HQ is not the zero rational map
hence EQ is f uh I I I I understand that this it was a messy uh proof because uh I had a mistake earlier but uh er do you want me to repeat the argument this is a this part Lisa where do you where do you want to
repeat uh I want to repeat the this like connection this um say again we're like um oh never mind never mind you get it I mean the the the Gap that I thought I had I mean it's it's enough to show that EQ is not a a the whole the whole group
E of K Bar because we already know that GQ and HQ are um or or that multiplication by by Q is a rational map right yes so and EQ this is always true EQ is always the PS of this rational map and if this rational map is not the zero rational map then EQ is finite okay but if we know that EQ is is not is not the whole of e k bar then we
know that um er gqhq is not the zero map it's it's an equivalent statement right yes ER nevertheless do you want me to repeat the the the proof from either from the beginning or from somewhere else no I think I think it's good and now what do you think where are you yeah no so so your last um overview on
the on on the part of the proof where you show that that it's final uh helped me to get on track so so I think I'm good now so thank you okay um let me do one more coroller which um is maybe a nice application but it um it's not it's not something that we will use today um the rational function GN minus
X is not identically zero of course for n bigger than one because for for n equal one it's exactly zero right GN I write GN but you should think of it it's GN of X Y right it's like some some rational function in two variables and the proof is very easy using what we we
showed um if GN minus X is zero identically then we would have NP is is equal to um either um plus or minus p i mean it would it would mean that NP has the same x coordinate as P so NP is either equal to P or to minus P but NP equal to plus minus p is the
same as saying that n Plus - one p is equal to Z and this is for all p and hence either e n minus one or e n +1 would be infinite would would be in fact the whole group would be equal would be e of of K Bar and this this cannot happen right we
know we know that each of the ens is finite okay um I think I think maybe it's it's um it's a good place to stop here for today um we progressed a bit slower than than I wanted but uh but it should be fine I don't want to start a new thing um do you have general questions on where we going or um anything else what is our plan for next two
sessions that will be before the break um so I I I want to show that the number of elements in N is n square right um for that we will need to examine carefully the functions GN and hn okay okay so H we will prove We Will We Will calculate for example the um the leading coefficient of GN and and hn H and once we we do that we will go for um calculating the divisor of GM
minus GN and after that we we will be in a position to to show that e n is is of size n square and and and from there um a simple argument by using the the structure theorem for finite a bilan groups would show us that n is in fact isomorphic to en to to ZN times ZN I see okay uh so if there are no other questions then uh have have a nice
weekend thank you bye thank you e