A FORMULA FOR THE SUPERSINGULAR POLYNOMIAL

LUÍS R. A. FINOTTI

Abstract. In these notes we prove that the supersingular polynomial in characteristic p ≥ 5 is given by

ss_{p}(X) = (− \frac{2}{9} )^{r} ∑_{i=r_{1}}^{r_{2}} \binom{r}{i}\binom{i}{3i − r} (− \frac{27}{4} )^{i} X^{i−r′_{1}}(X − 1728)^{r′_{2}−i},

where r =^{def} (p − 1)/2, r_{1} =^{def} ⌈r/3⌉, r_{2} =^{def} ⌊r/2⌋, r′_{1} =^{def} ⌊r/3⌋ and r′_{2} =^{def} ⌈r/2⌉. We also exhibit and prove a differential equation satisfied by this polynomial.

1. Introduction

Let k be a perfect field of characteristic p > 0 and E/k an elliptic curve over k. If k̄ denotes the algebraic closure of k, then E(k̄) is an Abelian group and its p-torsion, denoted by E[p], is either 0 or ℤ/pℤ. (See, for instance, Theorem V.3.1 in [Sil85].) E is then called supersingular if E[p] = 0, and ordinary otherwise. (As observed by Silverman in Remark V.3.2.2 of [Sil85], there are other characterizations of supersingular elliptic curves relevant to various applications.)

Its a known fact that, for a fixed characteristic p > 0, there are (up to isomorphism) finitely many supersingular elliptic curves. (See, for instance, Theorem V.4.1(c) of [Sil85].) Let s be the number of supersingular elliptic curves (for the fixed characteristic p) and j_{1}, …, j_{s} be the j-invariants of these curves. The supersingular polynomial is defined as

ss_{p}(X) =^{def} ∏_{i=1}^{s}(X − j_{i}).  (1.1)

In these notes we deduce a explicit formula for ss_{p}.

Deuring (in [Deu41]) gave a characterization of supersingular elliptic curves for p > 2 based on the Legendre form: if E is given by

E/k : y^{2} = x(x − 1)(x − λ),  (1.2)

then E is supersingular if, and only if, λ is a root of

L_{p}(X) =^{def} ∑_{i=0}^{r} \binom{r}{i}^{2}X^{i}, where r =^{def} \frac{p − 1}{2}.  (1.3)

2000 Mathematics Subject Classification. Primary 11G20; Secondary 11G07.

Key words and phrases. arithmetic geometry, elliptic curves, supersingular polynomial.

2 LUÍS R. A. FINOTTI

It turns out that this polynomial has distinct roots in k̄, which allows us to deduce that there are exactly ⌈r/2⌉ − ⌊r/3⌋ supersingular elliptic curves (up to isomorphism) in characteristic p.

On the other hand, the supersingular polynomial, as previously defined, seems to be a more natural criterion for supersingularity, since it depends on the j-invariant directly, which would be more appropriate in most situations than the λ for the curve’s Legendre form. Deuring, also in [Deu41], found formulas for the Hasse invariant (see section 2) of an elliptic curve in terms of the j-invariant, from which one can deduce a formula for ss_{p}. In fact we will follow a similar approach and the formula deduced here could be derived from Deuring formulas without too much difficulty. Hence, the formula presented in these notes is not necessarily new, but as far as the author knows, it has not appeared explicitly in other publications. Also, the formula as presented here is not broken into cases depending on the congruence class of p modulo 12, as are the formulas presented by Deuring.

Several papers have dealt with the supersingular polynomial in the past, notably [KZ98], [BM04], and [Mor06]. In [BM04], J. Brillhart and P. Morton give an explicit formula for the supersingular polynomial, which depends on the Jacobi polynomials P_{n}^{(α,β)}. In [KZ98], which is partially expository, a few different polynomials in ℚ[X] are given that reduce to the supersingular polynomial and, in particular, the Atkins Polynomials are quite explicit. Also, Morton’s [Mor06] has a few formulas, and in fact mentions that a formula can also be deduced from Deuring’s [Deu41]. The formula given here is simpler than most previous formulas, except for the one given by equations (1.2) and (1.6) of [Mor06], which is equally simple.

We have:

Theorem 1.1. Let p ≥ 5. Then

ss_{p}(X) = (−\frac{2}{9})^{r} ∑_{i=r_{1}}^{r_{2}} \binom{r}{i}\binom{i}{3i − r} (−\frac{27}{4})^{i} X^{i−r′_{1}}(X − 1728)^{r′_{2}−i},  (1.4)

where r =^{def} (p − 1)/2, r_{1} =^{def} ⌈r/3⌉, r_{2} =^{def} ⌊r/2⌋, r′_{1} =^{def} ⌊r/3⌋ and r′_{2} =^{def} ⌈r/2⌉.

In section 4, we give an application of the approach taken here, giving a direct and elementary proof of the known and complex differential equation satisfied by the supersingular polynomial.

2. Deduction of the Formula

Let k be a perfect field of characteristic p ≥ 5 and E/k an elliptic curve over k:

E/k : y^{2} = x^{3} + ax + b.  (2.1)

A FORMULA FOR THE SUPERSINGULAR POL. 3

then, the Hasse invariant of E is the coefficient x^{p−1} in (x^{3} + ax + b)^{(p−1)/2}. The following theorem, which is the only non-elementary result that we need here, gives a simple criterion for supersingularity, and is the crucial step of our deduction.

Theorem 2.1 (Deuring, Hasse). An elliptic curve E given by Eq. (2.1) is supersingular if, and only if, its Hasse invariant is zero.

To find an explicit formula for the Hasse invariant, we provide the following simple lemma:

Lemma 2.2. Let n and t be positive integers with t ≤ 3n, and n_{1} =^{def} ⌈(3n − t)/3⌉ and n_{2} =^{def} min{n, ⌊(3n − t)/2⌋} . Then, if a, b ≠ 0, the coefficient of x^{t} in (x^{3} + ax + b)^{n} is

(\frac{b}{a})^{3n−t} ∑_{i=n_{1}}^{n_{2}} \binom{n}{i}\binom{i}{3i − (3n − t)} (\frac{a^{3}}{b^{2}} )^{i} .  (2.2)

Proof. One has

(x^{3} + ax + b)^{n} = ∑_{i=0}^{n} \binom{n}{i}x^{3(n−i)}(ax + b)^{i}

= ∑_{i=0}^{n} ∑_{l=0}^{i} \binom{n}{i}\binom{i}{l}a^{l}b^{i−l}x^{3n+l−3i}.

Hence, the terms in x^{t} are obtained when 3n + l − 3i = t, i.e., l = 3i − (3n − t). Since l ≥ 0, we must have i ≥ ⌈(3n − t)/3⌉ and since l ≤ i ≤ n, we must have i ≤ min{n, ⌊(3n − t)/2⌋}.

□

Thus, if E is as in (2.1), then the Hasse invariant is given by:

(\frac{b}{a})^{r} ∑_{i=r_{1}}^{r_{2}} \binom{r}{i}\binom{i}{3i − r} (\frac{a^{3}}{b^{2}} )^{i} ,  (2.3)

where r =^{def} (p−1)/2, r_{1} =^{def} ⌈r/3⌉, and r_{2} =^{def} ⌊r/2⌋. (We shall keep this notation throughout these notes.) Note that the use of floor and ceiling above prevents the need of dealing with different cases for the congruence class of p modulo 12.

So, if a ≠ 0 (i.e., j ≠ 0) and b ≠ 0 (i.e., j ≠ 1728), then E is supersingular if, and only if, a^{3}/b^{2} is a root of

F (X) =^{def} ∑_{i=r_{1}}^{r_{2}} \binom{r}{i}\binom{i}{3i − r}X^{i−r_{1}}.  (2.4)

The j-invariant of E is given by

j =^{def} 1728\frac{4a^{3}}{4a^{3} + 27b^{2}} .

So, if a ≠ 0 and b ≠ 0, then

\frac{a^{3}}{b^{2}} = −\frac{27}{4} · \frac{j}{j − 1728}.

Thus, if j ≠ 0 and j ≠ 1728, E is supersingular if, and only if, j is a root of

F (−\frac{27}{4} · \frac{X}{X − 1728}) .

Clearing denominators, we obtain,

G(X) =^{def} ∑_{i=r_{1}}^{r_{2}} \binom{r}{i}\binom{i}{3i − r} (−\frac{27}{4})^{i} X^{i−r_{1}}(X − 1728)^{r_{2}−i}.  (2.5)

So, E is supersingular, with j ≠ 0, 1728, if, and only if, its j-invariant is a root of G(X).

We now deal with the cases when j = 0 or j = 1728. (It’s well known when those values are supersingular, but we present a proof here, since this can be easily deduced from the Hasse invariant.) If j = 1728 (i.e., b = 0), then the Hasse invariant of E, which we shall denote by A, is given by the coefficient of x^{p−1} in

(x^{3} + ax)^{r} = ∑_{i=0}^{r} \binom{r}{i}a^{i}x^{3r−2i}.

So,

A = \begin{cases}0 , & if r ≡ 1 (mod 2); \\ \binom{r}{r/2}a^{r/2}, & if r ≡ 0 (mod 2). \end{cases}

Therefore, if r ≡ 1 (mod 2), we should multiply G(X) by (X−1728), and leave it unchanged otherwise. Hence, if we let r′_{2} =^{def} ⌈r/2⌉, this can be accomplished by changing (X −1728)^{r_{2}−i} in G (Eq. (2.5)) by (X − 1728)^{r′_{2}−i}.

If j = 0 (i.e., a = 0), then the Hasse invariant of E is given by the coefficient of x^{p−1} in

(x^{3} + b)^{r} = ∑_{i=0}^{r} \binom{r}{i}b^{i}x^{3(r−i)}.

So,

A = \begin{cases}0 , & if r ≢ 0 (mod 3); \\ \binom{r}{r/3}b^{r/3}, & if r ≡ 0 (mod 3). \end{cases}

Therefore, if r ≢ 0 (mod 3), we should multiply G(X) by X, and leave it unchanged otherwise. Hence, if we let r′_{1} =^{def} ⌊r/3⌋, this can be accomplished by changing X^{i−r_{1}} in G (Eq. (2.5)) by X^{i−r′_{1}}.

So, the roots of the polynomial

H(X) =^{def} ∑_{i=r_{1}}^{r_{2}} \binom{r}{i}\binom{i}{3i − r} (−\frac{27}{4})^{i} X^{i−r′_{1}}(X − 1728)^{r′_{2}−i}  (2.6)

are exactly the j-invariants of the supersingular polynomial. Since we know (see Theorem V.4.1(c) of [Sil85]) that there are exactly r′_{2} − r′_{1} such j-invariants, H(X) has no multiple roots and therefore is, up to a constant multiple, the supersingular polynomial. (An alternative proof of this fact will be given in section 4. See also [Fin08].)

3. The Leading Coefficient

In this section we finish the construction of the supersingular polynomial by adjusting the leading coefficient of H(X). The leading coefficient of H(X) is given by

∑_{i=r_{1}}^{r_{2}} \binom{r}{i}\binom{i}{3i − r} (−\frac{27}{4})^{i} .  (3.1)

Also, by Eq. (2.3), the coefficient of x^{p−1} in (x^{3} − 3x + 2)^{r} = (x − 1)^{p−1}(x + 2)^{(p−1)/2} is

(−\frac{2}{3})^{r} ∑_{i=r_{1}}^{r_{2}} \binom{r}{i}\binom{i}{3i − r} (−\frac{27}{4})^{i} .

We will now simplify the expression for this coefficient.

We need the following simple lemma:

Lemma 3.1. If h(x) =^{def} (x − 1)^{p−1}(x + 2)^{r} (in characteristic p), then

h^{(n)}(0) = \begin{cases}n! ∑_{i=0}^{n} \binom{r}{i} 2^{r−i}, & if 0 ≤ n ≤ r; \\ n! 3^{r}, & if n ≥ r. \end{cases}

Proof. We prove the lemma by induction. For n = 0, the statement is trivially true. So, assume it is true for n − 1, with n ≤ r. We have:

\frac{d^{n}}{dx^{n}} ((x − 1)h(x)) = (x − 1)^{p} \frac{d^{n}}{dx^{n}} (x + 2)^{r} = (x − 1)^{p} \frac{r!}{(r − n)!}(x + 2)^{r−n}.

On the other hand, Leibniz rule gives us:

\frac{d^{n}}{dx^{n}} ((x − 1)h(x)) = nh^{(n−1)}(x) + (x − 1)h^{(n)}(x).  (3.2)

Comparing this two equations and evaluating at x = 0, the induction hypothesis gives us

h^{(n)}(0) = \frac{r!}{(r − n)!}2^{r−n} + nh^{(n−1)}(0)

= \frac{r!}{(r − n)!}2^{r−n} + n! ∑_{i=0}^{n−1} \binom{r}{i} 2^{r−i}

= n! ∑_{i=0}^{n} \binom{r}{i} 2^{r−i}.

Hence, the lemma holds for all n ≤ r.

Observing that,

∑_{i=0}^{r} \binom{r}{i} 2^{r−i} = (1 + 2)^{r},

6 LUÍS R. A. FINOTTI

we can proceed by assuming that the statement holds for some (n − 1) with n ≥ (r + 1). Then, since,

\frac{d^{n}}{dx^{n}} ((x − 1)h(x)) = (x − 1)^{p} \frac{d^{n}}{dx^{n}} ((x + 2)^{r}) = 0,

by Eq. (3.2), and using the induction hypothesis, we obtain

h^{(n)}(0) = nh^{(n−1)}(0) = n! 3^{r},

which concludes the proof. □

Thus, we have that the coefficient of x^{p−1} in h(x) = (x − 3x + 2)^{r} is 3^{r}. (Note that this also implies that F (−27/4) ≠ 0.) So, the leading coefficient of H(X) is

(−\frac{3}{2})^{r} 3^{r} = (−\frac{9}{2})^{r} ,

which gives us the following formulas for the supersingular polynomial (still with p ≥ 5):

ss_{p}(X) = (−\frac{2}{9})^{r} ∑_{i=r_{1}}^{r_{2}} \binom{r}{i}\binom{i}{3i − r} (−\frac{27}{4})^{i} X^{i−r′_{1}}(X − 1728)^{r′_{2}−i}

= ∑_{l=r_{1}−r′_{1}}^{r′_{2}−r′_{1}} [(−\frac{2}{9})^{r} (−1728)^{r′_{2}−r′_{1}−l} ∑_{i=r_{1}}^{r′_{1}+l} (−\frac{27}{4})^{i} \binom{r}{i}\binom{i}{3i − r}\binom{r′_{2} − i}{r′_{1} + l − i}] X^{l}.

4. Differential Equations

Finally, we give differential equations satisfied by the polynomials F, G, and ss_{p}, which can sometimes be useful. In fact, Igusa proved in [Igu58] that L_{p}(X) (given by Eq. (1.3)) has simple roots by the fact that L_{p} satisfies the following differential equation:

4X(1 − X)L′′_{p} + 4(1 − 2X)L′_{p} − L_{p} = 0.

(One should observe that this equation comes up naturally in a proper context, which we shall not describe here.) In the same spirit, we shall give a proof, at the end of this section, that H has simple roots, which was crucial to prove that it gives the supersingular polynomial up to a constant multiple. This would avoid quoting the known result on the number of supersingular elliptic curves for a given characteristic, as we have done in section 2.

One should note that the differential equations given for G and ss_{p} are certainly not new, but the proofs given here are elementary and do not depend on any previous result, as the simplicity of the formulas allows us to check them directly. We start with a differential equation for

F̃(X) =^{def} X^{r_{1}} · F (X) = ∑_{i=r_{1}}^{r_{2}} \binom{r}{i}\binom{i}{3i − r}X^{i}.  (4.1)

A FORMULA FOR THE SUPERSINGULAR POL. 7

This has a quite simple differential equation, from which we deduce all others. Note that by Eq. (2.3), we have that

A = (\frac{b}{a})^{r} F̃ (\frac{a^{3}}{b^{2}} ) .

Proposition 4.1. We have:

4X^{2}(4X + 27)F̃′′ + 4X(8X + 27)F̃′ + 3(X − 1)F̃ = 0.  (4.2)

Proof. Expanding the left-hand side of the Eq. (4.2) using (4.1), we have that the term in X^{i+1} has coefficient

\binom{r}{i}\binom{i}{3i − r}(16i(i − 1) + 32i + 3) + \binom{r}{i + 1}\binom{i + 1}{3i + 3 − r}(108(i + 1)i + 108i − 2).

We can then factor out r!/((r − i)!(3i + 3 − r)!(r − 2i)!) from this expression, leaving

(16i^{2} + 16i + 3)(3i + 3 − r)(3i + 2 − r)(3i + 1 − r)+ (108i^{2} + 216i + 105)(r − i)(r − 2i)(r − 2i − 1).

Since we are in characteristic p and r = (p − 1)/2, a simple calculation shows that the expression above is zero. □

We now proceed to deduce the others. Their proofs are simple and tedious, so we shall only give a brief description of the necessary steps.

Proposition 4.2. The polynomial F (X) (defined by Eq. (2.4)) satisfies the following differential equation:

X(4X + 27)F′′ + (8(r_{1} + 1)X + 27(2r_{1} + 1))F′ + (4r_{1} + \frac{31}{36}) F = 0.  (4.3)

Proof. We just use Eq. (4.1) to replace F̃ (and its derivatives) by F (and its derivatives) in Eq. (4.2). After that, we can divide the resulting expression by X^{r_{1}}.

Then, observing that in characteristic p we always have r_{1}^{2} = 1/36, one obtains Eq. (4.3). □

Proposition 4.3. The polynomial G(X) (defined by Eq. (2.5)) satisfies the following differential equation:

X(X − 1728)G′′ + ((−2r_{2} + 2r_{1} + 1)X − 1728(2r_{1} + 1))G′ + (r_{2} − r_{1})^{2}G = 0. (4.4)

Proof. The idea is the same as before. We just use

G(X) = (X − 1728)^{r_{2}−r_{1}}F (−\frac{27}{4} \frac{X}{X − 1728})

8 LUÍS R. A. FINOTTI

to replace F (and its derivatives) by G (and its derivatives) in Eq. (4.3). We multiply by 432(X − 1728)^{r_{2}−r_{1}} to clear denominators.

Observing that

(2r_{1} + 1)(r_{2} − r_{1}) + \frac{31}{144} + r_{1} = (r_{2} − r_{1})^{2},

which can be easily done, for instance by checking the possible congruences of p modulo 12 (which gives specific values for r_{1} and r_{2} in characteristic p), one can then divide the resulting expression by (X − 1728), giving Eq. (4.4). □

We observe that Eq. (4.4) is the same as Eq. (1.6) in [BM04].

Finally, we find a differential equation for the supersingular polynomial itself.

Proposition 4.4. Let B(X) =^{def} X^{r_{1}−r′_{1}}(X − 1728)^{r′_{2}−r_{2}} and C_{0}(X), C_{1}(X), and C_{2}(X) be the coefficients of G, G′, and G′′ in Eq. (4.4) respectively. Also, let

D_{2}(X) =^{def} C_{2}B,
D_{1}(X) =^{def} C_{1}B − 2C_{2}B′,
D_{0}(X) =^{def} C_{0}B − C_{1}B′ + 2((B′)^{2} − (r_{1} − r′_{1})(r′_{2} − r_{2})B)C_{2}/B.

Then,

D_{2} ss′′_{p} + D_{1}ss′_{p} + D_{0} ss_{p} = 0.  (4.5)

Proof. As before, just use

ss_{p}(X) = B(X) G(X)

to obtain Eq. (4.5) from Eq. (4.4). (Note that the term C_{2}/B in D_{0} is in fact a polynomial.) □

Although Eq. (4.5) does not depend on the possible congruences of p modulo 12, making it somewhat more direct, we can give clearer equations if we break it into cases.

Corollary 4.5. Let p ≥ 5 be prime. If p ≡ 1 (mod 12), then

X(X − 1728) ss′′_{p} + \frac{1}{6}(7X − 6912) ss′_{p} + \frac{1}{144} ss_{p} = 0.

If p ≡ 5 (mod 12), then

X^{2}(X − 1728) ss′′_{p} − \frac{1}{6}X(X − 6912) ss′_{p} + \frac{1}{144}(49X − 165888) ss_{p} = 0.

If p ≡ 7 (mod 12), then

X(X − 1728)^{2} ss′′_{p} + \frac{1}{6}(X − 1728)(X − 6912) ss′_{p} + \frac{1}{144}(25X + 81216) ss_{p} = 0.

If p ≡ 11 (mod 12), then

X^{2}(X − 1728)^{2} ss′′_{p} − \frac{1}{6}(X − 1728)(7X − 6912) ss′_{p}

+ \frac{1}{144}(169X^{2} − 333504X + 286654464) ss_{p} = 0.

We now use the differential Eq. (4.4) to prove that H(X) has only simple roots. Indeed, if H(x_{0}) = H′(x_{0}) = 0, with x_{0} ≠ 0, 1728, we have also H′′(x_{0}) = 0. Then, successive differentiation of would give that x_{0} is a zero of H(X) of infinite order, which is a contradiction. But also note that neither X = 0 nor X = 1728 can be a root of H(X), as one can clearly see from the definition (remembering that r_{1} ≤ r_{2} ≤ r = (p − 1)/2 < p), and hence H(X) has no multiple roots at all.

Acknowledgement. The author would like to thank P. Morton and J. Cogdell for their useful comments.

References

[BM04] J. Brillhart and P. Morton. Class numbers of quadratic fields, Hasse invariants of elliptic curves, and the supersingular polynomial. J. Number Theory, 106(1):79–111, 2004.

[Deu41] M. Deuring. Die typen der multiplikatorenringe elliptischer funktionenköper. Abh. Math. Sem. Univ. Hamburg, 14:197–272, 1941.

[Fin08] L. R. A. Finotti. A formula for the supersingular polynomial: Addendum. Available at

http://www.math.utk.edu/~finotti/, 2008.

[Igu58] Jun-ichi Igusa. Class number of a definite quaternion with prime discriminant. Proc. Nat. Acad. Sci. U.S.A., 44:312–314, 1958.

[KZ98] M. Kaneko and D. Zagier. Supersingular j-invariants, hypergeometric series, and Atkin’s orthogonal polynomials. In Computational perspectives on number theory (Chicago, IL, 1995), volume 7 of AMS/IP Stud. Adv. Math., pages 97–126. Amer. Math. Soc., Providence, RI, 1998.

[Mor06] P. Morton. Explicit identities for invariants of elliptic curves. J. Number Theory, 120(2):234–271, 2006.

[Sil85] J. H. Silverman. The Arithmetic of Elliptic Curves, volume 106 of Graduate Texts in Mathematics. Springer-Verlag, 1985.

Department of Mathematics, University of Tennessee, Knoxville, TN – 37996, USA

Email address: finotti@math.utk.edu