Suppose that $p\ge 5$ is a prime and $P$ be a torsion point on the elliptic curve $E_5:y^2=x^3+p^2$. Using the Nagell-Lutz theorem we can write down all possible values of $y(P)$ (where $P=(x(P),y(P))$) and these are $\pm 1,\pm 3,\pm p,\pm 3p,\pm p^2,\pm 3p^2$. I want to show that $y(P)=\pm p$ is the only $y(P)$ value that "makes sense". I was able to dismiss all the others except for $y(P)=\pm 3$. In this case, we must have $x(P)^3=9-p^2$. I don't know where it can go wrong. Essentially it remains to prove that $p^2-9$ can never be a cube for primes $p\ge 5$. I am not sure how to show that. I have tried using several elementary number theory techniques but none of them seems to work. Any suggestion will be appreciated.
Elliptic curves of the form $y^2=x^3+p^2$, $p$ a prime, has torsion subgroup isomorphic to $\mathbb{Z}/3\mathbb{Z}$.
algebraic-geometryelliptic-curvesnumber theory
Related Solutions
For $y$, $y^2|-23k^6$, then $|y|^2\leq |23k^6|\leq|25k^6|$, so $|y|\leq 5|k^3|$.
For $x$, we know $|x^3 - k^2x + k^3|\leq 25|k|^6$, thus $|x^3 - k^2x| \leq|k^3|+25|k|^6$, which is also $|x||x ^2- k^2|\leq|k^3|+25|k|^6$.
If $|x|>3k^2$, then $|x||x ^2- k^2|>3k^2(9k^4-k^2)$, so $3k^2(9k^4-k^2)<|k^3|+25|k|^6$, we now get $2k^6-3k^4<|k^3|$.
Now there are two possibilities.
If $k>0$, then $2k^3<3k+1$, so $k=1$. Now $y^2=x^3-x+1$ where $\Delta=-23$ and $y=1$ or $-1$, hence $x^3-x+1=1$, then we know $x=0,1,-1$ which doesn't satisfy $|x|>3|k|^2$.
If $k<0$, then $2k^3>3k+1$, this is always impossible too since $k$ is an integer.
It may not be immediately obvious from a cursory reading, but an underlying assumption in the stated result (by De Feo as well as in Silverman's book) is that it deals with the torsion parts of the group $E(\overline{k})$. In other words, $E[m]$ stands for the group of $m$-torsion points defined over an algebraic closure of $k$. If you want to specifically look at the $m$-torsion of the group of points with coordinates in the field $k$, you need a different notation such as $E(k)[m]$ (I'm afraid I don't know what is the standard notation here — caveat reader).
The upshot: To see all of the $m$-torsion of an elliptic curve you need to include the points with coordinates in selected (algebraic) extension fields of the field of definition $k$.
Further points:
- When the curve $E$ is defined over a finite field $k$, then the description based on divison polynomials implies that all the points in $E[m]$ have coordinates in a finite extension field $k'$, $[k':k]<\infty$. The same applies to curves defined over $\Bbb{Q}$, but that is of less concern here.
- If $k=\Bbb{F}_q$ is a finite field of cardinality $q$, and $E$ is an elliptic curve defined over $k$, then the Hasse-Weil bound says that the number of $k$-rational points of $E$ is a group of size $\le q+1+2\sqrt q$. So if $p$ is a prime number $>q+1+2\sqrt q$ it is impossible for the group $E(k)$ to have any $p$-torsion. Therefore you should not be surprised to learn that to find non-trivial points in $E[p]$ you need to go to an extension field $k'=\Bbb{F}_{q^m}$ (with the exponent $m$ not necessarily easy to figure out).
- The same phenomenon appears in elliptic curves that are easier to visualize. Consider the curve $E$ defined by $y^2=x^3+x$ over the field of real numbers $\Bbb{R}$. Its $2$-torsion points are $(0,0),(i,0),(-i,0)$ and the point at infinity. Four of them altogether, as prescribed by the cited theorem, but two with coordinates in the extension field $\Bbb{C}$.
Hopefully this clears up some of the fog.
About testing for supersingularity. I don't know how Sage does this, but I add a few suggestions:
- Theorem 4.1. from chapter V of Silverman's book (reference number 66 in De Feo's article) states that a curve defined over a finite field $K$ of characteristic $p$, $p>2$, by a Weierstrass equation $$y^2=f(x)$$ with $f$ a cubic without repeated roots (in $\overline{K}$) is supersingular if and only if the coefficient of $x^{p-1}$ in $f(x)^{(p-1)/2}$ vanishes. Applied to $f(x)=x^3+1$, $p=13$, we see that $$f(x)^6=x^{18}+6 x^{15}+15 x^{12}+20 x^9+15 x^6+6 x^3+1.$$ Here the coefficient of $x^{12}$ is $15\not\equiv0\pmod{13}$, so the curve is ordinary.
- Doing the same knowing the size of $E(\Bbb{F}_q)$ alone is possible but a bit trickier. It is known (Hasse-Weil-Davenport) that if we have $$\# E(\Bbb{F}_q)=q+1-\omega_1-\omega_2$$ for complex numbers $\omega_1,\omega_2$ that also satisfy $\omega_1\omega_2=q$ (these two equations determine $\omega_{1,2}$ uniquely) then for all extension degrees $r>1$ $$\# E(\Bbb{F}_{q^r})=q^r+1-\omega_1^r-\omega_2^r.$$ In the example curve we have $q=13$ and can easily calculate (or let Sage do it) that $\# E(\Bbb{F}_{13})=12.$ It follows that $\omega_{1,2}=1\pm 2\sqrt{3}i$. A bit of testing then reveals that $$\# E(\Bbb{F}_{13^{12}})=23298094520064$$ is divisible by $13^2$. So we have $13^2$-torsion points defined over $\Bbb{F}_{13^{12}}$.
See Chapter V in Silverman's book for more of the theory. Judging from my recent but brief encounter with the use of supersingular curves in cryptography that theory is very relevant to you!
Best Answer
The group $E_{tors}(\mathbb{Q})$ contains the points $(0, \pm p)$ of order $3$. Since $E_{tors}(\mathbb{Q})$ contains no $2$-torsion point $(x, 0)$, the only other possibility by Mazur's theorem is a point with $P = (x, \pm 3)$ with $3P = (0, \pm p)$. Writing out the latter equation for $x$ via the group law (and it should even be independent of $p$) is enough to eliminate that case.