Skip to main content

Section 3.3 Quaternion Algebras (Alex)

Q: Why study quaternion algebras?

A: They arise as the endomorphism algebras of supersingular elliptic curves \(/\FF_{p^2}\text{.}\)

I don't want to spoiler next week at all, but I cannot talk about quaternion algebras without a little bit of motivation first!

Example 3.3.1. What are we doing again?

Lets take

\begin{equation*} K = \FF_9 = \FF_3[\alpha] = \FF_3[x]/(x^2- x - 1) \end{equation*}

and

\begin{equation*} E/K\colon y^2 = x^3 + \alpha x = f(x)\text{,} \end{equation*}

simple eh? It's supersingular as the \(j\)-invariant is 0 (and are in characteristic 3). Alternatively, count points or even compute the Hasse invariant, the coefficient of \(p -1 = 2\) in \(f(x)^{(p-1)/2 = 1}\text{,}\) yep, it's 0.

We therefore have \(\#E(K) = 9 + 1 = 10\) so we have a \(2\)-torsion point (\(P = (0,0)\)) and any other point we can use to generate (will be \(5\) or \(10\) torsion). Let \(x = 1\) so \(y^2 = 1 + \alpha = \alpha^2\) so \(y = \pm\alpha\text{,}\) say \(Q = (1,\alpha)\text{.}\)

We have one endomorphism, \(p\)-power frobenius \(x\mapsto x^3\text{,}\) \(y\mapsto y^3\text{.}\) How to find another one?

Lets compute an isogenous curve and see what happens! We will compute \(\psi\colon E \to E/\langle P \rangle = E'\text{.}\) In general the formulae are a little annoying [100], when you have a 2-torsion point at \((0,0)\text{,}\) not as bad:

\begin{equation*} \psi = \left(x + \frac{f'(0)}{x}, y - \frac{yf'(0)}{x^2} \right) \end{equation*}
\begin{equation*} f'(0) = \alpha \end{equation*}

so

\begin{equation*} \psi= \left(\frac{x^2 + \alpha}{x}, y\frac{x^2 - \alpha}{x^2} \right) \end{equation*}

(aside: if \(g/h = (x^2+\alpha)/x\) then \((g/h)' = (g' h - g h')/h^2 = (2x^2 - (x^2 + \alpha))/x^2 = (x^2 - \alpha)/x^2\text{,}\) sanity check/fast computation?). The curve is then

\begin{equation*} E'\colon y^2 = x^3 + 0x^2 + (\alpha - 5\alpha)x +0 = x^3 - \alpha x\text{.} \end{equation*}

I think really here we're just recovering those classic formulae for 2-isogenies between curves with a rational 2 torsion point at \((0,0)\) (used in 2-descent).

\begin{align*} C\amp\colon y^2 = x(x^2+ax+b)\\ D\amp\colon v^2 = u(u^2+a_1u+b_1)\\ \phi\amp\colon C\to D\\ (x,y) \amp\mapsto ((y/x)^2 , y-by/x^2)\\ \hat\phi\amp\colon D\to C\\ (u,v) \amp\mapsto \left(\frac14\left(\frac vu\right)^2 ,\frac18( v-b_1 v/u^2)\right) \end{align*}

So far so good, our curve doesn't look exactly the same, but it's \(j\)-invariant is, so we are still in business. Is

\begin{equation*} E \simeq E'\text{?} \end{equation*}

If we substitute \(x= \alpha^2 x\text{,}\) \(y = \alpha ^3 y\) into \(E'\) we get

\begin{equation*} \alpha^6 y^2 = \alpha^6 x^3 - \alpha^3 x \end{equation*}
\begin{equation*} y^2 = x^3 - \alpha^{-3} x = x^3 +\alpha x\text{,} \end{equation*}

call this map \(\iota\text{.}\) Excellent, so to get \(\psi' \colon E\to E\) we compose \(\iota\circ \psi\text{.}\)

\begin{equation*} \iota \circ\left( \frac{x^2 + \alpha}{x}, \frac{(x^2 - \alpha )y}{x^2}\right) = \left( \alpha^2\frac{x^2 + \alpha}{x}, \alpha^3\frac{(x^2 - \alpha )y}{x^2}\right) \end{equation*}
\begin{equation*} = \left( (\alpha+ 1)\frac{x^2 + \alpha}{x}, ( -\alpha + 1)\frac{(x^2 - \alpha )y}{x^2}\right)\text{.} \end{equation*}

What happens to our other point \(Q\text{?}\) \(\psi'(Q) = (\alpha^2(1+\alpha), \alpha^4(1-\alpha)) =(-1, \alpha - 1)\)

\begin{gather*} (0 : 0 : 1) \mapsto (0 : 1 : 0),\, (0 : 1 : 0) \mapsto (0 : 1 : 0),\, (1 : \alpha : 1) \mapsto (-1 : \alpha -1 : 1),\\ (1 : -\alpha : 1) \mapsto (-1 : -\alpha + 1 : 1),\, (-1 : \alpha -1 : 1) \mapsto (1 : -\alpha : 1),\\ (-1 : -\alpha + 1 : 1) \mapsto (1 : \alpha : 1),\, (\alpha : \alpha + 1 : 1) \mapsto (-1 : -\alpha + 1 : 1),\\ (\alpha : -\alpha -1 : 1) \mapsto (-1 : \alpha -1 : 1),\, (-\alpha : 1 : 1) \mapsto (1 : \alpha : 1),\, (-\alpha : -1 : 1) \mapsto (1 : -\alpha : 1) \end{gather*}

A word of caution: If you are very awake you may check and be led to believe that this is just the multiplication by \(-2\) isogeny on \(E\text{,}\) its action on \(E(\FF_9)\) points is the same!!!!! It's not the same isogeny though so you can relax. Now we have an endomorphism ring with two elements, what are the relations between themselves, and each other?

As we quotiented by a rational \(2\)-torsion point we have computed a factor of \(\pi - 1\text{,}\) the other factor comes from quotienting by \(5\)-torsion. In fact we find. The frobenius has characteristic polynomial \(t^2 + 9 = (t + 3i)(t-3i)\) \(\pi\) looks like \(3i\text{.}\) \(\psi\) has characteristic polynomial \(t^2 - 2t + 2 = (t+1)^2 + 1\text{,}\) so \(\psi + 1\) looks like \(\pm i\text{.}\) \(?? \cdot \psi = \pi - 1\) \(?? \cdot (i - 1) = 3i - 1\text{,}\) so \(?? = 2 - i = 2 - (\psi + 1) = 1 - \psi\text{.}\)

So what if we quotient by non-rational 2-torsion? Pass to the quadratic extension \(\FF_{3^4}\text{,}\) which we get from adjoining the other roots of \(0 = x^3 + \alpha x\) i.e. \(\pm \sqrt{-\alpha}\text{.}\) Denote this extension \(\FF_3 \lb \beta \rb\text{,}\) \((\beta^2 - 1)^2 = -\alpha\text{.}\) We can use Vélu again, it's degree two still but a bit more ugh, you might need a computer from now on, actually I've been using one all along.

\begin{equation*} \phi = \left( \frac{\left(\alpha + 1\right) x^{2} + \left(- \beta^{3} - \beta - 1\right) x}{x - (\beta^{2} - 1)},y \frac{\left(-\alpha + 1\right) x^{2} + \left(\beta^{3} - \beta^{2} + \beta - 1\right) x - 1}{(x - ( \beta^{2} - 1))^2} \right) \end{equation*}

doing a computation it looks like \(\phi\) satisfies \(\phi^2 -\phi + 2\text{.}\)

What are the relations between these? Hopefully they generate the endomorphism ring by now but without relations we are screwed! Do they commute? Computing \(\tau = \phi \psi - \psi \phi\) is relevant, if 0, commutative, otherwise not! Note that if they are algebraically dependant they must commute! In our example we can compute \(\tau^2 + 3 = 0\)

Aside: I now believe Asra when she says not to use Vélu's formulae for large degree!

Aside 2: Frobenius can be weird for supersingular curves, e.g. for

\begin{equation*} y^2 = x^{3} + x/\FF_9 \end{equation*}

we have \(\pi = -3\text{.}\) Or

\begin{equation*} y^2 = x^{3} + 1/\FF_{25} \end{equation*}

we have \(\pi = -5\)

Indeed one can find on the internet claims like, all elliptic curves over finite fields have extra endomorphisms because frobenius exists!

Subsection 3.3.1 Quaternion Algebras

Pretty much all of this material was ripped with the utmost love and affection from [101], check it out.

The above book is 800 pages long.

So now we have gone out into nature and observed a beautiful new species of algebra, time to catch it, pin it to a wall, dissect it to study it in detail. It might not look as pretty any more but it's the way the science is done.

Example 3.3.3. Hamilton's quaternions.

Hamilton's quaternions \(\HH\) were the first quaternion algebra to be discovered (citation needed). The structure is like two copies of \(\CC\) tensored together in some non-commuting way over \(\RR\text{.}\) We have a real algebra with two generators \(i,j\) s.t. \(i^2 = j^2 = (ij)^2 = -1\) we let \(k = ij\) for aesthetic reasons (note that these relations imply noncommutativity!). Like this we get a division algebra.

Quaternion algebras are a generalisation of this to other fields.

Definition 3.3.4. Quaternion algebras.

Let \(F\) be a field (not characteristic 2), a quaternion algebra over \(F\) is an algebra \(B\) over \(F\) for which there exist \(a,b\in F^\times\) such that there is a basis

\begin{equation*} 1,i,j,k \in B \end{equation*}

such that

\begin{equation*} i^2 = a,j^2=b,k=ij=-ji\text{,} \end{equation*}

it is automatic that \(k^2 = -ab\) from this.

We denote this particular quaternion algebra by \(\legendre{a,b}{F}\)

Example 3.3.5.
\begin{equation*} \HH = \legendre{-1,-1}{\RR}\text{.} \end{equation*}
Example 3.3.6.

What is

\begin{equation*} \legendre{1,1}{F} \left( = \legendre{1,-1}{F}\right)\text{?} \end{equation*}

We have another way to come up with \(4\)-dimensional non-commutative algebras over fields, matrices! Let

\begin{equation*} i= \begin{pmatrix} 1\amp0\\0\amp -1\end{pmatrix} \end{equation*}
\begin{equation*} j =\begin{pmatrix} 0\amp1\\1\amp 0\end{pmatrix} \end{equation*}

so

\begin{equation*} k = ij = \begin{pmatrix} 0\amp1\\-1\amp 0\end{pmatrix} = -ji \end{equation*}

as required.

Call this example split, in analogy with quadratic theory, If \(x^2 - N\) has a solution mod \(p\) then \(\legendre{N}{p} = 1 = \legendre{1}{p}\text{.}\)

Note that if \(a\) or \(b \in (F^\times)^2\) then we can divide the corresponding basis element by \(\sqrt{a}\) or whatever and find that \(\legendre{a,b}{F} = \legendre{1,b}{F}\text{.}\) This shows:

This is helpful as it allows us to work with non-split quaternion algebras as matrix algebras over a quadratic extension.

Example 3.3.8.

\(\HH/\RR\) can be seen as \(\Mat_{2\times 2}(\RR(i)) = \Mat_{2\times 2}(\CC)\text{,}\) explicitly

\begin{equation*} i= i\begin{pmatrix} 1\amp0\\0\amp -1\end{pmatrix} = \begin{pmatrix} i\amp0\\0\amp -i\end{pmatrix} \end{equation*}
\begin{equation*} j = i\begin{pmatrix} 0\amp1\\1\amp 0\end{pmatrix} = \begin{pmatrix} 0\amp i\\i\amp 0\end{pmatrix} \end{equation*}

please excuse the unfortunate notational clash here, I hope you agree it's somewhat unavoidable.

Here is a nice lemma I probably used implicitly already somewhere!

Show linear independence of \(1,i,j,ij\) (exercise).

Definition 3.3.10. Conjugate, trace and norm.

Given a quaternion algebra \(B/F\) there is a unique anti-involution \(\overline \cdot \colon B \to B\text{,}\) called conjugation.

With basis \(1,i,j,ij\in \legendre{a,b}{F}\) as above it is given as

\begin{equation*} \overline {x + yi + zj + w ij} = x - yi - zj - w ij,\,x,y,z,w\in F\text{.} \end{equation*}

As normal (heh) we define the (reduced) norm and trace

\begin{equation*} \norm \alpha = \alpha + \overline \alpha,\,\forall \alpha \in B \end{equation*}
\begin{equation*} \norm(x + yi + zj + w ij) = x^2 - ay^2 - b z^2 + ab w^2 \end{equation*}

and

\begin{equation*} \trace \alpha = \alpha + \overline \alpha,\,\forall \alpha \in B \end{equation*}
\begin{equation*} \trace (x + yi + zj + w ij) = 2x\text{.} \end{equation*}

Subsubsection 3.3.1.1 Orders

In our example, while the endomorphism algebra \(\End(E)\otimes \QQ\) was of interest, the endomorphism ring \(\End(E)\) was the more fundamental object. What is this? A quaternion ring?

Definition 3.3.11. Orders in quaternion algebras.

Let \(B/\QQ\) be a quaternion algebra, an order in \(B\) is a full rank sub-\(\ZZ\)-module that is also a subring.

Example 3.3.12. The Lipschitz order.

\(B = \legendre{-1,-1}{\QQ}\) (Hamilton quaternions with \(\QQ\)-coefficients) then we have an order

\begin{equation*} \ZZ + \ZZ i + \ZZ j + \ZZ ij \end{equation*}

the Lipschitz order.

Definition 3.3.13. Maximality.

Orders are ordered (heh) with respect to inclusion, thus we get notions of maximality of orders etc.

Is the Lipschitz order maximal? NO! Whats going on? \(\ZZ\lb i\rb\) is maximal in \(\QQ(i)\) after all. Consider

\begin{equation*} i + j + k,\,(i+j + k)^2 = i^2 + j^2 + k^2 + \cancelto{0}{ij + ji} + \cancelto{0}{ik + ki} + \cancelto{0}{jk + kj} = -3 \end{equation*}

so we have a \(\ZZ\lb \sqrt{-3}\rb\) lurking inside \(\legendre{-1,-1}{\QQ}\text{,}\) quaternion algebras are not everything they appear to be at first sight! \(\ZZ\lb \sqrt{-3}\rb\) is non-maximal and we must add \(\sqrt{-3}/2\) to make it so. Lets add this in the quaternion setting:

Example 3.3.14. The Hurwitz order.

Let \(B = \legendre{-1,-1}{\QQ}\text{,}\) then

\begin{equation*} \ZZ+ \ZZ i + \ZZ j + \ZZ \left(\frac{i + j + k}{2}\right) \end{equation*}

is an index two suborder of the Lipschitz order, called the Hurwitz order, this is maximal.

Warning, just because \(\sqrt{-3} \in \legendre{-1,-1}{\QQ}\) we do not have \(\legendre{-1,-3}{\QQ} = \legendre{-1,-1}{\QQ}\text{!}\)

Example 3.3.15. /Exercise.

Show that the elliptic curve from the exercise earlier

\begin{equation*} y^2 + y = x^3/\overline{\FF_2} \end{equation*}

has endomorphism algebra the Hurwitz order.

Solution

Here is what me and Angus think, we have the 2-power frobenius \(\pi\) a degree 2 isogeny whose square is minus 2, we also have the isogeny \(\phi \colon x\mapsto \zeta_3 x, y\mapsto y\) which is in fact an automorphism (degree 1) and satisifies \(\phi^2 + \phi + 1 = 0\text{.}\) The relation between these two isogenies is that \(\pi \phi = \phi^2 \pi \colon x\mapsto \zeta_3^2 x^2, y\mapsto y^2\text{.}\)

Inside the Huwitz order we have some candidates for an element whose square is \(-2\) there are a few, coming in two types \(a+ b\) for \(a \ne b \in \{i,j,k\}\) and \(a-b\) for \(a\ne b\in \{i,j,k\}\text{,}\) we choose the second type (why? because it works and the other doesn't), let \(p = i + j\) for concreteness. We also have a cube root of unity in the Hurwitz order, it is \(f = (-1 + i + j + k)/2\text{.}\)

We can calculate now what \(pf\) and \(f^2 p\) are, they both come out to be \(- i + k\text{,}\) some other square root of minus 2, which makes sense because degree is multiplicative. Anyway this is consistent with the endomorphism ring but there is a slight problem, the order generated here has discriminant \(6\text{,}\) so its non-maximal as we know its contained in the Hurwitz order but the discriminant is higher, Deuring tells us we have to get a maximal order so we need something extra.

Warning, there is no such thing as the maximal order of a quaternion algebra! Rather there are multiple maximal orders due to non-commutativity, e.g. if \(\ints\) is a maximal order then so is

\begin{equation*} \alpha \ints \alpha\inv \ne \ints\text{.} \end{equation*}

Normally when we have unique maximal things with a certain property, its because we can always take spans/unions and they still have that property.

This is no longer true here, the sum of two elements with integral trace and norm need not remain so, nor the product.

We can define discriminants of orders which like normal give a hint as to their maximality

\begin{equation*} \ints = \ZZ + \ZZ i + \ZZ j + \ZZ ij \subseteq \legendre{a,b}{\QQ} \end{equation*}
\begin{equation*} \disc \ints = d(1,i,j,ij) = \left| \det\begin{pmatrix} 2 \amp 0 \amp 0\amp 0 \\ 0 \amp 2a \amp 0 \amp 0 \\ 0 \amp 0 \amp 2b \amp 0 \\ 0 \amp 0 \amp 0 \amp -2ab\end{pmatrix}\right| = (4ab)^2 \end{equation*}

Find the discriminant of the Lipschitz order.

Subsubsection 3.3.1.2 Local theory

Definition 3.3.18. Split and ramified quaternion algebras.

Let \(B/\QQ_v\) be a quaternion algebra, we say that \(B\) is

\begin{equation*} \begin{cases} \text{split} \amp \text{if } B\cong M_2(\QQ_v) = \legendre{1,-1}{\QQ_v}\\ \text{ramified} \amp \text{otherwise} \end{cases} \end{equation*}

Correspondingly we say that \(B/\QQ\) is split/ramified at a place \(v\) if the corresponding \(B\otimes \QQ_v\) has that property.

The terminology definite for quaternion algebras ramified at infinity is also used (i.e. for which \(B\otimes \RR = \HH\)).

In fact:

Warning: Quaternion algebras may not be ramified where you think they are?

Knowing the ramification of a quaternion algebra \(\QQ\) is enough to identify it uniquely, in fact we have the following theorem

Sometimes however we want generators and relations not just ramification information: (As we will only care about discriminant \(p\) quaternion algebras) In our setting the relevant theorem is:

Ibukiyama has given a nice description of a maximal order in such.

Here are some nice references:

  1. Computational Problems in Supersingular Elliptic Curve Isogenies - Steven D. Galbraith and Frederik Vercauteren https://www.esat.kuleuven.be/cosic/publications/article-2842.pdf
  2. Computing Isogenies Between Abelian Varieties - David Lubicz Damien Robert https://perso.univ-rennes1.fr/david.lubicz/articles/isogenies.pdf
  3. Toric forms of elliptic curves and their arithmetic - Wouter Castryck and Frederik Vercauteren https://homes.esat.kuleuven.be/~fvercaut/papers/ec_forms.pdf
  4. Isogenies of Elliptic Curves: A Computational Approach - Daniel Shumow https://www.sagemath.org/files/thesis/shumow-thesis-2009.pdf
  5. Hard and Easy Problems for Supersingular Isogeny Graphs - Christophe Petit and Kristin Lauter https://eprint.iacr.org/2017/962.pdf
  6. Perspectives on the Albert-Brauer-Hasse-Noether Theorem for Quaternion Algebras - Thomas R. Shemanske https://www.math.dartmouth.edu/~trs/expository-papers/tex/ABHN.pdf
  7. COMPUTING ISOGENIES BETWEEN SUPERSINGULAR ELLIPTIC CURVES OVER Fp CHRISTINA DELFS AND STEVEN D. GALBRAITH http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.740.6509&rep=rep1&type=pdf