Complex Multiplication - Elliptic Curves: Number Theory and Cryptography - page 318

is still the case when we allow p -adic coe cients for some p ,thenwesay

that the quaternion algebra is ramified at p . Otherwise, it is split at p .
A maximal order O

≤∞

in a quaternion algebra Q is a subring of Q that is

finitely generated as an additive abelian group, and such that if is a ring

with O⊆R⊆Q and such that R is finitely generated as an additive abelian
group, then O = R . For example, consider the Hamiltonian quaternions H .
The subring Z + Zi + Zj + Zk is finitely generated as an additive abelian
group, but it is not a maximal order since it is contained in

R

O = Z + Zi + Zj + Z 1+ i + j + k
2

. (10.2)

It is not hard to show that O is a ring, and it can be shown that it is a
maximal order of H .
The main theorem on endomorphism rings is the following. For a proof, see
[33].

THEOREM 10.6
Let E be an elliptic curve over a finitefie d of characteristic p .

1. If E isordinary (that is, # E [ p ]= p ), then E nd ( E ) isanorderinan
imaginary quadraticfie d.

2. If E is supersingular (that is, # E [ p ]=1 ), then E nd ( E ) isamaximal
order in a definitequaternion algebra that isramified at p and ∞ and
issplitatthe other primes.

If E is an elliptic curve defined over Q and p is a prime where E has good
reduction, then it can be shown that End( E ) injects into End( E mod p ).
Therefore, if E has complex multiplication by an order R in an imaginary
quadratic field, then the endomorphism ring of E mod p contains R .If E
mod p is ordinary, then R is of finite index in the endomorphism ring of
E mod p . However, if E mod p is supersingular, then there are many more
endomorphisms, since the endomorphism ring is noncommutative in this case.
The following result shows how to decide when E mod p is ordinary and when
it is supersingular.

THEOREM 10.7
Let E be an elliptic curve defined over Q with g ood r eduction at p .Suppose

E has com plex m ultiplication by an order in Q ( √ −D ) .If −D isdivisibleby
p ,orif −D is not a square m od p ,then E mod p is supersingular. If −D is
a n on zero squ are m od p ,then E mod p isordinary.

For a proof, see [70, p. 182].