The Basic Theory - Elliptic Curves: Number Theory and Cryptography - page 55

THEOREM 2.22
Let E be an elliptic cur ve defined ov er a field K .Let α

=0 be an endom or-

phism of E .Then α : E ( K )

→ E ( K ) issurjective.

REMARK 2.23 We definitely need to be working with K instead of K in
the theorem. For example, the Mordell-Weil theorem (Theorem 8.17) implies
that multiplication by 2 cannot be surjective on E ( Q ) if there is a point in
E ( Q ) of infinite order. Intuitively, working with an algebraically closed field
allows us to solve the equations defining α in order to find the inverse image
of a point.

PROOF Let ( a, b ) ∈ E ( K ). Since α ( ∞ )= ∞ , we may assume that
( a, b ) = ∞ .Let r 1 ( x )= p ( x ) /q ( x )beasabove. If p ( x ) − aq ( x )isnota
constant polynomial, then it h as a root x 0 .Since p and q have no common
roots, q ( x 0 ) =0. Choose y 0 ∈ K to be either square root of x 0 + Ax 0 + B .
Then α ( x 0 ,y 0 ) is defined (Exercise 2.19) and equals ( a, b )forsome b .Since
b 2 = a 3 + Aa + B = b 2 ,wehave b = b .If b = b , we're done. If b =

± − b ,

then α ( x 0 , −y 0 )=( a, −b )=( a, b ).
We now need to consider the case when p − aq is constant. Since E ( K )is
infinite and the kernel of α is finite, only finitely many points of E ( K )can
maptoapointwithagiven x -coordinate. Therefore, either p ( x )or q ( x )isnot
constant. If p and q are two nonconstant polynomials, then there is at most
one constant a such that p−aq is constant (if a is another such number, then
( a −a ) q =( p−aq ) − ( p−a q )isconstantand( a −a ) p = a ( p−aq ) −a ( p−a q )
is constant, which implies that p and q are constant). Therefore, there are at
most two points, ( a, b )and( a, −b )forsome b , that are not in the image of
α .Let( a 1 ,b 1 ) be any other point. Then α ( P 1 )=( a 1 ,b 1 )forsome P 1 .We
can choose ( a 1 ,b 1 ) such that ( a 1 ,b 1 )+( a, b ) =( a, ± b ), so there exists P 2 with

α ( P 2 )=( a 1 ,b 1 )+( a, b ). Then α ( P 2 − P 1 )=( a, b ), and α ( P 1 − P 2 )=( a, − b ).

Therefore, α is surjective.

For later applications, we need a convenient criterion for separability. If
( x, y ) is a variable point on y 2 = x 3 + Ax + B , then we can differentiate y

with respect to x :

2 yy =3 x 2 + A.

Similarly, we can differentiate a rational function f ( x, y ) with respect to x :

d

dx f ( x, y )= f x ( x, y )+ f y ( x, y ) y ,

where f x and f y denote the partial derivatives.