The Weil Pairing

A nice thing about elliptic curves is the wealth of information which is tied up in the isomorphism class of the group. Over the complex numbers, every elliptic curve is $\mathbf{C}/\Lambda$ where $\Lambda$ is a lattice of rank 2 contained in the complex numbers. The Mordell-Weil Theorem tells us that when we restrict to a number field we get a finitely generated abelian group.  The Birch and Swinnerton-Dyer conjecture tells us how important the rank is and today we get a glimpse of what the torsion can tell us. The Weil Pairing is a canonical identification of $\bigwedge^2 E[m]$ with the $m$-th roots of unity (here we work over a field of characteristic not dividing $m$).We begin with a lemma concerning rational functions on an elliptic curve.

Lemma: A divisor $D = \sum_P n_P P$ is $div(f)$ for some rational function $f$ if and only if $\sum_P n_P=0$(i.e.  $\deg(D) = 0$) and in elliptic curve addition, $\sum_P [n_P]P = O$ (i.e. $\sigma([D]) = O$ where $\sigma : Pic^0(E) \stackrel{\sim}{\to}E$ and $[D]$ denotes the class of $D$ in $Pic^0(E)$.)

The reason is, if $f$ is a rational function, $\deg(div(f)) =0$ and $[div(f)] = [0]$ so $\sigma[0] = O$. On the other hand if $\deg(D) = 0$ then it makes sense to speak of $[D]\in Pic^0(E)$. If $\sigma([D]) = O$ then $[D] = [0]$ so there is some rational function $f$ for which $D = div(f)$.

We need this to say that if $Q\in E[m]$  there is some rational function $f_Q$ such that $div(f_Q) = m(Q - O) = mQ - mO$. Consider $f_Q\circ [m]$. Since $f_Q$ is only zero at $Q$ and will have multiplicity $m$ at each point, the divisor of zeros is $m([m]^*Q)$ and likewise the divisor of poles is $m([m]^*O)$. This is to say that $div(f_Q\circ [m]) = m[m]^*(Q-O)$.

Note that $f_Q\circ [m]$ is constant on the addition of any element of $E[m]$. Thus if $R$ is any element of $E[m]$ then $\frac{f_Q\circ[m]( X +R)}{f_Q\circ [m] (X)} = 1$ for any $X \in E$. We now show the $m$-th root of $f_Q\circ [m]$ is a rational function.

Consider $[m]^*(Q-O) = [m]^*Q - [m]^*O = [m]^*Q - \sum_{P\in E[m]} P$. Meanwhile we know that unless $[m]$ is a inseparable map(i.e. when the characteristic of $k$ does not divide $m$, for which I still need to give a proof) then $deg([m]^*D) = m^2 deg(D)$ and $\# E[m] = m^2$. Thus if $[m]Q' = Q$ then $[m]^{-1}(Q) = \{ Q' \oplus P: P \in E[m]\}$(we use $\oplus$ to make clear that this is the chord and tangent addition in $E$) and so $[m]^*Q = \sum_{P\in E[m]} Q' \oplus P$. Thus $[m]^*(Q-O) = \sum_{P\in E[m]} Q' \oplus P - P$.

Now consider for any $P \in E[m]$, the divisor $Q' \oplus P - P$. Clearly it has degree zero, but in the addition law, it is not $O$ but $Q'$, so we subtract $Q'$ and add $O$ to get something of degree zero which adds up to $O$. So by our lemma, there is a rational function $f$ such that $div(f) = Q'\oplus P - P -Q' + O$, so $[m]^*(Q-O) = \sum_{P\in E[m]} Q' - O = m^2 Q' - m^2 O$. Then since $[m]^2Q' = [m][m]Q' = [m]Q = O$, there is a rational function $g_Q$ such that $div(g_Q^m) = div(f_Q\circ [m])$.

Definition: The Weil Pairing $e_m(R,Q) := \frac{g_Q(X + R)}{g_Q(X)}$ for some $X\in E$.

We have already shown that $e_m(R,Q)^m = 1$ since $f_Q(X + R) = f_Q(X)$. Thus it is a map $E[m]\times E[m] \to \mu_m$. Moreover, $e_m$ is

• alternating ($e_m(Q,Q) = 1$ so by bilinearity, $e_m(R,Q) = e_m(Q,R)^{-1}$)
• bilinear($e_m(Q+R,S+T) = e_m(Q,S)e_m(Q,T)e_m(R,S)e_m(R,T)$)
• nondegenerate(if $e_m(R,Q) = 1$ for all $R\in E[m]$ then $R=O$)
• Galois invariant(if $s \in Gal(\overline{k}/k)$ then $s(e_m(R,Q)) = e_m(s(R),s(Q))$
• Surjective, (there exist $Q,R\in E[m]$ such that $e_m(Q,R)$ is a primitive $m$-th root of unity)

These properties alone are enough to show that $e_m$ induces an isomorphism of Galois modules $E[m] \wedge E[m] \to \mu_m$ and thus if $E[m]$ is $k$-rational, then so is $\mu_m$.

There is also a corresponding pairing for an abelian variety $A$, where we match $A[m]$ with $A^\vee[m] : = \{ L \in A^\vee | L^{\otimes m} \cong \mathcal{O}$, the $m$-torsion line bundles (which, since every abelian variety is smooth could just be thought of in terms of Weil Divisors). The proof that such a pairing exists, instead of relying on the extensive knowledge we have about $E[m]$, must instead come from a homomorphism $End(A) \to End(A^\vee)$, wherein we show that if $L \in A^\vee = Pic^0(A)$ then $[m]^*L \cong L^{\otimes m}$ (corresponding in Divisors to $mD$ linearly equivalent to $[m]^*D$).

Tune in next time when we talk about Modular Curves and the geometric role that modular forms play.

Oh yes. The point is that $g_Q(X + R) = g_Q(X)$ for any $X \in E$, and we can see that because they have the same divisor as functions of $X$.