Proving Symmetry

Proposition 1   Let $p\geq 5$ be a prime number. For every elliptic curve $C$ defined over $\ensuremath{\mathbb{Z}}_p$ there is another elliptic curve $C'$ defined over $\ensuremath{\mathbb{Z}}_p$ such that $\char93 C(\ensuremath{\mathbb{Z}}_p) + \char93 C'(\ensuremath{\mathbb{Z}}_p) = 2(p+1)$.

Notice that Proposition 1 proves the symmetry because the numbers of points of $C(\ensuremath{\mathbb{Z}}_p)$ and $C'(\ensuremath{\mathbb{Z}}_p)$ are symmetric with respect to $p+1$.

Proof. Our first step is to give a formula for $\char93 C(\ensuremath{\mathbb{Z}}_p)$. The idea is very simple: using the expression (1) for $C$, for each possible value of $x\in \ensuremath{\mathbb{Z}}_p$, there are three possibilities:

1. $x^3+bx+c=0$, in which case $x$ produces a single point, $(x,0)$, on $C(\ensuremath{\mathbb{Z}}_p)$;
2. $x^3+bx+c$ is a square in $\ensuremath{\mathbb{Z}}_p$, in which case $x$ produces two points on $C(\ensuremath{\mathbb{Z}}_p)$: $(x,y_1)$ and $(x,y_2)$, where $y_1$ and $y_2$ are the two square roots of $x^3+bx+c$ in $\ensuremath{\mathbb{Z}}_p$;
3. $x^3+bx+c$ is not a square in $\ensuremath{\mathbb{Z}}_p$, in which case $x$ produces no point on $C(\ensuremath{\mathbb{Z}}_p)$.

Additionally, we have to count the point at infinity (the zero in the group), ${\mathcal O}$.

Using the Legendre symbol

$$\left( \frac{{a}}{{p}} \right) = \begin{cases}1 \text{, if } a \t... ...text{, if } a \text{ is not a square in } \ensuremath{\mathbb{Z}}_p \end{cases}$$

we can write

$$\char93 C(\ensuremath{\mathbb{Z}}_p) = 1 + \sum_{x\in \ensuremath{\mathbb{Z}}_p} \left(1+\left( \frac{{x^3+bx+c}}{{p}} \right) \right).$$

Fix a non-square number $k\in \ensuremath{\mathbb{Z}}_p$. Next, for the given curve $C$ we define the elliptic curve $C'$:

$$C': k\cdot y^2 = x^3+bx+c y^2 = x^3 + k^2 b + k^3 c.$$

It is immediate that $C'$ is an elliptic curve defined over $\ensuremath{\mathbb{Z}}_p$.

Similarly to what we did above we can count the points on $C'$ as follows. For each $x$ in $\ensuremath{\mathbb{Z}}_p$ there are three possibilities --here we will use the expression $k\cdot y^2 = x^3+bx+c$ for $C'$--:

1. $x^3+bx+c=0$, in which case $x$ produces a single point on $C(\ensuremath{\mathbb{Z}}_p)$;
2. $x^3+bx+c$ is a square in $\ensuremath{\mathbb{Z}}_p$, in which case $x$ produces no points on $C(\ensuremath{\mathbb{Z}}_p)$, since otherwise $k$ would be a square in $\ensuremath{\mathbb{Z}}_p$;
3. $x^3+bx+c$ is not a square in $\ensuremath{\mathbb{Z}}_p$, in which case $k^{-1} \cdot (x^3+bx+c)$ is a square³ and it has two square roots $y_1$, $y_2$ so that $x$ contributes the two points $(x,y_1)$ and $(x,y_2)$.

We can rewrite these conditions using the Legendre symbol:

$$\char93 C'(\ensuremath{\mathbb{Z}}_p) = 1 + \sum_{x\in \ensuremath{\mathbb{Z}}_p} \left(1-\left( \frac{{x^3+bx+c}}{{p}} \right) \right).$$

All together, we have

$$\begin{split}\char93 C(\ensuremath{\mathbb{Z}}_p) + \char93 C... ...2 \sum_{x\in \ensuremath{\mathbb{Z}}_p} 1 = 2 + 2p, \end{split}$$

as wanted. $\qedsymbol$

Notice that in the previous Proposition we can replace $p$ by $q=p^r$ with $r\in\ensuremath{\mathbb{N}}$ and so obtain, with the same proof, the following result.

Proposition 2   Let $q=p^r$ with $p\geq 5$ prime and $r\in\ensuremath{\mathbb{N}}$. For every elliptic curve $C$ defined over $\ensuremath{\mathbb{Z}}_q$ there is another elliptic curve $C'$ defined over $\ensuremath{\mathbb{Z}}_q$ such that $\char93 C(\ensuremath{\mathbb{Z}}_q) + \char93 C'(\ensuremath{\mathbb{Z}}_q) = 2(q+1)$.

That is, the symmetry holds over arbitrary finite fields.