An isogeny is a structure-preserving map between elliptic curves that respects the group law and has finite kernel. It is neither an arbitrary rational map nor merely a change of coordinates. The kernel determines much of the map, the degree measures its algebraic size, and Vélu’s formulas make separable isogenies explicit when the kernel points are known.
Over finite fields, isogenies organise elliptic curves into graphs. Vertices represent curve isomorphism classes or j-invariants; edges represent low-degree isogenies. This graph viewpoint links point counting, endomorphism rings, complex multiplication and modern algorithmic arithmetic.
This is Guide 35 in the Bukit Timah Tutor Computational Number Theory series. It follows Guide 34: SEA, where Elkies primes appeared through rational ℓ-isogenies.
1. Definition
An isogeny
φ:E→E'
is a nonconstant morphism of elliptic curves that sends the identity O to O.
It automatically becomes a group homomorphism:
φ(P+Q)=φ(P)+φ(Q).
The kernel
ker φ={P in E : φ(P)=O}
is finite.
2. Degree and separability
The degree of an isogeny is the degree of the induced extension of function fields.
For a separable isogeny,
deg φ = #ker φ.
In characteristic p, inseparable maps such as Frobenius require separate care because degree can exceed the number of geometric kernel points.
3. Kernel determines a separable isogeny
Given a finite subgroup G of E over an algebraic closure, there is—up to target isomorphism—a separable isogeny
φ:E→E/G
with kernel G.
This is the computational starting point for Vélu’s formulas: supply the curve and a finite kernel subgroup; obtain the quotient curve and explicit rational map.
4. A special 2-isogeny family
Consider
E: y²=x³+a x²+b x.
The point
T=(0,0)
has order two because T=−T.
The subgroup
G={O,T}
therefore defines a separable 2-isogeny when the characteristic is not two and the curve is nonsingular.
5. Explicit quotient curve
For this family, one quotient curve is
E': y²=x³−2a x²+(a²−4b)x.
An explicit isogeny away from x=0 is
x' = x + b/x, y' = y(1−b/x²).
The kernel point x=0 is sent to O, as required.
This compact formula is a special case of the general kernel-sum philosophy behind Vélu’s formulas.
6. Worked example over F101
Take
E: y²=x³−x
over F101.
This has a=0,b=−1, so T=(0,0) is a rational 2-torsion point.
The quotient curve is
E': y²=x³+4x.
The isogeny is
x' = x−1/x, y' = y(1+1/x²).
7. Verify a source point
Take
P=(2,39).
Check E:
39²=1521≡6 (mod101), 2³−2=6.
So P lies on E.
8. Apply the isogeny
Modulo101,
2^−1=51.
Therefore
x' =2−51≡52.
Also
2²=4, 4^−1=76, 1+4^−1=77.
Hence
y'=39·77≡74.
Thus
φ(2,39)=(52,74).
9. Verify the image point
On E’:
74²≡22 (mod101).
And
52³+4·52≡22 (mod101).
Therefore the image lies on E’.
This direct substitution is an essential verification step for any explicit isogeny formula.
10. The kernel point
The affine formula contains division by x, so it is not evaluated directly at x=0.
The rational map extends to the elliptic curve by defining
φ(O)=O, φ(0,0)=O.
Thus
ker φ={O,(0,0)}
and the degree is two.
11. Isogenous curves have the same finite-field point count
If two elliptic curves over F_q are isogenous over F_q, they have the same Frobenius characteristic polynomial and therefore the same number of F_q-rational points.
For the worked example, direct counting gives
#E(F101)=104, #E'(F101)=104.
The common trace is
t=101+1−104=−2.
12. Tate’s theorem viewpoint
For elliptic curves over a finite field, having the same number of F_q-rational points is equivalent to being F_q-isogenous.
More conceptually, the Frobenius characteristic polynomial determines the finite-field isogeny class.
Point counting therefore partitions elliptic curves into isogeny classes before any explicit isogeny path is constructed.
13. Vélu’s general idea
Let G be a finite subgroup of E.
Vélu constructs coordinate corrections by summing the displacement caused by translating a generic point P by every nonzero Q in G.
Schematically,
x'(P)=x(P)+Σ_(Q∈G\{O}) [x(P+Q)−x(Q)]
with a corresponding y-coordinate expression.
The sums simplify to rational functions and produce both the quotient map and new curve coefficients.
14. Why kernel sums are natural
If P is replaced by P+R for R in G, the set
{P+R+Q : Q∈G}
is merely a permutation of
{P+Q : Q∈G}.
Kernel-symmetric sums are therefore constant on cosets P+G.
That is exactly what a quotient map E→E/G should do: identify points differing by kernel elements.
15. Cyclic ℓ-isogenies
If G is cyclic of prime order ℓ, the quotient map has degree ℓ.
For an Elkies prime in SEA, one Frobenius-stable cyclic subgroup of E[ℓ] is defined over the base field as a subgroup scheme, and the corresponding ℓ-isogeny leads to an isogenous curve over F_q.
Thus SEA’s kernel polynomials are compressed descriptions of isogeny kernels.
16. Modular polynomials revisited
The modular polynomial Φ_ℓ(X,Y) satisfies
Φ_ℓ(j(E),j(E'))=0
when E and E’ are linked by a cyclic ℓ-isogeny, subject to the usual characteristic qualifications.
A root in Y therefore gives a neighbouring j-invariant in the ℓ-isogeny graph.
17. Isogeny graphs
Fix q and ℓ≠char(F_q).
Construct a graph whose vertices are elliptic-curve j-invariants over F_q and whose edges connect pairs linked by ℓ-isogenies.
The graph reflects endomorphism-ring structure. Ordinary and supersingular curves produce strikingly different graph geometries.
18. Ordinary volcanoes
For ordinary elliptic curves, low-degree isogeny components often have a volcano structure.
The horizontal rim corresponds to curves with the same endomorphism order at the chosen ℓ-adic level. Descending edges move to curves with smaller endomorphism orders; ascending edges reverse that move.
Volcano navigation is useful in endomorphism-ring computation, point counting and CM algorithms.
19. Supersingular isogeny graphs
Supersingular ℓ-isogeny graphs over suitable finite fields are highly connected and approximately regular.
Their endomorphism algebras are quaternionic rather than imaginary quadratic.
This changes both graph geometry and algorithmic behaviour. Ordinary-volcano intuition should not be transferred directly to the supersingular case.
20. Dual isogeny
For a separable isogeny
φ:E→E'
of degree m, there is a dual isogeny
φ̂:E'→E
such that
φ̂∘φ=[m]
and
φ∘φ̂=[m]
on the respective curves.
This makes isogenies reversible up to multiplication-by-m.
21. Degree multiplication
If
E→E'→E''
are isogenies φ and ψ, then
deg(ψ∘φ)=deg ψ · deg φ.
Long isogeny walks can therefore be represented as compositions of small-degree maps rather than one huge rational map.
22. Endomorphisms are self-isogenies
An endomorphism is an isogeny from E to itself, together with the zero map if one works in the full endomorphism ring.
Ordinary elliptic curves over finite fields have endomorphism rings that are orders in imaginary quadratic fields. Frobenius itself belongs to that ring.
This is the bridge to complex multiplication in Guide36.
23. Isogeny invariants and non-invariants
Isogenous curves over F_q share:
Frobenius trace point count over every finite extension zeta function.
They need not share:
j-invariant curve coefficients rational torsion presentation endomorphism order within the same isogeny class.
An isogeny preserves the arithmetic class while changing the curve model.
24. Kernel validation
Before applying Vélu, verify that the proposed kernel points really form a subgroup.
For a cyclic kernel generated by P of order m, check
[m]P=O
and that no proper divisor of m kills P.
Then enumerate
G={O,P,[2]P,...,[m−1]P}.
25. Computational representation
Small kernels can be stored as explicit points.
Larger kernels are better represented by a kernel polynomial whose roots are x-coordinates of nonzero kernel points modulo sign.
This reduces memory and permits symbolic Vélu-style formulas without enumerating points in large extension fields.
26. Verification receipts
For an explicit isogeny, retain:
source and target curve kernel description map formulas kernel-point images sample nonkernel image checks degree point-count / Frobenius consistency.
For a graph edge, retain the modular-polynomial identity or explicit kernel map establishing the edge.
27. Common mistakes
1. Treating any rational map as an isogeny. 2. Forgetting O must map to O. 3. Using #ker=degree for inseparable maps without qualification. 4. Evaluating an affine formula directly at a kernel pole.
5. Assuming same j means isogenous only; same j actually means isomorphic over an algebraic closure. 6. Assuming isogenous curves must have the same coefficients. 7. Confusing the kernel polynomial with the modular polynomial. 8. Importing ordinary volcano structure into supersingular graphs.
28. Practice set
1. Define an isogeny. 2. What is the degree/kernel relation for separable isogenies? 3. Why is (0,0) 2-torsion on y²=x³+ax²+bx? 4. State the 2-isogenous curve.
5. State the explicit map. 6. Verify (2,39) lies on y²=x³−x mod101. 7. Compute its image. 8. Verify the image lies on y²=x³+4x.
9. State the point counts of the worked curves. 10. What does Φ_ℓ encode? 11. What is a dual isogeny? 12. What geometric structure often appears in ordinary ℓ-isogeny graphs?
29. Answers
1. A nonconstant elliptic-curve morphism sending O to O. 2. degφ=#kerφ. 3. Its negative equals itself because y=0. 4. y²=x³−2ax²+(a²−4b)x.
5. x’=x+b/x and y’=y(1−b/x²) away from the kernel. 6. Both sides equal6. 7. (52,74). 8. Both sides equal22 mod101.
9. Both have104 points. 10. j-invariants connected by cyclic ℓ-isogenies. 11. An isogeny back whose composition with φ is multiplication by degφ. 12. An isogeny volcano.
Sources and further study
René Vélu’s formulas give explicit quotient curves and isogenies from finite kernels. For practical computation, modern elliptic-curve references and systems such as SageMath provide kernel-polynomial and isogeny routines. René Schoof’s point-counting survey explains how isogenies enter the Elkies improvements to point counting.
Continue through Batch 09
Return to Guide 34. Continue to Guide 36: Complex Multiplication, Hilbert Class Polynomials and CM Curve Construction.