EXPLICIT n-DESCENT ON ELLIPTIC CURVES I. ALGEBRA

J.E. CREMONA, T.A. FISHER, C. O’NEIL, D. SIMON, AND M. STOLL

Abstract. This is the first in a series of papers in which we study the n-Selmer group of an elliptic curve, with the aim of representing its elements as genus one normal curves of degree n. The methods we describe are practical in the case n = 3 for elliptic curves over the rationals, and have been implemented in MAGMA .

Introduction

Descent on an elliptic curve E, defined over a number field K, is a method for obtaining information about both the Mordell-Weil group E(K) and the Tate-Shafarevich group � (E/K). Indeed for each integer n ≥ 2 there is an exact sequence

0 → E(K)/nE(K) → Sel^{(n)}(E/K) → � (E/K)[n] → 0

where Sel^{(n)}(E/K) is the n-Selmer group.

This is the first in a series of papers in which we study the n-Selmer group with the aim of representing its elements as genus one normal curves C ⊂ ℙ^{n−1} (when n ≥ 3). Having this representation allows searching for rational points on C (which in turn gives points in E(K), since C may be seen as an n-covering of E) and is a first step towards doing higher descents. A further application is to the study of explicit counter-examples to the Hasse Principle.

In this introduction we discuss our approach to the problem and set out the goals of our work. Following some historical remarks, we will outline the contents of this first paper, and then briefly that of the remaining papers in the series.

The method of descent, for explicitly determining the solutions of Diophantine Equations, has a long and distinguished history going back (at least) to Fermat. As a tool for the determination of the Mordell-Weil groups of elliptic curves over number fields, descent has been used since the very first applications of computing to number theory. Until the 1990s, the only methods which had been implemented for general elliptic curves were based on 2-descent and could be applied only to elliptic curves defined over ℚ, though of course individual examples had been worked out over other fields. The advent of higher-level computer algebra software and the development of efficient algorithms for handling the arithmetic of more general number fields has meant that 2-descent can now be carried out over general number fields (of moderate degree and discriminant, for practical reasons). We may cite both Simon’s gp program ell.gp (see [17]), and the MAGMA package written primarily by Bruin, as examples of this which are widely used.

Date: 1st March 2006.

The situation regarding so-called higher descents, meaning n-descent for n > 2, has until now been much more fragmentary and less satisfactory. Some 3-descents (for twists of Fermat curves) and certain other descents via isogeny have been studied systematically, but these apply only to special families and not to general elliptic curves (at least, not without an extension of the ground field, which introduces further complexities and complicates implementation significantly). Higher 2power descents (also known as second and third 2-descents) have been studied and implemented by Siksek [9] and Womack [19] for 4-descent, and by Stamminger [18] for 8-descent.

In the case of 2-descent, the map C → ℙ^{1} is a double cover rather than an embedding, and the elements of Sel^{(2)}(E/K) are represented as curves of the form Y^{2} = g(X) where g is a quartic. Our goal is to be equally explicit for all n > 2. The methods we present are fully worked out for all odd prime n, and have been implemented in MAGMA [8] in the case n = 3 for elliptic curves over ℚ. This implementation will be included in MAGMA version 2.13, to be released later this year.

To avoid making assumptions about the Galois module structure of E[n], we work with the étale algebra R of E[n]. This is a K-algebra of dimension n^{2}, explicitly realised as a product of number fields. The starting point for our work is the paper of Schaefer and Stoll [14], which improves on earlier methods in [5]. They show that if n is prime then a certain group homomorphism

w_{1} : H^{1}(K, E[n]) → R^{×}/(R^{×})^{n}

is injective, and determine its image. This is the basis of an algorithm for computing Sel^{(n)}(E/K) as a subgroup of R^{×}/(R^{×})^{n}. (In fact they assume that n is odd, since the case n = 2 was already well known.) The algorithm requires knowledge of the class group and unit group of each constituent field of R.

In §3 we replace w_{1} by a group homomorphism

w_{2} : H^{1}(K, E[n]) → (R ⊗ R)^{×}/∂R^{×}

EXPLICIT n-DESCENT ON ELLIPTIC CURVES 3

where ∂ : R^{×} → (R ⊗ R)^{×} is a certain map. We show that w_{2} is injective for all n ≥ 2 and determine its image. If n is prime then it is possible to convert the subgroup of R^{×}/(R^{×})^{n} computed by Schaefer and Stoll to a subgroup of (R ⊗ R)^{×}/∂R^{×}. Since R ⊗ R is the étale algebra of E[n] × E[n], it is again a product of number fields. In principle one could compute the n-Selmer group directly as a subgroup of (R ⊗ R)^{×}/∂R^{×}, but this would require knowledge of the class group and unit group of each constituent field of R ⊗ R, and in general these fields have larger degree than those appearing in R.

Our goal is now the following. We must convert elements of Sel^{(n)}(E/K) represented algebraically by ρ ∈ (R ⊗ R)^{×}, to elements of Sel^{(n)}(E/K) represented geometrically by (equations for) genus one normal curves C ⊂ ℙ^{n−1}. We present three algorithms for performing this conversion, the second and third of which apply for arbitrary n ≥ 2. In particular we have no need to assume that n is prime. In the case n = 2 our third algorithm reduces to the classical number field method for 2-descent. Nevertheless we assume for ease of exposition that n ≥ 3.

We give a brief description of each algorithm.

The Hesse pencil method. We determine n × n matrices (with entries in an extension of K) that represent the action of E[n] on C ⊂ ℙ^{n−1}. At least in the case n = 3 it is then practical to recover an equation for C.

The flex algebra method. We embed E ⊂ ℙ^{n−1} via the complete linear system |n.0| where 0 is the identity on E. We then determine a change of co-ordinates (defined over an extension of K) that takes E ⊂ ℙ^{n−1} to C ⊂ ℙ^{n−1}. We use this change of co-ordinates to compute equations for C.

The Segre embedding method. We determine equations for C as a curve of degree n^{2} in the rank 1 locus of ℙ(Mat_{n}). Thus C lies in the image of the Segre embedding

ℙ^{n−1} × (ℙ^{n−1})^{∨} → ℙ(Mat_{n}).

We pull back to ℙ^{n−1} × (ℙ^{n−1})^{∨} and then project onto the first factor to get C ⊂ ℙ^{n−1}.

It is important to realise that not every element of H^{1}(K, E[n]) can be represented by a genus one normal curve C ⊂ ℙ^{n−1}. Those elements of H^{1}(K, E[n]) that can be represented in this way form the “kernel” of the obstruction map

Ob : H^{1}(K, E[n]) → Br(K)

where Br(K) is the Brauer group of K. The reader is warned that in general the obstruction map is not a group homomorphism, and its kernel is not a group.

In fact each of our algorithms works over an arbitrary field K (assumed perfect and with char(K) ∤ n) provided we make the following hypotheses:

• We start with an element ρ ∈ (R ⊗ R)^{×} that represents an element of H^{1}(K, E[n]) with trivial obstruction.

• We have access to a “Black Box” that, given structure constants for a K-algebra known to be isomorphic to Mat_{n}(K), finds such an isomorphism explicitly.

Returning to the case K a number field, it follows by the commutativity of the diagram

\xymatrix{H^{1}(K, E[n]) \ar[r]^{Ob} \ar[d] & Br(K) \ar[d] \\ ∏_{v} H^{1}(K_{v}, E[n]) \ar[r]^{_{∏_{v} Ob_{v}}} & ∏_{v} Br(K_{v})}

and the injectivity of the right hand map, that an element of H^{1}(K, E[n]) has trivial obstruction if and only if it has trivial obstruction everywhere locally. We deduce that Sel^{(n)}(E/K) is contained in the kernel of the obstruction map. In our algorithms it then becomes necessary to use an explicit version of the local-to-global principle for the Brauer group. This role is played by the Black Box. An essentially equivalent problem is that of finding a rational point on a Brauer-Severi variety of dimension n − 1. In the case n = 2 this means finding a rational point on a conic, a task which we recognise as one of the steps in the classical number field method for 2-descent, cf. [2], §15.

We present our work in a series of papers, of which this is the first. We briefly summarise the contents of each.

Paper I: Algebra. We work over a perfect field K with char(K) ∤ n. We give a list of interpretations of the Galois cohomology group H^{1}(K, E[n]), and explore the relationships between them. Then we go through several different descriptions of the obstruction map and check that they are all equivalent. In §3 we introduce the étale algebra R of E[n] and define the maps w_{1} and w_{2}. In §4 we explain how the element ρ ∈ (R ⊗ R)^{×} may be used to construct certain K-algebras. We end by outlining each of our three algorithms, assuming in each case the existence of a suitable Black Box.

Paper II: Geometry. We give further details of the Segre embedding method. We represent elements of H^{1}(K, E[n]) by Brauer-Severi diagrams [C → S]. The obstruction in Br(K) is represented both by the Brauer-Severi variety S (of dimension n−1) and by the obstruction algebra A (a central simple algebra over K of dimension n^{2}). We specify certain embeddings

C → S × S^{∨} → ℙ(A)

where S^{∨} is the dual of S. Then starting from ρ ∈ (R ⊗ R)^{×} we explain how to write down both structure constants for A, and equations for C as a curve in ℙ(A). If the obstruction is trivial then there are isomorphisms S ≅ ℙ^{n−1} and A ≅ Mat_{n}(K). We recover C ⊂ ℙ^{n−1} by pulling back the image of C in ℙ(Mat_{n}) to ℙ^{n−1} × (ℙ^{n−1})^{∨} and then projecting onto the first factor.

Paper III: Algorithms. We work over a number field K and assume that n is prime. We briefly recall how to compute Sel^{(n)}(E/K) first as a subgroup of R^{×}/(R^{×})^{n} and then as a subgroup of (R ⊗ R)^{×}/∂R^{×}. Then we give further practical details of our algorithms for converting ρ ∈ (R ⊗ R)^{×} to C ⊂ ℙ^{n−1}, concentrating on the Segre embedding method in the case n = 3. We also describe the methods we use for the Black Box, including one that is practical in the case K = ℚ and n = 3. We illustrate our work with numerical examples.

1. Interpretations of H^{1}(K, E[n])

Let E be an elliptic curve defined over a perfect field K. We write G_{K} = Gal(\overline{K}/K), where \overline{K} is the algebraic closure of K, and H^{i}(K, −) for the Galois cohomology group (or set) H^{i}(G_{K}, −). Let n ≥ 2 be an integer with char(K) ∤ n. Taking Galois cohomology of the exact sequence

0 ⟶ E[n] ⟶ E ⟶^{n} E ⟶ 0

we obtain the Kummer exact sequence

… → E(K) → H^{1}(K, E[n]) → H^{1}(K, E) → ….

We discuss how to represent elements of these groups. For the group on the left this is straight forward: we fix a Weierstrass equation for E and specify points in E(K) by writing down their co-ordinates.

To interpret the other two groups we call upon the general principle that the twists of an object X (defined over K) are parametrised by H^{1}(K, Aut(X)) where Aut(X) is the automorphism group of X. More precisely if Y is another object defined over K, and ϕ : Y → X is an isomorphism defined over \overline{K}, then associating to Y the cocycle ξ_{σ} = σ(ϕ)ϕ^{−1}, determines an injective map from the K-isomorphism classes of twists to H^{1}(K, Aut(X)). We claim that in each of our applications this map is also surjective. Indeed if X is a quasi-projective K-variety, then the surjectivity follows by Galois descent: see [15], Chap. V, Cor. 2 to Prop. 12. In general X will be a quasi-projective K-variety X_{0} equipped with certain “additional structure”. Thus Aut(X) ⊂ Aut(X_{0}). To construct the twist of X by ξ ∈ H^{1}(K, Aut(X)) we first take the twist Y_{0} of X_{0} by ξ and then use the isomorphism ϕ : Y_{0} → X_{0} with σ(ϕ)ϕ^{−1} = ξ_{σ} to transfer the additional structure on X_{0} to Y_{0}. A routine calculation shows that the additional structure on Y_{0} is Galois invariant, and so defined over K. We recall that if Aut(X) is abelian then H^{1}(K, Aut(X)) is an abelian group; otherwise, it is a pointed set with the class of X as its distinguished element.

The prototype example is that of a torsor or principal homogeneous space under E. In §1.4 we will also consider torsors under E[n].

Definition 1.1. (i) A torsor under E is a pair (C, μ) where C is a smooth projective curve of genus one (defined over K) and μ : E×C → C is a morphism (defined over K) that induces a simple transitive action on \overline{K}-points. (ii) An isomorphism of torsors (C_{1}, μ_{1}) ≅ (C_{2}, μ_{2}) is an isomorphism of curves C_{1} ≅ C_{2} that respects the action of E.

The trivial torsor is (E, +) where + : E × E → E is the group law.

Lemma 1.2. Every torsor under E is a twist of (E, +).

Proof: More generally we note that if (C, μ) is a torsor under E and P_{0} ∈ C(\overline{K}) then (E, +) ≅ (C, μ) ; P ↦ μ(P, P_{0}) is an isomorphism of torsors defined over K(P_{0}). □

Lemma 1.3. Aut(E, +) ≅ E.

Proof: The automorphisms of E, as a torsor under itself, are the automorphisms of E, as a curve, that commute with all translation maps. The only such automorphisms are the translation maps themselves. □

By the twisting principle we obtain

Proposition 1.4. The torsors under E, viewed as twists of (E, +), are parametrised up to isomorphism by H^{1}(K, E).

With this geometric interpretation, the group H^{1}(K, E) is called the Weil-Châtelet group WC(E/K).

Remark 1.5. By a standard abuse of notation we refer to a torsor as C rather than (C, μ). The only ambiguity in the choice of μ comes from the automorphisms of E as an elliptic curve. If j(E) ≠ 0, 1728 these are just {±1}, so C will have at most two possible structures of torsor under E. The two structures coincide when either one has order dividing 2 in H^{1}(K, E).

We have prepared the following list of interpretations of the group H^{1}(K, E[n]). Some are already well known, but others less so. The elliptic curve E/K and integer n ≥ 2 remain fixed throughout.

base object twisted object
1. Torsor divisor class pairs  (E, [n.0]) (C, [D])
2. n-coverings (E, [n]) (C, π)
3. Brauer-Severi diagrams  [E → ℙ^{n−1}] [C → S]
4. E[n]-torsors  (E[n], +) (Φ, μ)
5. Comm. extns. of E[n] by 𝔾_{m} 𝔾_{m} × E[n] Λ
6. Theta groups  Θ_{E}  Θ.

Each of these interpretations appears frequently in our work (except for the fourth, which is required only for the flex algebra method). The first three interpretations depend on the elliptic curve E in an essential way: indeed E may be recovered as the Jacobian of C. The fourth and fifth interpretations depend only on E[n] as a Galois module equipped with the Weil paring. If n is odd then, by Lemma 3.11, the same is true of the sixth interpretation. We now go through each of the six interpretations in turn.

1.1. First interpretation: Torsor divisor class pairs.

Definition 1.6. (i) A torsor divisor class pair (C, [D]) is a torsor C under E together with a K-rational divisor class [D] on C of degree n. The rationality means that D is linearly equivalent, but not necessarily equal, to all its Galois conjugates. (ii) An isomorphism of torsor divisor class pairs (C_{1}, [D_{1}]) ≅ (C_{2}, [D_{2}]) is an isomorphism of torsors ϕ : C_{1} ≅ C_{2} with ϕ^{∗}D_{2} ∼ D_{1}.

The trivial (or base) torsor divisor class pair is (E, [n.0]) where 0 is the identity on E. We recall that two divisors on an elliptic curve are linearly equivalent if and only if they have the same degree and the same sum.

Lemma 1.7. Every torsor divisor class pair is a twist of (E, [n.0]).

Proof: Let (C, [D]) be a torsor divisor class pair. We choose an isomorphism of torsors ϕ : C ≅ E defined over \overline{K}. We then compose with a translation so that ϕ^{∗}(n.0) ∼ D. □

Lemma 1.8. Aut(E, [n.0]) ≅ E[n].

Proof: The automorphisms of E as a torsor under itself are the translation maps τ_{P} for P ∈ E. It suffices to note that τ_{P}^{∗}(n.0) ∼ n.0 if and only if P ∈ E[n]. □

By the twisting principle we obtain

Proposition 1.9. The torsor divisor class pairs, viewed as twists of (E, [n.0]), are parametrised up to isomorphism by H^{1}(K, E[n]).

Remark 1.10. The maps in the Kummer exact sequence

E(K) ⟶^{δ} H^{1}(K, E[n]) ⟶^{ι} H^{1}(K, E)

are given by δ(P) = (E, [(n − 1).0 + P]) and ι(C, [D]) = C.

1.2. Second Interpretation: n-coverings.

Definition 1.11. (i) A covering of E is a pair (C, π) where C is a smooth projective curve and π : C → E is a non-constant morphism. (ii) An isomorphism of coverings (C_{1}, π_{1}) ≅ (C_{2}, π_{2}) is an isomorphism of curves ϕ : C_{1} ≅ C_{2} with π_{1} = π_{2} ∘ ϕ.

We write [n] for the multiplication-by-n map on E. The trivial (or base) n-covering of E is (E, [n]).

Definition 1.12. An n-covering (C, π) is a twist of (E, [n]).

Lemma 1.13. Aut(E, [n]) ≅ E[n].

Proof: Let ϕ : E → E be an automorphism of (E, [n]). Then we have [n] = [n] ∘ ϕ and so [n] ∘ (ϕ − 1) = 0. We deduce that ϕ − 1 is not surjective, and therefore constant. It follows that ϕ is translation by an n-torsion point. □

By the twisting principle we obtain

Proposition 1.14. The n-coverings of E are parametrised up to isomorphism by H^{1}(K, E[n]).

Remark 1.15. Given (C, [D]) a torsor divisor class pair, the corresponding n-covering is (C, π) where π : C → Pic^{0}(C) ≅ E is the map P ↦ [n.P − D]. Conversely, given an n-covering (C, π) there exists an isomorphism ϕ : C → E defined over \overline{K} making the diagram

\xymatrix{C \ar[dr]^{π} \ar[d]_{ϕ} \\ E \ar[r]_{[n]} & E}

commute. We give C the structure of torsor under E via

(P, Q) ↦ ϕ^{−1}(P + ϕ(Q)).

This definition is independent of the choice of ϕ. The corresponding torsor divisor class pair is (C, [ϕ^{∗}(n.0)]). The maps in the Kummer exact sequence

E(K) ⟶^{δ} H^{1}(K, E[n]) ⟶^{ι} H^{1}(K, E)

are given by δ(P) = (E, τ_{P} ∘ [n]) and ι(C, π) = C.

1.3. Third interpretation: Brauer-Severi diagrams.

Definition 1.16. (i) A diagram [C → S] is a morphism from a torsor C under E to a variety S. (ii) An isomorphism of diagrams [C_{1} → S_{1}] ≅ [C_{2} → S_{2}] is an isomorphism of torsors ϕ : C_{1} ≅ C_{2} together with an isomorphism of varieties ψ : S_{1} ≅ S_{2} making the diagram

\xymatrix{C_{1} \ar[r] \ar[d]_{ϕ} & S_{1} \ar[d]^{ψ} \\ C_{2} \ar[r] & S_{2}}

commute.

The trivial (or base) diagram [E → ℙ^{n−1}] is that determined by the complete linear system |n.0|. We recall that a twist of projective space is called a Brauer-Severi variety.

Definition 1.17. A Brauer-Severi diagram [C → S] is a twist of [E → ℙ^{n−1}]. In particular S is a Brauer-Severi variety.

Lemma 1.18. Aut[E → ℙ^{n−1}] ≅ E[n].

Proof: An automorphism ϕ of E extends to an automorphism of ℙ^{n−1} if and only if ϕ^{∗}(n.0) ∼ n.0. We are done by Lemma 1.8. □

By the twisting principle we obtain

Proposition 1.19. The Brauer-Severi diagrams are parametrised up to isomorphism by H^{1}(K, E[n]).

Remark 1.20. Given a torsor divisor class pair (C, [D]) the complete linear system |D| may be identified with the dual of a Brauer-Severi variety S. There is then a natural morphism C → S. Conversely, given a Brauer-Severi diagram [C → S] we have S ≅ ℙ^{n−1} over \overline{K}. We pull back the hyperplane section on ℙ^{n−1} to give a K-rational divisor class [D] on C.

If n ≥ 3 then the morphism C → ℙ^{n−1} determined by a complete linear system of degree n is an embedding. The image is called a genus one normal curve of degree n. In the case n = 3 we get a smooth plane cubic. The homogeneous ideal of a genus one normal curve of degree n ≥ 4 is generated by a vector space of quadrics of dimension n(n − 3)/2. The term “elliptic normal curve” is standard in the geometric literature, the word “normal” referring to the fact that the homogeneous co-ordinate ring is integrally closed. We say “genus one normal curve” since we do not wish to imply that our curves have rational points.

1.4. Fourth interpretation: E[n]-torsors.

Definition 1.21. (i) An E[n]-torsor is a pair (Φ, μ) where Φ is a zerodimensional variety and μ : E[n] × Φ → Φ is a morphism that induces a simple transitive action on \overline{K}-points. (ii) An isomorphism of E[n]-torsors (Φ_{1}, μ_{1}) ≅ (Φ_{2}, μ_{2}) is an isomorphism of varieties Φ_{1} ≅ Φ_{2} that respects the action of E[n].

The trivial E[n]-torsor is (E[n], +) where + is the restriction of the group law on E. In a manner entirely analogous to the proof of Proposition 1.4 we obtain

Proposition 1.22. The E[n]-torsors, viewed as twists of (E[n], +), are parametrised up to isomorphism by H^{1}(K, E[n]).

Remark 1.23. (i) Given a torsor divisor class pair (C, [D]) the corresponding E[n]-torsor is the set of “flex points”, i.e.

{P ∈ C : n.P ∼ D}.

(ii) An n-covering π : C → E determines an E[n]-torsor π^{−1}(0). (iii) The connecting map E(K) → H^{1}(K, E[n]) sends P ↦ [n]^{−1}(P).

Remark 1.24. Generically, the splitting field of Φ has Galois group the affine general linear group, AGL(2, n), which sits in an exact sequence

0 → (ℤ/nℤ)^{2} → AGL(2, n) → GL(2, n) → 0.

In the case n = 2 this reduces to the exact sequence 0 → V_{4} → S_{4} → S_{3} → 0, as studied in [3].

1.5. Fifth Interpretation: Commutative extensions of E[n] by 𝔾_{m}. The following definition is common to our fifth and sixth interpretations of H^{1}(K, E[n]).

Definition 1.25. (i) A central extension of E[n] by 𝔾_{m} is an exact sequence of group varieties

0 ⟶ 𝔾_{m} ⟶^{α} Λ ⟶^{β} E[n] ⟶ 0

with 𝔾_{m} contained in the centre of Λ. (ii) An isomorphism of central extensions Λ_{1} ≅ Λ_{2} is an isomorphism of group varieties ϕ : Λ_{1} ≅ Λ_{2} making the diagram

[figure: 0; 𝔾_{m}; α_{1}; Λ_{1}; β_{1}; ϕ; E[n]; 0; 0; 𝔾_{m}; α_{2}; Λ_{2}; β_{2}; E[n]; 0]

commute.

We usually refer to Λ as a central extension, the maps α and β being taken for granted. The trivial extension is Λ_{0} = 𝔾_{m} × E[n].

Lemma 1.26. Every commutative extension of E[n] by 𝔾_{m} is a twist of Λ_{0}.

Proof. Since \overline{K}^{×} is a divisible group every commutative extension of E[n] by 𝔾_{m} splits over \overline{K}. □

Lemma 1.27. Let Λ be any central extension of E[n] by 𝔾_{m}. Then Aut(Λ) ≅ Hom(E[n], 𝔾_{m}) ≅ E[n].

Proof. The automorphisms of Λ take the form x ↦ α(π(β(x)))x for π : E[n] → 𝔾_{m} a homomorphism. This gives the first isomorphism. The second isomorphism comes from the Weil pairing. □

By the twisting principle we obtain

Proposition 1.28. The commutative extensions of E[n] by 𝔾_{m}, viewed as twists of Λ_{0}, are parametrised up to isomorphism by H^{1}(K, E[n]).

This result may be interpreted as giving an isomorphism

H^{1}(K, E[n]) ≅ Ext_{K}^{1}(E[n], 𝔾_{m})

cf. [10], Example 0.8.

1.6. Sixth Interpretation: Theta groups.

Definition 1.29. (i) A theta group is a central extension of E[n] by 𝔾_{m}

0 ⟶ 𝔾_{m} ⟶^{α} Θ ⟶^{β} E[n] ⟶ 0

with commutator given by the Weil pairing, i.e.

xyx^{−1}y^{−1} = α(e_{n}(βx, βy))

for all x, y ∈ Θ. (ii) An isomorphism of theta groups is an isomorphism of central extensions (see Definition 1.25).

In §1.3 we considered the morphism E → ℙ^{n−1} determined by the complete linear system |n.0|. The action of E[n] on E by translation extends to an action on ℙ^{n−1} and so determines a map χ_{E} : E[n] → PGL_{n}. Writing Θ_{E} for the inverse image of χ_{E}(E[n]) in GL_{n} we obtain a commutative diagram with exact rows:

(1)  [figure: 0; 𝔾_{m}; Θ_{E}; E[n]; χ_{E}; 0; 0; 𝔾_{m}; _{GL_{n}}; _{PGL_{n}}; 0]

It is clear that Θ_{E} is a central extension of E[n] by 𝔾_{m}. To show it is a theta group, we must show that it has commutator given by the Weil pairing. In fact this may be used as the definition of the Weil pairing (cf. Lemma 3.13). For the relationship with the definition in Silverman [16], Chapter III, §8, we refer to Mumford [11], §§20,23. There are issues of choice of sign here which we will ignore.

Lemma 1.30. Every theta group is a twist of Θ_{E}.

Proof: More generally we show that any two central extensions of E[n] by 𝔾_{m}, with the same commutator pairing, must necessarily be isomorphic over \overline{K}. Let Λ_{1} and Λ_{2} be two such extensions, and pick a basis S, T for E[n]. Since \overline{K}^{×} is a divisible group we may lift S, T to elements s_{1}, t_{1} ∈ Λ_{1} and s_{2}, t_{2} ∈ Λ_{2} each of order n. Then there is an isomorphism Λ_{1} ≅ Λ_{2}, defined over \overline{K}, uniquely determined by s_{1} ↦ s_{2} and t_{1} ↦ t_{2}. □

By Lemmas 1.27, 1.30 and the twisting principle we obtain

Proposition 1.31. The theta groups for E[n], viewed as twists of Θ_{E}, are parametrised up to isomorphism by H^{1}(K, E[n]).

Let (C, [D]) be a torsor divisor class pair. We assume for simplicity that D is a K-rational divisor. Then the complete linear system |D| determines a morphism C → ℙ^{n−1}. The action of E[n] on C extends to an action on ℙ^{n−1} and so determines a map χ_{C} : E[n] → PGL_{n}. We obtain a diagram analogous to (1):

(2)  [figure: 0; 𝔾_{m}; Θ; E[n]; χ_{C}; 0; 0; 𝔾_{m}; _{GL_{n}}; _{PGL_{n}}; 0]

We show that this construction of Θ from (C, [D]) is compatible with our first and sixth interpretations of H^{1}(K, E[n]). To do this, let (C, [D]) be the twist of (E, [n.0]) by ξ ∈ H^{1}(K, E[n]). Then there is an isomorphism of Brauer-Severi diagrams defined over \overline{K},

\xymatrix{C \ar[r] \ar[d]_{ϕ} & ℙ^{n−1} \ar[d]^{ψ} \\ E \ar[r]^{|n.0|} & ℙ^{n−1}}

with σ(ϕ)ϕ^{−1} = τ_{ξ_{σ}}. We lift ψ to a matrix B ∈ GL_{n} so that conjugation by B defines an isomorphism Ψ : Θ ≅ Θ_{E}. It is evident that y_{σ} = σ(B)B^{−1} is an element of Θ_{E} projecting onto ξ_{σ}. Therefore

σ(Ψ)Ψ^{−1} : Θ_{E} → Θ_{E}; x ↦ y_{σ}xy_{σ}^{−1} = e_{n}(ξ_{σ}, x)x

and Θ is the twist of Θ_{E} by ξ as was to be shown.

In fact there is a more direct way to construct Θ from (C, [D]). We write τ_{P} : C → C; Q ↦ μ(P, Q) for the action of P ∈ E on C.

Proposition 1.32. Let (C, [D]) be a torsor divisor class pair with D a K-rational divisor. Then the corresponding theta group is

Θ = \{ (f, T) ∈ \overline{K}(C)^{×} × E[n] | div(f) = τ_{T}^{∗}D − D \}

with group law

(3)  (f_{1}, T_{1}) ∗ (f_{2}, T_{2}) = (τ_{T_{2}}^{∗}(f_{1})f_{2}, T_{1} + T_{2})

and structure maps α : λ ↦ (λ, 0) and β : (f, T) ↦ T.

Proof: The complete linear system |D| determines a morphism

C → ℙ(L(D)^{∗}) ≅ ℙ^{n−1}

where L(D) is the Riemann-Roch space

L(D) = \{f ∈ \overline{K}(C)^{×} | div(f) + D ≥ 0\} ∪ \{0\}.

Let ι : Θ → End(L(D)^{∗}) be given by

ι(f, T)(x) = (h ↦ x(fτ_{T}^{∗}h))

for all x ∈ L(D)^{∗} and h ∈ L(D). It may be verified that the diagram

\xymatrix{C \ar[r] \ar[d]_{τ_{T}} & ℙ(L(D)^{∗}) \ar[d]^{ι(f,T)} \\ C \ar[r] & ℙ(L(D)^{∗})}

commutes. The group law on Θ is then that required to make ι a group homomorphism. □

2. The obstruction map

We continue to take E an elliptic curve over K and n ≥ 2 an integer. We recall from §1.1 that H^{1}(K, E[n]) parametrises the torsor divisor class pairs (C, [D]). Here [D] is a K-rational divisor class on C.

For any smooth projective variety X over K there is an exact sequence of Galois modules

0 → \overline{K}^{×} → \overline{K}(X)^{×} → Div(X) → Pic(X) → 0.

Splitting into short exact sequences and taking Galois cohomology we obtain an exact sequence (see [7] for details)

(4) 0 → K^{×} → K(X)^{×} → Div(X)^{G_{K}} → Pic(X)^{G_{K}} →^{δ_{X}} Br(K).

We define the obstruction map

Ob : H^{1}(K, E[n]) → Br(K) ; (C, [D]) ↦ δ_{C}([D]).

From (4) we obtain the fundamental property of the obstruction map, namely that D is linearly equivalent to a K-rational divisor if and only if Ob(C, [D]) = 0. We also have

Lemma 2.1. Let (C, [D]) be a torsor divisor class pair. If C(K) ≠ ∅ (equivalently C ≅ E over K) then Ob(C, [D]) = 0.

Proof. Let P ∈ C(K). By Riemann-Roch D − (n − 1)P is linearly equivalent to a unique point Q ∈ C. The uniqueness statement proves that Q is K-rational. So D ∼ (n−1)P +Q and the latter is K-rational. It follows that Ob(C, [D]) = 0. Alternatively the lemma follows from Remark 1.10. □

We give an alternative description of the obstruction map. The base theta group Θ_{E} was defined in §1.6.

Proposition 2.2. The obstruction map

Ob : H^{1}(K, E[n]) → H^{2}(K, 𝔾_{m})

is obtained as the connecting map of (non-abelian) Galois cohomology for the exact sequence

0 → 𝔾_{m} → Θ_{E} → E[n] → 0.

Proof. The proof is by means of a cocycle calculation. We start with a torsor divisor class pair (C, [D]). Since [D] is a K-rational divisor class, there exist rational functions h_{σ} ∈ \overline{K}(C)^{×} with div(h_{σ}) = σD−D for all σ ∈ G_{K}. By definition of the obstruction map, Ob(C, [D]) is represented by the cocycle

(5)  (σ, τ) ↦ \frac{σ(h_{τ})h_{σ}}{h_{στ}} .

Let ξ ∈ H^{1}(K, E[n]) describe (C, [D]) as a twist of (E, [n.0]). This means there is an isomorphism of torsors ϕ : C ≅ E, defined over \overline{K}, with ϕ^{∗}(n.0) = D and σ(ϕ)ϕ^{−1} = τ_{ξ_{σ}}. We recall that Θ_{E} is the theta group determined by (E, [n.0]). By Proposition 1.32 we identify

Θ_{E} = \{ (f, T) ∈ \overline{K}(E)^{×} × E[n] | div(f) = τ_{T}^{∗}(n.0) − n.0 \}.

We lift ξ_{σ} ∈ E[n] to a pair (f_{σ}, ξ_{σ}) ∈ Θ_{E}. Then

div(ϕ^{∗}f_{σ}) = ϕ^{∗}τ_{ξ_{σ}}^{∗}(n.0) − ϕ^{∗}(n.0)
= (σϕ)^{∗}(n.0) − ϕ^{∗}(n.0)
= σD − D.

Taking h_{σ} = ϕ^{∗}f_{σ} in (5) we obtain

Ob(ξ)(σ, τ) = σ(ϕ^{∗}f_{τ}) ϕ^{∗}f_{σ} (ϕ^{∗}f_{στ})^{−1}
= τ_{ξ_{σ}}^{∗}(σf_{τ}) f_{σ} f_{στ}^{−1}
= (τ_{ξ_{σ}}^{∗}(σf_{τ}) f_{σ}, ξ_{στ}) ∗ (f_{στ}, ξ_{στ})^{−1}
= σ(f_{τ}, ξ_{τ}) ∗ (f_{σ}, ξ_{σ}) ∗ (f_{στ}, ξ_{στ})^{−1}

where ∗ is the group law (3). We recognise this final expression as the connecting map of Galois cohomology. □

Remark 2.3. We may identify ker(Ob) = H^{1}(K, Θ_{E}).

It is well known that taking Galois cohomology of the exact sequence

0 → 𝔾_{m} → GL_{n} → PGL_{n} → 0

gives an injection

Δ : H^{1}(K, PGL_{n}) ↪ Br(K)[n].

This leads to our third interpretation of the obstruction map.

Lemma 2.4. Let [E → ℙ^{n−1}] be the base Brauer-Severi diagram and let χ_{E} : E[n] → PGL_{n} describe the action of E[n] on E. Then the obstruction map is

χ_{E,∗} : H^{1}(K, E[n]) → H^{1}(K, PGL_{n}).

Proof: (Taken from [13].) Taking Galois cohomology in (1) we obtain a commutative diagram

[figure: H^{1}(K, E[n]); χ_{E,∗}; H^{2}(K, 𝔾_{m}); H^{1}(K, PGL_{n}); Δ; H^{2}(K, 𝔾_{m})]

The lemma follows from the description of the obstruction map given in Proposition 2.2. □

Finally we interpret the obstruction map as a forgetful map.

Corollary 2.5. The obstruction map Ob : H^{1}(K, E[n]) → Br(K) sends [C → S] to S.

Proof: Let [C → S] be the twist of [E → ℙ^{n−1}] by ξ ∈ H^{1}(K, E[n]). Then there is an isomorphism of Brauer-Severi diagrams defined over \overline{K}

\xymatrix{C \ar[r] \ar[d]_{ϕ} & S \ar[d]^{ψ} \\ E \ar[r] & ℙ^{n−1}}

with σ(ϕ)ϕ^{−1} = τ_{ξ_{σ}}. It follows that σ(ψ)ψ^{−1} = χ_{E}(ξ_{σ}) and so S is the twist of ℙ^{n−1} by Ob(ξ) = χ_{E,∗}(ξ) ∈ H^{1}(K, PGL_{n}). □

If [C → S] is a Brauer-Severi diagram with C(K) ≠ ∅ then clearly S(K) ≠ ∅. So Corollary 2.5 gives an alternative proof of Lemma 2.1.

Remark 2.6. In general the obstruction map is not a group homomorphism. But, as shown in [13], it is quadratic in the sense that

(i) Ob(aξ) = a^{2} Ob(ξ) for a an integer, and

(ii) (ξ, η) ↦ Ob(ξ + η) − Ob(ξ) − Ob(η) is bilinear.

3. The étale algebra

Let R be the affine co-ordinate algebra of E[n]. It consists of all Galois equivariant maps from E[n] to \overline{K}. In symbols

R = Map_{K}(E[n], \overline{K}).

For example, any rational function on E defined over K and not having poles in E[n] will give an element of R. Since E[n] is an étale Kscheme, R is an étale algebra: it is isomorphic to a product of (finite) field extensions of K, one for each G_{K}-orbit in E[n]. If T is a point in one such orbit, then the corresponding field extension is K(T). If n is prime then typically we have R = K × L where L/K is a field extension of degree n^{2} − 1.

We also work with the algebra

\overline{R} = R ⊗_{K} \overline{K} = Map(E[n], \overline{K}).

Note that the action of σ ∈ G_{K} is α ↦ (σ(α) : T ↦ σ(α(σ^{−1}T))). As a \overline{K}-vector space \overline{R} has basis the δ_{T} for T ∈ E[n] where

δ_{S}(T) = \{ \begin{matrix}1 & if S = T, \\ 0 & otherwise. \end{matrix}

In general, if R_{A} and R_{B} are the coordinate rings of two affine Kschemes A and B, then R_{A} ⊗_{K} R_{B} is the coordinate ring of A × B. So R ⊗_{K} R is the algebra of Galois equivariant maps from E[n] × E[n] into \overline{K}, and \overline{R} ⊗\overline{K} \overline{R} = (R ⊗_{K} R) ⊗_{K} \overline{K} is the algebra of all such maps.

The Weil pairing e_{n} : E[n] × E[n] → μ_{n} determines an injection

w : E[n] ↪ \overline{R}^{×} = Map(E[n], \overline{K}^{×})

via w(S)(T) = e_{n}(S, T). We observe that the w(T), for T ∈ E[n], are not only maps, but also homomorphisms E[n] → \overline{K}^{×}. By the nondegeneracy of the Weil pairing, all such homomorphisms arise in this way. So if we define ∂ : \overline{R}^{×} → (\overline{R} ⊗\overline{K} \overline{R})^{×} via

(6)  (∂α)(T_{1}, T_{2}) = \frac{α(T_{1})α(T_{2})}{α(T_{1} + T_{2})},

then there is an exact sequence

(7)  0 ⟶ E[n] ⟶^{w} \overline{R}^{×} ⟶^{∂} (\overline{R} ⊗ \overline{R})^{×}.

By a generalised version of Hilbert’s theorem 90 (which reduces by Shapiro’s lemma to the usual version of Hilbert’s theorem 90 applied to each constituent field of R) we have

H^{1}(K, \overline{R}^{×}) = 0.

We use these observations to define group homomorphisms

w_{1} : H^{1}(K, E[n]) → R^{×}/(R^{×})^{n}

and

w_{2} : H^{1}(K, E[n]) → (R ⊗ R)^{×}/∂R^{×}.

It is convenient to give both definitions at once. We start with ξ ∈ H^{1}(K, E[n]) and use Hilbert’s theorem 90 to write w(ξ_{σ}) = σ(γ)/γ for some γ ∈ \overline{R}^{×}. Then α = γ^{n} and ρ = ∂γ are Galois invariant and so belong to R^{×} and (R ⊗ R)^{×} respectively. We define w_{1}(ξ) = α(R^{×})^{n} and w_{2}(ξ) = ρ ∂R^{×}. If we change ξ by a coboundary, say σ(T) − T, then γ is multiplied by w(T). Since w(T)^{n} = 1 and ∂(w(T)) = 1 this leaves the values of α and ρ unchanged. The only remaining freedom is to multiply γ by an element of R^{×}. This has the effect of multiplying α and ρ by elements of (R^{×})^{n} and ∂R^{×} respectively. It follows that w_{1} and w_{2} are well defined.

The map w_{1} is in fact the composite

H^{1}(K, E[n]) ⟶^{w_{∗}} H^{1}(K, μ_{n}(\overline{R})) ⟶^{k} R^{×}/(R^{×})^{n}

where w_{∗} is induced by w, and k is the Kummer isomorphism.

Lemma 3.1. If n is prime then w_{1} is injective.

Proof: See [5], Proposition 7, or [14], Corollary 5.1. □

In general w_{1} is not injective. For example, taking n = 4 and E/ℚ the elliptic curve y^{2} = x^{3} + x + 2/13, it may be shown that w_{1} has kernel of order 2.

Lemma 3.2. The map w_{2} is injective.

Proof: Let ξ belong to the kernel of w_{2}. Then w(ξ_{σ}) = σ(γ)/γ for some γ ∈ \overline{R}^{×}. Multiplying γ by an element of R^{×} we may suppose that ∂γ = 1. Then (7) gives γ = w(T) for some T ∈ E[n]. Since w is injective it follows that ξ_{σ} = σ(T) − T. Hence ξ is a coboundary. □

In §1.5 we showed that H^{1}(K, E[n]) parametrises the commutative extensions of E[n] by 𝔾_{m}. This point of view will help us determine the image of w_{2}. By Hilbert’s theorem 90 every central extension

0 → 𝔾_{m} → Λ → E[n] → 0

has a Galois equivariant section ϕ : E[n] → Λ. In general ϕ is not a group homomorphism. The possible choices of ϕ differ by elements of

Map_{K}(E[n], \overline{K}^{×}) = R^{×}.

We define the first and second invariants of Λ. The first invariant is inv_{1}(Λ) = α(R^{×})^{n} where α ∈ R^{×} satisfies

(8)  ϕ(T)^{n} = α(T)

for all T ∈ E[n]. The second invariant is inv_{2}(Λ) = ρ ∂R^{×} where ρ ∈ (R ⊗ R)^{×} satisfies

(9)  ϕ(T_{1})ϕ(T_{2}) = ρ(T_{1}, T_{2})ϕ(T_{1} + T_{2}).

for all T_{1}, T_{2} ∈ E[n]. Notice that inv_{1}(Λ) and inv_{2}(Λ) depend only on Λ and not on the choice of section ϕ.

Lemma 3.3. Let Λ be the twist of Λ_{0} by ξ ∈ H^{1}(K, E[n]). Then inv_{1}(Λ) = w_{1}(ξ) and inv_{2}(Λ) = w_{2}(ξ).

Proof: By hypothesis there is a commutative diagram

[figure: 0; 𝔾_{m}; Λ; ψ; E[n]; 0; 0; 𝔾_{m}; Λ_{0}; E[n]; 0]

with σ(ψ)ψ^{−1} : x ↦ e_{n}(ξ_{σ}, x)x. We use Hilbert’s theorem 90 to write w(ξ_{σ}) = σ(γ)/γ for some γ ∈ \overline{R}^{×}. Let ϕ_{0} : E[n] → Λ_{0} be the natural section for Λ_{0}. A calculation reveals that

ϕ : E[n] → Λ ; T ↦ γ(T)ψ^{−1}(ϕ_{0}(T))

is a Galois equivariant section for Λ. So by (8) and (9) we have α = γ^{n} and ρ = ∂γ as required. □

Remark 3.4. It is clear that a central extension of E[n] by 𝔾_{m} is uniquely determined up to isomorphism by its second invariant. Thus Lemma 3.3 gives an alternative proof of Lemma 3.2.

We extend (7) to a complex

0 ⟶ E[n] ⟶^{w} \overline{R}^{×} ⟶^{∂} (\overline{R} ⊗ \overline{R})^{×} ⟶^{∂} (\overline{R} ⊗ \overline{R} ⊗ \overline{R})^{×}

where the second ∂ is given by

(∂ρ)(T_{1}, T_{2}, T_{3}) = \frac{ρ(T_{1}, T_{2})ρ(T_{1} + T_{2}, T_{3})}{ρ(T_{1}, T_{2} + T_{3})ρ(T_{2}, T_{3})}.

For each ρ ∈ (R⊗R)^{×} we write ρ^{op} for the element obtained by switching the operands, i.e. ρ^{op}(T_{1}, T_{2}) = ρ(T_{2}, T_{1}).

Lemma 3.5. The image of w_{2} is

H = { ρ ∈ (R ⊗ R)^{×} | ρ = ρ^{op} and ∂ρ = 1}/∂R^{×}.

Proof: The conditions ρ = ρ^{op} and ∂ρ = 1 express the fact that Λ is commutative and associative. Conversely, if ρ ∂R^{×} ∈ H then we define a new multiplication on 𝔾_{m} × E[n] via

(λ_{1}, T_{1}) ∗ (λ_{2}, T_{2}) = (λ_{1}λ_{2}ρ(T_{1}, T_{2}), T_{1} + T_{2}).

This gives the required commutative extension of E[n] by 𝔾_{m}. □

Corollary 3.6. If ρ ∂R^{×} ∈ H then ρ = ∂γ for some γ ∈ \overline{R}^{×}.

Proof: This is the case K = \overline{K} of the last lemma. □

Remark 3.7. Lemma 3.5 may equally be deduced from Corollary 3.6 by taking Galois cohomology of the short exact sequence

0 ⟶ E[n] ⟶^{w} \overline{R}^{×} ⟶^{∂} ker(∂| Sym^{2}(\overline{R})^{×}) ⟶ 0

where Sym^{2}(\overline{R}) = \{ρ ∈ \overline{R} ⊗ \overline{R} | ρ = ρ^{op}\}.

In applications we take K a number field and n a prime. As explained in the introduction, we compute Sel^{(n)}(E/K) first as a subgroup of R^{×}/(R^{×})^{n} and then convert it to a subgroup of H ⊂ (R ⊗ R)^{×}/∂R^{×}. To make this conversion, we let κ be the map making the diagram

\xymatrix{H^{1}(K, E[n]) \ar[d]_{w_{2}} \ar[dr]^{w_{1}} \\ H \ar[r]^{κ} & R^{×}/(R^{×})^{n}}

commute. If ρ∂R^{×} ∈ H then by Corollary 3.6 we have ρ = ∂γ for some γ ∈ \overline{R}^{×}. Tracing through the definitions we find that κ(ρ∂R^{×}) = α(R^{×})^{n} where α = γ^{n} ∈ R^{×}.

Lemma 3.8. Let α(R^{×})^{n} belong to the image of w_{1}. Then there exists ρ ∈ Sym^{2}(R)^{×} with (i) ∂α = ρ^{n}, (ii) α(T) = ∏_{i=0}^{n−1} ρ(T, iT) for all T ∈ E[n], and (iii) ∂ρ = 1. Moreover if ρ ∈ Sym^{2}(R)^{×} satisfies (ii) and (iii) then κ(ρ ∂R^{×}) = α(R^{×})^{n}.

Proof: Since w_{1} = κ ∘ w_{2} there exists ρ ∂R^{×} ∈ H with κ(ρ ∂R^{×}) = α(R^{×})^{n}. Corollary 3.6 gives ρ = ∂γ for some γ ∈ \overline{R}^{×}. Multiplying γ by a suitable element of R^{×} we may suppose that γ^{n} = α. Conditions (i), (ii) and (iii) follow at once.

Conversely if ρ ∈ Sym^{2}(R)^{×} satisfies (ii) and (iii) then ρ ∂R^{×} ∈ H and so ρ = ∂γ for some γ ∈ \overline{R}^{×}. By (ii) we deduce α = γ^{n}. □

Remark 3.9. If Sym^{2}(R) contains no non-trivial nth roots of unity, then we construct ρ from α by taking the unique nth root of ∂α. There is no need to check conditions (ii) and (iii).

We have identified H^{1}(K, E[n]) with a subgroup H ⊂ (R⊗R)^{×}/∂R^{×}. We did this using commutative extensions of E[n] by 𝔾_{m}. But we may equally work with theta groups (cf. §1.6).

Lemma 3.10. Let Θ be the twist of Θ_{E} by ξ ∈ H^{1}(K, E[n]). Then inv_{1}(Θ) = w_{1}(ξ) inv_{1}(Θ_{E}) and inv_{2}(Θ) = w_{2}(ξ) inv_{2}(Θ_{E}).

Proof: The proof is similar to that of Lemma 3.3. □

Let ε ∈ (R ⊗ R)^{×} with inv_{2}(Θ_{E}) = ε ∂R^{×}. Then the theta groups for E[n], or rather their second invariants, make up the coset

εH = {ρ ∈ (R ⊗ R)^{×} | ρ(ρ^{op})^{−1} = e and ∂ρ = 1}/∂R^{×}

where e ∈ μ_{n}(R ⊗ R) is the Weil pairing. We discuss several ways of computing ε. Our first method uses the definition of Θ_{E} as a subgroup of GL_{n}. Recall that we mapped E → ℙ^{n−1} via |n.0|. Let M be a matrix in

GL_{n}(R) = Map_{K}(E[n], GL_{n}(\overline{K}))

that describes the action of E[n] on ℙ^{n−1}. Then Θ_{E} has Galois equivariant section T ↦ M_{T} and so ε ∈ (R ⊗ R)^{×} is determined by

M_{T_{1}}M_{T_{2}} = ε(T_{1}, T_{2})M_{T_{1}+T_{2}}.

Our second method uses the description of Θ_{E} obtained by taking (C, [D]) = (E, [n.0]) in Proposition 1.32. Let F be a rational function in

R(E)^{×} = Map_{K}(E[n], \overline{K}(E)^{×})

with div(F_{T}) = n.T − n.0. Then Θ_{E} has Galois-equivariant section T ↦ (F_{T} , −T)^{−1}. Using the group law (3) we obtain

ε(T_{1}, T_{2}) = \frac{F_{T_{1}+T_{2}}(P)}{F_{T_{1}}(P)F_{T_{2}}(P − T_{1})}

where the righthand side is constant as a function of P ∈ E.

If n is odd then we are spared the above calculations.

Lemma 3.11. If n is odd, say n = 2m − 1, then inv_{1}(Θ_{E}) is trivial and inv_{2}(Θ_{E}) = e^{m}∂R^{×}. In particular Θ_{E} depends on E[n] and the Weil pairing, but not on E.

Proof: As before we map E → ℙ^{n−1} via |n.0|. The action of E[n] on E determines χ_{E} : E[n] → PGL_{n}. Likewise the negation map [−1] on E determines an element ι ∈ PGL_{n}. We claim that for each torsion point T ∈ E[n] there is a unique lift M_{T} of χ(T) to GL_{n} such that (i) ιM_{T} ι^{−1} = M_{T}^{−1} and (ii) M_{T}^{n} = I. Indeed the first condition determines M_{T} up to sign, and implies M_{T}^{n} = ±I. Then, since n is odd, the second condition determines a unique choice of this sign.

The uniqueness statement tells us that the map ϕ : T ↦ M_{T} is Galois equivariant. A short calculation (using (i), (ii) and the commutator condition) reveals that M_{S}M_{T} = e_{n}(S, T)^{m}M_{S+T} for all S, T ∈ E[n]. Substituting in (8) and (9) we get α = 1 and ρ = e^{m} as required. □

If n is odd then the restriction of w_{1} to the kernel of the obstruction map has the following alternative interpretation.

Corollary 3.12. Assume n is odd. Let [C → ℙ^{n−1}] be the Brauer-Severi diagram determined by ξ ∈ H^{1}(K, E[n]) and let M ∈ GL_{n}(R) describe the action of E[n] on C. Then w_{1}(ξ) = (det M)(R^{×})^{n}.

Proof: Let Θ be the theta group determined by [C → ℙ^{n−1}]. Then Θ is the twist of Θ_{E} by ξ ∈ H^{1}(K, E[n]). By Lemmas 3.10 and 3.11 we have inv_{1}(Θ) = w_{1}(ξ). Therefore w_{1}(ξ) = α(R^{×})^{n} where α ∈ R^{×} is determined by M^{n} = αI_{n}. The next lemma shows that if T ∈ E[n] has order r then M_{T} has characteristic polynomial of the form (X^{r} − c)^{n/r}. We deduce that det(M) = α as required. □

In the following lemma we assume that K is algebraically closed, and fix ζ_{n} ∈ K a primitive nth root of unity.

Lemma 3.13. Let C ⊂ ℙ^{n−1} be a genus one normal curve with Jacobian E. Let T_{1}, T_{2} be a basis for E[n] with e_{n}(T_{1}, T_{2}) = ζ_{n}. Then we can choose co-ordinates on ℙ^{n−1} so that T_{1}, T_{2} act on C via

M_{1} = (\begin{matrix}1 & 0 & 0 & ⋯ & 0 \\ 0 & ζ_{n} & 0 & ⋯ & 0 \\ 0 & 0 & ζ_{n}^{2} & ⋯ & 0 \\ ⋮ & ⋮ & ⋮ & & ⋮ \\ 0 & 0 & 0 & ⋯ & ζ_{n}^{n−1} \end{matrix}) , M_{2} = (\begin{matrix}0 & 0 & ⋯ & 0 & 1 \\ 1 & 0 & ⋯ & 0 & 0 \\ 0 & 1 & ⋯ & 0 & 0 \\ ⋮ & ⋮ & & ⋮ & ⋮ \\ 0 & 0 & ⋯ & 1 & 0 \end{matrix}) .

Proof: This is quite standard. See for example [12]. □

4. From extensions to enveloping algebras

4.1. Enveloping algebras. We consider K-algebras A that are finite dimensional over K. The unit group of \overline{A} = A ⊗_{K} \overline{K} may be viewed as (the \overline{K}-rational points of) a K-group variety. For instance, if A is the matrix algebra Mat_{n}(K) then this construction yields GL_{n}.

Definition 4.1. Let Λ be a central extension of E[n] by 𝔾_{m}. Let A be a K-algebra with [A : K] = n^{2}. An embedding of Λ in A is a morphism of K-group varieties ι : Λ → \overline{A}^{×} such that

(i) ι preserves scalars, i.e. ι(λ) = λ for all λ ∈ \overline{K}^{×}, (ii) the image of ι spans \overline{A} as a \overline{K}-vector space.

Lemma 4.2. Every central extension of E[n] by 𝔾_{m} embeds in a Kalgebra.

Proof: Let ϕ : E[n] → Λ be a Galois equivariant section for Λ. As in §3 we write R for the étale algebra of E[n] and recall that \overline{R} is a \overline{K}-vector space with basis the δ_{T} for T ∈ E[n]. We define a Galois equivariant inclusion of Λ in \overline{R} via

λϕ(T) ↦ λδ_{T}

for all λ ∈ \overline{K}^{×} and T ∈ E[n]. The group law on Λ extends uniquely to a new \overline{K}-algebra multiplication on \overline{R}, which in turn descends to a K-algebra multiplication

∗ : R × R → R.

Thus Λ embeds in the K-algebra A = (R, +, ∗). □

Lemma 4.3. Let Λ_{1} and Λ_{2} be central extensions of E[n] by 𝔾_{m} embedding in K-algebras A_{1} and A_{2}. Then every isomorphism of central extensions ψ : Λ_{1} ≅ Λ_{2} extends uniquely to an isomorphism of Kalgebras Ψ : A_{1} ≅ A_{2}.

Proof: We construct Ψ from ψ by extending linearly to an isomorphism of \overline{K}-algebras, and then restricting to K-algebras. Condition (ii) of Definition 4.1 ensures that Ψ is unique. □

Definition 4.4. Let Λ be a central extension of E[n] by 𝔾_{m}. If Λ embeds in a K-algebra A then A is the enveloping algebra of Λ.

We have shown that enveloping algebras exist and are unique up to isomorphism. Next we outline a method for computing them. The addition law

E[n] × E[n] → E[n]

gives rise to the comultiplication

Δ : R → R ⊗ R

with Δ(α)(T_{1}, T_{2}) = α(T_{1} + T_{2}). Viewing R ⊗ R as an R-algebra via Δ there is a trace map

Tr : R ⊗ R → R.

In terms of functions it is given by

(10)  Tr(ρ)(T) = ∑_{T_{1}+T_{2}=T} ρ(T_{1}, T_{2}).

It may also be built out of the trace maps for the constituent fields of R ⊗ R and R.

Lemma 4.5. Let Λ be a central extension of E[n] by 𝔾_{m}. If inv_{2}(Λ) = ρ ∂R^{×} then Λ has enveloping algebra (R, +, ∗_{ρ}) where

z_{1} ∗_{ρ} z_{2} = Tr(ρ.z_{1} ⊗ z_{2}).

Proof: By hypothesis there exists T ↦ ϕ(T) a Galois equivariant section for Λ → E[n] with

ϕ(T_{1})ϕ(T_{2}) = ρ(T_{1}, T_{2})ϕ(T_{1} + T_{2}).

Following the proof of Lemma 4.2 we obtain

δ_{S} ∗_{ρ} δ_{T} = ρ(S, T)δ_{S+T} .

We write this multiplication in a form that descends to K:

z_{1} ∗_{ρ} z_{2} = (∑_{T} z_{1}(T)δ_{T}) ∗_{ρ} (∑_{T} z_{2}(T)δ_{T})
= ∑_{T} (∑_{T_{1}+T_{2}=T} ρ(T_{1}, T_{2})z_{1}(T_{1})z_{2}(T_{2}))δ_{T}
= Tr(ρ.z_{1} ⊗ z_{2}).
□

Lemma 4.3 tells us that if Λ_{1} and Λ_{2} are isomorphic (as central extensions) then A_{1} and A_{2} are isomorphic (as K-algebras). More concretely we have

Lemma 4.6. Let A_{1} = (R, +, ∗_{ρ_{1}}) and A_{2} = (R, +, ∗_{ρ_{2}}) be the enveloping algebras determined by ρ_{1}, ρ_{2} ∈ (R ⊗ R)^{×} with ∂ρ_{1} = ∂ρ_{2} = 1. If ρ_{1} = ρ_{2}∂γ for some γ ∈ R^{×} then there is an isomorphism of K-algebras

A_{1} ≅ A_{2} ; z ↦ γ.z

where the multiplication is that in R.

Proof: We compute

γ.(z_{1} ∗_{ρ_{1}} z_{2}) = (T ↦ γ(T) ∑_{T_{1}+T_{2}=T} ρ_{1}(T_{1}, T_{2})z_{1}(T_{1})z_{2}(T_{2}))
= (T ↦ ∑_{T_{1}+T_{2}=T} ρ_{2}(T_{1}, T_{2})γ(T_{1})z_{1}(T_{1})γ(T_{2})z_{2}(T_{2}))
= (γ.z_{1}) ∗_{ρ_{2}} (γ.z_{2})
□

4.2. The flex algebra. Let Φ be an E[n]-torsor and let F be the étale algebra of Φ, i.e.

F = Map_{K}(Φ, \overline{K}).

Since E[n] acts on Φ it also acts on \overline{F}^{×} = Map(Φ, \overline{K}^{×}). The “eigenvectors” for this action form a group

Λ = \{z ∈ \overline{F}^{×}| \begin{matrix}there exists T ∈ E[n] such that \\ z(S + P) = e_{n}(S, T)z(P) \\ for all S ∈ E[n] and P ∈ Φ \end{matrix} \} .

Thus we obtain a commutative extension

0 ⟶ 𝔾_{m} ⟶^{α} Λ ⟶^{β} E[n] ⟶ 0

where in the above notation β(z) = T. We show that this construction of Λ from F is compatible with our fourth and fifth interpretations of H^{1}(K, E[n]). To do this let Φ be the twist of E[n] by ξ ∈ H^{1}(K, E[n]). This means there is an isomorphism of E[n]-torsors ψ : Φ → E[n], defined over \overline{K}, with σ(ψ)ψ^{−1} = τ_{ξ_{σ}}. We define

ψ^{∗} : \overline{F} = Map(Φ, \overline{K}) → Map(E[n], \overline{K}) = \overline{R}

via ψ^{∗}(z)(P) = z(ψ^{−1}(P)). Then ψ^{∗} restricts to an isomorphism of central extensions γ : Λ ≅ Λ_{0} where

Λ_{0} = 𝔾_{m} × E[n] = \{ λw(T) ∈ \overline{R}^{×} | λ ∈ \overline{K}^{×}, T ∈ E[n] \}.

We find

σ(γ)γ^{−1} : Λ_{0} → Λ_{0} ; x ↦ e_{n}(ξ_{σ}, x)x.

So Λ is the twist of Λ_{0} by ξ as was to be shown. We summarise the above discussion in

Proposition 4.7. The enveloping algebra of a commutative extension of E[n] by 𝔾_{m} is the étale algebra of the corresponding E[n]-torsor.

If ξ ∈ H^{1}(K, E[n]) with w_{2}(ξ) = ρ∂R^{×} then by Lemmas 3.3 and 4.5 the flex algebra is (R, +, ∗_{ρ}). Taking ρ = 1 should give the étale algebra of E[n]. We recognise (R, +, ∗_{1}) as the group algebra of E[n]. It is isomorphic to R via the Fourier transform α ↦ α̂ where

α̂(S) = \frac{1}{n^{2}} ∑_{T} e_{n}(S, T)α(T).

4.3. The obstruction algebra.

Lemma 4.8. The base theta group Θ_{E} embeds in Mat_{n}(K). In particular Θ_{E} spans Mat_{n}(\overline{K}) as a \overline{K}-vector space.

Proof: We recall that Θ_{E} was defined in §1.6 as a subgroup of GL_{n}. Let T ↦ M_{T} be a section for Θ_{E} → E[n]. By Definition 1.29 we have

M_{S}M_{T} M_{S}^{−1}M_{T}^{−1} = e_{n}(S, T)

for all S, T ∈ E[n]. From the non-degeneracy of the Weil pairing it follows that the M_{T} are linearly independent over \overline{K}. A dimension count shows that they span Mat_{n}(\overline{K}). This proves the second statement of the lemma. The first now follows by Definition 4.1. □

Lemma 4.9. If Θ is a theta group for E[n] with enveloping algebra A then A is a central simple K-algebra with [A : K] = n^{2}. In particular Θ spans \overline{A} as a \overline{K}-vector space.

Proof: We saw in Lemma 1.30 that Θ is a twist of Θ_{E}. It follows by Lemma 4.3 that A is a twist of Mat_{n}(K). □

We use Definition 4.1 and Lemma 4.9 to build a commutative diagram with exact rows

(11)  [figure: 0; 𝔾_{m}; Θ; E[n]; 0; 0; 𝔾_{m}; _{\overline{A}_{×}}; Aut(A); 0.]

The second row is exact by the Noether-Skolem theorem. The righthand vertical arrow is the composite of E[n] = Aut(Θ), cf. Lemma 1.27, and Aut(Θ) → Aut(A), cf. Lemma 4.3. We recognise (1) and (2) as special cases of this new diagram.

Proposition 4.10. If Θ is a theta group for E[n] with enveloping algebra A then the obstruction map sends the class of Θ in H^{1}(K, E[n]) to the class of A in Br(K).

Proof. Let Θ_{E} be the base theta group, i.e. the theta group associated to (E, [n.0]). Let χ_{E} : E[n] → PGL_{n} be the right-hand vertical arrow in (1). According to Proposition 2.4 the obstruction map is

χ_{E,∗} : H^{1}(K, E[n]) → H^{1}(K, PGL_{n}).

Now let Θ be the twist of Θ_{E} by ξ ∈ H^{1}(K, E[n]). This means there is an isomorphism of theta groups γ : Θ ≅ Θ_{E}, defined over \overline{K}, with

σ(γ)γ^{−1} : x ↦ e_{n}(ξ_{σ}, x)x

for all x ∈ Θ_{E}. It follows from the commutator condition that σ(γ)γ^{−1} is conjugation by any lift of ξ_{σ} to Θ_{E}. Then Lemma 4.3 tells us that γ extends to an isomorphism Γ : \overline{A} ≅ Mat(n, \overline{K}). So σ(Γ)Γ^{−1} is conjugation by any lift of χ_{E}(ξ_{σ}) to GL_{n}(\overline{K}). It follows that χ_{E,∗}(ξ) represents the class of A in H^{1}(K, PGL_{n}). □

The following variant on the above terminology is often helpful.

Definition 4.11. Let Θ be a theta group for E[n]. As a special case of Definition 4.1 we define a representation of Θ to be an embedding of Θ in the matrix algebra Mat_{n}(K). In other words, a representation is a morphism of group varieties Θ → GL_{n} that preserves scalars. We recognise diagrams (1) and (2) as representations of theta groups.

5. Recovering explicit equations

Given ρ ∈ (R⊗R)^{×} representing an element ρ ∂R^{×} ∈ H ≅ H^{1}(K, E[n]) with trivial obstruction, we aim to find equations for the corresponding Brauer-Severi diagram [C → ℙ^{n−1}]. We present three algorithms for performing this conversion, assuming in each case the existence of a “Black Box” to trivialise the obstruction algebra. We assume for ease of exposition that n ≥ 3.

We fix a basis r_{1}, …, r_{n^{2}} for R as a K-vector space. Let r_{1}^{∗}, …, r_{n^{2}}^{∗} be the dual basis with respect to the trace form

(r, s) ↦ tr_{R/K}(rs) = ∑_{T ∈E[n]} r(T)s(T).

A useful technique, used in several proofs, is reduction to the “geometric case”. By this we mean taking K = \overline{K} and r_{i} = r_{i}^{∗} = δ_{T_{i}} where E[n] = {T_{1}, …, T_{n^{2}}}. The following lemma is typical.

Lemma 5.1. Let δ = ∑_{i=1}^{n^{2}} r_{i}^{∗} ⊗ r_{i} ∈ R ⊗ R. Then

δ(S, T) = \{ \begin{matrix}1 & if S = T, \\ 0 & otherwise. \end{matrix}

Proof: We first note that δ does not depend on the choice of basis r_{1}, …, r_{n^{2}}. The lemma follows by reduction to the geometric case. □

5.1. The Hesse pencil method. We start with the Hesse pencil method, since it is the simplest of our three methods both to explain and to implement.

Proposition 5.2. Let Θ be the twist of Θ_{E} by ξ ∈ H^{1}(K, E[n]).

(i) The theta group Θ has a representation

(12)  [figure: 0; 𝔾_{m}; Θ; E[n]; χ; 0; 0; 𝔾_{m}; _{GL_{n}}; _{PGL_{n}}; 0]

if and only if Ob(ξ) = 0. (ii) If Θ has a representation (12) then there is a unique genus one normal curve C ⊂ ℙ^{n−1} with Jacobian E for which the action of each T ∈ E[n] on C is given by χ(T). Moreover [C → ℙ^{n−1}] is the Brauer-Severi diagram determined by ξ.

Proof: (i) This is a special case of Proposition 4.10. (ii) Let [C → ℙ^{n−1}] be the Brauer-Severi diagram determined by ξ. We recall from §1.6 that Θ has a representation

(13)  [figure: 0; 𝔾_{m}; Θ; E[n]; χ_{C}; 0; 0; 𝔾_{m}; _{GL_{n}}; _{PGL_{n}}; 0]

According to Lemma 4.3, the representations (12) and (13) differ only by an automorphism of Mat_{n}(K). By the Noether-Skolem theorem this automorphism is conjugation by an element of GL_{n}(K). So making a change of co-ordinates on ℙ^{n−1} we may arrange that χ = χ_{C}.

The proof of Lemma 1.7 shows that if C, C′ ⊂ ℙ^{n−1} are genus one normal curves with the same j-invariant, then there exists α ∈ PGL_{n}(\overline{K}) with α(C) = C′. Moreover, using Lemma 3.13, one can show that the image of χ_{C} is its own centraliser in PGL_{n}. The uniqueness statement follows. □

We describe the Hesse pencil method in greater detail.

Proposition 5.3. Let ξ ∈ H^{1}(K, E[n]) and ρ ∈ (R⊗R)^{×} with w_{2}(ξ) = ρ ∂R^{×}. Let A_{ρ} = (R, +, ∗_{ερ}) where inv_{2}(Θ_{E}) = ε ∂R^{×}. Then

(i) Ob(ξ) = 0 if and only if A_{ρ} ≅ Mat_{n}(K). (ii) If τ : A_{ρ} ≅ Mat_{n}(K) is an isomorphism of K-algebras and

M = ∑_{i=1}^{n^{2}} r_{i}^{∗}τ(r_{i}) ∈ GL_{n}(R) = Map_{K}(E[n], GL_{n}(\overline{K}))

then there is a unique genus one normal curve C ⊂ ℙ^{n−1} with Jacobian E for which the action of each T ∈ E[n] on C is given by M_{T}. Moreover [C → ℙ^{n−1}] is the Brauer-Severi diagram determined by ξ.

Proof: (i) Let Θ be the twist of Θ_{E} by ξ. By Lemma 3.10 we have inv_{2}(Θ) = ερ ∂R^{×}. Then Lemma 4.5 identifies A_{ρ} as the enveloping algebra of Θ. We are done by Proposition 4.10. (ii) Since inv_{2}(Θ) = ερ ∂R^{×} there exists a Galois equivariant section ϕ : E[n] → Θ with

ϕ(S)ϕ(T) = ε(S, T)ρ(S, T)ϕ(S + T)

for all S, T ∈ E[n]. We claim that ϕ(T) ↦ M_{T} extends to a representation of Θ. It suffices to check this in the geometric case, whereupon M_{T} = τ(δ_{T}). The proof of Lemma 4.5 shows that ϕ(T) ↦ δ_{T} extends to an embedding of Θ in A_{ρ}. Since τ is an isomorphism of K-algebras, it follows that Θ embeds in Mat_{n}(K) as claimed.

Finally we apply Proposition 5.2(ii) with χ(T) = [M_{T}]. □

Remark 5.4. We may take any convenient choice for ε. For example we saw in Lemma 3.11 that if n is odd then a convenient choice is the square root of the Weil pairing.

It remains to recover equations for C ⊂ ℙ^{n−1} from M ∈ GL_{n}(R).

Proposition 5.5. Assume n ≥ 3 and let M ∈ GL_{n}(R) such that

(i) E[n] → PGL_{n}; T ↦ [M_{T}] is a group homomorphism, and (ii) M_{S}M_{T} M_{S}^{−1}M_{T}^{−1} = e_{n}(S, T)I_{n} for all S, T ∈ E[n]. Then the genus one normal curves C ⊂ ℙ^{n−1} for which each matrix M_{T} acts as translation by some n-torsion point of Jac(C), are parametrised by (a twist of) the modular curve Y (n). Moreover the number of curves in this family that are defined over K and have Jacobian E is

ν_{E,n} = [Aut_{K}(E[n]) : Aut_{K}(E)]

where Aut_{K}(E[n]) is the group of K-rational automorphisms of E[n] that respect the Weil pairing.

Proof: The first statement is a geometric one. For its proof we may fix a basis S, T for E[n] and assume that M_{S} and M_{T} are the standard matrices M_{1} and M_{2} specified in Lemma 3.13. We recall that Y (n) parametrises the triples (E′, S′, T′) where E′ is an elliptic curve and S′, T′ are a basis for E′[n] with e_{n}(S′, T′) = ζ_{n}. Lemma 3.13 furnishes us with a bijection between the triples (E′, S′, T′) and the genus one normal curves C ⊂ ℙ^{n−1} considered here. So the latter are also parametrised by Y (n).

Proposition 5.2(ii) establishes the existence of a genus one normal curve C ⊂ ℙ^{n−1} with Jacobian E for which the action of each T ∈ E[n] is given by M_{T}. Let C′ be another curve in the Y (n) family, defined over K and with Jac(C′) ≅ E. Then each T ∈ E[n] acts on C′ via M_{α(T)} for some α ∈ Aut_{K}(E[n]). Changing our choice of isomorphism Jac(C′) ≅ E changes α by an element of Aut_{K}(E). Here we use our assumption n ≥ 3 to identify Aut_{K}(E) as a subgroup of Aut_{K}(E[n]). It follows by Proposition 5.2(ii) that the curves C′ considered here are in bijection with the quotient group Aut_{K}(E[n])/ Aut_{K}(E). □

In general we have ν_{E,n} ≤ # PSL_{2}(ℤ/nℤ). We now specialise to the case n = 3.

Lemma 5.6. Let M ∈ GL_{3}(R) as in Proposition 5.5. Let (x : y : z) be co-ordinates on ℙ^{2} and put

(\begin{matrix}x′ \\ y′ \\ z′ \end{matrix}) = M (\begin{matrix}x \\ y \\ z \end{matrix}) ,  (\begin{matrix}x′′ \\ y′′ \\ z′′ \end{matrix}) = M^{2} (\begin{matrix}x \\ y \\ z \end{matrix}) .

Then the family of curves parametrised by Y (3) is (an open subset of) the pencil of plane cubics spanned by the F_{i}(x, y, z) ∈ K[x, y, z] where

| \begin{matrix}x & x′ & x′′ \\ y & y′ & y′′ \\ z & z′ & z′′ \end{matrix} | = ∑_{i=1}^{9} F_{i}(x, y, z)r_{i}.

Proof: Let S, T be a basis for E[n]. For the proof we may assume that M_{S} and M_{T} are the standard matrices M_{1} and M_{2} specified in Lemma 3.13. In this case our construction does indeed give the pencil of plane cubics spanned by x^{3} + y^{3} + z^{3} and xyz. □

We use the classical invariants of a ternary cubic (cf. [1]) to pick out those members of the pencil that are defined over K and have Jacobian E. In practice this means finding the K-rational roots of a polynomial of degree 12. According to Proposition 5.5 we are left with a list of ν_{E,3} candidates for C ⊂ ℙ^{2}. In favourable circumstances (including the case K = ℚ) we can show ν_{E,3} = 1.

Lemma 5.7. Assume that either (i) ρ_{E,3} : G_{K} → GL_{2}(ℤ/3ℤ) is surjective, or (ii) K is a number field with a real place. Then ν_{E,3} = 1.

Proof: Let G ⊂ GL_{2}(ℤ/3ℤ) be the image of ρ_{E,3}. Then

(14)  Aut_{K}(E[3]) = {x ∈ SL_{2}(ℤ/3ℤ) | xy = yx for all y ∈ G}.

(i) We find Aut_{K}(E[3]) = {±1} and so ν_{E,3} = 1. (ii) Since ζ_{3} ∉ K it is clear that G contains an element of determinant −1. But there are only 3 such conjugacy classes in GL_{2}(ℤ/3ℤ). Hence we may assume that G contains either ±a or b where

a = (\begin{matrix}1 & 1 \\ −1 & 1 \end{matrix}) and b = (\begin{matrix}1 & 0 \\ 0 & −1 \end{matrix}) .

It follows by (14) that Aut_{K}(E[3]) = {±1} or {±1, ±a^{2}}. If the latter, then a further application of (14) shows that G is cyclic of order 8. By considering the subfields of K(E[3]) we are led to the contradiction K(\sqrt{−3}) ⊂ K(E[3]) ∩ ℝ. Hence Aut_{K}(E[3]) = \{±1\} and ν_{E,3} = 1 as claimed. □

In [6] a formula based on Corollary 3.12 is used to recover α ∈ R^{×}/(R^{×})^{3} from a ternary cubic. The Hesse pencil method is completed in the case ν_{E,3} > 1 by applying this formula to each of the (at most 12) candidate ternary cubics, and seeing which gives rise to the correct element α ∈ R^{×}/(R^{×})^{3}.

5.2. The flex algebra method. This method has the advantage over the Hesse pencil method that it works for all n ≥ 2. For ease of exposition we continue to assume that n ≥ 3.

We embed E → ℙ^{n−1} via the complete linear system |n.0| and compute M ∈ GL_{n}(R) = Map_{K}(E[n], GL_{n}(\overline{K})) describing the action of E[n] on E by translation. We also compute ε ∈ (R ⊗ R)^{×} with M_{S}M_{T} = ε(S, T)M_{S+T} for all S, T ∈ E[n].

Proposition 5.8. Let ξ ∈ H^{1}(K, E[n]) and ρ ∈ (R⊗R)^{×} with w_{2}(ξ) = ρ ∂R^{×}. Let A_{1} = (R, +, ∗_{ε}) and A_{ρ} = (R, +, ∗_{ερ}).

(i) There exists γ ∈ \overline{R}^{×} with ∂γ = ρ, and so an isomorphism of \overline{K}- algebras .γ : \overline{A}_{ρ} → \overline{A}_{1}. (ii) The map τ_{1} : A_{1} → Mat_{n}(K) given by τ_{1}(x)_{ij} = tr_{R/K}(xM_{ij}) is an isomorphism of K-algebras. (iii) If τ_{ρ} : A_{ρ} ≅ Mat_{n}(K) is an isomorphism of K-algebras then there is a commutative diagram

(15)  \xymatrix{\overline{A}_{ρ} \ar[r]^{τ_{ρ}} \ar[d]_{.γ} & Mat_{n}(\overline{K}) \ar[d]^{β} \\ _{\overline{A}_{1}} \ar[r]^{τ_{1}} & Mat_{n}(\overline{K})}

where β is conjugation by some matrix B ∈ GL_{n}(\overline{K}). Moreover B represents a change of co-ordinates on ℙ^{n−1} taking the Brauer-Severi diagram [E → ℙ^{n−1}] to its twist [C → ℙ^{n−1}] by ξ.

Proof: (i) The element γ ∈ \overline{R}^{×} exists by Corollary 3.6. The isomorphism .γ is that specified in Lemma 4.6. (ii) We must show that τ_{1} is a ring homomorphism. Reducing to the geometric case we have τ_{1}(δ_{T}) = M_{T}. Since δ_{S} ∗_{ε} δ_{T} = ε(S, T)δ_{S+T} and M_{S}M_{T} = ε(S, T)M_{S+T} the result is clear. (iii) Let β be the isomorphism of \overline{K}-algebras making (15) commute. By the Noether-Skolem theorem it is conjugation by some matrix B ∈ GL_{n}(\overline{K}).

Let Θ_{E} and Θ be the theta groups for E[n] with second invariants inv_{2}(Θ_{E}) = ε∂R^{×} and inv_{2}(Θ) = ερ∂R^{×}. By Lemma 4.5 the enveloping algebras are A_{1} and A_{ρ}. We interpret the isomorphisms τ_{1} : A_{1} ≅ Mat_{n}(K) and τ_{ρ} : A_{ρ} ≅ Mat_{n}(K) as representations of Θ_{E} and Θ. So Θ_{E} and Θ are now subgroups of GL_{n} generated up to scalars by the τ_{1}(δ_{T}), respectively τ_{ρ}(δ_{T}), for T ∈ E[n].

Since τ_{1}(δ_{T}) = M_{T} the theta group Θ_{E} ⊂ GL_{n} is that determined by [E → ℙ^{n−1}]. On the other hand Proposition 5.2 tells us that Θ ⊂ GL_{n} is the theta group for some [C → ℙ^{n−1}]. Moreover, since Θ is the twist of Θ_{E} by ξ, the proposition also tells us that [C → ℙ^{n−1}] is the twist of [E → ℙ^{n−1}] by ξ. The commutativity of (15) shows that Θ_{E} ⊂ GL_{n} and Θ ⊂ GL_{n} are related by conjugation by B. It follows by the uniqueness statement of Proposition 5.2 that B represents a change of co-ordinates on ℙ^{n−1} taking [C → ℙ^{n−1}] to [E → ℙ^{n−1}]. □

As it stands the method is unsatisfactory, since we have to solve for γ ∈ \overline{R}^{×} = (R ⊗ \overline{K})^{×} with ∂γ = ρ. By (7) the n^{2} choices for γ form a coset of E[n] inside \overline{R}^{×}. This coset is an E[n]-torsor, which turns out to be the twist of E[n] by ξ. A glance at Remark 1.23 now suggests we should solve for γ ∈ (R ⊗ F)^{×} where F is the field of definition of a flex point on C. This is already clear from the conclusions of Proposition 5.8, since the K-rational point 0 ∈ E gets mapped to a flex point on C. These observations motivate the following refinement of Proposition 5.8.

Proposition 5.9. Let ξ ∈ H^{1}(K, E[n]) and ρ ∈ (R⊗R)^{×} with w_{2}(ξ) = ρ ∂R^{×}. Let A_{1} = (R, +, ∗_{ε}), A_{ρ} = (R, +, ∗_{ερ}) and F = (R, +, ∗_{ρ}).

(i) Let Φ be the E[n]-torsor determined by ξ. Then F is the étale algebra of Φ. In particular F is a product of field extensions of K. (ii) There is an isomorphism of F -algebras

\begin{aligned}α : & A_{ρ} ⊗_{K} F & → & A_{1} ⊗_{K} F \\ & x ⊗ 1 & ↦ & ∑_{i=1}^{n^{2}} r_{i}^{∗}x ⊗ r_{i}. \end{aligned}

(iii) Let τ_{1} : A_{1} ≅ Mat_{n}(K) and τ_{ρ} : A_{ρ} ≅ Mat_{n}(K) be the isomorphisms of Proposition 5.8. Then there is a commutative diagram

(16)  \xymatrix{A_{ρ} ⊗_{K} F \ar[d]_{α} \ar[r]^{τ_{ρ}} & Mat_{n}(F) \ar[d]^{β} \\ A_{1} ⊗_{K} F \ar[r]^{τ_{1}} & Mat_{n}(F)}

where β is conjugation by some matrix B ∈ GL_{n}(F) = Map_{K}(Φ, GL_{n}(\overline{K})). Moreover for each P ∈ Φ the matrix B_{P} ∈ GL_{n}(\overline{K}) represents a change of co-ordinates on ℙ^{n−1} taking the Brauer-Severi diagram [E → ℙ^{n−1}] to its twist [C → ℙ^{n−1}] by ξ.

Proof: (i) This is proved in Proposition 4.7. (ii) We first show that α is a ring homomorphism, i.e.

(17)  ∑_{i=1}^{n^{2}} r_{i}^{∗}(x ∗_{ερ} y) ⊗ r_{i} = ∑_{i,j=1}^{n^{2}}(r_{i}^{∗}x ∗_{ε} r_{j}^{∗}y) ⊗ (r_{i} ∗_{ρ} r_{j})

for all x, y ∈ R. Since α does not depend on the choice of basis r_{1}, …, r_{n^{2}} we may reduce to the geometric case. Putting x = δ_{S} and y = δ_{T} in (17) it becomes

ε(S, T)ρ(S, T)δ_{S+T} ⊗ δ_{S+T} = ε(S, T)δ_{S+T} ⊗ ρ(S, T)δ_{S+T}

which is a tautology. Since A_{ρ} and A_{1} are central simple algebras (of the same dimension) it follows that α is an isomorphism. (iii) Let β be the isomorphism of F -algebras making the diagram commute. By the Noether-Skolem theorem (applied to each constituent field of F) it is conjugation by some matrix B ∈ GL_{n}(F).

Let γ = (1 ⊗ ι_{F})(δ) ∈ R ⊗ F where δ ∈ R ⊗ R was defined in Lemma 5.1, and ι_{F} : R ≅ F is the isomorphism of underlying K-vector spaces. Then the isomorphism α : A_{ρ} ⊗ F ≅ A_{1} ⊗ F is multiplication by γ in R ⊗ F. So for each P ∈ Φ we obtain a diagram

\xymatrix{\overline{A}_{ρ} \ar[r]^{τ_{ρ}} \ar[d]_{.γ_{P}} & Mat_{n}(\overline{K}) \ar[d]^{β_{P}} \\ _{\overline{A}_{1}} \ar[r]^{τ_{1}} & Mat_{n}(\overline{K})}

where .γ_{P} is multiplication by γ_{P} in \overline{R}^{×} and β_{P} is conjugation by B_{P} ∈ GL_{n}(\overline{K}). We are done by Proposition 5.8. □

We summarise the flex algebra method in the following 7 steps.

Step 1. We embed E → ℙ^{n−1} via the complete linear system |n.0|. The curve E is now defined by homogeneous polynomials f_{1}, …, f_{N} in K[x_{1}, …, x_{n}].

Step 2. We compute M ∈ GL_{n}(R) and ε ∈ (R ⊗ R)^{×} as described at the start of this subsection. If n is odd then, in the notation of Lemma 3.11, we may choose M with M^{n} = I_{n} and ιMι^{−1} = M^{−1}. This enables us to take ε = e^{1/2}.

Step 3. Let A_{1} = (R, +, ∗_{ε}). We compute the isomorphism of Kalgebras τ_{1} : A_{1} ≅ Mat_{n}(K) specified in Proposition 5.8.

Step 4. Let A_{ρ} = (R, +, ∗_{ερ}). We use the Black Box to find an isomorphism of K-algebras τ_{ρ} : A_{ρ} ≅ Mat_{n}(K).

Step 5. Let F = (R, +, ∗_{ρ}). We compute the composite

τ′_{ρ} : A_{ρ} ⟶^{α} A_{1} ⊗ F ⟶^{τ_{1}} Mat_{n}(K) ⊗ F = Mat_{n}(F).

It is given by τ′_{ρ}(x) = ∑_{i=1}^{n^{2}} τ_{1}(r_{i}^{∗}x) ⊗ r_{i}.

Step 6. We use linear algebra to solve for B ∈ GL_{n}(F) with τ′_{ρ}(x) = B τ_{ρ}(x) B^{−1} for all x ∈ R.

Step 7. Let w_{1}, …, w_{n^{2}} be a basis for F as a K-vector space. Then C is defined by the homogeneous polynomials g_{ij} ∈ K[x_{1}, …, x_{n}] with

f_{i}(∑_{j=1}^{n} B_{1j}x_{j}, …, ∑_{j=1}^{n} B_{nj}x_{j}) = ∑_{j=1}^{n^{2}} w_{j}g_{ij}(x_{1}, …, x_{n}).

Remark 5.10. In Steps 6 and 7 it suffices to work with any constituent field of F. But in the generic case Galois acts transitively on the flex points of C. So F is already a field and there is no saving to be made.

5.3. The Segre embedding method. The third of our algorithms leads more directly to equations for C (and avoids the need to compute the flex algebra). Here we confine ourselves to a brief description. Further details, including a proof that the method works, will be given in the second paper of this series [4].

Let ρ ∂R^{×} ∈ H correspond to a torsor divisor class pair (C, [D]). Even before we use the Black Box, we can write down equations for C as a genus one normal curve in ℙ^{n^{2}−1} with hyperplane section nD. To do this we fix a Weierstrass equation for E and write (x(P), y(P)) for the co-ordinates of P ∈ E \ {0}. We also write λ(P_{1}, P_{2}) for the slope of the chord through P_{1}, P_{2} ∈ E \ {0} with P_{1} + P_{2} ≠ 0, respectively of the tangent line if P_{1} = P_{2}. We put z = ∑ r_{i}z_{i} where z_{1}, …, z_{n^{2}} are indeterminates. Since R = Map_{K}(E[n], \overline{K}) we have

z(T) = ∑_{i=1}^{n^{2}} r_{i}(T)z_{i} ∈ \overline{K}[z_{1}, …, z_{n^{2}}].

For T ∈ E[n] \ {0} we consider the polynomial

(x − x(T))z(0)^{2} − ρ(T, −T)z(T)z(−T)

in \overline{K}[x, z_{1}, …, z_{n^{2}}]. We define a quadric of type 1 to be the difference of any two such polynomials. These quadrics span a \overline{K}-vector subspace of \overline{K}[z_{1}, …, z_{n^{2}}] of dimension d_{1} where

d_{1} = \{ \begin{matrix}(n^{2} − 3)/2 & if n odd, \\ n^{2}/2 & if n even. \end{matrix}

For T, T_{1}, T_{2} ∈ E[n]\{0} with T_{1}+T_{2} = T we consider the polynomial

(λ_{T} − λ(T_{1}, T_{2}))z(0)z(T) − ρ(T_{1}, T_{2})z(T_{1})z(T_{2})

in \overline{K}[λ_{T} , z_{1}, …, z_{n^{2}}]. We define a quadric of type 2 to be the difference of any two such polynomials that share the same choice of T. These quadrics span a \overline{K}-vector subspace of \overline{K}[z_{1}, …, z_{n^{2}}] of dimension d_{2} where

d_{2} = \{ \begin{matrix}(n^{2} − 1)(n^{2} − 3)/2 & if n odd, \\ n^{2}(n^{2} − 4)/2 & if n even. \end{matrix}

It is clear that the spaces of quadrics of types 1 and 2 are each Galois invariant. We thus obtain a K-vector space of quadrics in K[z_{1}, …, z_{n^{2}}] of dimension d_{1} + d_{2} = n^{2}(n^{2} − 3)/2. It is shown in the second paper of this series [4] that these quadrics generate the homogeneous ideal of C ⊂ ℙ^{n^{2}−1} embedded by |nD|. Notice that our formulae for the dimension of each vector space of quadrics are easily checked by reduction to the geometric case.

Remarks 5.11. (i) In practice when computing the quadrics defining C we work over the constituent fields of R ⊗ R, rather than over \overline{K}. (ii) It is arguably more natural first to give equations for C ⊂ ℙ(R) and only then to identify ℙ(R) = ℙ^{n^{2}−1} by means of our choice of basis r_{1}, …, r_{n^{2}} for R. (iii) We recall that ρ ∂R^{×} is an element of H ⊂ (R ⊗ R)^{×}/∂R^{×}. If we multiply ρ by ∂γ for some γ ∈ R^{×} then the effect on C is that of a change of co-ordinates on ℙ^{n^{2}−1}. (iv) In the case n = 2 we find that C ⊂ ℙ^{3} is the complete intersection of two quadrics of type 1. Our method reduces to the classical number field method for 2-descent.

We now have equations for C ⊂ ℙ^{n^{2}−1} embedded by |nD|. It remains to compute equations for C ⊂ ℙ^{n−1} embedded by |D|. This is achieved in the following 5 steps.

Step 1. We compute F ∈ R(E)^{×} = Map_{K}(E[n], \overline{K}(E)^{×}) with div(F_{T}) = n.T − n.0. We fix a local parameter z in the local ring of E at 0 and scale each of the rational functions F_{T} to have leading coefficient 1 when expanded as a Laurent power series in z.

Step 2. We compute ε ∈ (R ⊗ R)^{×} with

ε(T_{1}, T_{2}) = \frac{F_{T_{1}+T_{2}}(P)}{F_{T_{1}}(P)F_{T_{2}}(P − T_{1})}

for all T_{1}, T_{2} ∈ E[n] and P ∈ E \ {0, T_{1}, T_{1} + T_{2}}. (This formula for ε was derived near the end of §3.)

Step 3. Let A_{ρ} = (R, +, ∗_{ερ}). We use the Black Box to find an isomorphism of K-algebras τ : A_{ρ} ≅ Mat_{n}(K).

Step 4. For each quadric f(z_{1}, …, z_{n^{2}}) computed above we make a change of co-ordinates to obtain a quadric g(x_{11}, x_{12}, …, x_{nn}) with

g(∑_{i=1}^{n^{2}} τ(r_{i})_{11}z_{i}, …, ∑_{i=1}^{n^{2}} τ(r_{i})_{nn}z_{i}) = f(z_{1}, …, z_{n^{2}}).

The new quadrics define C as a curve in ℙ(Mat_{n}).

Step 5. There is a direct sum decomposition Mat_{n} = ⟨I_{n}⟩ ⊕ {Tr = 0} where {Tr = 0} is the subspace of matrices of trace zero. We project C to the trace zero subspace. Then C is contained in the rank 1 locus. In other words C lies in the image of the Segre embedding

ℙ^{n−1} × (ℙ^{n−1})^{∨} → ℙ(Mat_{n}).

We pull back to a curve in ℙ^{n−1} × (ℙ^{n−1})^{∨} and finally project onto the first factor to obtain C → ℙ^{n−1}. (In fact, projecting onto the second factor gives the dual curve.)

Remark 5.12. In both the flex algebra method and the Segre embedding method we have specified particular choices for ε ∈ (R ⊗ R)^{×}. But for the purposes of computing the obstruction algebra, we can use any ε ∈ (R ⊗ R)^{×} with inv_{2}(Θ_{E}) = ε ∂R^{×}. Then after trivialising the obstruction algebra we can use the isomorphism of Lemma 4.6 to compensate for having made a different choice of ε. So the method we use (Hesse pencil, flex algebra or Segre embedding) has no impact on the implementation of the Black Box.

References

[1] S.Y. An, S.Y. Kim, D.C. Marshall, S.H. Marshall, W.G. McCallum and A.R. Perlis, Jacobians of genus one curves, J. Number Theory 90 (2001), no. 2, 304–315.

[2] J.W.S. Cassels, Lectures on elliptic curves, LMS Student Texts, 24, Cambridge University Press, Cambridge, 1991.

[3] J.E. Cremona, Classical invariants and 2-descent on elliptic curves, J. Symbolic Comput. 31 (2001), no. 1-2, 71–87.

[4] J.E. Cremona, T.A. Fisher, C. O’Neil, D. Simon and M. Stoll, Explicit ndescent on elliptic curves, II Geometry, III Algorithms, in preparation

[5] Z. Djabri, E.F. Schaefer and N.P. Smart, Computing the p-Selmer group of an elliptic curve, Trans. Amer. Math. Soc. 352, 5583–5597 (2000).

[6] T.A. Fisher, Testing equivalence of ternary cubics, preprint.

[7] S. Lichtenbaum, The period-index problem for elliptic curves, Amer. J. Math. 90 1209–1223 (1968).

[8] MAGMA is described in W. Bosma, J. Cannon and C. Playoust, The Magma algebra system I: The user language, J. Symbolic Comput. 24, 235–265 (1997).

The Magma home page is at http://magma.maths.usyd.edu.au/magma/

[9] J.R. Merriman, S. Siksek and N.P. Smart, Explicit 4-descents on an elliptic curve, Acta Arith. 77 (1996), no. 4, 385–404.

[10] J.S. Milne, Arithmetic duality theorems, Perspectives in Mathematics, 1. Academic Press, Inc., Boston, MA, 1986.

[11] D. Mumford, Abelian varieties, Oxford University Press, Oxford (1985).

[12] C. O’Neil, Jacobians of genus one curves, Math. Res. Lett. 8 (2001), no. 1-2, 125–140.

[13] C. O’Neil, The period-index obstruction for elliptic curves, J. Number Theory 95 (2002), no. 2, 329–339.

[14] E.F. Schaefer and M. Stoll, How to do a p-descent on an elliptic curve, Trans. Amer. Math. Soc. 356 (2004), no. 3, 1209–1231.

[15] J.-P. Serre, Algebraic groups and class fields, GTM 117, Springer-Verlag, New York, 1988.

[16] J.H. Silverman, The arithmetic of elliptic curves, GTM 106, Springer-Verlag, New York, 1992.

[17] D. Simon, Computing the rank of elliptic curves over number fields, LMS J. Comput. Math. 5 (2002), 7–17 (electronic).

[18] S. Stamminger, Explicit 8-descent on elliptic curves, PhD thesis, International University Bremen, 2005.

[19] T.O. Womack, Explicit descent on elliptic curves, PhD thesis, University of Nottingham, 2003. Available online at

    http://www.maths.nott.ac.uk/personal/jec/theses/womack.pdf

School of Mathematical Sciences, University of Nottingham, University Park, Nottingham NG7 2RD, UK

  E-mail address: John.Cremona@nottingham.ac.uk

University of Cambridge, DPMMS, Centre for Mathematical Sciences, Wilberforce Road, Cambridge CB3 0WB, UK

  E-mail address: T.A.Fisher@dpmms.cam.ac.uk

Barnard College, Columbia University, Department of Mathematics, 2990 Broadway MC 4418, New York, NY 10027-6902,USA

  E-mail address: oneil@math.columbia.edu

Université de Caen, Campus II - Boulevard Maréchal Juin, BP 5186– 14032, Caen, France

  E-mail address: Denis.Simon@math.unicaen.fr

School of Engineering and Science, International University Bremen, P.O. Box 750561, 28725 Bremen, Germany

  E-mail address: M.Stoll@iu-bremen.de