I've read that an elliptic curve is supersingular if and only if its endomorphism ring is an order in a quaternion algebra. Does anyone have a simple explanation of this (or a good reference)?



Supersingular elliptic curves
Let $k$ be an algebraically closed field, and let $E/k$ be an elliptic curve. In general, *how do we know the structure of $\mathrm{End}(E)$*?


We know the following two facts in all cases: (1) considered as an additive group, $\mathrm{End}(E)$ is free abelian on 1, 2 or 4 generators; and (2) $\mathrm{End}(E) \otimes\_Z Q$ is a division algebra. The first fact comes from considering homology (more on this momentarily), and the second comes from the theory of the dual isogeny.


* In the case of rank=1, we must have $\mathrm{End}(E)$ an order in $Q$, i.e. $\mathrm{End}(E)=Z$.
* In the case of rank=2, we must have $\mathrm{End}(E)$ an order in a quadratic field $F/Q$. This field must be imaginary, because its norm map is identified with $\lambda \mapsto \lambda \lambda^\vee$, and the latter is positive definite.
* In the case of rank=4, we must have End(E) an order in a quaternion algebra R/Q.


The last case gets *ruled out* when $\operatorname{char}(k)=0$. We don't see it in the familiar characteristic zero setting, so we think of it as strange, but there really is nothing unnatural about it. The "simple explanation" that you seek is, most bluntly, that it *does not get ruled out*, since there is no replacement for $H\_1(E,Z)$ in positive characteristic.


By the way, here is the reason it gets ruled out in characteristic zero: Without loss of generality by the Lefschetz principle, we may declare that k=C. Assume that $\mathrm{End}(E)$ is an order in $R$. The hard step in proving (1) above is showing that $\mathrm{End}(E)$ acts faithfully on the first homology group $H\_1(E,Z)$. Granted this, $\mathrm{End}(E)$ embeds as a free rank four $Z$-submodule of $\mathrm{End}(H\_1(E,Z)) = M\_2(Z)$. Tensoring with $Q$ we get that $R = M\_1(Q)$, and hence $M\_1(Q)$ would be a division algebra, which is false.


The reason I mention this argument is that, even though when $\operatorname{char}(k)=p>0$ the argument fails as stated (since one can't make $k=C$ and access $H\_1(E,Z)$), one can still modify it to get information about $R$. As a substitute for $H\_1(E,Z)$, one instead takes a prime $\ell$ not equal to $p$, and considers the $\ell$-adic Tate module $T\_\ell(E) = \varprojlim\_n E[\ell^n]$, with transition maps given by multiplication by \ell. (This gadget is a free $Z\_\ell$-module of rank 2 whether $\operatorname{char}(k)=0$ or not, and when $k=C$ it is canonically identified with $H\_1(E,Z\_\ell) = H\_1(E,Z) \otimes\_Z Z\_\ell$, which motivates its use as a substitute.) Considering again the faithfulness of the action of $\mathrm{End}(E)$, we have that $\operatorname{End}(E) \otimes\_Z Z\_\ell$ embeds into $\mathrm{End}(T\_\ell(E)) = M\_2(Z\_\ell)$, and therefore $R \otimes\_Q Q\_\ell = M\_2(Q\_\ell)$. By definition, this means that the quaternion algebra $R$ is "split at $\ell$". Now we invoke a by-product of global class field theory, which is the determination of all quaternion algebras over $Q$. They are parameterized by nonempty finite sets of even cardinality, consisting of prime numbers and possibly the symbol $\infty$. There is a unique quaternion algebra that is split at exactly those primes not occurring in the parameterizing set. Since for all $\ell$ not equal to $p$ we know that $R$ is split at $p$, the only possibility for the set associated to $R$ is $\{p,\infty\}$. Thus we know, on the nose, *which* quaternion algebra $R = \mathrm{End}(E) \otimes\_Z Q$ is.


