pole & zero
https://crypto.stanford.edu/pbc/notes/elliptic/divisor.html
Zeroes and Poles
Let P=(a,b)P=(a,b) be a point, not of order 2. Consider the rational function g(X,Y)=(X−a)kg(X,Y)=(X−a)k for some k>0k>0. Then note g(P)=0g(P)=0. We say gg has a zero at PP of multiplicity kk. On the other hand, if g(X,Y)=1/(X−a)kg(X,Y)=1/(X−a)k for some k>0k>0, we say gg has a pole at PP of multiplicity kk.
We can generalize this to all functions, so for example, if a function can be written in the form (X−a)kh(X,Y)(X−a)kh(X,Y) where h(a,b)≠0,∞h(a,b)≠0,∞, then we have a zero of order kk if k>0k>0, or a pole of order −k−k if k>0k>0.
Given an arbitrary function g(X,Y)g(X,Y), it may not be immediately obvious where the zeroes and poles are. Fortunately, there exists an efficient algorithm to put any given gg into the form (X−a)kh(X−a)kh with h(P)≠0,∞h(P)≠0,∞, provided PP is not a point of order 2.
It turns out this definition can be extended to points of order 2, and also the point OO (when we homogenize the functions and work over the projective plane). Moreover, every rational function has as many zeroes as poles counting multiplicities, because of the way we extend the definition to the point at infinity.
TODO: link to page with proofs
Divisors
Divisors are a device for keeping track of poles and zeroes. For example, suppose a function gg has a zero at a point PP of order 3, and a pole at another point QQ of order 2, and a pole at OO of order 1. (Note the number of zeroes and poles are equal, as they must be.) Then using divisors, we can say all this concisely as follows:
We define these concepts more precisely.
The group of divisors is the free abelian group generated by the points of EE and is denoted Div(E)Div(E). (The angle brackets are present to avoid confusion between points of EE and elements of Div(E)Div(E), that is, to make it clear we are talking about zeroes and poles at points, not the points themselves.)
Let Δ=∑P∈EmP⟨P⟩Δ=∑P∈EmP⟨P⟩ be a divisor. Then define its degree by degΔ=∑P∈EmPdegΔ=∑P∈EmP.
The subgroup of Div(E)Div(E) consisting of all divisors of degree zero is denoted Div0(E)Div0(E).
Let gg be a nonzero rational function. Then
where ordP(g)ordP(g) is the number of zeroes or poles at PP (and is negative if it represents the number of poles). Such a divisor is called principal, that is, a divisor is a principal divisor if it represents the zeroes and poles of some rational function. The group of principal divisors is denoted Prin(E)Prin(E).
Since every rational function has as many zeroes as poles, we see that Prin(E)Prin(E) is a subgroup of Div0(E)Div0(E).
Example
Suppose P=(a,b)P=(a,b) is a (finite) point. Let g(X,Y)=X−ag(X,Y)=X−a. Then we have
(When PP has order 2, then P=−PP=−P so this could be written as ⟨g⟩=2⟨P⟩−2⟨O⟩⟨g⟩=2⟨P⟩−2⟨O⟩.)
Consider a line g=Y−(mX+b)g=Y−(mX+b) that is not vertical. It intersects the curve at three finite points P,Q,RP,Q,R. Then
Equivalent Divisors
An equivalence relation can be defined on the group of divisors as follows. We say that two divisors D1,D2D1,D2 are linearly equivalent (written as D1 D2D1 D2) if D1−D2∈Prin(E)D1−D2∈Prin(E).
In other words, there exists a rational function whose zeroes and poles are exactly the difference between the D1D1 and D2D2.
Pushing zeroes and poles to infinity
Theorem: Let D∈Div(E)D∈Div(E). Then there exists a unique point P∈EP∈E such that
Proof: (Existence:) We find lines with zeroes and poles in the right places to add and subtract from DD.
Let D=∑P∈EmP⟨P⟩D=∑P∈EmP⟨P⟩. For this proof, define the norm of the divisor DD to be
If |D|=1|D|=1 then we are done as it is already in the desire form. Otherwise we show how to replace DD by another divisor with a smaller norm. There are several stages to the algorithm. Firstly:
-
If there are two points P,QP,Q with mP,mQ>0mP,mQ>0, subtract the divisor of the line ll through PP and QQ. Then mP,mQmP,mQ are both reduced by one.
If P≠−QP≠−Q then the line ll also intersects EE at a third finite point RR, and in this case mRmR is increased by one.
Either way, the norm is reduced by at least one. -
If there are two points P,QP,Q with mP,mQ<0mP,mQ<0, then add the line ll through PP and QQ, and as above, the norm is reduced by at least one.
By repeating the above, eventually we will have reduced DD to the form m⟨P⟩−n⟨Q⟩+o⟨O⟩m⟨P⟩−n⟨Q⟩+o⟨O⟩. Then:
-
If m≥2m≥2 then subtract the divisor of the tangent line at PP, which reduces mm by 2 but also increases mRmR for some point RR. This reduces the norm by at least one. If n≥2n≥2 then a similar procedure is performed on QQ; we add the divisor of the tangent line at QQ.
-
If m=n=1m=n=1 then we first add the line through QQ and −Q−Q, which zeroes mQmQ, but increases m−Qm−Q. We are then left with the first case described in the previous stage, so we subtract the line through PP and −Q−Q.
Hence eventually we find a divisor D′ DD′ D with |D′|≤1|D′|≤1. If D′D′ is still not in the desired form:
-
If |D′|=0|D′|=0 then write D′=⟨O⟩+(degD−1)⟨O⟩)D′=⟨O⟩+(degD−1)⟨O⟩).
-
If D′=−⟨P⟩+(degD+1)⟨O⟩)D′=−⟨P⟩+(degD+1)⟨O⟩), then we add the divisor of the line through PP and −P−P to get ⟨−P⟩+(degD−1)⟨O⟩⟨−P⟩+(degD−1)⟨O⟩.
(Uniqueness:) suppose D ⟨P⟩−o⟨O⟩ ⟨Q⟩−o⟨O⟩D ⟨P⟩−o⟨O⟩ ⟨Q⟩−o⟨O⟩.
This implies ⟨P⟩−⟨Q⟩⟨P⟩−⟨Q⟩ is principal, which is a contradiction unless P=QP=Q (for it would imply there exists a rational function with only one finite pole and only one finite zero).
The procedure used in the proof shows how to build a rational function corresponding to any given principal divisor. In brief: we start with the constant function 1 and the zero divisor and add/subtract divisors of lines to get to the target principal divisor. Every time we add the divisor of a line, we multiply our function by the equation of that line, and similarly, every time we subtract a divisor of a line, we divide the function by the equation of that line.
We shall see later how this is used in the computation of certain bilinear maps.
The sum map
Define the map sum:Div(E)→Esum:Div(E)→E by
In other words, we treat the poles and zeroes as points on the elliptic curve and add and subtract them together according to their multiplicities.
Fact: Let D=∑mP⟨P⟩D=∑mP⟨P⟩ be a divisor. Then DD is principal if and only if deg(D)=∑mP=0deg(D)=∑mP=0 and sum(D)=∑mPP=Osum(D)=∑mPP=O.
The result about the degree of DD follows from the fact that rational functions have equal numbers of poles and zeroes.
The other result in the above fact is not hard to see: from the above proof, we can build a rational function with a given principal divisor by multiplying several equations of lines together. Each line ll goes through two or three finite points. If ll goes through two finite points, then one is the inverse of the other. If ll goes through three finite points, from the chord-tangent composition law, we have that the third point is exactly the inverse of the sum of the other two. Either way, sum(l)=0sum(l)=0.
The converse is similar. Starting with a divisor DD with sum(D)=Osum(D)=O, we build a rational function by multiplying lines together while reducing the norm of DD. Eventually, DD is reduced to the zero divisor (it cannot be anything else, otherwise sum(D)≠0sum(D)≠0), and the rational function we have constructed has divisor DD, showing that DD is principal.